Human reliability

The importance measures from Hana's model keep pointing at the same thing: operator actions. Lise sends her to the plant-referenced simulator at one of TVA's training centers to watch a crew run a loss-of-feedwater scenario. Marcel Thibodeau, who trained as a licensed operator before moving to radiation protection, comes with her. "Watch what the crew looks at, what they say to each other and when they reach for the procedure," he says. "Then try to put a number on the chance they get it wrong. You will see why human reliability analysis is the hardest part of a PRA."

Why people matter in risk

Every probabilistic assessment of a nuclear plant finds that human actions contribute a large share of the risk. People maintain and test equipment, so they can leave it misaligned. People respond to transients, so they can misdiagnose an event or carry out the wrong action. People also recover from failures, starting equipment that failed to start automatically or restoring power, and these recovery actions often reduce risk a great deal. Leaving people out of a probabilistic model would make it both optimistic about equipment and pessimistic about recovery. Human reliability analysis is the discipline of identifying the human actions that matter, modeling them and estimating their probabilities of failure.

The accidents described later in this course show the range of human contributions. At Three Mile Island, operators throttled emergency injection because their training and instruments told them the system was filling with water, when in fact it was losing water. At Chernobyl, the crew followed a test program that placed the reactor in an unstable state, under pressure to complete the test. At Fukushima Daiichi, operators improvised heroically in the dark with almost no instruments, but some of the decisions they needed to make could not be made in time with the information available. Human reliability analysis tries to anticipate these situations and to design plants, procedures and training that make success more likely.

Types of human failure events

Errors are also classified by their nature. A slip or lapse is an error in carrying out an intended action, such as pressing the wrong button or skipping a step. A mistake is an error in forming the intention, such as misdiagnosing the event and choosing the wrong procedure. Violations are deliberate departures from rules, usually well-intended, such as bypassing a step thought to be unnecessary. Diagnosis errors are generally harder to recover from than execution errors, because the crew believes it is doing the right thing and interprets new information to fit.

Estimating human error probabilities

Human error probabilities are estimated with structured methods that combine a nominal probability for the type of task with adjustments for the conditions. The earliest widely used method, THERP, the Technique for Human Error Rate Prediction, published by Swain and Guttmann in 1983, breaks a task into steps, assigns each a nominal error probability from tables, and modifies them for factors such as stress and experience. It also provides a model for dependence between successive actions: if the first action fails, the probability of failing the next one rises, from a small increase for low dependence to certainty for complete dependence.

Later methods simplified the approach. SPAR-H, developed for the NRC's standardized plant analysis risk models, assigns a nominal probability to diagnosis tasks (0.01) and action tasks (0.001) and multiplies it by factors for eight performance shaping factors: available time, stress, complexity, experience and training, procedures, ergonomics and the human-machine interface, fitness for duty, and work processes. More recent methods, such as the cause-based decision tree method and the Integrated Human Event Analysis System, IDHEAS, model the cognitive failure modes of detection, understanding, decision and action in more detail.

The adjusted formula is used when the composite multiplier is large, so that the result cannot exceed one. When the multipliers are near one it reduces to the simple product of the nominal probability and the multipliers. Performance shaping factors can also be less than one: an action with ample time and an excellent procedure may be credited a lower probability than the nominal value.

# Human error probability with a SPAR-H style calculation (simplified, illustrative).
# HEP = nominal x product of performance shaping factor multipliers,
# with the usual adjustment when the product is large so that HEP stays below 1.
nominal = {"diagnosis": 1e-2, "action": 1e-3}
psf = {"available time": 1.0, "stress": 2.0, "complexity": 2.0,
       "experience": 1.0, "procedures": 5.0, "ergonomics": 1.0}
def hep(nhep, factors):
    composite = 1.0
    for v in factors.values(): composite *= v
    if composite >= 3:      # adjustment used when several factors are negative
        return nhep * composite / (nhep * (composite - 1) + 1), composite
    return min(1.0, nhep * composite), composite
for task, n in nominal.items():
    h, c = hep(n, psf)
    print(f"{task:9s} nominal {n:.0e}, composite multiplier {c:5.0f}, HEP {h:.3f}")
psf["procedures"] = 1.0
h, c = hep(nominal["diagnosis"], psf)
print(f"diagnosis with a clear procedure: HEP {h:.3f}")

diagnosis nominal 1e-02, composite multiplier    20, HEP 0.168
action    nominal 1e-03, composite multiplier    20, HEP 0.020
diagnosis with a clear procedure: HEP 0.039

In the example, high stress, high complexity and an incomplete procedure give a composite multiplier of 20, and the diagnosis error probability rises from 0.01 to about 0.17. Improving the procedure alone brings it down to about 0.04. This is typical of what human reliability analysis is for: not producing a precise number, which is impossible, but showing which conditions make failure likely and which improvements help most.

