ii

NUREG/CR-6751

THE HUMAN PERFORMANCE EVALUATION

PROCESS: A Resource for Reviewing the Identification

and Resolution of Human Performance Problems

Manuscript completed: September 2001

Date Published:

Prepared by:

Valerie Barnes1

Brian Haagensen1

Contributing author:

John O’Hara2

1

Performance, Safety and Health Associates, Inc.

Post Office Box 30

Boalsburg, PA 16827

2Human Factors and Performance Analysis Group

Energy Sciences and Technology Department

Brookhaven National Laboratory

Upton, New York 11973

Isabelle Schoenfeld

Eugene Trager

NRC Project Managers

Prepared for:

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, DC 20555

NRC Job Code W6528
iii

ABSTRACT

The Human Performance Evaluation Process (HPEP) is a resource for U.S. Nuclear Regulatory

Commission inspectors to use when reviewing licensee problem identification and resolution

programs with regard to human performance. Part I provides a step-by-step process for

reviewing licensee effectiveness in identifying, analyzing and resolving human performance

problems. Part I also addresses the challenges in identifying and investigating human

performance problems, describes three root cause analysis techniques, and discusses

characteristics of effective corrective action plans. Part II is comprised of the HPEP Cause Tree

and Modules. The Cause Tree is a screening tool for identifying the range of possible causes for

a human performance problem. The Modules describe frequently identified causes for human

performance problems and provide examples. Part II is intended to support the evaluation of

licensee root cause analyses for human performance problems identified in Part I.
iv
v

Contents

ABSTRACT..........................................................................................................................iii

LIST OF FIGURES .............................................................................................................x

LIST OF TABLES ...............................................................................................................xi

ACKNOWLEDGEMENTS.................................................................................................xii

PART I: THE HUMAN PERFORMANCE REVIEW PROCESS ...............................1-1

1. OVERVIEW OF THE HUMAN PERFORMANCE EVALUATION PROCESS

(HPEP).......................................................................................................................1-2

1.1 INTRODUCTION..............................................................................................................................1-2

1.2 OBJECTIVES......................................................................................................................................1-3

1.3 ORGANIZATION..............................................................................................................................1-3

2. HUMAN PERFORMANCE PROBLEM REVIEW.............................................2-1

2.1 OVERVIEW OF THE REVIEW PROCESS.................................................................................2-1

2.2 PROBLEM IDENTIFICATION AND CHARACTERIZATION..............................................2-2

2.3 INVESTIGATION METHODS.......................................................................................................2-2

2.4 CAUSAL ANALYSES ......................................................................................................................2-3

2.5 CORRECTIVE ACTIONS................................................................................................................2-3

2.6 USING THE REVIEW TABLES ....................................................................................................2-4

2.7 ASSESSING RISK IMPACT...........................................................................................................2-5

2.8 INCORPORATING HPEP FINDINGS IN AN INSPECTION REPORT ...............................2-5

3. IDENTIFYING HUMAN PERFORMANCE PROBLEMS AND

THEIR CAUSES ......................................................................................................3-1

3.1 INTRODUCTION..............................................................................................................................3-1

3.2 CHALLENGES IN IDENTIFYING HUMAN PERFORMANCE PROBLEMS...................3-1

3.3 CHALLENGES IN IDENTIFYING THE CAUSES OF ERRORS..........................................3-3

3.4 A BARRIER ANALYSIS FRAMEWORK FOR INVESTIGATING HUMAN ERRORS..3-4

3.5 ANALYZING THE PROGRAMS THAT CREATE AND MAINTAIN BARRIERS..........3-5

3.6 SUMMARY.........................................................................................................................................3-6

4. INVESTIGATION METHODS FOR HUMAN PERFORMANCE...................4-1

4.1 INTRODUCTION..............................................................................................................................4-1

4.2 LINES OF INQUIRY.........................................................................................................................4-1

4.3 COLLECTING EVIDENCE.............................................................................................................4-3

4.4 TERMINATING THE INVESTIGATION....................................................................................4-6

5. EVALUATING THE LICENSEE’S ROOT CAUSE ANALYSIS......................5-1

5.1 INTRODUCTION..............................................................................................................................5-1

5.2 CAUSAL FACTORS.........................................................................................................................5-1

5.3 OVERVIEW OF ROOT CAUSE ANALYSIS TECHNIQUES ................................................5-3
vi

Contents (continued)

5.4 EVENTS AND CAUSAL FACTORS CHARTING AND ANALYSIS ..................................5-3

5.4.1 Events and Causal Factors Charting................................................................................5-4

5.4.2 Events and Causal Factors Analysis................................................................................5-5

5.5 CHANGE ANALYSIS......................................................................................................................5-7

5.6 BARRIER ANALYSIS......................................................................................................................5-10

5.7 COMBINING TECHNIQUES .........................................................................................................5-13

6. EVALUATING CORRECTIVE ACTION PLANS .............................................6-1

6.1 INTRODUCTION..............................................................................................................................6-1

6.2 CORRECTIVE ACTION PLAN SCOPE.......................................................................................6-1

6.3 ACCOUNTABILITY FOR HUMAN PERFORMANCE...........................................................6-3

6.4 CORRECTIVE ACTION PLAN COMPLETENESS..................................................................6-3

6.5 PLAN IMPLEMENTATION AND EFFECTIVENESS .............................................................6-3

6.6 CONCLUSION...................................................................................................................................6-5

PART II: INTRODUCTION TO PART II OF THE HUMAN PERFORMANCE

EVALUATION PROCESS.................................................................................................7-1

7. OVERVIEW OF THE HPEP CAUSE TREE AND MODULES ........................7-2

7.1 INTRODUCTION..............................................................................................................................7-2

7.2 USING THE CAUSE TREE AND MODULES ...........................................................................7-2

7.2.1 Verification ..........................................................................................................................7-2

7.2.2 Conducting an Independent Event Investigation ..........................................................7-3

7.2.3 Identifying a Human Performance Trend.......................................................................7-3

7.3 ORGANIZATION..............................................................................................................................7-4

8. FITNESS FOR DUTY..............................................................................................8-1

8.1 ERRORS RELATED TO FITNESS FOR DUTY.........................................................................8-1

8.1.1 Drug and Alcohol Use........................................................................................................8-1

8.1.1.1 Marijuana .............................................................................................................8-1

8.1.1.2 Stimulants ............................................................................................................8-1

8.1.1.3 Depressants ..........................................................................................................8-1

8.1.1.4 Hallucinogens......................................................................................................8-2

8.1.2 Fatigue ..................................................................................................................................8-2

8.1.3 Emotional Stress.................................................................................................................8-2

8.1.4 Illness....................................................................................................................................8-3

8.1.5 Combinations of Factors....................................................................................................8-3

8.2 DIRECT CAUSES OF FITNESS-FOR-DUTY-RELATED ERRORS....................................8-3

8.3 PROGRAMMATIC CAUSES OF FITNESS-FOR-DUTY ERRORS......................................8-4

8.4 ADDITIONAL RESOURCES ON FITNESS FOR DUTY.........................................................8-5

9. KNOWLEDGE, SKILLS AND ABILITIES .........................................................9-1

9.1 KNOWLEDGE, SKILLS AND ABILITIES IN HUMAN PERFORMANCE........................9-1

9.1.1 Systems Approach to Training .........................................................................................9-1

9.1.2 Identifying KSAs with Job and Task Analysis..............................................................9-2

9.1.3 Training ................................................................................................................................9-3

9.1.4 Testing..................................................................................................................................9-3

9.1.5 Proficiency Training...........................................................................................................9-4

9.1.6 Training Evaluation and Revision....................................................................................9-4

9.1.7 Cognitive Errors: Loss of Situational Awareness and Mental Lapses .....................9-5

9.1.7.1 Loss of Situational Awareness.........................................................................9-5
vii

Contents (continued)

9.1.7.2 Mental Lapse.......................................................................................................9-6

9.1.8 Personnel Selection and Contracting...............................................................................9-6

9.2 DIRECT CAUSES OF KSA-RELATED ERRORS.....................................................................9-7

9.3 PROGRAMMATIC CAUSES OF KSA-RELATED ERRORS.................................................9-7

9.3.1 Training Program Weaknesses.........................................................................................9-7

9.3.2 Other Programmatic Weaknesses ....................................................................................9-8

9.4 ADDITIONAL RESOURCES ON KSAs AND TRAINING.....................................................9-9

10. ATTENTION AND MOTIVATION......................................................................10-1

10.1 ATTENTION AND MOTIVATION IN HUMAN PERFORMANCE.....................................10-1

10.1.1 Attention...............................................................................................................................10-1

10.1.2 Motivation............................................................................................................................10-3

10.2 DIRECT CAUSES OF ATTENTION AND MOTIVATION ERRORS ..................................10-4

10.2.1 Detection and Monitoring .................................................................................................10-4

10.2.2 Situation Assessment .........................................................................................................10-4

10.2.3 Response Planning..............................................................................................................10-5

10.2.4 Execution..............................................................................................................................10-5

10.2.5 Motivation............................................................................................................................10-5

10.3 PROGRAMMATIC CAUSES OF ATTENTION AND MOTIVATION ERRORS..............10-6

10.4 ADDITIONAL RESOURCES..........................................................................................................10-7

11. PROCEDURES ........................................................................................................11-1

11.1 PROCEDURE-RELATED ERRORS AND THEIR CAUSES...................................................11-1

11.2 DIRECT CAUSES OF PROCEDURE-RELATED ERRORS....................................................11-2

11.2.1 No Procedure Used .............................................................................................................11-2

11.2.2 Wrong Procedure Used ......................................................................................................11-3

11.2.3 Procedure Used, But Wrong or Incomplete....................................................................11-3

11.2.4 Procedure Used, But Followed Incorrectly .....................................................................11-4

11.3 PROGRAMMATIC CAUSES OF PROCEDURE-RELATED ERRORS.................................11-4

11.3.1 Procedures Program............................................................................................................11-4

11.3.2 Other Programmatic Weaknesses.....................................................................................11-6

11.4 ADDITIONAL RESOURCES ON PROCEDURES.......................................................................11-6

12. TOOLS AND EQUIPMENT...................................................................................12-1

12.1 EFFECTS OF TOOLS AND EQUIPMENT ON HUMAN PERFORMANCE.......................12-1

12.1.1 Tool Design and Use..........................................................................................................12-1

12.1.2 Equipment ............................................................................................................................12-1

12.1.3 Personal Protective Equipment.........................................................................................12-2

12.2 DIRECT CAUSES OF ERRORS RELATED TO TOOLS AND EQUIPMENT ...................12-2

12.2.1 Tools .....................................................................................................................................12-2

12.2.2 Equipment ............................................................................................................................12-3

12.2.3 Personal Protective Equipment.........................................................................................12-4

12.3 PROGRAMMATIC CAUSES FOR ERRORS RELATED TO

TOOLS AND EQUIPMENT............................................................................................................12-4

12.4 ADDITIONAL RESOURCES ON TOOLS AND EQUIPMENT .............................................12-6

13. STAFFING................................................................................................................13-1

13.1 EFFECTS OF STAFFING ON HUMAN PERFORMANCE.....................................................13-1

13.1.1 Staffing Requirements .......................................................................................................13-1

13.1.2 Staffing Decision-Making .................................................................................................13-1
viii

Contents (continued)

13.1.2.1 Range of Expertise..............................................................................................13-1

13.1.2.2 Staff Size...............................................................................................................13-2

13.1.3 Task Overload .....................................................................................................................13-3

13.2 DIRECT CAUSES OF ERRORS RELATED TO STAFFING..................................................13-3

13.3 PROGRAMMATIC CAUSES FOR STAFFING RELATED ERRORS..................................13-4

13.4 ADDITIONAL RESOURCES ON STAFFING............................................................................13-5

14. SUPERVISION ........................................................................................................14-1

14.1 SUPERVISION AND HUMAN PERFORMANCE.....................................................................14-1

14.1.1 Direction..................................................................................................................................14-1

14.1.2 Oversight.................................................................................................................................14-2

14.1.3 Leadership...............................................................................................................................14-2

14.2 DIRECT CAUSES OF SUPERVISION ERRORS.......................................................................14-3

14.2.1 Direction..................................................................................................................................14-4

14.2.2 Oversight.................................................................................................................................14-4

14.2.3 Leadership...............................................................................................................................14-5

14.3 PROGRAMMATIC CAUSES OF SUPERVISION ERRORS ..................................................14-5

14.4 ADDITIONAL RESOURCES ON SUPERVISION....................................................................14-5

15. HUMAN-SYSTEM INTERFACE..........................................................................15-1

15.1 THE HUMAN-SYSTEM INTERFACE AND HUMAN PERFORMANCE..........................15-1

15.1.1 HSI Design Process............................................................................................................15-1

15.1.2 HSI Characteristics.............................................................................................................15-2

15.1.2.1 Information Display............................................................................................................15-2

15.1.2.2 User-System Interaction ....................................................................................15-2

15.1.2.3 Controls ................................................................................................................15-3

15.1.2.4 Alarm Systems ....................................................................................................15-3

15.1.2.5 Soft Control Systems..........................................................................................15-3

15.1.2.6 Computer-Based Procedure Systems ..............................................................15-3

15.1.2.7 Computerized Operator Support Systems ......................................................15-4

15.1.2.8 Workstations........................................................................................................15-4

15.1.2.9 Control Room......................................................................................................15-4

15.1.2.10 Local Control Stations.....................................................................................15-4

15.1.2.11 Maintainability Features ..................................................................................15-5

15.2 DIRECT CAUSES OF HSI-RELATED ERRORS.......................................................................15-5

15.2.1 Information Display............................................................................................................15-5

15.2.2 User-System Interaction ....................................................................................................15-6

15.2.3 Controls and Soft Control Systems..................................................................................15-6

15.2.4 Alarm Systems ....................................................................................................................15-7

15.2.5 Computer-Based Procedures and Operator Support Systems .....................................15-7

15.2.6 Workstations........................................................................................................................15-8

15.2.7 Control Room......................................................................................................................15-8

15.2.8 Local Control Stations.......................................................................................................15-9

15.2.9 Maintainability ....................................................................................................................15-9

15.3 PROGRAMMATIC CAUSES FOR HSI-RELATED ERRORS ...............................................15-10

15.4 ADDITIONAL RESOURCES ON THE HSI................................................................................15-10

16. TASK ENVIRONMENT.........................................................................................16-1

16.1 EFFECTS OF ENVIRONMENTAL FACTORS ON HUMAN PERFORMANCE...............16-1

16.1.1 Vibration...............................................................................................................................16-1

16.1.2 Noise.....................................................................................................................................16-1

16.1.3 Heat .......................................................................................................................................16-2
ix

Contents (continued)

16.1.4 Cold .......................................................................................................................................16-2

16.1.5 Lighting ................................................................................................................................16-3

16.1.6 Other Adverse Task Conditions.......................................................................................16-4

16.1.7 Combination of Conditions...............................................................................................16-4

16.2 DIRECT CAUSES OF TASK ENVIRONMENT-RELATED ERRORS.................................16-4

16.3 PROGRAMMATIC CAUSES OF TASK ENVIRONMENT ERRORS..................................16-5

16.4 ADDITIONAL RESOURCES ON TASK ENVIRONMENTS .................................................16-6

17. COMMUNICATIONS.............................................................................................17-1

17.1 COMMUNICATIONS IN ORGANIZATIONS............................................................................17-1

17.2 DIRECT CAUSES OF COMMUNICATIONS-RELATED ERRORS....................................17-1

17.2.1 Sending Errors ....................................................................................................................17-2

17.2.2 Receiving Errors.................................................................................................................17-3

17.3 PROGRAMMATIC CAUSES OF COMMUNICATIONS-RELATED ERRORS................17-4

17.4 ADDITIONAL RESOURCES ON COMMUNICATIONS........................................................17-5

18. COORDINATION AND CONTROL.....................................................................18-1

18.1 COORDINATION AND CONTROL: SETTING THE STAGE FOR ERRORS..................18-1

18.1.1 Work Control.......................................................................................................................18-1

18.1.1 Coordination ........................................................................................................................18-3

18.1.2 Information Management ..................................................................................................18-4

18.2 EFFECTS OF COORDINATION AND CONTROL WEAKNESSES....................................18-5

18.2.1 Work Control.......................................................................................................................18-5

18.2.2 Coordination ........................................................................................................................18-6

18.2.3 Information Management ..................................................................................................18-6

 18.3 ADDITIONAL RESOURCES ON COORDINATION AND CONTROL..............................18-6

APPENDIX A. GLOSSARY......................................................................................A-1

APPENDIX B BIBLIOGRAPHY............................................................................B-1

APPENDIX C BLANK REVIEW TABLES ...........................................................C-1
x

LIST OF FIGURES

Figure 2-1: An Example of Table 2.5 Completed for a Hypothetical

Inspection.......................................................................................................2-7

Figure 3-1: HPEP Framework...........................................................................................3-7

Figure 5-1: Partial ECF Chart from March, 1990 RHR Overpressurization

Event...............................................................................................................5-6

Figure 5-2: Partial ECF Chart from March, 1990 RHR Overpressurization

Event with One Causal Factor Added............................................................5-8

Figure 7-1: The HPEP Cause Tree....................................................................................7-5
xi

LIST OF TABLES

Table 2.1: Problem Identification and Characterization..................................................2-9

Table 2.2: Investigation Methods....................................................................................2-10

Table 2.3: Causal Analyses.............................................................................................2-12

Table 2.4: Corrective Actions..........................................................................................2-14

Table 2.5: Summary Review Table.................................................................................2-16

Table 5.1: Example Change Analysis Worksheet for an RCS Overpressurization

Event...............................................................................................................5-10

Table 5.2: Example Barrier Analysis Worksheet for Overpressurization Event.............5-12
xii

ACKNOWLEDGEMENTS

The authors wish to express their sincere gratitude to Isabelle Schoenfeld, Julius Persensky,

Eugene Trager and Clare Goodman of the U.S. Nuclear Regulatory Commission for their

technical guidance, knowledge and support of this project. We also wish to recognize John

Kauffman and Robert Spence of the U.S. Nuclear Regulatory Commission, and Calvin Walbert

of the U.S. Chemical Safety and Hazard Investigation Board, for their reviews of the report.

These reviewers provided insightful comments on the issues addressed in the report, and their

perspectives as experienced inspectors and investigators were invaluable. The primary author

also wishes to thank Dennis Vernon, Program Manager of the U.S. Department of Energy’s

Environment, Safety and Health Office of Oversight Accident Investigation Program, for his

tutelage.
1-1

PART I:

THE HUMAN PERFORMANCE REVIEW PROCESS
1-2

1 OVERVIEW OF THE HUMAN PERFORMANCE

EVALUATION PROCESS (HPEP)

1.1 INTRODUCTION

Reliable human performance is a requirement for safe operations in many settings, including

operations of commercial nuclear power and nuclear materials licensees. Among the industries

regulated by the U.S. Nuclear Regulatory Commission (NRC), human error has played an

important role in numerous events. Researchers for the Electric Power Research Institute note:

Ever since the systematic study of human performance and accidents began, it has

been clear that human errors (i.e., inappropriate or inadequate human actions)

contribute to a large portion of accidents and incidents. This has been found true

for vehicle operation (aircraft, cars, motorcycles, bicycles), for industry

(commercial aviation maintenance, manufacturing, chemical processing, mining),

and for electric power generation. In nuclear power generation, the portion of

events or mishaps attributed at least in part to human error has ranged from 40%

to 80%, depending on the study and the specific measures used, but it is

consistently reported as having a major role (Gross and Ayres, 1998).

Human errors may play several different roles in an event sequence. An error may

• directly cause an event,

• contribute to an event by setting up the conditions that, in combination with other events

or conditions, allowed the event to occur (e.g., leaving a valve open that should be

closed),

• make the consequences of an event more severe, or

• delay recovery from an event.

Human errors typically contribute to events rather than directly cause them. In fact, a single

human error directly causes very few significant events because most systems that involve

nuclear processes are designed to be fault-tolerant; that is, designed to prevent a single human

action (or failure to act) from causing an event with important consequences.

More often, a risk-significant event involves several system deficiencies, some of which may

have happened long before the event takes place. For example, errors in the original installation

of a system may set the stage for another human error to initiate an event months or years later.

The value of investigating the human errors involved in an event is to understand what caused

them so that corrective actions can be developed to minimize the likelihood of recurrence.

It is also important to detect and correct patterns of errors before they result in an event. Human

performance trends are a pattern of related errors resulting from the same causal factors.
1-3

Although most errors that are made day-to-day have no immediate impact on safe operations, an

adverse human performance trend may contribute to an overall increase in risk to the public. For

example, a pattern of related errors may systematically degrade the reliability of a class of

components (e.g., miscalibration errors) or the errors may be committed in the wrong

combination of circumstances and cause an event.

In most cases, the causes of errors that occur in an event or as part of a trend (collectively

referred to here as human performance problems) can be traced to weaknesses in the

programs, policies and practices that NRC licensees use to increase the reliability of human

performance in their operations. Examples of these programs include training and qualification

programs; the fitness-for-duty program; programs to develop and validate procedures; work

planning and control processes; overtime policies; and structured methods for communicating

important information, such as shift turnover. Programmatic weaknesses are often found to be

the root causes of human performance problems.

In the course of implementing NRC Inspection Procedure 71152, Identification and Resolution

of Problems, inspectors may be called upon to validate licensees' investigations of events

involving human performance problems. For significant conditions adverse to quality,

inspectors will evaluate licensees' detection and characterization of human performance

problems as well as the effectiveness of licensee root cause analyses and corrective actions. The

Human Performance Evaluation Process (HPEP) is intended to help NRC inspectors in

performing these tasks.

1.2 OBJECTIVES

The HPEP is not intended to replace existing NRC inspection procedures. The purpose of the

HPEP is to support NRC staff reviews of the effectiveness of licensee problem identification and

resolution programs in detecting and resolving human performance problems. Methods are

presented for evaluating licensee investigations of human performance problems, root cause

analyses and corrective actions. It is recognized that the approach described in Part II of the

HPEP is different from that used in NRC inspection procedures, such as Inspection Procedure

71841, Human Performance.

1.3 ORGANIZATION

The HPEP is presented in two parts. Part I is a step-by-step process to help a reviewer evaluate a

licensee’s problem identification, investigation, causal analyses and corrective actions for human

performance problems. Part II is comprised of the HPEP Cause Tree and Modules. The

modules provide background information on frequently identified causes of human performance

problems and specific examples to assist in the evaluation of a licensee's causal analyses.

A glossary of terms and concepts that are central to understanding and applying the review

guidance is presented in Appendix A. Terms that are defined in the glossary are presented in

bold in the text.
1-4

Appendix B presents a bibliography of sources used to develop this document. References are

not cited in the text in order to increase the usability of the document.
2-1

2 HUMAN PERFORMANCE PROBLEM REVIEW

2.1 OVERVIEW OF THE REVIEW PROCESS

In this section, a systematic method is presented for evaluating the effectiveness of a licensee's

identification and resolution program with regard to human performance problems. The HPEP

review process is organized as a series of tables that ask the inspector to answer evaluation

questions in four areas. These areas are:

• The licensee's identification and characterization of human performance problems (Table

2.1 Problem Identification and Characterization)

• Methods and information used to investigate human performance (Table 2.2

Investigation Methods)

• The analyses used to determine the causes of the human performance problems

(Table 2.3 Causal Analyses)

• The likely effectiveness of corrective action plans (Table 2.4 Corrective Actions).

Table 2.5, Summary Review Table, is provided to assist in summarizing the results of the

review. Blank tables are presented at the end of this section and in Appendix C for copying.

More detailed background information on each of the evaluation areas is provided in Sections 3-

6 of this document, as follows:

• Challenges in identifying human performance problems and the theoretical framework

underlying the HPEP are discussed in Section 3.

• Information and detailed guidance regarding appropriate investigation methods for

human performance problems are presented in Section 4.

• An overview of root cause analysis is presented in Section 5. Three root cause analysis

techniques are also described: events and causal factors analysis, barrier analysis and

change analysis.

• Information regarding corrective actions for human performance problems is presented in

Section 6. This section discusses alternative methods of correcting human performance

problems and determining the appropriate scope of a corrective action plan.

The HPEP Cause Tree and Modules are presented in Part II of this document to assist in

answering the questions in Table 2.3, Causal Analyses. This additional information on typical

causes of human performance problems is presented because determining the causes for human

performance problems is often difficult.
2-2

2.2 PROBLEM IDENTIFICATION AND CHARACTERIZATION

The review questions in Table 2.1 (p. 2-9) may be used in evaluating the extent to which

licensees appropriately identify and characterize human performance problems. Human

performance problems are sometimes difficult to identify in the documents that describe

problems at licensee facilities or may not be identified at all. Licensee documentation may focus

on system or equipment performance without discussion of the human actions and decisions that

contributed to the event or condition.

There are a number of reasons that human performance problems may not be well documented in

either internal licensee problem reports or in reports to the NRC. For example, human errors

may not be reported and documented as such to avoid embarrassment to personnel or possible

disciplinary action. A more complete discussion of the challenges in identifying human

performance problems is presented in Section 3.

For some problems that the licensee has identified, human actions and decisions may not be

important contributors to the problem. In others, human behavior may have been central to

creating the problem, and an understanding of the nature and causes of the behavior was

necessary to develop effective corrective actions. In the latter case, it is important that the

human performance problem was characterized in sufficient detail to support problem resolution.

If the licensee did not identify the human performance problem(s) in the documents available for

review, it may be necessary to request additional documents or to interview licensee personnel.

Often, the human performance problem(s) in an event, for example, were identified and

investigated, but the information may not have been included in a formal report.

2.3 INVESTIGATION METHODS

The review questions in Table 2.2 (p. 2-10) may be used to guide the evaluation of a licensee’s

investigation of a human performance problem. A thorough and systematic investigation is

necessary to provide the information needed to perform causal analyses and develop effective

corrective actions.

In general, the extent to which licensee personnel will investigate a human performance problem

depends upon the perceived significance of the problem. For example, an error that caused a

reportable event will likely receive more attention than an error that resulted in an event that was

not reportable. Many licensees have established criteria for determining the types of problems

that must be investigated and the degree of thoroughness required in the investigation. These

criteria may include risk, cost, or regulatory implications, for example. If a human performance

problem falls below the licensee's threshold for conducting an investigation and the inspector

agrees with the licensee's determination, many of the questions in Table 2.2 will be marked as

NA for the problem.

A discussion of methods for investigating human performance problems can be found in

Section 4.
2-3

2.4 CAUSAL ANALYSES

The review questions in Table 2.3 (p. 2-12) may be used in evaluating the licensee's causal

analyses of human performance problems. The purpose of analyzing the causes of human

performance problems is to guide the development of effective corrective actions. Standard root

cause analysis techniques, such as events and causal factors charting and analysis, change

analysis and barrier analysis, are resource-intensive and time-consuming to apply, but yield

reliable and useful results when performed properly. Use of the standard techniques may not

always be warranted, however, and licensees apply these techniques only to the more significant

problems. When standard root cause analysis techniques are used, more than one cause is

typically identified for a human performance problem. An overview of root cause analysis, and

a discussion of the different types of causes that will be identified by using root cause analysis

techniques, can be found in Section 5.

More detailed information about frequently identified causes of human performance problems is

presented in the HPEP Cause Modules in Part II. The HPEP Cause Tree and Modules are

intended to assist inspectors in verifying the causal factors a licensee has identified as an aid in

answering the questions in Table 2.3.

2.5 CORRECTIVE ACTIONS

The review questions in Table 2.4 (p. 2-14) may be used in evaluating the licensee’s corrective

actions for human performance problems. An effective corrective action for a human

performance problem is one that will decrease the likelihood that it, and similar problems, will

happen again. In an ideal world, an effective corrective action would prevent recurrence of the

human performance problem. As discussed in Section 3, however, the causes of human behavior

are difficult to identify and, as a result, measures to improve human performance often yield

inconsistent results.

Developing effective corrective actions typically requires a thorough root cause analysis and an

understanding of available methods for enhancing human performance. Depending upon the

significance and scope of the cause(s) identified, corrective action plans may vary in scope from

correcting a single cause, such as a missing tag on a valve, to a general organizational

improvement plan. As a minimum, corrective actions must address each of the causal factors

identified from the investigation.

Corrective action plans that have an appropriate scope still may be ineffective, however.

Corrective action plans may be ineffective because, for example, the steps for achieving the

plan’s objectives were not defined in detail; responsibility was not assigned to specific

individuals for accomplishing the actions; or measures for determining the success of the

corrective actions were not defined or used to refine the plan when necessary. Other

management initiatives and events may arise that take precedence over implementing the

corrective actions. Without a method for monitoring the on-going effectiveness of the corrective

action plan, human performance problems may reoccur.

More detailed background information about corrective action plans can be found in Section 6.
2-4

2.6 USING THE REVIEW TABLES

Follow these steps to use the review tables:

1. Assemble the reports that describe the human performance problems to be evaluated.

These may consist of Licensee Event Reports, self-assessments, problem reports entered

into a licensee’s corrective action tracking system(s), licensee responses to inspection

findings, or others. Request that the licensee also provide any related background or

supporting documentation that may contain more information than what is available in

the reports.

2. Identify each human error or trend that is described in the documents and develop a brief,

shorthand description of the human performance problem. Focus on describing the

human behavior or action, to the extent that information is available. For example,

"procedure step skipped," "alarm disabled," "jumper not removed," and so on. Record

the brief description in the top row of each table, along with the date it occurred, if that

information is available. (If you will be reviewing multiple human performance

problems, make additional copies of the tables. Space is provided on each table to review

two problems.)

3. In the row labeled “Document Identifier” at the top of Table 2.1, you may also want to

record information about the source document in which you found the human

performance problem discussed for later reference.

4. Begin the review of each human performance problem with Table 2.1 and continue

through Table 2.4. Answer the questions in all of the tables for each problem. If a

question is not applicable to the problem, mark it as NA. Space is provided in each table

for recording notes.

5. When you have completed answering the questions on the page, count up and record the

total number of Yes answers you circled and the total number of NA answers you circled

on that page. Record these totals in the spaces provided in the lower right-hand corner of

the page. The questions in each table are designed so that a Yes answer suggests problem

identification and resolution program effectiveness. There is no threshold percentage of

Yes answers that would show that a licensee's problem identification and resolution

program was ineffective with regard to human performance. However, these percentages

provide an indication of program sensitivity to human performance problems.

6. When you have completed Tables 2.1-2.4 for each human performance problem under

review, summarize the results of your evaluations in Table 2.5. By following the

procedure described below, calculate the percentage of Yes answers you circled to the

applicable evaluation questions in each area addressed by the tables. Figure 2.1 shows an

example of Table 2.5 that has been completed for a hypothetical inspection.
2-5

a. Record the total number of human performance problems you reviewed in the

space provided at the top left of the table.

b. Multiply the number of problems you reviewed by the number of questions in

each table (the latter number is provided in the summary table).

c. Add up the total number of Yes answers you circled in each table and record

those totals in Row C. For example, if you used six copies of Table 2.1 (to review

twelve human performance problems), you would add up the Yes answers on all

of the six pages to arrive at the total number of Yes answers you circled in Table

2.1. Record this total in Row C in the column titled "2.1 Problem Identification

and Characterization" on Table 2.5, the "Summary Review Table."

d. Add up the total number of NA answers you circled in each table and record those

totals in Row D.

e. Subtract the total number of NA answers (Row D) from the total calculated in

Row B. The difference represents the number of applicable questions that could

have been answered Yes.

f. Divide the number of Yes answers in each table (as recorded in Row C) by the

number of applicable questions that could have been answered Yes (as recorded

in Row E).

g. Multiply the result in Row F by 100 to arrive at the percentage of Yes answers

you circled out of the total number of applicable questions that could have been

answered Yes.

h. Adding up your answers to each question in Tables 2.1-2.4 may also be useful in

developing insights regarding any specific areas of weakness in the licensee's

problem identification and resolution program with regard to human performance.

For example, question 2.2.3 in Table 2.2 asks, "Did the licensee validate the

information gathered about the problem by seeking information from more than

one source?" If you find that you circled No for 11 out of 12 problems reviewed,

your answers may suggest that further assessment of the licensee's investigation

methods is warranted. Copies of the tables may also be used to record the tallies

for each question.

2.7 ASSESSING RISK IMPACT

There are a number of methods available for assessing the risk importance of the human

performance problems reviewed. The problem identification reports that are reviewed may be

screened prior to the HPEP evaluation to ensure that only risk-important events or trends are

evaluated. Or, as the HPEP evaluation progresses, the inspector may identify human

performance problems that should be evaluated for risk-significance. Guidance for assessing the

risk impact of weaknesses in the licensee’s problem identification and resolution processes with

regard to human performance problems may also be consulted.

2.8 INCORPORATING HPEP FINDINGS IN AN INSPECTION REPORT

The results of an HPEP review, taken together with other information from inspection activities,

should assist NRC personnel in drawing conclusions regarding the effectiveness of a licensee's

problem identification and resolution program for human performance. For example, if an HPEP
2-6

review indicated that a licensee identified and appropriately characterized the human

performance problems in only 10% of the issues reviewed (as indicated by the percentage of Yes

answers calculated in Row G of Table 2.5), inspectors may question the sensitivity of the

program to human performance problems. Or, if a low percentage of Yes answers were given to

the questions in Table 2.3 regarding the licensee's causal analyses, inspectors may question the

likely effectiveness of corrective actions based upon those analyses. Taken together with

additional information that shows a pattern of undetected human performance trends, a low

percentage of Yes answers to the HPEP review questions could support a finding that the

licensee's program is weak in the identification and resolution of human performance problems.
2-7

Table 2.5 Summary Review Table

Tables

A. Number of human

performance problems

reviewed = 10

2.1 Problem

Identification and

Characterization

2.2 Investigation

Methods 2.3 Causal Analyses 2.4 CorrectiveActions

Number of questions in

each table 6 10 13 12

B. Multiply the number of

questions in each table by

the total number of

problems reviewed

6 X 10=(B)60 10 X 10=(B)100 13 X 10=(B)130 12 X 10=(B)120

C. Record the total

number of Yes answers

circled from each table

(C) = 40 (C) = 65 (C) = 110 (C) = 87

D. Record the total

number of NA answers

circled from each table

(D) = 7 (D) = 5 (D) = 0 (D) = 3

E. Subtract the total from

Row D from the total in

Row B

(B)60 - (D)7=(E)53 (B)100 - (D)5=(E)95 (B)130 - (D)0=(E)130 (B)120 - (D)3=(E)127

F. Divide the answer in

Row C by the answer in

Row E

(C)40 /(E) 53=(F).75 (C)65 /(E) 95=(F).68 (C)110 /(E)130=(F).85 (C)87/ (E) 127=(F).69

G. Multiply the answer in

Row F by 100 to obtain the

percentage of Yes answers

(F).75 X 100 = 75% (F).68 X 100 = 68% (F).85X 100 = 85% (F).69 X 100 = 69%

Figure 2.1 An Example of Table 2.5 Completed for a Hypothetical Inspection
2-8

HPEP REVIEW TABLES
2-9

Table 2.1 Problem Identification and Characterization

Document Identifier:

Problem Number: __ Problem Number: __

Question

Number

Brief description

of the problem and

date(s) of occurrence:

2.1.1 Was the human performance

problem identified?

Yes

No

NA

Yes

No

NA

2.1.2

If not, was the human

performance problem

tangential to understanding

and resolving the issue under

review?

Yes

No

NA

Yes

No

NA

2.1.3

Were the individuals involved

in the problem identified (by

job role)?

Yes

No

NA

Yes

No

NA

2.1.4

Were the actions and decisions

or failures to act that

comprised the problem

described?

Yes

No

NA

Yes

No

NA

2.1.5

Were precursor errors or

earlier evidence of a

developing trend identified?

Yes

No

NA

Yes

No

NA

2.1.6

Was the problem described in

enough detail to support causal

analyses and the development

of corrective actions?

Yes

No

NA

Notes:

Yes

No

NA

Notes:

Notes:

Total number of Yes's: ____

Total number of NA's: ____
2-10

Table 2.2 Investigation Methods

Question

Number Problem description:

Problem Number: __ Problem Number: __

2.2.1

Was the extent of the

investigation consistent with

the importance of the

problem?