Time and the response

For many post-initiator actions, time is the dominant factor. The crew must detect that something is wrong, diagnose the event, decide on the response, and carry it out before the plant reaches an unrecoverable state. The time available comes from thermal-hydraulic analysis: for example, how long after a loss of all feedwater the steam generators boil dry and feed-and-bleed must start. The time required comes from simulator observations, interviews and walk-throughs. If the time required is close to the time available, the probability of failure is high whatever the procedure says.

Data and its limits

Human error data are scarce, because serious errors are rare and every situation is different. Methods rely on a mix of sources: plant event reports, simulator studies, data from other industries and expert judgment. Simulator programs, such as the international Halden studies and the NRC's SACADA database of operator performance in training, have improved the empirical basis. Even so, the uncertainty in human error probabilities is large, often a factor of ten either way, and results are tested with sensitivity studies.

The NRC reviews human factors engineering in new designs under NUREG-0711, and the industry analyzes human actions in PRAs according to the ASME/ANS PRA standard, typically using SPAR-H, the EPRI HRA Calculator or IDHEAS.

Designing for human success

The best use of human reliability analysis is to improve the conditions under which people work. Control room design gives operators clear, unambiguous indications of the plant's state, especially of the safety functions. Symptom-based emergency procedures guide the crew from what the instruments show rather than requiring a correct diagnosis of the initiating event. Training on full-scope simulators exposes crews to realistic transients, including multiple failures. Staffing and shift arrangements keep enough qualified people available. Automation can remove the need for fast actions under stress, though it introduces its own failure modes and can erode skills if operators rarely practice manual control.

After Three Mile Island, control rooms were redesigned, safety parameter display systems were added, emergency procedures were rewritten in symptom-based form and simulator training became standard. After Fukushima, attention turned to actions taken outside the control room in degraded conditions: with no lighting, high radiation, damaged access routes and exhausted staff. Modern human reliability methods now include these conditions explicitly.

Observing crews on the simulator

Simulator observations are among the best sources of insight into human performance. Analysts watch crews respond to scenarios that include the events modeled in the assessment, record the times at which key cues appear and key actions are taken, and note where crews hesitate or disagree. Debriefings with the crew reveal how they interpreted the indications and why they chose particular actions. Repeated over several crews, these observations show the spread of response times and identify scenario features that cause difficulty, such as a misleading indication or a procedure transition that is easy to miss.

Simulator results must be interpreted carefully. Crews know they are being observed and may be more alert than on a quiet night shift. Scenarios are usually run in a training context where the crew expects an event. The simulator may not reproduce the stress of a real emergency, the noise and smoke of a fire, or the fatigue of a long event. Analysts therefore treat simulator times as an indication of what is achievable and adjust them for the real conditions in which an action would be needed.

Actions outside the control room

Many important actions are carried out by field operators outside the control room: opening a manual valve, aligning a portable pump, or starting a diesel generator locally. These actions depend on access routes, lighting, communication, protective equipment and environmental conditions such as heat, steam or radiation. The time needed includes walking to the location, sometimes through several buildings, as well as the action itself. Walk-throughs with field operators, timing the route and checking the equipment and tools, give realistic estimates and often reveal practical obstacles, such as a locked door or a valve that is hard to reach.

Since Fukushima, analysts have paid particular attention to actions with portable equipment in degraded conditions after an external hazard. Debris, flooding, aftershocks and loss of lighting may slow movement; staff may be fewer than normal if access to the site is difficult; and several units may need help at once. Human reliability methods for these conditions are still developing, and assessments typically use conservative assumptions and sensitivity studies.

Errors of commission

Most human reliability analysis models errors of omission, in which a required action is not taken. Errors of commission, in which an unrequired or harmful action is taken, are harder to model because they can take many forms. The throttling of injection at Three Mile Island is the classic example: the operators took a deliberate action that made the situation worse, based on a mistaken understanding of the plant state. Methods for identifying errors of commission look for situations in which indications are misleading or procedures could be misapplied, and for actions whose effects would be severe. The best defense is design: indications that make the true state clear and procedures that do not require operators to infer it.

Organizational factors sit behind many individual errors. Staffing levels, shift patterns, overtime, the quality of training programs and the way management responds to reported errors all influence the performance shaping factors that methods such as SPAR-H assess for a single task. Human reliability analysis therefore connects naturally with safety culture, the subject of the last lesson: an organization that learns from small errors and near misses removes many of the conditions that make serious errors likely.