Yes

No

NA

Yes

No

NA

2.2.2

Were licensee criteria for

determining which issues

require an investigation

appropriately applied to this

problem?

Yes

No

NA

Yes

No

NA

2.2.3

Did the licensee validate the

information gathered about

the problem by seeking

information from more than

one source?

Yes

No

NA

Yes

No

NA

2.2.4

Did the licensee seek the

appropriate type(s) of evidence

for investigating the problem?

Yes

No

NA

Yes

No

NA

2.2.5

Did the licensee gather enough

information to understand the

sequence of events and

conditions leading up to the

problem?

Yes

No

NA

Notes:

Yes

No

NA

Notes:

Notes:

Total number of Yes's: ____

Total number of NA's: ____
2-11

Table 2.2 Investigation Methods (continued)

Question

Number Problem description:

Problem Number: __ Problem Number: __

2.2.6

Did the licensee check plant

records to identify other

problems that occurred during

the same work activity?

Yes

No

NA

Yes

No

NA

2.2.7

Did the licensee identify the

programs that applied to the

job(s) during which the human

performance problem arose?

Yes

No

NA

Yes

No

NA

2.2.8

If the licensee found

weaknesses in the applicable

programs, were the

weaknesses investigated in

sufficient detail to understand

their scope and likely effects, if

not corrected?

Yes

No

NA

Yes

No

NA

2.2.9

Were the licensee’s conclusions

clearly supported by the

results of the investigation?

Yes

No

NA

Yes

No

NA

2.2.10 Was there a basis documented

for stopping the investigation?

Yes

No

NA

Notes:

Yes

No

NA

Notes:

Notes:

Total number of Yes's: ____

Total number of NA's: ____
2-12

Table 2.3 Causal Analyses

Question

Number Problem description:

Problem number: __ Problem Number: __

2.3.1

Were causal factors identified for

this human performance

problem?

Yes

No

NA

Yes

No

NA

2.3.2 Was more than one causal factor

identified for the problem?

Yes

No

NA

Yes

No

NA

2.3.3

Was the type of causal analysis of

this problem consistent with its

importance ?

Yes

No

NA

Yes

No

NA

2.3.4

Was there enough information

provided to verify the accuracy of

the causal factors identified?

Yes

No

NA

Yes

No

NA

2.3.5 Were several possible causes for

the problem investigated?

Yes

No

NA

Yes

No

NA

2.3.6 Did the evidence support the

licensee’s choice of causes?

Yes

No

NA

Yes

No

NA

2.3.7

Were the bases for rejecting

possible causes for the problem

documented?

Yes

No

NA

Notes:

Yes

No

NA

Notes:

Notes:

Total number of Yes's: ____

Total number of NA's: ____
2-13

Table 2.3 Causal Analyses (continued)

Question

Number Problem description:

Problem Number: __ Problem Number: __

2.3.8

Did the licensee analyze

programmatic weaknesses to

determine if they could account

for more than one human

performance problem?

Yes

No

NA

Yes

No

NA

2.3.9

Did the licensee perform and

document a root cause analysis

using systematic root cause

analysis techniques?

Yes

No

NA

Yes

No

NA

2.3.10 Was more than one root cause

analysis technique used?

Yes

No

NA

Yes

No

NA

2.3.11

Was the rationale for terminating

the root cause analysis sufficient

and documented?

Yes

No

NA

Yes

No

NA

2.3.12 Were the root causes identified

under management control?

Yes

No

NA

Yes

No

NA

2.3.13

If corrected, would the causes

identified reduce the likelihood of

the same and similar problems

from happening again?

Yes

No

NA

Notes:

Yes

No

NA

Notes:

Notes:

Total number of Yes's: ____

Total number of NA's: ____
2-14

Table 2.4 Corrective Actions

Question

Number Problem description:

Problem Number: __ Problem Number: __

2.4.1

Were corrective actions for the

human performance problem

identified?

Yes

No

NA

Yes

No

NA

2.4.2

Were the corrective actions

effective, or appear likely to be

effective, even if no causal

analysis was performed and/or

documented?

Yes

No

NA

Yes

No

NA

2.4.3

If a causal analysis was

performed, were the links

between the causal factors and

the corrective actions clear?

Yes

No

NA

Yes

No

NA

2.4.4

Was there a corrective action

for every causal factor? (a oneto-one correspondence is not

required)

Yes

No

NA

Yes

No

NA

2.4.5

Was the scope of the

corrective action plan

appropriate?

Yes

No

NA

Yes

No

NA

2.4.6

Were the desired

condition(s) that the

corrective actions are

intended to create clearly

described?

Yes

No

NA

Notes:

Yes

No

NA

Notes:

Notes:

Total number of Yes's: ____

Total number of NA's: ____
2-15

Table 2.4 Corrective Actions (continued)

Question

Number Problem description:

Problem Number: __ Problem Number: __

2.4.7

Did the licensee define

measurable objectives to be

achieved from the corrective

actions?

Yes

No

NA

Yes

No

NA

2.4.8

Did the licensee define

evaluation and

acceptance criteria for

assessing corrective

action effectiveness?

Yes

No

NA

Yes

No

NA

2.4.9

Did the licensee define an

implementation process for the

corrective actions and

specific performance

indicators for evaluating

success?

Yes

No

NA

Yes

No

NA

2.4.10

Did the licensee assign

responsibility to specific,

qualified individuals for

implementing the corrective

actions?

Yes

No

NA

Yes

No

NA

2.4.11

Did the licensee develop a plan

for on-going monitoring of

continued acceptable

performance?

Yes

No

NA

Yes

No

NA

2.4.12

Did the licensee review the

corrective actions before

implementation to ensure that

they will not cause unintended

negative consequences?

Yes

No

NA

Notes:

Yes

No

NA

Notes:

Notes:

Total number of Yes's: ____

Total number of NA's: ____
2-16

Table 2.5 Summary Review Table

Tables

A. Number of human

performance problems

reviewed = ____

2.1 Problem

Identification and

Characterization

2.2 Investigation

Methods 2.3 Causal Analyses 2.4 CorrectiveActions

Number of questions in

each table

6 10 13 12

B. Multiply the number of

questions in each table by

the total number of

problems reviewed

6 X ___=(B)____ 10 X ___=(B)____ 13 X ___=(B)____ 12 X ___=(B)____

C. Record the total

number of Yes answers

circled from each table

(C) = ____ (C) = ____ (C) = ____ (C) = ____

D. Record the total

number of NA answers

circled from each table

(D) = ____ (D) = ____ (D) = ____ (D) = ____

E. Subtract the total in

Row D from the total in

Row B

(B)____-(D)____=(E)____ (B)____-(D)____=(E)____ (B)____-(D)____=(E)____ (B)____-(D)____=(E)____

F. Divide the answer in

Row C by the answer in

Row E

(C)____/(E) ____=(F)____ (C)____/(E) ____=(F)____ (C)____/(E)____=(F)____ (C)____/ (E)____=(F)____

G. Multiply the answer in

Row F by 100 to obtain the

percentage of Yes answers

circled in each review

table

(F)____X 100 = ____% (F)____X 100 = ____% (F)____X 100 = ____% (F)____X 100 = ____%

Notes:
3-1

3 IDENTIFYING HUMAN PERFORMANCE PROBLEMS

AND THEIR CAUSES

3.1 INTRODUCTION

Identifying human performance problems and their causes is often difficult. Further, the simple

identification of "human error" as a root or contributing cause of events provides little

information about how to prevent similar problems from recurring. Recognizing human

performance problems when they occur and accurately identifying their causes are necessary first

steps to developing effective corrective actions.

In this section, the term, "human error," is discussed and the challenges to identifying human

performance problems are discussed. Common difficulties in identifying the causes of error are

also discussed. Finally, the framework for investigating human errors that underlies the design

of the HPEP is presented.

3.2 CHALLENGES IN IDENTIFYING HUMAN PERFORMANCE PROBLEMS

The term, "human error," refers to an interaction between human behavior and the context in

which it occurs.1 The concept of an interaction is important because it is the context in which a

human action takes place that determines whether or not it is an error. In most cases, a particular

human action only becomes an "error" when it deviates from what was planned or expected in a

given task environment. This definition of error is important because it directs attention both to

the behavior and to the characteristics of the task environment that allowed the behavior to cause

or contribute to an event.

The human behaviors of greatest concern in a nuclear power plant are those in which personnel

interact with plant equipment and systems (i.e., human-system interactions), such as

manipulating valves, operating controls, placing or removing jumpers, locating and reading

gauges, or making and implementing decisions. Human-system interactions affect plant

performance.

Human performance trends, defined as a pattern of related errors resulting from the same

causal factors, may be difficult to identify for several reasons. First, humans commit errors

 

1

The term, "human error," has become somewhat controversial. Some practitioners and researchers have argued

that it inappropriately focuses attention on workers as the cause of an event and carries a connotation of blame

(NUREG-1624, 2000; Reason, 1997). The term is used in this document, however, because "error" accurately

implies that the very large majority of actions (or failures to act) that cause or contribute to events are unintentional.

For blame to accrue to an individual worker, it would be necessary to establish that the worker had both knowledge

of the correct actions to take in the given context and took the incorrect actions with intent (i.e., despite the

knowledge that the actions were proscribed). If both knowledge and intent were established, but the intent did not

involve causing harm, then the more accurate term for the worker's behavior would be a “violation.” If harm was

intended, which we are certain is rarely the case, then the more accurate term would be "sabotage.” Both violations

and sabotage fall outside the scope of this document.
3-2

relatively frequently but the errors often are not detected and reported as such. Most are not

detected for two primary reasons: (1) they have no impact on equipment or system performance,

or (2) they are caught and corrected before they have an impact. Errors are so common, in fact,

that people often do not notice an error has been committed unless it results in observable

consequences, such as degraded equipment, injuries, or equipment failures.

Second, personnel are often reluctant to report their own or co-workers' errors for many different

reasons. These may include the desire to avoid embarrassment or the potential for disciplinary

action; “chilling effects” from management that discourage workers from reporting problems; a

fear of retaliation or social ostracism from peers; the simple burden of filling out paperwork; or

there may be no systematic and impersonal method available to report errors and their causes.

As a result, a pattern of repeated errors may not be detected until they have a noticeable impact

on hardware performance. An accepted practice of deviating from the steps in a poorly written

procedure, rather than ensuring that the procedure is revised, is an example of an error that may

not be reported, but could result in adverse consequences if, for example, the deviations had

undetected effects on equipment, such as accelerated aging.

Third, some licensee's corrective action item tracking systems may not be designed to support

the aggregation of human performance data to identify trends. In some cases, problems are

coded and tracked by the system, component or part, and human errors that occurred to cause the

problem may be buried in the problem descriptions and not coded in a manner that is retrievable

for analysis. As a result, different errors that result from the same cause may not be identified as

symptoms of an underlying problem.

Finally, management and regulators may also affect the human performance information that is

reported and tracked. For example, some managers may edit or influence the writing of problem

reports to ensure that their departments are not blamed for the problems or to address economic

considerations. Regulatory interest in some types of human performance problems may

influence the types of problems that are reported and how they are characterized. The results

might be that some problems are under-reported while others may be over-reported.

A number of classification schemes have been developed to categorize human errors into

different types. For example, Kirwan (1994) identifies four types of errors, including (1) errors

of commission, in which incorrect actions were taken, (2) errors of omission, in which required

actions were not taken, (3) extraneous acts, in which an action that was not required was taken,

and (4) missed error-recovery opportunities, comprised of actions which could have corrected

previous errors. Other schemes divide errors into motor (e.g., a slip) and cognitive (e.g., a

mental lapse) categories that may be further divided into subtypes.

Error classification schemes that focus on behaviors provide a language for describing the

different ways in which human behavior in a nuclear licensee's workplace can go wrong. But, as

will be discussed below, they are not particularly useful for understanding the causes of errors

that lead to events or to on-going human performance problems.
3-3

3.3 CHALLENGES IN IDENTIFYING THE CAUSES OF ERRORS

Establishing the causes of errors is necessary to detect and correct human performance problems,

but is often more difficult than establishing the causes for hardware failures. The challenge

arises from the flexibility and adaptability of human behavior as well as from the post hoc nature

of problem or event investigations.

There are few simple, one-to-one relationships between causal factors and specific human errors.

For example, a single causal factor, such as fatigue, may cause a variety of different types of

errors, such as skipping a step in a procedure, dropping tools, performing maintenance on the

wrong valve or failing to detect a sudden change in temperature or pressure on a gauge. Further,

humans are highly adaptable and the presence of a potential causal factor does not guarantee that

it will cause an error to be committed. Even a deeply fatigued person may be able to sustain high

levels of accurate performance in some circumstances, such as in combat or the operating room.

Although human factors research provides rules-of-thumb for designing human-system

interfaces to reduce the likelihood of errors, and guidelines for the design of tasks and

organizations, the person who is investigating an error cannot be sure that the research results

apply to the specific situation under investigation.

Establishing causes for human error in an event sequence can be further complicated by

weaknesses in the evidence available. For example, although interview data yield reliable

information about some lines of inquiry, people are notably limited in their ability to know what

has influenced their behavior. The social psychological research literature provides numerous

examples of how people create explanations for their decisions and actions that bear little or no

relationship to what can be objectively demonstrated to have caused them to behave in a

particular way. In addition, interview data are subject to various predictable biases and memory

distortions that reduce their reliability. For example, some research has shown that the accuracy

of people’s memories for events decreases by about 50% within two days after the event

occurred. Moreover, in contrast to the equipment or materials involved in an event, licensee

investigation personnel or NRC inspectors typically do not have the option of sending the

humans involved off to the laboratory for additional testing to confirm a causal hypothesis.

The consequence of the lack of a one-to-one correspondence between different types of errors

and specific causes is that there is no reliable road map to guide the identification of an error's

causes. Any single error may be caused by a variety of factors, and the "true" cause of the error

may be unknowable after the fact. Of course, there are cases in which an error's cause can be

determined unambiguously. For example, if a procedure step provides an incorrect instruction,

personnel report that they followed the step, and the consequences of their actions are consistent

with what should have occurred from following the incorrect step, the investigator can be fairly

confident that the "true" cause of the error was in the procedure. However, those cases are rare.

Identifying causes for human error is further complicated by many possible sources of bias or

limitations in the investigation process itself. The choice of potential causes to investigate for a

human error may be influenced, for example, by the investigator's greater knowledge of and

comfort level with some causal factors over others as well as by a lack of knowledge in some
3-4

areas. Or, the investigation and selection of causal factors may be influenced by the anticipated

costs of implementing subsequent corrective actions; institutional biases and mindsets; the time

and resources available to conduct the investigation; the investigators' perceptions of what will

be acceptable to management; and, sometimes, communications from management regarding

acceptable or unacceptable lines of inquiry to pursue and the “right” answers to the

investigations’ questions.

Inherent biases in how humans process information and come to conclusions about causes may

also affect an investigation. For example, research into the event investigation process identified

the following ways in which human information-processing biases can affect investigations:

• There is a general tendency to start an investigation with a few ideas about possible

causes, and then restrict the investigation to seeking information related to those causes.

It is also common to end the investigation before alternative causes have been fully

explored.

• People are subject to what has been termed the "confirmation bias," in which they only

seek out information that is consistent with an explanation and ignore disconfirming

evidence.

• Investigators may base their ideas of possible causes on the most immediately available

and visible information and neglect information that is less obvious.

• There is a general human tendency to attribute the cause of an event to the dispositions,

motivations or traits of persons rather than to situational factors, so the characteristics of

the "actors" involved in an event may be given more weight as causal factors than the

characteristics of the work environment.

Because the task of conclusively identifying the cause(s) for an error in an event sequence is so

difficult, a comprehensive and systematic approach to investigating human errors is necessary.

The barrier analysis framework described below is an approach to investigating human error that

has been shown to be useful in practice and to lead to reliable results.

3.4 A BARRIER ANALYSIS FRAMEWORK FOR INVESTIGATING HUMAN

ERRORS

The fact that human performance is fallible is one of the bases for the "defense-in-depth"

approach to nuclear power plant operations in which multiple barriers to human error are

implemented. Research and industry experience have identified both the most common causes

of human error and the barriers to error that are effective in addressing these common causes.

Those responsible for safe operations implement programs, policies and processes to ensure that

these barriers are in-place and functioning, commensurate with the risks posed by the activities

involved.

The barriers can be grouped into four basic categories, as follows:

• Personnel attributes required for successful task performance, including fitness for duty,

knowledge and skills, and attention and motivation
3-5

• The resources provided to support task performance, such as complete, technically

accurate and usable procedures, accurate and complete reference documentation,

appropriate tools and equipment, supervision and the appropriate number of staff to

accomplish the work

• A physical work environment compatible with human capabilities, including the design

of human-system interfaces and appropriate controls on environmental factors, such as

noise, vibration, and temperature

• An organizational work environment that facilitates task performance, including

effective verbal and written communications, inter-group and intra-group coordination,

an established safety culture, and planning and scheduling of work activities.

When these barriers are in-place and functioning, plant operations are controlled and the

likelihood of errors is reduced.

Missing barriers, such as the failure to hold a pre-job briefing for important work on a safety

system, or deficiencies in existing barriers, such as a poorly designed display, are often found to

be the direct causes of errors. Direct causes of errors are also known as performance-shaping

factors.

Once an error has been identified and characterized, the initial lines of inquiry into the cause(s)

of the error determine what barriers to the error existed and how they failed, and what barriers

could have been implemented to prevent the error from occurring, but were missing. The HPEP

Cause Modules in Part II (e.g., Procedures, Communications, Supervision) represent the most

common barriers implemented at plants to prevent errors. The modules also include examples of

the types of direct causes that lead to errors when the barriers fail or are missing.

3.5 ANALYZING THE PROGRAMS THAT CREATE AND MAINTAIN BARRIERS

Although the identification of missing or failed barriers to human error is more useful than

simply identifying "human error" as one of an event's causes, stopping the investigation at this

level may not provide sufficient information to develop effective corrective actions. When failed

or missing barriers to human error are encountered, it is also important to determine whether the

failed or missing barriers represent isolated conditions or are symptoms of underlying flaws in

the plant programs intended to ensure that the barriers are in-place and effective.

The root cause of an error is often found in programmatic weaknesses. Programs are

comprised of policies (both formal and informal), organizational processes and procedures that

define management expectations for how work is to be performed. Some are solely focused on

ensuring safe operations (e.g., the ALARA program or the process for developing emergency

operating procedures), while others perform a dual role (e.g., human resources and training

programs) or have little direct impact on safety (e.g., the accounting system). If there is a flaw in

one of the programs responsible for maintaining safe operations, that flaw will create conditions

that may not only allow the error under investigation to reoccur, but may represent a

vulnerability to additional events caused by the same programmatic flaw. Programmatic

weaknesses are often found to be the cause of human performance trends.
3-6

As a simple example, an incorrect step in a procedure that is found to have caused an error may

represent an isolated problem in a single procedure. Or, there may be a weakness in the program

responsible for developing and maintaining procedures that allowed not only the one incorrect

step to be published, but was ineffective in ensuring that procedures overall were technically

accurate. If the investigation were to stop with the identification of the single incorrect step, and

a corrective action was taken to fix that one step in the single procedure, the underlying flaw in

the procedures program would not be detected. The consequence of failing to detect and correct

the programmatic flaw would be that other inaccuracies in procedures would remain. Further,

any new procedures that were developed under the same program could also include technical

inaccuracies, thus setting the stage for further errors that could result in future hardware failures

and other events.

Tracing the root causes of human error to the programmatic level can be resource intensive,

however. Licensee problem identification and resolution programs may not require this type of

extensive investigation and analysis until a human error is implicated in a significant problem or

event, although definitions of "significance" vary among licensees. Databases that allow the

tracking of human errors and their direct causes may pinpoint an emerging human performance

trend, however, and could also lead to an investigation of programmatic causes. For this reason,

the HPEP includes guidance for assessing a licensee's investigation of programmatic weaknesses

that may be causing an adverse human performance trend or that played a causal or contributory

role in a significant event.

3.6 SUMMARY

Figure 3-1 illustrates the HPEP framework described in this section. A hypothetical event

sequence is shown across the bottom of the figure. Possible direct causes of the human error

(barriers that failed or were missing) are shown above the event sequence. Possible

programmatic causes that may have been responsible for the barrier failure are shown above the

direct causes, demonstrating the loss of operational control that is evident from a human

performance problem or significant event. In this hypothetical event, a person who was not

qualified to perform the task committed the error, and both the training and work control

programs were implicated as root causes.

The HPEP, then, may be used when evaluating a licensee's problem identification and resolution

program to determine whether it (1) is effective in identifying the causes of human performance

problems that play a causal or contributory role in significant events, and (2) results in corrective

actions that target the causes of the problem(s) and result in effective problem resolution.
 

3-7

Knowledge Procedures Environment

Tools &

Equipment

CommunicationFitness-forduty

Staffing

Training

Program

Procedures

Program

Work

Planning

HFE

Program

ProcurementHuman

Resources

OPERATIONAL CONTROL

Human

Error

Other

events and

conditions

Example

Programmatic

Causes

Example

Direct

Causes

Event

Sequence

Figure 3.1 HPEP Framework

SIGNIFICANT

EVENT

Initiating

events and

conditions
4-1

4 INVESTIGATION METHODS FOR HUMAN PERFORMANCE

4.1 INTRODUCTION

The purpose of investigating human performance problems is to gather the information necessary

to identify their causes and develop effective corrective actions. An investigation should

establish the "Who, What, When, Where and How?" of the human performance issue. The

causal analysis of the information gathered in the investigation establishes the "Why."

In general, the thoroughness with which an error or a human performance problem will be

investigated and analyzed depends upon the perceived significance (e.g., safety, potential

economic impact) of the event sequence in which the error occurred or the potential for harm that

an adverse human performance trend presents. In addition, the role of the error in an event

sequence will also influence the extent to which an error is investigated. For example, an error

that was the root cause of an event will likely receive more attention than an error that only

contributed to the event.

Although licensees will not thoroughly investigate every human performance problem that

arises, a systematic investigation of significant problems provides the basis for developing

corrective actions to decrease the likelihood of recurrence. The investigation should be

systematic to overcome the many challenges to investigating human performance that were

discussed in Section 3. A systematic investigation process assures that the evidence gathered is

complete, valid and reliable. Evidence validity refers to the accuracy of the information.

Evidence reliability refers to whether or not different investigators would find the same

information and reach the same conclusions from it. A complete investigation identifies the

direct, contributing and root causes of the human performance problem so that corrective actions

can be developed to minimize recurrence of the same and similar problems. In this section,

methods for systematically investigating human performance problems are presented.

4.2 LINES OF INQUIRY

At the beginning of an investigation, investigators focus is on establishing the basic facts

surrounding the human performance problem. As the investigation progresses, the lines of

inquiry expand to investigate possible causes for the human performance problem and the scope

of any problems that are identified.

The initial lines of inquiry in an investigation help characterize the human performance problem.

Questions to be answered may include:

• What were the specific actions (or failures to act) that occurred in the event or that

comprise the human performance trend?

• What were the conditions under which the actions occurred?

• What work activities, if any, were going on at the time of the error, or that are linked to
4-2

the human performance problem?

• What systems or equipment were involved or affected by the actions?

• When and where did the problem occur?

• Who was involved in the work activity and who was supervising?

Developing an event chronology (i.e., a timeline), or an events and causal factors chart,

organizes the information gathered and is useful for showing gaps and conflicts in the

information that has been collected. Events and causal factors charting is discussed in Section

5.

At times, the information required to develop the event chronology leads rapidly to identification

of the direct cause of the human error under investigation. For example, the evidence may show

that personnel were working in a very noisy environment, wearing hearing protection, and were

unable to communicate effectively -- with the result that a communication error occurred. The

noisy environment would be the direct cause of the error, in this case.

At other times, the direct cause of the error will not be obvious and more investigation and

analysis may be required. Direct causes that are commonly implicated in human performance

issues are described in detail in the HPEP Cause Modules in Part II of this document. The Cause

Modules may suggest possible lines of inquiry to follow to establish the direct cause of an error.

In addition, special tests or analyses may be required. For example, interview data may suggest

that the worker who committed the error had been drinking. A blood or breath sample, if

available, may be necessary to determine the validity of the interview data and to assess the

likelihood that the worker was impaired.

Once the basic facts surrounding the human performance problem have been established, the

lines of inquiry expand to begin identifying root and contributing causes for the error. The

investigator will analyze the events and conditions leading up to the error and may use standard

causal analysis techniques, such as those discussed in Section 5, to identify possible causal

factors. Programmatic causes are investigated to determine whether a deficiency in a program,

policy or practices for managing work activities at a site allowed barriers to error, established by

management, to fail. As discussed in Section 3, barriers may fail because they are missing

altogether or there is a weakness in how they are implemented.

The extent of the conditions that caused the human performance problem is also investigated.

The investigator gathers evidence to determine whether the problem has occurred before, how

frequently, and whether the conditions that led to this problem could cause other, similar human

performance problems if not corrected. Further, the potential consequences of a recurrence of

this error under different circumstances should also be evaluated.

For an error that was directly caused by a miscommunication in a noisy work environment, the

lines of inquiry to identify programmatic causes and the extent of the conditions that caused the

communication error might include: “What were the communication practices, if any, that

personnel were trained to use in noisy environments? Did they follow those practices? If not,

why not? Were there additional communication practices or devices that would have allowed the
4-3

operators to communicate more effectively in the noisy work environment? How many times in

the past year have communication errors occurred in this and other noisy environments? Are

there circumstances in which an inability to communicate could increase plant risk to

unacceptable levels?"

For an error that was directly caused by fatigue from excessive hours worked over several

months, the investigator could ask, “What are the work scheduling and overtime practices at this

site? How many times in the past year have hours in excess of administrative limits been

approved and for how many workers? How many extra work hours were approved for

individuals, for certain job positions, within departments? Is there any evidence that error rates

increased during the periods in which other personnel were working excess hours? What kinds

of tasks were they performing and could errors on those tasks increase plant risk to unacceptable

levels?”

The process of establishing the event chronology and gathering the information needed for

conducting the causal analyses and to identify the needed corrective actions is described

sequentially here. In most investigations, however, the investigation process is iterative. That is,

the answers to one set of questions generate new questions for which information must be

gathered. In general, the more thorough the investigation, the more likely that the causal

analyses will identify the correct causal factors for the problem and that the corrective actions

will be effective.

4.3 COLLECTING EVIDENCE

The evidence that can be used to investigate human performance problems falls into three

general types. These are defined here as physical evidence, documentary evidence and human

evidence. A thorough discussion of evidence collection and preservation methods is outside the

scope of this document. Some of the methods for and challenges in collecting and preserving

evidence are discussed here, however, to facilitate review of the licensee’s investigation.

Physical evidence is any matter (e.g., solids, liquids, gases) related to the error or human

performance problem, such as equipment, parts, debris, contaminated water, hardware or tools.

Physical evidence may be used to establish the state or condition of equipment and the work

environment prior to an event as well as to determine what happened in the course of the event.

For example, examination of the personal protective equipment worn by the individuals involved

may show that their ability to see through a faceplate or to make fine manual adjustments in

gloves was limited and could have contributed to an error. At times, physical evidence regarding

the state or condition of the individuals involved in an event may also be collected, such as

collecting urine or blood samples to test for the presence of drug metabolites. Assuring that

perishable physical evidence is analyzed before it degrades, and that non-perishable evidence is

controlled so that it is available for further analysis, if necessary, are two important challenges in

gathering physical evidence.

Documentary evidence is also useful in understanding human performance problems, and

particularly any programmatic causes for an error. Documents regarding the work activity in
4-4

which the human performance problem occurred help to establish what happened, who was

involved and the conditions under which the problem arose. Examples of documentary evidence

include:

• Event recordings (e.g., event history, computer printouts, automatic and manual plots of

plant variables as a function of time showing the occurrence of alarms, system

activations, and other conditions during the event). These documents may show, for

example, the actions that were taken, when they were taken and any unusual conditions

that existed at the time.

• Design drawings, specifications, design and installation procedures, modification

packages. These documents may be useful in identifying discrepancies between how a

system was designed and how it was functioning at the time an error occurred, for

example. This information might allow the investigator to determine whether personnel

were trained appropriately and whether the instructions and supporting information they

had available during task performance were accurate.

• Maintenance records for affected systems, including vendor manuals. Maintenance

records may be useful in determining, for example, the point in time at which an error

during maintenance first occurred and, perhaps, how often it was repeated. Vendor

manuals can be used to verify that procedures are up-to-date.

• Procedures and work orders used during or relevant to the event. These documents are

very useful in establishing what happened in the event and in identifying discrepancies

between what was planned versus what was implemented.

• Plant technical specifications and associated safety analyses. These documents are often

useful in identifying discrepancies between what should have occurred versus what

actually happened.

• Operations logs. Similar to event recordings, these documents may be helpful in

establishing what happened and when.

• Correspondence, such as e-mails, letters, memoranda. These documents may also

contain information that is useful in establishing the event timeline, but also often contain

important information about the organizational work environment.

• Records of similar events, including root causes and corrective actions. These documents

assist investigators in assessing the scope of the human performance problem as well as

the effectiveness of previous corrective actions for similar human performance problems.

• Descriptions of programs, processes, and practices addressing plant operations and

maintenance, personnel performance, and procedure development. These documents

often clarify programmatic weaknesses, such as missing or weak barriers to error.

Human evidence is typically the primary source of information about human performance

problems, and may include written statements, the results of interviews, recordings of human

actions during the event or similar work activities, and the results of event reconstruction

activities. For example, audio or videotapes of the situation that preceded or occurred during the

event can be particularly useful for analyzing an error, but are usually not recorded. Tapes of

similar work activities, such as those made of control room crews for training purposes, can be

used to assess general work practices and may demonstrate an on-going human performance

problem, or help to determine whether the particular error that occurred in an event is common.
4-5

Human evidence may also include demonstrations of critical actions, such as manipulations of

the equipment involved in the event; walk through exercises, in which personnel act out

important actions as the stages of a scenario are described or are directed by procedure steps; and

dynamic exercises, in which scenarios are reenacted under more realistic conditions, such as in a

training simulator. These evidence collection activities may provide information about possible

task overload, for example, or deficiencies in the human-system interface, coordination and

communication problems, knowledge or skill deficiencies, and so on.

The participants in an event are often available to the investigator and are typically able to

provide the most detailed information about the error that occurred or the human performance

problem. As discussed in Section 3, however, individuals' memories for events may be limited,

if they are not interviewed immediately after the event. Further, they may not possess complete

information about the event, because what they remember will be limited to the aspects of the

event on which they were focused at the time. Or, memory for the event may be distorted from

strong emotion, the passage of time and intervening thoughts, by hearing others' descriptions of

what occurred or discussing it with them, the kinds of questions that are asked during the

interview, and other factors. Licensee investigators should interview eyewitnesses who observed

the event but did not participate in it as well as the event participants as soon as possible after the

event.

The information obtained from different sources is often conflicting. Further evidence collection

may resolve some conflicts. As a simple example, an operator may report in an interview that he

entered a room at a particular time, but the entry records for that room show that he keyed in

about 15 minutes later than he reported. Additional evidence regarding the accuracy and

reliability of the clock used when recording entries may allow the investigator to conclude that

the entry log is the more accurate information source. In other instances, it may not be possible

to collect additional evidence to resolve conflicts. In these cases, investigators will have to

weigh the evidence and use judgment to reach a conclusion. For example, if five eyewitnesses’

descriptions of an event are consistent, but vary from the description given by the individual who

committed the error, the investigator might conclude that the eyewitnesses’ accounts were more

valid.

It is often the case, however, that the evidence an investigator needs to conclusively establish

what happened or why an error occurred does not exist or is unavailable. In these cases,

investigators may have to assume that certain events occurred or conditions existed to explain the

error, or may develop and analyze plausible alternative scenarios. Given that human

performance is often so difficult to explain post hoc, it may be possible to derive some lessons

learned from the investigation but not to develop corrective actions that will be effective in

minimizing the likelihood that a similar error will reoccur.

As noted above, collecting evidence about a human performance problem is an iterative process.

As answers to one question are found, other questions arise that require follow-up. In addition,

new information may shed a different light on information collected earlier in the investigation

or conflict with it, so that additional information collection is necessary.
4-6

In general, the evidence gathered about a human performance problem should enable licensee

staff to identify several possible causes for the problem. Plausible causes should be documented

and the licensee should gather further evidence to confirm or rule out the possibilities. The most

plausible causes that were not confirmed by the evidence and the basis for rejecting them should

also be documented.

4.4 TERMINATING THE INVESTIGATION

The licensee's basis for terminating the investigation of a human performance problem should

also be documented. Theoretically, an investigation could continue until every question is fully

resolved. Time and resources for conducting an investigation this thoroughly are usually not

available, however. Therefore, other criteria may be applied to determine when an investigation

should be terminated. These could include, for example, a pre-set deadline for completing the

investigation, reaching a dead-end due to the unavailability of further evidence, or a decision that

the problem under investigation is minor and does not warrant the expenditure of further

resources. For events that the licensee has classified as significant, the investigation is typically

not terminated until the investigator and licensee management concur that sufficient evidence has

been gathered to support the determination of the causes of the human performance problem and

to develop specific and effective corrective actions.
5-1

5 EVALUATING THE LICENSEE’S ROOT CAUSE ANALYSIS

5.1 INTRODUCTION

Root cause analysis is a systematic method for analyzing the evidence collected about a

hardware failure or human performance problem. The purpose of root cause analysis is to

identify the basic set of conditions that, if eliminated or modified, would minimize the likelihood

of the same and similar problems from happening again. Performing a systematic root cause

analysis and identifying the direct, contributing and root causes for human performance

problems aids in ensuring that the problem is understood with sufficient depth to support the

development of effective correction actions.

In this section, background information for evaluating licensees' root cause analyses of human

performance problems is presented. The different types of causes that may be identified as a

result of using root cause analysis techniques are discussed, and detailed information about three

commonly used root cause analysis techniques is presented. These techniques are events and

causal factors charting and analysis, change analysis and barrier analysis.

5.2 CAUSAL FACTORS

A causal factor is any action or condition that occurred or existed prior to an error without

which the error is less likely have occurred. There are three types of causal factors that a root

cause analysis will typically identify. These are the direct cause, contributing causes and root

causes. Programmatic weaknesses are also often identified using root cause analysis techniques,

and may be determined to be either contributing or root causes of a human performance problem.

Apparent causes for an error may be identified by a licensee in problem reports for tracking and

trending purposes, but are not derived from applying a formal root cause analysis technique.

A direct cause is the action or condition immediately preceding an error in an event sequence

that caused or allowed the error to occur. For example, consider a situation in which an operator

silenced what he thought was a nuisance high radiation alarm from an air monitor that had a

history of spurious activations. Within a few minutes, however, it was discovered that the alarm

was valid when several other air monitors in the same area also alarmed. The error here was

failing to confirm whether the alarm was valid before silencing it. The investigation and analysis

in this example showed that the direct cause of the error (i.e., the reason that the operator did not

confirm the alarm’s validity before silencing it) was the operator's belief that the alarm was

invalid, based on its history of spurious activations. (Many other examples of typical direct

causes for human errors can be found in Part II of this document, the HPEP Cause Modules.)

A contributing cause is the actions or conditions that set the stage for a human performance

problem to occur, but, alone, were not sufficient to cause it. A contributing cause may be a longstanding condition or a series of prior events and problems that, while unimportant in

themselves, increased the probability of error. For example, consider again the operator who

silenced the high radiation alarm. In this case, the alarm’s history of spurious activation would
5-2

be a contributing cause for the error, because it set the stage for the error, but, alone, did not

cause it. Other operators at the site or at other plants might have assessed conditions in the area

monitored before silencing the alarm, so the alarm’s history contributed to the operator’s action

of silencing the alarm, but did not fully explain it.

A root cause of a human performance problem is the set of conditions that, if eliminated or

modified, would minimize the likelihood that the problem would reoccur as well as prevent

similar problems from occurring. A root cause is often responsible for multiple human errors or

hardware failures, rather than single problems. Root causes are more fundamental causes than

direct causes, affect a wider scope of work activities, are both necessary and sufficient to cause

the problem, and are often the results of programmatic weaknesses. In the case of the alarm

error, a deficiency in alarm response procedures, supervision or training may have allowed a

practice to develop of silencing alarms without verifying conditions. If so, weaknesses in the

procedures or training programs could be a root cause of the error and some other operators at

the plant, who use the same procedures or have received the same training, may be likely to

commit the same error. Weaknesses in immediate supervision, such as the failure to

communicate and enforce management expectations regarding alarm verification before

silencing, could also be a root cause of the error.

A programmatic cause is a deficiency in one of the licensee's programs for managing work

activities at a site that allows human errors to occur and may be the root cause of a single error as

well as an adverse human performance trend. Licensee programs, such as the procedures and

training programs, overtime policies and practices, or the fitness-for-duty program, are

implemented by management to create and maintain barriers to errors. When weaknesses exist

in these programs, or their implementation is flawed, the barriers to error they are intended to

maintain may be ineffective. In the alarm example discussed above, a failure to emphasize alarm

verification, even of nuisance alarms, in the operator training program would be a programmatic

cause of the operators error, as well as a possible root cause. Other examples of common

programmatic causes for human performance problems can be found in Part II of this document,

the HPEP Cause Modules.

Many licensees also identify apparent causes for human performance problems that are perceived

as having little individual significance but that will be tracked to enable monitoring of

developing trends. An apparent cause is typically an estimate of the direct cause of an event or

problem, based upon a limited investigation. An apparent cause is identified without using

standard root cause analysis techniques.

Using standard root cause analysis techniques is not a regulatory requirement. The licensee is

required under 10 CFR 50 Appendix B Criteria XVI to prevent the recurrence of “significant

conditions adverse to quality,” however, and many licensees have concluded that the use of

standard root cause analysis techniques is beneficial in understanding and correcting these

significant conditions. Licensees specify the criteria for determining significance, which may

include issues of risk, regulatory requirements and economic considerations. Other conditions

that are “adverse to quality,” but do not meet the licensee’s significance criteria, may be

assigned an apparent cause on the basis of a cursory investigation and without a formal root
5-3

cause analysis. In some cases, the licensee may elect to track these low-risk conditions and

monitor adverse trends for a larger number of similar conditions. If the trending indicates a

common or related cause for these conditions, then a root cause determination may be required

by the licensee’s policy or administrative procedures.

5.3 OVERVIEW OF ROOT CAUSE ANALYSIS TECHNIQUES

Root cause analysis relies to some extent on judgment. However, structured root cause analysis

techniques provide step-by-step procedures that can be repeated and verified. Clear

documentation of the analysis allows a reviewer to check its accuracy and completeness.

Several root cause analysis methods that may be used in licensee facilities are listed below:

• Events and causal factors analysis (to identify the events and conditions that led up to the

human performance issue)

• Change analysis (to identify changes in the work environment since the job was last

performed successfully that may have caused or contributed to the problem)

• Barrier analysis (to identify the barriers that, if present or strengthened, would have

prevented the human performance issue from occurring)

• Management Oversight and Risk Tree (MORT) analysis (to systematically check that all

possible causes of problems have been considered)

• Critical incident techniques (to identify critical actions that, if performed correctly, would

have prevented the event from occurring or would have significantly reduced its

consequences)

• Fault tree analysis (to identify relationships among events and the probability of event

occurrence)

In general, a root cause analysis repeatedly asks the question "Why?" about the events and

conditions that caused or contributed to the human performance problem.

Once the evidence has been gathered and the important causes for the human performance

problem have been identified, the root cause analysis then looks for any relationships among the

causes. The root cause analysis determines whether the causal factors demonstrate any order or

precedence, either in terms of time or scope of effect. If one causal factor preceded another in

time and affected it, or if a causal factor accounted for more than one of the human errors that

occurred in an event sequence or among those comprising an adverse human performance trend,

it is a candidate root cause. The goal of the analysis is to determine which causal factor(s), if

corrected, would prevent the recurrence of the same and similar errors. Events and causal factors

charting and analysis, change analysis and barrier analysis work well together to ensure that all

causal factors are identified.

5.4 EVENTS AND CAUSAL FACTORS CHARTING AND ANALYSIS

Events and causal factors charting and analysis is a method for organizing and analyzing the

evidence gathered during an investigation. An events and causal factors (ECF) chart graphically
5-4

displays the events and conditions associated with an occurrence (e.g., an error, a significant

event, a human performance problem) the user wishes to understand. In an ECF analysis, the

chart is used to identify the causal factors associated with the hardware failure or human

performance problem.

5.4.1 Events and Causal Factors Charting

An ECF chart is comprised of symbols that represent the important events and conditions that led

up to the hardware failure or human performance problem under investigation. An event in an

ECF chart is any action or occurrence that happened at a specific point in time relative to the

hardware failure or human performance problem under investigation. A condition is a state or

circumstance that affected the sequence of events in the ECF chart.

Some of the symbols that may be used for ECF charting are as follows2:

A rectangle is typically used to indicate an event. A brief

description of the event is written within the symbol as well

as the date and time at which the event occurred. Events are

arranged in a line in chronological order from left to right.

Events that are assumed to have occurred, but for which no

validated evidence exists or has yet been collected, may be

indicated by a rectangle outlined with dashed lines.

An oval is typically used to indicate a condition. A brief

description of the condition is written within the oval and

the condition is placed above the event it affected on the

chart.

A condition that is assumed to have existed, but for which

no validated evidence exists or has yet been collected, is

indicated by an oval outlined with dashed lines.

A diamond is used to indicate the occurrence of interest,

such as a significant event.

 

2

 The symbols used for charting are unimportant. Any symbol set or other method to differentiate among events,

conditions, causes and their inter-relationship, such as color-coding, may be used in the chart.
5-5

Arrows are used to connect events, and to connect

conditions to events.

An octagon may be used to indicate a causal factor and is

placed above the events or conditions it caused.

Triangles are used to connect event lines that must be

broken when, for example, the entire sequence of events

will not fit on a page.

An example of an ECF chart can be found in Figure 5-1. This example depicts a partially

completed ECF chart for an operational event in which the residual heat removal (RHR) system

was overpressurized during initial pressurization of the reactor coolant system (RCS) following a

refueling outage (NUREG/CR-5953, 1992).

Events and causal factors charting was developed to support the investigation of a single event.

It can also be used to identify human performance problems. Developing ECF charts for the

different errors that may represent an adverse trend and comparing them allows the detection of

patterns and similarities in the events and conditions associated with the different errors.

5.4.2 Events and Causal Factors Analysis

Analysis of the ECF chart begins after the investigation is completed, although the analysis itself

may raise additional questions that require further investigation. The analysis is performed to

identify direct, contributing and root causes for the hardware failure or human performance

problem of interest. The analysis consists of first identifying the significant events in the

timeline and then evaluating them by asking a number of questions about each one.

An ECF chart will often contain events that did not play a causal role in the human performance

problem under investigation, but must be included to “tell the story,” so that others can

understand what happened. These other events may be retained in the chart, but only the

significant events will be analyzed.

Identifying the significant events in the ECF chart starts with the event that came immediately

before the hardware failure or human performance problem of interest. To determine whether

this event is significant or not, the question is asked, “If this event had not occurred, would the

 A
5-6

 7:00 am 7:05 am 9:38 am

 9:20 am

Nightshift

completes fill

and vent

Venting 1-2

hrs. longer

than normal

Dayshift

starts RCS

pressurization

RHR Pump B

relief valve

lifts

PRT level

rises

Engineer

reports RHR

pressure high

Less gases in

SG U tubes

Operators

unaware of

pressure rise

PORV Lo-temp.

overpress. mode

inoperable

RCS press.

indicators

inoperable

Operators

unaware

RCS & RHR

pressurized

Operators

believe RCS

leaking

Operators not

monitoring

letdown or RHR

pump discharge

pressure

indications

Figure 5-1. Partial ECF Chart from March, 1990 RHR Overpressurization Event

RCS

pressure

exceeds

100 psig
5-7

failure have occurred?” If the answer to this question is, “Yes,” then the question is asked

whether the event represented a normal activity with the expected outcomes. If it was a normal

activity with the expected outcomes (e.g., the maintenance technician arrived at work, control

rods were inserted and the reactor scrammed), then it is not a significant event in the chart. If the

event had unplanned or unwanted consequences, then it is a significant event in the chart and

should be further analyzed by asking the following additional questions:

• What were the other events and conditions that led to the significant event?

• What went wrong that allowed the event to occur?

• Why did those conditions exist?

• Were other significant events necessary for the failure or problem to occur or would the

recurrent of this event alone lead to another failure or problem?

• Is the significant event linked to other events or conditions that may indicate a more

general or larger deficiency, such as a programmatic weakness?

For example, in Figure 5-1, the event in the chart that precedes the overpressurization was the

control room crew initiating system pressurization. Starting RCS pressurization is a significant

event in this timeline, because, obviously, RCS could not have overpressurized without it and

because initiating pressurization had unplanned and unwanted consequences.

The significant events in an ECF chart, and the events and conditions that were responsible for

them, are causal factors. A brief statement that summarizes the relevant characteristics of the

causal factor is added to the ECF chart above the significant event to which it applies. Figure 5-

2 shows the ECF chart for the overpressurization event with one causal factor added above the

conditions and event in the chart to which it applies.

When each significant event in the chart has been analyzed, relationships among the causal

factors may be revealed. For example, in some situations, several examples of training

weaknesses may be identified or the failure of one piece of equipment or system is found to have

caused several of the events in the chart. When common causes are found, they may indicate the

root cause of the problem under investigation.

5.5 CHANGE ANALYSIS

Changes in the work environment often result in unanticipated and unwanted consequences.

Change analysis involves systematically identifying and analyzing any changes that may have

affected the problem under investigation.

Many types of changes may lead to unwanted consequences. These could include, for example,

changes in

• the characteristics or number of workers involved in the task

• other work activities going on concurrently with the work activity of interest

• equipment condition or status

• the work location or the environmental conditions in which the work was performed
5-8

 7:00 am 7:05 am 9:38 am

 9:20 am

Nightshift

completes fill

and vent

Venting 1-2

hrs. longer

than normal

Dayshift

starts RCS

pressurization

RHR Pump B

relief valve

lifts

PRT level

rises

Engineer

reports RHR

pressure high

RCS

pressure

exceeds

100 psig

Less gases in

SG U tubes

Operators

unaware of

pressure rise

PORV Lo-temp.

overpress. mode

inoperable

RCS press.

indicators

inoperable

Operators

unaware

RCS & RHR

pressurized

Operators

believe RCS

leaking

Operators not

monitoring

letdown or RHR

pump discharge

pressure

indications

Figure 5-2. Partial ECF Chart from March, 1990 RHR Overpressurization Event with One Causal Factor Added

Work planning &

scheduling did not

ensure configuration

control
5-9

• supervision

• management expectations for the work.

Changes that may lead to an unwanted occurrence can be difficult to detect in advance because

change is pervasive. Change control processes, such as reviewing the safety implications of

planned changes, are one method to ensure that changes do not have a negative impact on safe

operations. Formal reviews or risk analyses sometimes miss important conditions, however.

There also are many avenues for introducing changes to the work environment that do not appear

to be sufficiently risky to warrant formal review.

Change analysis for human performance problems is most effective when the same work activity

has been performed successfully in the past, when the work activity and conditions under which

it was performed were documented or can be reconstructed, and when procedures for performing

the work are available. Change analysis can also be performed by comparing the work activity

under investigation to how the work activity is successfully performed at other sites, or to “ideal”

situations as documented in standards and regulations.

The first step of a change analysis is to define the “event-free situation” and compare it to the

situation in which the “event” under investigation occurred. The “event” may be any hardware

failure, human error or human performance problem. The “event-free” situation is a comparable

situation in which the hardware did not fail or the work activity was performed successfully.

Once the “event” and “event-free” situations have been identified, they are analyzed to determine

the specific differences between them. The impact of each difference on the event is then

evaluated to determine whether the change was unimportant or was a direct, contributing, root

and/or programmatic cause of the problem.

Table 5.1 shows an example of a change analysis worksheet for the overpressurization event

discussed previously. The human error of interest is the operators’ failure to detect and control

the rapid rise in RCS pressure. As can be seen in Table 5.1, four changes from previous

occasions on which RCS pressurization activities were performed successfully were identified.

Evaluating the causal roles of these changes involves asking, for each change, whether or not it

meets the definition of a direct, contributing, root and/or programmatic cause, or did not play a

causal role in the error. In this example, the inoperability of the RCS pressure transmitters was

the direct cause of the error, because it was “the action or condition immediately preceding the

error in the event sequence that caused or allowed the error to occur.” If the RCS pressure

transmitters were operable, the crew would have detected the rapid pressure increase in time to

control it and prevent the transient. Evaluation of the roles of the other four changes, based on

the evidence available, indicates that they were contributing causes. That is, each of the changes,

alone, did not cause the error, but rather set the stage for it. It was the combination of these

additional changes with the inoperability of the RCS pressure indications that allowed the event

to occur.
5-10

Table 5.1 Example Change Analysis Worksheet for an RCS Overpressurization Event

Event Situation Event-Free

Situation Difference Effect on Event

RCS pressure instrument

transmitters isolated for

maintenance

RCS pressure indicators

operable

No accurate indications

of RCS pressure were

available

Operators were unable to

monitor RCS pressure

Fill and venting of reactor

head extended

Fill and vent evolution

completed within normal

time limits

Venting continued 1-2

hours longer than

normally

The longer vent and fill

evolution decreased the

volume of gases in the steam

generator (SG) U tubes

Reduced volume of gases

in SG U tubes caused by

longer vent time

Greater volume of gases

in SG U tubes

Reduced amount of noncondensable gases

caused RCS pressure to

increase sooner than in

previous refill operations

RCS pressure rose sooner

then expected and

approached 100 psig within

2.5 hours of initiating

pressurization

Operators were

monitoring the inoperable

RCS pressure gauges, but

not all available pressure

indications (e.g., letdown

and RHR discharge pump

pressure gauges)

Operators monitored all

available pressure

indications

Operators did not detect

indications of the rapid

pressure increases on the

letdown and RHR

discharge pump pressure

gauges

An opportunity to detect the

pressure rise and prevent the

overpressurization was

missed

5.6 BARRIER ANALYSIS

The barrier analysis technique can also be used to identify causes for human performance

problems. The purpose of a barrier analysis is to identify the barriers to error that were missing,

bypassed or failed and their causal roles. Barrier analysis also shows the barriers that succeeded

and prevented the problem from having more serious consequences.

Barrier analysis is based on the concept that hazards represent potentially harmful energy flows

or environmental conditions from which targets (i.e., personnel and equipment) must be

protected. Hazards to personnel may include, for example, radiation, electrical energy, chemical

and biological agents or adverse environmental conditions. Hazards to equipment may include

human error, damage from wear and tear or natural phenomena.

A barrier is any means used to protect targets from hazards. There are two basic types:

physical and management barriers. Examples of typical physical barriers used in industrial

settings to protect personnel are fences, guardrails around moving equipment, protective clothing

and safety devices. Management barriers used to protect equipment in nuclear licensee facilities
5-11

include preventative and corrective maintenance as well as supervision, training, the design of

the human-system interface or procedures to reduce the likelihood of damage from human error.

The barriers that could or should have been in-place and how they should have functioned can be

identified from subject matter expertise, knowledge of industry good practices, licensee policies

and procedures, design basis documents and regulations.

A barrier analysis is performed in five steps. The first step is to identify the hazard and target.

The second step is to identify all of the barriers that could have protected the target from the

hazard. The third step is to evaluate how each barrier performed. That is, did the barrier succeed

or fail? For barriers that failed, the fourth step is to determine why they failed. Finally, the

causal role of each barrier is evaluated to determine whether it was a direct, contributing, root

and/or programmatic cause.

This technique is particularly useful in providing the basis for developing corrective actions to

prevent the same or a similar problem from happening again. Corrective actions can strengthen

existing barriers that failed or erect barriers where they are missing.

Table 5.2 shows an example of a barrier analysis worksheet for the RCS overpressurization

event. In this example, the hazard would be pressure and the target would be the catastrophic

failure of the reactor coolant or residual heat removal system piping.

Evaluating the causal role of each failed barrier involves asking whether or not it meets the

definition of a direct, contributing or root cause, or did not play a causal role in the error. In this

example, the inoperability of the RCS pressure transmitters again meets the criterion for the

direct cause of the error, because it was “the action or condition immediately preceding the error

in the event sequence that caused or allowed the error to occur.” Further, if the RCS pressure

transmitters were operable, two additional physical barriers would not have failed: the poweroperated relief valves (PORVs) low-temperature overpressure protection and the computer

alarm. Because the failure of these barriers was dependent upon the RCS pressure transmitters

being inoperable, they are contributing causes of this event.

As can be seen from this example, barrier analysis is an effective method to begin identifying

programmatic causes as well as potential corrective actions. For example, had the RCS pressure

indicators been tagged out-of-service, it is unlikely that the operators would have started RCS

pressurization activities until these indications were available. The station’s policy of excluding

control room instrumentation from the tagout program indicates that the scope of the tagout

program may have been a programmatic weakness that, if corrected, could have prevented this

event and other, similar events. However, responsibility for configuration control lies with the

work management program. Had the work planners (or an independent review) recognized that

the RCS indicators were not available for initial RCS pressurization and ensured that they were,

the rate of the pressure rise and the operators’ focus on the three RCS indicators would not have

mattered because accurate pressure indications would have been available to detect and control

pressure. Therefore, the startup procedure and the operators’ status monitoring were contributing

causes to the event, but not root causes. Further investigation of the work management program
5-12

Table 5.2 Example Barrier Analysis Worksheet for Overpressurization Event

Hazard: Pressure Target: Catastrophic failure of system piping

Physical Barriers Performance Why Did it Fail? Effect on Event

RCS pressure instrument

transmitters

Failed Out of service for

maintenance

RCS pressure indicators

inoperable so operators could

not detect rapid pressure rise

Power-operated relief

valves (PORVs) lowtemperature overpressure

protection

Failed The two wide-range RCS

pressure instruments were

the sensors for the PORV

low-temperature overpressure protection mode

PORV low-temperature overpressure protection

unavailable

RHR Pump B suction

relief valve

Succeeded in stopping

uncontrolled pressure

rise

Maintained pressure below

limits – prevented

catastrophic failure of RHR

piping

Pressurizer relief tank

(PRT) level indication

PRT level increased

when RHR suction

relief valve opened

Succeeded in alerting

operators to problem situation

Annunciators Missing RHR pressure did not reach

alarm actuation setpoint and

computer alarm came off the

inoperable pressure

transmitters

No audible indications of

pressure rise

Management

Barriers Performance Why Did it Fail? Effect on Event

Startup procedures Did not control RCS

vent evolution

Fill and vent procedure did

not specify a time limit for

venting gases from reactor

head

Night shift extended the RCS

vent evolution 1-2 hours

longer than normal, reducing

the volume of gases remaining

in the SG U tubes

Work management

(planning and

scheduling)

Failed Work planners overlooked

the need for the RCS

pressure instruments to be

operable before initial

pressurization of the RCS

Pressurization was initiated

without RCS pressure

indications operable

Independent review Missing Not performed or required Failed to identify the RCS

pressure instrument isolation

Tagging out-of-service

control room instruments

Missing Tagging of out-of-service

instruments in control room

not required by tagout

program

There was no visual cue that

the three RCS pressure

indicators were inoperable

Systems monitoring Inadequate Operators were focused on

the RCS pressure indicators

and were not monitoring all

pressure indications

available

Operators did not notice other

indications of the pressure rise

that indicated RHR, CVCS

and RCS were pressurized
5-13

would be necessary to identify the specific weaknesses that allowed this event to occur, as well

as the corrective actions necessary to strengthen the program. However, flaws in the work

management program appear to have been the root cause of the operators’ error in this event.

5.7 COMBINING TECHNIQUES

Practical experience has shown that different root cause analysis techniques provide different

perspectives on an event. As a result, using a combination of methods ensures that a more

complete set of causal factors is identified.

Because different root cause analysis techniques ask different questions about a human

performance or hardware problem, the causes that are identified may differ. Compare, for

example, the differences in the causal factors above that resulted from the change and barrier

analyses for the overpressurization event. For the overpressurization event, the barrier analysis

yielded a larger number of causal factors and led to the identification of the root causes of the

event. For other events, changes may be the key causal factors and barrier analysis used alone

may not identify them.

No matter which root cause analysis techniques are used by a licensee, the purpose of the

analysis is to identify the causal factors that, if corrected, would minimize the likelihood that the

same and similar “significant conditions adverse to quality” will occur again. The effectiveness

of a problem identification and resolution program rests less on the root cause analysis

techniques used than on the thoroughness of the investigation conducted, assurance that the key

causal factors have been identified, and the development and implementation of the corrective

actions suggested by the analysis.
6-1

6 EVALUATING CORRECTIVE ACTION PLANS

6.1 INTRODUCTION

An effective corrective action for a human performance problem is one that will minimize the

likelihood of the problem happening again. Developing effective corrective actions for human

performance problems requires a thorough root cause analysis and an understanding of methods

for enhancing human performance.

In this section, background information for evaluating corrective actions plans is presented. The

different types of corrective action plans and issues in implementing them are discussed.

6.2 CORRECTIVE ACTION PLAN SCOPE

Corrective action plans, which incorporate corrective actions for human performance problems,

vary in scope. The scope of the plan is determined by the significance of the error or adverse

trend as well as the extent of the conditions created by the causal factors identified. Three types

are described below.

The broadest type is a general organizational improvement plan. This type of plan usually

involves all or a large number of the work groups at a site and, sometimes, corporate

headquarters. Its purpose is to make significant changes in how work is done and how it is

managed in order to improve operational performance and to reverse declining performance

trends. Corrective actions may address problems in any aspect of plant operations, such as

• changing the organizational structure

• changing managers’ spans of control

• improving manager capabilities and competence

• improving worker training and qualification programs

• revising the hierarchical family of vision, goals, objectives, policies, programs, processes,

procedures and practices.

General organizational improvement plans are typically required to correct a safety culture

problem in an organization.

An intermediate scope corrective action plan focuses on adding to or strengthening the

programs that are responsible for maintaining barriers to human performance problems. Typical

programs that are implemented to maintain barriers to error are:

• programs for developing procedures, keeping them updated and requiring their use for

certain jobs

• human resources programs for selecting and promoting personnel

• behavioral safety programs such as STAR (Stop, Think, Act, Review)
6-2

• human-system interface design programs, such as the program responsible for ensuring

that labels on parts and equipment are accurate and legible

• management systems for defining and organizing work flow

• quality control programs.

Limited scope corrective action plans focus on fixing the direct cause of an error. These plans

add or strengthen specific barriers.

Corrective actions to add new barriers might include:

• writing a procedure for a task that previously depended on “skill of the craft”

• moving personnel with operations experience into the work planning group

• developing a new training module for maintenance workers, or

• replacing an analog display with a new digital display that is more accurate and easier to

read.

Corrective actions to strengthen existing barriers could be redesigning an existing training

module or adding a requirement for a supervisor to be present when a particular job is

performed. Most limited corrective action plans use a combination of adding new and

strengthening existing barriers.

Sometimes correcting the direct cause of an error will prevent that specific error from recurring

but fail to prevent similar errors. For example, if the direct cause of an error was an ambiguous

procedure step, fixing that one step may stop others from making the same error when

performing that step. But fixing that step in the procedure will not correct other ambiguous steps

in the same procedure or in other procedures. If the ambiguous steps have the same root cause,

such as a procedure writer in need of additional training, the root cause must be corrected to

prevent future errors due to poorly written procedure steps.

Corrective action plans must also address any adverse conditions that were created by a human

performance problem, based upon the assessment done of the extent of the conditions created by

a causal factor. For example, if an instrument is miscalibrated and the cause is determined to be

an error in a miscalibration procedure, the corrective action plan must include actions not only to

ensure that the instrument is re-calibrated correctly, but also that other instruments governed by

the same procedure are also calibrated correctly.

The appropriate scope of a corrective action plan depends upon the nature of the causal factors

identified in the root cause analysis, their scope and the risks they pose. Licensees may use

probabilistic risk assessment or human reliability analysis methods to choose among corrective

action alternatives.
6-3

6.3 ACCOUNTABILITY FOR HUMAN PERFORMANCE

Some corrective actions in a corrective action plan may focus on the individual worker who

committed an error. These corrective actions may include, for example, remedial training,

participation in the investigation and root cause analysis, loss of qualification for a period of time

and/or time off work.

Corrective actions that focus on the individual worker are often ineffective. Routinely placing

responsibility for errors on the individual workers adversely impacts a licensee’s safety culture

and may discourage personnel from reporting errors or raising concerns. A “blame the worker”

approach to human performance may result in adversarial relations between workers and

supervisors, which will hinder effective communication and teamwork. On the other hand, it

may be appropriate to hold workers accountable for errors if they have been provided with the

necessary resources to perform their tasks correctly. These resources include relevant training,

usable and technically accurate procedures, well-designed tools and equipment, accurate

drawings, labels on equipment and other operator aids, and clearly defined and specific

management expectations for performing each task. Industry experience has shown that

improving human performance requires balancing the organization’s responsibility for providing

personnel with the tools and resources they need to accomplish their tasks with individual

accountability for performance to reasonable standards.

6.4 CORRECTIVE ACTION PLAN COMPLETENESS

An important requirement for corrective action plan effectiveness is completeness. A complete

corrective action plan addresses each of the causal factors that were identified from the root

cause analysis. In some cases, a single corrective action may address more than one causal

factor. For example, if a root cause analysis has identified several weaknesses in work planning

and scheduling, the licensee may decide to re-engineer the entire work management program.

Often, several corrective actions may be developed to address one causal factor. More than one

corrective action may be required because the causal factor is complex or the licensee wishes to

ensure there is “defense-in-depth” against a recurrence of the human performance problem.

6.5 PLAN IMPLEMENTATION AND EFFECTIVENESS

Corrective action plans that appear to have an appropriate scope and to be complete may be

ineffective when they are implemented. Corrective action plan implementation may be

ineffective for several reasons.

A common reason that corrective action plans fail is that detailed information from the problem

investigation and root cause analysis is not communicated to those who are assigned

responsibility for developing and implementing the corrective actions. The detailed information

about the human performance problem that has been collected is usually not recorded in the

investigation report or presented in a briefing. Further, information collected about human

performance problem may include sensitive personnel matters that are not documented. A
6-4

detailed understanding of the human performance problem is necessary for corrective action

effectiveness, however, because these problems are typically complex with multiple, interacting

causes. Ensuring that the individuals involved in investigating and analyzing human

performance problems work closely with the personnel responsible for the corrective action

plans improves the likelihood that the plans will be effective.

Other commonly identified reasons for ineffective corrective action plans are:

• Responsibility not assigned. Responsibility for developing, implementing and

monitoring the effectiveness of corrective actions may not be assigned to specific

individuals who are held accountable for them. Responsibility for corrective actions

may be assigned to a department or to “management,” rather than to individuals who

have the expertise, authority and resources to ensure they are implemented.

• Staffing changes. Personnel change jobs and the individuals who developed and

began implementing a corrective action plan may move on to other positions. The

information they had about the basis for a corrective action plan may not be

communicated to their successors.

• The steps for achieving the plan’s objectives are not defined. Some corrective

action plans define the goals to be achieved, but not the steps required to achieve

them. Corrective action implementation is typically most effective when project

management techniques are used, such as defining milestones and deliverables, a

project schedule, the resources required, and so on.

• Competition for resources. Other management initiatives and events arise that take

precedence over implementing the corrective actions.

• Measurement. Corrective action plans may fail because measures for determining

the success of the corrective actions were not defined and used to refine the plan

when necessary.

• Unintended consequences. Corrective actions may have unforeseen, unintended

consequences that cause them to fail.

For human performance problems that have a relatively high risk significance, the licensee may

schedule effectiveness reviews for the corrective action plan that was implemented. Corrective

action effectiveness reviews are analyses of whether the corrective actions in a plan have

worked as intended. They are typically scheduled weeks or months after a corrective action has

been implemented and has had time to demonstrate an effect. The schedule for conducting

effectiveness reviews and the measures of effectiveness that will be used may be included in the

initial corrective action plan.
6-5

6.6 CONCLUSION

The most important test of a corrective action plan is whether it succeeds in minimizing

recurrence of the human performance problem it is designed to address. As discussed in Section

3, however, the recurrence of a problem behavior does not necessarily indicate that a corrective

action plan is ineffective because the same behavior can result from many different causal

factors. The corrective action plan may have been effective in controlling one cause for a

particular behavior, but other causes may still exist. These other causes could not have been

identified in the investigation and analysis because they did not play a role in the original

problem. Investigation and causal analysis of the recurrent problem behavior would be

necessary to determine whether the corrective action plan for the initial problem was ineffective

or whether the recurrent problem is due to other causes that would then need to be addressed.
7-1

THE HUMAN PERFORMANCE EVALUATION PROCESS

Part II: The HPEP Cause Tree and Modules
7-2

7 OVERVIEW OF THE HPEP CAUSE TREE AND MODULES

7.1 INTRODUCTION

Part II of the Human Performance Evaluation Process (HPEP) is comprised of the HPEP Cause

Tree and Modules. The HPEP Cause Tree is a screening tool for identifying the range of

possible causes for a human performance problem. The Cause Modules discuss typical causes of

human performance problems in nuclear licensee facilities and provide examples of frequently

identified direct and programmatic causes, based upon the research literature and industry

experience.

The Cause Tree and Modules are not a complete list of all possible causes for human errors. In

practice, the evidence that is collected in an investigation and the results of causal analyses are

necessary to determine an error’s actual cause(s). The primary value of a list of possible causes,

such as those presented here, is that it prompts consideration of a range of causes. Used as a

checklist, the Cause Tree and Modules assist in overcoming the tendency to arrive at conclusions

too early in an investigation or to only investigate the possibilities that are initially suggested

when an error is committed. Thus, the Cause Tree and Modules are intended to be used

heuristically, but the possible causes that are investigated must be derived from the evidence.

7.2 USING THE CAUSE TREE AND MODULES

Part II is for use by inspectors to verify the causes that a licensee has identified for human

performance problems in order to complete Table 2.3, Causal Analyses, in Part I. The HPEP

Cause Tree and Cause Modules may also be used as guidance in conducting an event

investigation and to identify a human performance trend.

7.2.1 Verification

The HPEP Cause Tree and Modules are intended to assist in evaluating a licensee’s causal

analyses of human performance problems. In general, a causal analysis that is complete and

valid will also be reliable. That is, it will yield similar results when repeated by another

individual or team, although the specific terminology used to describe the cause(s) will likely

differ. By answering the questions in the Cause Tree and reviewing the information in the

appropriate Cause Modules, the inspector could verify that the evidence the licensee has gathered

supports the causes identified and that other plausible causes can be ruled out.

To verify the licensee’s conclusions, the inspector may (1) use the information available in the

licensee’s documentation of the investigation or collect evidence independently, (2) answer the

questions in the Cause Tree and then (3) review the information in the appropriate Cause

Modules to determine whether or not the licensee correctly identified the causes of a human

performance problem. If the inspector arrives at direct and programmatic causes that are similar

to those documented by the licensee, based upon the same evidence, it is likely that the licensee

has accurately identified the causes for the human performance problem. If the inspector arrives

at different direct and programmatic causes, then the Cause Modules may be used to identify

additional information to request from the licensee. Or, the inspector may use the Cause
7-3

Modules to determine the lines of inquiry for an independent investigation. In most cases,

discrepancies between the inspectors’ cause(s) and the licensee’s will be resolved on the basis of

the evidence.

7.2.2 Conducting an Independent Event Investigation

If an inspector or NRC inspection team is conducting an independent event investigation, the

Cause Tree and Modules can be used to understand the human errors that occurred in the event.

The Cause Tree and Modules may be used to identify promising lines of inquiry to explore in the

investigation. They may also serve as a checklist to ensure that possible causes for the error(s)

have not been overlooked.

The Cause Tree will streamline an investigation by directing inspectors to the most likely causes

of an error. Further evidence can then be collected regarding a specific cause to support the

causal analysis. The lists of possible direct and programmatic causes within the Modules may be

used to develop the specific lines of inquiry. For example, the Cause Tree would prompt

inspectors to ask, “Were there weaknesses in the procedures used to perform the task?” If the

answer were “yes,” then the Procedures Module in Section 11 would prompt the investigators to

further ask, “What were the procedural weaknesses and did they cause or contribute to the error?

Were there systematic weaknesses in the procedures or another program that allowed these flaws

in the procedure to exist? Are other licensee procedures similarly affected?”

As the investigation matures, the Cause Tree and Modules can be reviewed again to verify that

potential causes have not been overlooked. Often the evidence that is gathered indicates that

different causes than originally identified should be investigated. Repeated reference to the

Cause Tree and Modules during the course of an investigation may help to assure that the

investigation is complete and that sufficient evidence has been gathered to support the team’s

conclusions.

7.2.3 Identifying a Human Performance Trend

The Cause Tree and Modules may also be helpful in identifying a human performance trend. A

human performance trend may be indicated if one cause category, such a procedures or

supervision, is repeatedly identified by the licensee in a sample of problem reports, or appears to

the inspector to be implicated in numerous problem reports.

To verify that a human performance trend has developed, however, it is important that the human

errors are investigated and analyzed sufficiently to identify the direct and programmatic causes

with some confidence. By definition, a human performance trend is a pattern of related errors

resulting from the same causal factor. Therefore, licensee reports of the apparent causes of an

error may be suggestive, but even a large number of reports citing a particular cause category do

not establish the existence of a human performance trend unless the direct and programmatic

causes of the errors are known.
7-4

7.3 ORGANIZATION

The HPEP Cause Tree is presented in Figure 7-1. The HPEP Cause Modules are presented in

Sections 8 through 18. The Cause Tree asks a series of questions about the conditions

surrounding a human error of interest. Based upon the answers to those questions, the inspector

is referred to the appropriate Cause Modules. Each Cause Module is comprised of causal factors

that have been found to affect human performance in the workplace as follows:

Personnel – These Cause Modules discuss characteristics that individual workers bring to the

job that may affect task performance, such as

Section 8: Fitness for Duty

Section 9: Knowledge, Skills and Abilities

Section 10: Attention and Motivation

Resources – These Cause Modules discuss characteristics of the resources available to personnel

to assist in performing their tasks, such as

Section 11: Procedures and Reference Documentation

Section 12: Tools and Equipment

Section 13: Staffing

Section 14: Supervision

Work Environment – These Cause Modules discuss characteristics of the work environments in

which personnel perform tasks, such as

Section 15: Human-System Interface

Section 16: Task Environment

Communication and Coordination – These Cause Modules discuss characteristics of the

human interactions required to perform a task correctly, such as

Section 17: Communication

Section 18: Coordination and Control

Within each Cause Module, background information is presented regarding the effects of each

causal factor on human performance and examples of typical direct and programmatic causes for

errors are listed.
7-5

Personnel

Resources

Work

Environment

Communica-

 tion and

Coordination

No

No

No

No

No

No

No

No

No

No

No

No

No

No

Were the

personnel capable

of performing the

task correctly?

Were they fit for duty?

Did they possess the

required knowledge, skills

Were they paying attention and abilities?

and motivated to perform

correctly?

Did the necessary

human

interactions

occur?

 Were communications

effective?

Were the right

resources

provided to

perform the task?

Were procedures and

reference documents

Were necessary tools, accurate, available, used?

equipment and PPE

available and used?

Was the number of staff

assigned appropriate for

the task?

Could the task be

performed easily

in the work

environment?

Did the human-system

interface meet information

and control needs? Were environmental

conditions within

expected/comfortable

limits?

Was the type and amount

of supervision appropriate

for the task?

8. Fitness for Duty

9. KSAs

10. Attention/Motivation

11. Procedures

12. Tools/Equipment

14. Supervision

13. Staffing

15. HSI

16. Task Environment

17. Communications

Was the work planned, No

scheduled and coordinated

effectively?

18. Coordination/Control

Figure 7-1 The HPEP Cause Tree
8-1

8 FITNESS FOR DUTY

8.1 ERRORS RELATED TO FITNESS FOR DUTY

Successful task performance requires that the capabilities workers bring to the task fall within an

expected range. Impairment, or a reduction in an individual’s mental or physical capabilities

due to substance abuse, fatigue, illness or stress, increases the likelihood of errors. Types of

possible impairments and their likely consequences for task performance are discussed below.

8.1.1 Drug and Alcohol Use

The use of some drugs and alcohol on the job or within several hours of reporting to work may

adversely impact human performance. Extensive information about the effects of different drugs

on task performance, including prescription and over-the-counter (OTC) drugs, has been

published elsewhere (see Section 8.4 of this Module below). This information is briefly

summarized here.

8.1.1.1 Marijuana

The use of marijuana has several effects that may adversely impact task performance. Marijuana

use decreases the ability to process both auditory and visual stimuli, so may affect, for example,

an individual’s ability to read and follow procedures correctly or to correctly process verbal

instructions. It also reduces an individual’s attention span. Other effects include impaired social

behavior and reduced retention and recall of information. Marijuana use also affects motor

performance. It slows reaction time, decreases motor steadiness and manual dexterity, and

reduces eye-hand coordination.

8.1.1.2 Stimulants

Drugs that are stimulants include caffeine, cocaine and amphetamines. Some OTC medications

also contain stimulants, such as pseudophedrine, which is commonly used in cold and allergy

medications. In small amounts, stimulants generally improve both cognitive and motor

performance. For example, attention span is increased, vigilance is improved and reaction time

is faster. Larger doses or chronic use adversely affect performance in all areas.

8.1.1.3 Depressants

Central nervous system depressants include the opiates, barbiturates, sedatives, the minor

tranquilizers and alcohol. In general, higher doses are associated with significant cognitive and

motor performance impairments. At lower doses, the effects depend upon the specific drug used,

body weight and the extent to which the user has become habituated to it. For example, eyehand coordination and performance of complex tasks will be adversely affected by barbiturate

use, but typically are not affected by the minor tranquilizers. Use of drugs in this class will often

cause drowsiness when they are first taken, but this effect decreases with continued use.

Depressants cause disruptions in auditory and visual information processing, impair learning and

recall, and reduce attention span.
8-2

8.1.1.4 Hallucinogens

Hallucinogens, by definition, are drugs that distort sensory perception, thought processes and

behavior. There are four subclasses: anticholinergics (these are rare), catechols (e.g., peyote,

mescaline, MDA), indoles (e.g., LSD, psilocybin), and anaesthetics (e.g., PCP). The

anticholinergics are highly toxic and not of concern in the workplace. The catechols distort

perception of light, color, space and shapes, and increase alertness. They are not associated with

memory loss, but may cause muscle spasms in large doses. The indoles primarily cause mood

and sensory perception changes leading to altered senses of time, space, touch and color. Vision

and hearing are impaired and motor functions decline. At higher doses of indoles, the user may

experience euphoria, fear, hostility and confusion. Anaesthetics cause confusion, distorted

spatial awareness, aggression, trouble breathing and numbed nerves.

8.1.2 Fatigue

Fatigue has been shown to impair both cognitive and motor performance with an important

adverse effect on alertness. Fatigue decreases the ability to process complex information such as

that presented by unusual plant conditions. In addition, fatigue may increase reaction time, and

impair recall and decision-making. As fatigue increases, performance is increasingly impaired

and shows greater variability.

There are many factors that may cause fatigue. These include the amount of time spent working

on a single task, sleep disorders and deprivation, and the effects of circadian rhythms or their

disruption. For example, long periods of time performing a single physical task will cause

muscles to become fatigued so that they are less easily controlled and errors are more likely.

Sleep disorders and sleep schedules that do not allow sufficient deep sleep will adversely affect

cognitive and motor performance and, over time, individuals will accumulate a “sleep debt.”

That is, most working-age adults require about eight hours of sleep on a regular schedule to

maintain optimum alertness, mood and performance levels. If sleep is ineffective or insufficient,

impairments will be seen during the next waking period. If sleep is ineffective or insufficient for

an extended period, the impairments will be cumulative.

Task performance and alertness are also affected by circadian rhythms. Circadian rhythms are

also known as “biological clocks” and are patterns in physiological functioning over the course

of a day. Sleepiness, for example, typically is at a peak between 3 a.m. and 5 a.m. with another

increase occurring between 3 p.m. and 5 p.m. When an individual’s daily schedule is changed

by a change in shift schedule or travel to a different time zone, circadian rhythms are disrupted

and performance decrements will occur until a new pattern is established.

8.1.3 Emotional Stress

Stress is an internal psychological and physiological response to threatening events or conditions

that require unusual changes in behavior or adaptation. The amount of stress an individual

experiences in any given context increases when the individual perceives that the demands of the

situation are perceived as exceeding his or her capabilities to cope.
8-3

Because a stress response depends upon the individual’s appraisal of his or her ability to cope

with the situation, individuals will differ in the events and conditions that they experience as

stressful. Common sources of potential emotional stress include interpersonal conflicts at home

or on the job, grief and loss, unpredictability in one’s personal or work life, and any events at

home or at work that reduce self-esteem.

Stress may impair task performance in several ways. Personnel may become distracted and

unable to focus on the task and so commit errors. Or, stress may cause a worker to become too

focused on one aspect of a task to the exclusion of others or have difficulty determining when

and how to act. Physiological stress responses may also reduce fine motor coordination. If

stress persists over a long period of time, it can cause physical and mental illnesses.

Stress may also adversely affect team performance. Team members typically communicate less

under stressful conditions and may fail to exchange information needed to succeed at a task. Or,

team members may lose sight of team goals and focus instead on their personal goals and needs.

Experience with a stressor reduces the stress response. Successful past experiences in surviving

stressful events and conditions increase an individual’s confidence in his or her ability to cope,

so that less stress is experienced when similar situations are encountered again.

8.1.4 Illness

Physical and mental illnesses may also cause errors. The effects of physical illness on cognitive

and motor performance depend upon the nature of the illness itself. Most physical illnesses are

accompanied by fatigue. Some may cause stress. Similarly, the effects of mental illnesses

depend upon the nature of the illness and the extent to which symptoms are controllable (and are

controlled) with medication.

8.1.5 Combinations of Factors

The effects on performance of combinations of these impairment-causing factors may be

synergistic and they may also interact with other conditions in the workplace. For example,

fatigue may increase the experience of emotional stress. Or, physical illness may reduce an

individual’s tolerance for environmental conditions, such as heat or noise.

8.2 DIRECT CAUSES OF FITNESS-FOR-DUTY-RELATED ERRORS

A direct cause of an error resulting from personnel impairment describes characteristics of the

impairment that caused task performance to fail. There are a number of ways in which

impairment may cause or contribute to an error. These include:

Substance use – Personnel capabilities were reduced by the use of drugs or alcohol prior

to or during working hours, resulting in errors.

Excessive consecutive work hours – Personnel became fatigued because of working too

many consecutive hours or working too long on the same task. As a result, for example,

mental fatigue due to long hours performing a repetitious task without rest breaks caused
8-4

a momentary lapse in monitoring of indications with the result that a safety parameter

was exceeded.

Inadequate rest – Excessive overtime with insufficient time off-duty created a “sleep

debt.” As a result, for example, personnel vigilance was reduced and changes to

parameters were not detected.

Circadian rhythms – An individual’s circadian rhythms were disrupted by scheduled

changes, such as shift rotation or jet lag. Or, capabilities were reduced because task

performance occurred during a natural “trough” in physiological functioning. As a result,

for example, steps were performed incorrectly during a task because the worker did not

recall the correct action sequence.

Emotional stress – Events or conditions in an individual’s personal or work life affected

the individual’s task focus or motor coordination.

Illness – Worker capabilities to perform a task were reduced by the symptoms of physical

or mental illness that were not controlled by medication. For example, judgment and

decision making may be impaired, leading to errors.

Combination of impairments – Combinations of impairing factors reduced worker

capabilities, leading to errors.

8.3 PROGRAMMATIC CAUSES OF FITNESS-FOR-DUTY ERRORS

Barriers to fitness-for-duty-related errors include licensee programs for the detection and

prevention of potential or actual impairment, as well as the individual responsibility of

workers to decline assignments if they are impaired for any reason. The latter barrier is a

weak one, however, because humans are generally over-confident of their capabilities when

under the influence of drugs or alcohol, or are stressed, fatigued or ill. Other factors that

may discourage self-reporting include the fear of losing access authorization, an operating

license or extra income from overtime. Licensee programs that may be implicated in errors

caused by personnel impairment include:

Access Authorization – This program is responsible for assuring that individuals

with access to special nuclear materials are reliable and trustworthy. Psychological

examinations and background investigations are two of the techniques used.

Weaknesses in this program may allow impaired individuals to have unescorted

access to vital areas in a plant.

Fitness-for-Duty – Licensee fitness-for-duty programs are primarily responsible for

detecting and preventing impaired personnel from performing tasks that may affect

public health and safety. Medical evaluations of personnel, behavioral observation

programs, employee assistance programs and drug and alcohol testing are used to

detect impairment. Weaknesses in this program may allow impaired personnel to

have access to vital areas in a plant where they could commit errors.
8-5

Operator Licensing – NRC requirements for obtaining and maintaining an operating

license also include medical and psychological examinations to screen for potential

health conditions. Weaknesses in this program may set the stage for health

conditions to adversely affect an operator's ability to perform his or her tasks.

Overtime Policies and Practices – The NRC issued Generic Letter 82-12 that

provides guidance for limiting work hours to reduce on-the-job fatigue and the

potential consequences for task performance. Licensee Technical Specifications and

administrative procedures also define work-hour limitations. Routine authorization

for work hours in excess of those recommended may result in fatigued workers.

Further, a practice of excluding training or meetings that occur outside of an

individual’s normal work schedule from work-hour limitations will also contribute to

fatigue.

Shift Scheduling – Shift scheduling may also affect the likelihood that personnel will

show performance decrements due to fatigue. A change in the assigned shift or a

rotating shift schedule will disrupt circadian rhythms and may increase the likelihood

of errors.

Safety Culture – The effectiveness of self-reporting and behavioral observation programs

depends greatly upon the safety culture at a site. For example, if self-reporting of

impairment or reporting an impairment concern about another staff member consistently

results in disciplinary action, then supervisors and workers may be reluctant to report

other staff members who appear to be impaired. On the other hand, if individuals who

have come to work under some form of stress are treated fairly and with concern,

personnel will report more frequently. If the licensee’s culture emphasizes safety over

other goals, personnel may be willing to turn down overtime and monitor their own

fatigue levels, even if turning down the opportunity results in a loss of income.

8.4 ADDITIONAL RESOURCES ON FITNESS FOR DUTY

• U.S. Code of Federal Regulations, Part 11, Criteria and procedures for determining

eligibility for access to or control over special nuclear material, Title 10, Energy (revised

periodically). Washington, DC: U.S. Government Printing Office.

• U.S. Code of Federal Regulations, Part 26, Fitness for duty programs, Title 10, Energy

(revised periodically). Washington, DC: U.S. Government Printing Office.

• U.S. Code of Federal Regulations, Part 55, Operators licenses, Title 10, Energy (revised

periodically). Washington, DC: U.S. Government Printing Office.

• U.S. Code of Federal Regulations, Part 73, Physical protection of plants and materials,

Title 10, Energy (revised periodically). Washington, DC: U.S. Government Printing

Office.
8-6

• U.S. Nuclear Regulatory Commission (1982). Nuclear power plant staff working hours

(Generic Letter 82-12). Washington, DC: U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1989). Fitness for duty in the nuclear power

industry: Responses to public comments (NUREG-1354). Washington, DC: U.S.

Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1989). Fitness for duty in the nuclear power

industry: Responses to implementation questions (NUREG-1385). Washington, DC:

U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1991). Nuclear plant staff working hours

(Information Notice 91-36). Washington, DC: U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1998). Medical evaluation of licensed personnel

at nuclear power plants (Regulatory Guide 1.134, Rev. 3). Washington, DC: U.S.

Nuclear Regulatory Commission.

• Baker, T. (1995). Alertness, performance and off-duty sleep on 8-hour and 12-hour night

shifts in a simulated continuous operations control room setting (NUREG/CR-6046).

Washington, DC: U.S. Nuclear Regulatory Commission.

• Barnes, V.E., Fleming, I., Grant, T., Hauth, J., Hendrickson, J., Kono, B., Moore, C.,

Olson, J. Saari, L., Toquam, J., Wieringa, D., Yost, P., Hendrickson,P., Moon, D and

Scott, W. (1988). Fitness for duty in the nuclear power industry: A review of technical

issues (NUREG/CR-5227). Washington, DC: U.S. Nuclear Regulatory Commission.

• Durbin, N., Moore, C. Grant, T., Fleming, T., Hunt, P., Martin, R. Murphy, S., Hauth, J.

Wilson, R., Bittner, A., Bramwell, A., Macauley, J., Olson, J., Terrill, E. and Toquam, J.

(1991). Fitness for duty in the nuclear power industry: A review of the first year of

program performance and an update of the technical issues (NUREG/CR-5784, PNL7795, BHARC-700/91/025). Washington, DC: U.S. Nuclear Regulatory Commission.

• Durbin, N. and Grant, T. (1996). Fitness for duty in the nuclear industry: Update of the

technical issues 1996 (NUREG/CR-6470, BSRC-700/96/004, PNNL-11134).

Washington, DC: U.S. Nuclear Regulatory Commission.

• Moore, C., Barnes, V., Hauth, J., Wilson, R., Fawcett-Long, J., Toquam, J., Baker, K.,

Wieringa, D., Olson, J., & Christensen, J. (1989). Fitness for duty in the nuclear power

industry: A review of technical issues (NUREG/CR-5227, Supplement 1, PNL-6652,

BHARC-700/88/018). Washington, DC: U.S. Nuclear Regulatory Commission.
9-1

9 KNOWLEDGE, SKILLS AND ABILITIES

9.1 KNOWLEDGE, SKILLS AND ABILITIES IN HUMAN PERFORMANCE

Many of the job positions at licensee sites require extensive and specialized KSAs for correct

task performance. Knowledge is a set of facts, factual information, a method of analysis or the

application of methods and facts to successfully perform a task. A skill is a motor or mental

capability such as the ability to open a valve or operate a controller. Ability is the combination

of knowledge and skills required to perform a task. Mastery is the process of achieving the

requisite KSAs to perform a job or task safely and competently.

A KSA deficiency is one of the more frequently identified causes for human error. There are

four basic ways in which an error may occur as a result of KSA deficiencies. These are:

• The worker did not receive training and so did not master the requisite KSA(s)

• The worker was trained, but the training did not result in KSA mastery

• The worker was trained and mastered the KSA, but did not retain it over time

• The worker mastered the requisite KSA, but did not apply it to the task.

The potential risk impacts of personnel performing tasks without the requisite KSAs are the basis

for NRC and industry efforts to improve training programs. Not all KSA errors are caused by

training deficiencies, however. As will be discussed below, a mental lapse or a momentary loss

of situational awareness may also cause KSA-related errors. In addition, for some jobs, a certain

level of proficiency is expected when personnel are hired into the position or the services of

contractors are obtained. In these cases, human resources screening and selection processes or

procurement processes for contractor services may play a role in preventing KSA errors.

9.1.1 Systems Approach to Training

Licensee training programs are presently conducted in accordance with the principles of the

systems approach to training (SAT), which is also called performance-based training (PBT).

The NRC assures that training is conducted in accordance with 10 CFR 50.120, “Training and

Qualification of Nuclear Power Plant Personnel” and 10 CFR 55.4, “Operators Licenses

(Definitions).” The systems approach to training means that a training program includes the

following five elements:

• Systematic analysis of the jobs to be performed

• Learning objectives derived from the analysis, which describe desired performance

after training

• Training design and implementation based on the learning objectives

• Evaluation of trainee mastery of the objectives during training

• Evaluation and revision of the training based on the performance of trained personnel

in the job setting.
9-2

As noted in the Statements of Consideration for the 1987 amendment to 10 CFR 55.4, a

licensee's training program is considered NRC-approved when it is accredited by the National

Nuclear Accrediting Board.

There are currently nine licensee training programs subject to accreditation, as follows:

1. Licensed and non-licensed operators

2. Shift supervisor

3. Shift technical advisor

4. Instrument and control technician

5. Electrical maintenance personnel

6. Mechanical maintenance personnel

7. Radiological protection technician

8. Chemistry technician

9. Engineering support personnel

These training programs identify the required KSAs to successfully function in a job. A job is

defined by a set of tasks to be mastered by the worker. These tasks are analyzed to identify the

KSAs they require. The KSAs are then consolidated into a master taxonomy of KSAs for each

job. Learning objectives for training are prepared from the taxonomies. Mastery of the learning

objectives equates to mastery of the KSAs and a successful training program assures that each

worker is qualified to perform the various tasks that comprise his or her job.

Performance-based training programs were implemented and first accredited during the late

1980s. Most nuclear power plant personnel have been trained under these programs.

9.1.2 Identifying KSAs with Job and Task Analysis

Job and task analysis (JTA) is a systematic method for identifying the KSAs that are required

for successful performance of the tasks associated with a job. The JTA is used to identify the

tasks for which training is necessary and may be used to identify requirements for personnel

screening and selection.

Tasks are analyzed in the JTA based upon their importance, frequency and difficulty.

• An important task is one that is critical to successful job performance. For example, the

operator actions that are modeled in plant probabilistic risk assessments are important, so

training for mastery is required.

• An infrequently performed task is one that may not be performed often enough for

personnel to maintain mastery.

• A difficult task is one that is complex. For example, the task may involve multiple

decisions based upon dynamic plant states.

The KSAs required for these tasks are affected by the quality of the procedures that are available

and the characteristics of the human-system interface (HSI). For example, if controls are easily

manipulated and displays easy to understand, then the operator may not need to master a large
9-3

body of detailed information to operate the system. Similarly, if the procedures for a task are

clearly written and easily understood, then the worker might not need to memorize the exact

sequence of actions required to repair a particular component, because the procedure steps will

guide the worker through the task.

Changes to equipment, the HSI and the as-written procedures may require an update to the JTA.

When equipment design or procedures are changed, training program personnel will reassess the

adequacy of the existing KSAs to determine if additional training is required, or whether current

training should be revised or deleted. Revisions to existing training programs and new training

may also be required as operating experience provides lessons learned. Personnel screening and

selection criteria or contractor requirements may also be impacted.

9.1.3 Training

Training to master the KSAs required for a job may be obtained from a variety of sources.

Whether the licensee provides the training or it is obtained from other sources (e.g., trade

schools, universities, contractor organizations), there are several factors that may result in

personnel not mastering the required KSAs for a job. These include course design and delivery

methods, course completion, and training frequency.

Course design begins when the learning objectives have been identified. The design process

consists of determining the delivery methods (e.g., classroom, simulator, on-the-job training),

number of hours required to cover the materials, instructor qualifications and so on. Although

some methods, materials and instructors may be more effective or efficient than others, the

important issue is that the course content is complete and addresses all of the relevant KSAs, so

that the learning objectives are met and the KSAs mastered.

Another determinant of KSA mastery is course completion. Although this factor appears

obvious, there are often competing demands on personnel that may pull them out of training at

times. As a result, they may miss the instruction related to specific KSAs. Testing may not

identify the KSA deficiency because it is impossible to test mastery of all KSAs. Sampling

techniques are used to generate examinations. If attendance and participation are not controlled,

some personnel may miss training on specific KSAs and testing may not identify the deficiencies

before an error is committed.

9.1.4 Testing

Testing is the primary means used to evaluate KSA mastery. In order to assure that personnel

are competent to perform their jobs, the testing requirements should be valid for the job. There

are three kinds of validity that are important for a mastery test:

• Content validity – the test items are directly related to job performance by ensuring they

match the learning objectives and are appropriately weighted

• Operational validity – the test items address the mental and psychomotor activities that

are performed on the job
9-4

• Discriminate validity – the test items differentiate between workers who have mastered

KSAs required to perform the job and those who have not.

Most training programs do not require perfect performance on test items for all KSAs to

demonstrate mastery of the subject. As an example, a score of 80% on most components of the

test is required in the operator licensing examination process. A score of 100% is not required,

in part, because the validity and reliability of test items vary.

The examination process should identify critical tasks, however. For operators, critical tasks are

those actions that are so important to safety that a competent operator is expected to correctly

perform these tasks every time to demonstrate mastery. Critical tasks typically form a small

subset of the overall group of tasks to be mastered for any job. Emphasis on critical tasks and

their associated KSAs in training and testing is important to reduce the likelihood of error.

9.1.5 Proficiency Training

Another factor affecting KSA mastery is forgetting. An individual's ability to perform a task will

degrade over time unless the relevant KSAs are refreshed. Proficiency training (i.e., refresher)

will be required for some tasks to maintain the level of mastery that was demonstrated following

initial training. One function of training programs is to identify those tasks that require

proficiency training.

If certain tasks are performed frequently, proficiency training may be unnecessary. By

performing a task, personnel practice the task and obtain feedback regarding successful task

mastery. Task performance refreshes the KSAs and successful task performance verifies that

proficiency has been maintained.

“Just-in-time” training may be used for infrequently performed and difficult tasks. “Just-intime” training techniques may include a comprehensive pre-job briefing, practice runs on a

mock-up or a simulator familiarization session. Determination of the periodicity required to

refresh KSAs is part of the design of the training and requalification program, although actual

“just-in-time” training may be triggered and administered by a different process, such as work

planning and control.

9.1.6 Training Evaluation and Revision

An important aspect of a performance-based training system is the constant evaluation and

revision of the training program. This mechanism assures that changes in plant configuration,

equipment modifications, procedural changes and lessons learned from operating experience are

included in learning objectives and addressed in training program design. An effective training

program is dynamic as the plant organization changes and learns. If the training program ceases

to capture changes in the plant and industry, training will not provide the necessary KSAs to

assure successful task performance.
9-5

9.1.7 Cognitive Errors: Loss of Situational Awareness and Mental Lapses

Two fundamental sources of human error that are not associated with KSA mastery are a loss of

situational awareness and a mental lapse. A loss of situational awareness or a mental lapse

occurs when personnel have previously demonstrated mastery of a KSA but cannot recall it at

the required time to prevent an error. An example would be failure to trip a pump when pressure

reached a certain value. If the operator did not recognize that pressure had reached that value,

the problem was caused by a loss of situational awareness. If the operator recognized that

pressure had reached the pump trip criterion but still did not trip the pump, the problem would be

a mental lapse. In each case, if the operator had been directly asked when he or she needed to

trip the pump, the operator would have correctly responded, “when pressure reached the trip

criterion.”

9.1.7.1 Loss of Situational Awareness

Loss of situational awareness occurs when a worker does not recognize that a certain KSA

applies to the task that he or she is performing. The worker has mastered the KSA and, if asked

in a different setting, would be able to demonstrate this mastery. There are four elements

required for a finding of a loss of situational awareness:

1. The KSA was essential for satisfactory task performance

2. The individual received training to adequately complete the task

3. The individual mastered the KSA required for task performance

4. The individual did not recognize that the KSA was applicable to the task.

There are several methods available to prevent the likelihood of errors due to a loss of situational

awareness. Situational awareness can be improved through “just-in-time training” that focuses

on “what-if” scenarios for events that are pre-planned. This allows the individual to think

through the various situations that may be encountered during the work activity. Emphasizing

rule-based precautions during training may also be helpful (e.g., “Always check Tech Specs

whenever any component is declared inoperable”), but will not prevent all losses of situational

awareness. Placing the staff member into the situation in which a KSA will be applied, such as a

simulator, is also useful in preventing a loss of situational awareness. However, there are so

many potential event paths in a nuclear power plant that it is unlikely that simulator-based

training can address every possible situation.

The most effective corrective actions to enhance situational awareness for unplanned events are

to ensure that prompts or reminders are included in job performance aids. This type of support

may include:

• Adding notes or cautions to procedures

• Adding annunciators and alarms that call attention to equipment conditions

• Eliminating or conditionally suppressing unnecessary annunciators that may overwhelm

operators during events

• Improving the human-system interface.
9-6

9.1.7.2 Mental Lapse

Another source of error is the mental lapse, or a momentary lapse in recall for the correct KSA

when it is required. Lapses may be random, or may be related to performance shaping factors,

such as fatigue, environmental conditions or stress. Often, the lapse occurs because the

individual becomes distracted or unfocused. For example, an individual may have been working

through one procedure when the task was interrupted by the need to implement a higher priority

procedure. The staff member may have intended to complete the initial procedure, but was

distracted by the other, higher priority activities and did not remember to return to the first

procedure.

Mental lapses are identified when the following four conditions are met:

1. The KSA was essential for satisfactory task performance

2. The individual received training to adequately complete the task

3. The individual previously demonstrated mastery of the KSA(s) required to complete

the task

4. The individual did not recall the KSA(s) when required.

Although training programs cannot prevent mental lapses, personnel can be trained to recognize

the warning signs of conditions that may increase the likelihood of a lapse and use various

strategies to minimize their occurrence. These strategies may include self-checking programs or

stress management techniques.

Reducing or eliminating the performance-shaping factors that momentarily distract or overload

cognitive processes may also reduce the likelihood of mental lapses. Corrective actions to

minimize or eliminate the performance-shaping factors that caused a lapse will be more effective

than remedial training on the KSA, given that the individual has already mastered it.

9.1.8 Personnel Selection and Contracting

Licensees often hire new staff, promote staff to new positions, or augment the existing staff with

contractor personnel. Personnel selection processes identify the best-qualified individual for a

job using several different methods, which typically include an evaluation of previous job

experience, education and training. Personality, ability and proficiency tests may also be

administered. These methods are intended to ensure that new hires and the staff who are

promoted either possess the KSAs required for the job or have the ability to benefit from training

for the job. Procurement processes specify the qualifications that contractor personnel are

required to have, although licensees may also provide site-specific training to contractor

personnel. Weaknesses in the personnel selection and procurement processes may result in work

being performed by individuals who have not mastered the necessary KSAs for the task and so

lead to errors.
9-7

9.2 DIRECT CAUSES OF KSA-RELATED ERRORS

A direct cause of a KSA error describes the reason that the requisite KSA was not applied to task

performance. The direct cause of the error may be:

No KSA – The worker did not possess the KSA required for successful task performance.

For example, certain skills were required to use a particular type of self-contained

breathing apparatus (SCBA) but the worker did not possess those skills. As a result, the

individual was exposed to airborne contamination because the SCBA did not fit properly.

Inadequate mastery - The individual had not mastered the KSA. In this case, the

individual had received some form of training, but it was inadequate. For example, a

maintenance technician was required to review a new revision to a procedure on her own

time. She completed the review, but when it was time to use the procedure, she found

that certain steps in the procedure did not make sense to her and she was unable to follow

it. As a result, she took incorrect actions.

Inadequate retention – The individual had mastered the KSA but had forgotten how to

perform important components of the task, and so, for example, performed steps out of

sequence.

Loss of situational awareness - The individual had mastered the KSA but did not

recognize the KSA applied to the current situation and so committed an error. For

example, a unit supervisor had mastered knowledge regarding the conditions under which

it is necessary to post a fire watch, but failed to recognize that a fire watch was required

for a particular welding job. As a result, sparks from the welding task caused a small fire.

Mental lapse – The individual had mastered the KSA but failed to recall it and so did not

apply it to performing the task. For example, a security guard became distracted by an

incident that was being discussed over the radio and so failed to check that a door was

securely locked.

9.3 PROGRAMMATIC CAUSES OF KSA-RELATED ERRORS

The training program is responsible for assuring that personnel master the necessary KSAs to

perform their tasks. NUREG-1220, Training Review Criteria and Procedures, provides detailed

review criteria for assessing training program effectiveness. Several key training program

weaknesses are also described here. In addition, other licensee programs or processes that may

cause or contribute to KSA-related errors are also listed.

9.3.1 Training Program Weaknesses

Job and Task Analysis – The JTA did not identify and characterize all of the important

KSAs for a job position. As a result, training did not address them and workers were not

prepared to perform some tasks correctly. For example, operators violated Technical
9-8

Specifications because they had not been trained to understand their applicability to the

current situation.

Training Design and Delivery – Training was provided but the design and delivery did

not assure KSA mastery. For example, the course content may not have addressed all of

the important KSAs for the job, course delivery methods may have been inappropriate for

the KSA (e.g., classroom lectures to teach a skill with no opportunity to practice), or the

instructors were not qualified to teach the course.

Training Completion – Student attendance and participation were not managed. As a

result, an individual or group of workers missed instruction related to important KSAs,

did not master them and could not perform the task correctly when required.

Testing – KSA mastery was not evaluated or testing was invalid. As a result, students

who had not mastered important KSAs were not detected and so were allowed to perform

tasks for which they were not qualified.

Frequency – Proficiency training was not provided or was not provided with sufficient

frequency. As a result, KSA mastery degraded and personnel could no longer perform

some tasks correctly.

Evaluation and Revision – Lessons learned related to training weaknesses were not

communicated or tracked and so training was not revised to address them. Or, changes in

plant equipment, work practices and requirements did not result in training revisions. As

a result, some staff’s KSAs were incomplete or inaccurate.

9.3.2 Other Programmatic Weaknesses

Human Resources – Personnel selection processes did not ensure that new hires or newly

promoted individuals had mastered the KSAs required for the job. As a result, some staff

did not possess the KSAs to perform effectively.

Procurement – Licensee processes for bringing contractor personnel on-site did not

assure that the contractors had mastered the KSAs required for the job.

Work Planning and Control – The work planning and control process did not assign

qualified individuals to the task. As a result, personnel who had not mastered the KSAs

required performed a task and committed errors.

Shift Staffing – An inadequate number of qualified personnel were assigned to each shift.

As a result, planned work could not be executed or unplanned conditions or events could

not be managed.

Human Factors Engineering – Procedures, equipment labeling, and human-system

interfaces were inadequate to assist personnel in maintaining situational awareness. As a

result, workers were unable to complete a repair task because the combination of
9-9

inadequate training with poor procedures and labeling prevented them from locating the

component on which the task was to be performed.

Industrial Hygiene and Radiation Protection – Weaknesses in these programs may result

in workers performing tasks under environmental conditions that promote errors. For

example, excessive noise distracted staff from performing their tasks, leading to a mental

lapse.

9.4 ADDITIONAL RESOURCES ON KSAs AND TRAINING

• U.S. Code of Federal Regulations, Part 50.120, Training and qualification of nuclear

power plant personnel, Title 10, Energy (revised periodically). Washington, DC: U.S.

Government Printing Office.

• U.S. Code of Federal Regulations, Part 55.4, Operators licenses (definitions), Title 10,

Energy (revised periodically). Washington, DC: U.S. Government Printing Office.

• U.S. Nuclear Regulatory Commission (2000). Qualification and training of personnel

for nuclear power plants (Regulatory Guide 1.8, Rev. 3). Washington, DC: U.S.

Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1999). Operator licensing examination standards

for power reactors (NUREG-1021). Washington, DC: U.S. Nuclear Regulatory

Commission.

• U.S. Nuclear Regulatory Commission (1998). Knowledge and abilities catalog for

nuclear power plant operators: Pressurized water reactors (NUREG-1122, Rev. 2).

Washington, DC: U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1998). Knowledge and abilities catalog for

nuclear power plant operators: Boiling water reactors (NUREG-1123, Rev. 2).

Washington, DC: U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1996). Nuclear power plant simulation facilities

for use in operator license examinations (Regulatory Guide 1.149, Rev. 2). Washington,

DC: U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1993). Training review criteria and procedures

(NUREG-1220, Rev.1). Washington, DC: U.S. Nuclear Regulatory Commission.
10-1

10 ATTENTION AND MOTIVATON

10.1 ATTENTION AND MOTIVATION IN HUMAN PERFORMANCE

Attention and motivation are often identified as causes for error. “Inattention to detail” and

“complacency,” for example, are frequently cited as causal factors in licensee problem reports.

The evidence supporting these conclusions is often weak, however.

Determining the role of attention or motivation in a human error is difficult outside of a

laboratory or simulator setting. Attention and motivation are internal states that cannot be

measured directly. In the laboratory, the experimenter can use sensitive instruments to track eye

movements and record focus times as measures of attention, for example, or can establish control

over the incentives presented to subjects to manipulate motivation levels. Recordings of workers

“thinking aloud” as they perform tasks also provide insights into attention and motivation. In an

investigation, however, real-time, objective measures of attention or motivation cannot be

obtained because the investigation necessarily occurs after the fact. As a result, the investigator

must rely on self-reports and inference, which are subject to the biases and inaccuracies

discussed in Section 3.

Attributing causality to workers’ attention, attitudes, motivations or traits may be common

because it is consistent with the “fundamental attribution error.” As mentioned in Section 3, this

“error” is a natural human tendency in how we explain another’s behavior and appears to be

“hard-wired” into the human perceptual system. In the absence of compelling evidence that

some characteristic of the work environment affected the workers’ actions, investigators may

resort to this “default” explanation and conclude that the workers were not paying attention or

lacked the motivation to perform their work correctly. In reviewing a licensee problem report

that cites attention and motivation as causal factors, it may be necessary for NRC inspectors to

carefully assess the evidence provided to ensure that it supports the conclusions.

10.1.1 Attention

The term, “cognition,” refers to how people attend to and process information in making

decisions and performing tasks. A useful description of the cognitive processes involved in task

performance can be found in NUREG/CR-6126, “Cognitive Skill Training for Nuclear Power

Plant Operational Decision Making,” and is summarized here.

The information processing required for task performance can be broken down into four stages.

These are (1) detection and monitoring, (2) situation assessment, (3) planning, and (4) execution.

In the detection and monitoring stage, the individual seeks out information that is relevant to the

task, such as reading gauges, or receives it from signals and cues in the environment that draw

attention to salient information, such as alarms activating. The information that is sought is

determined by the individual’s knowledge of what information is needed or by procedures and
10-2

other task demands. The signals and cues provided by the environment may be relevant to the

task, such as alarms, or irrelevant, such as a thunderclap.

Numerous errors are possible at this first processing stage. For example, an individual may only

seek some information and ignore other relevant information. Or, the worker may be distracted

and fail to monitor important indications. Or, there may be too many signals received from the

environment at one time and the individual misses important information.

In the situation assessment stage, the individual uses the information gathered from detection and

monitoring and his or her knowledge to develop a coherent explanation of the information

received. This explanation is formed into a mental representation of plant state, in the case of

operators, or equipment status, for maintenance or instrumentation and control technicians. This

mental representation is used to generate expectations about other plant or equipment

parameters, expectations about future consequences, and explanations of what has been

observed, as well as to identify unusual conditions and anticipate potential problems.

Errors during the situation assessment stage arise due to inaccuracies in the mental representation

that is formed. For example, the representation may be incomplete, if relevant information was

not detected during the initial stage. Or, the information received may be interpreted incorrectly.

Or, the knowledge that is incorporated into the representation may be incomplete or inaccurate.

In some cases, a situation may be too complex for an operator to be able to form an accurate

mental representation.

In the response planning stage, the individual chooses a course of action based upon the situation

assessment. Response planning involves establishing goals, generating an action plan,

monitoring the effectiveness of the plan in achieving the goals, filling in gaps in the plan and

adapting it as the situation changes or feedback is received on its effectiveness.

Errors may also occur during any of the response-planning activities. For example, the goals that

are established may be incorrect because the situation assessment was inaccurate. The procedure

selected for use may be the wrong one for the situation. Or, unexpected events may occur that

are not detected, so the plan is not corrected.

Finally, in the execution phase, plans are implemented to achieve the task goals. Plan execution

will typically require prioritization of actions, and the allocation of personnel resources and

coordination, whenever more than one individual is involved in the task. During the execution

phase, the achievement of subgoals is monitored and adjustments may be required.

Errors also occur during plan execution. For example, an individual may forget to take a

required action or fail to detect and correct an error that is made.

A key contributor to information-processing errors is the limited capacity of working memory.

Long-term memory, where knowledge is stored, is virtually unlimited. But research has shown

that working memory can hold and manipulate only about seven items at one time. As a result,

information that exceeds working memory capacity may be displaced or lost.
10-3

Another contributor to information-processing errors is habit. When a behavior has been

practiced or executed many times, it becomes automatic. That is, the need to pay attention to

executing the behavior and to exert conscious control over actions is reduced. The benefit of

habits is that they reduce the burden on working memory. The disadvantage is that a habit may

intrude on performing a new or different task where the habitual behavior is unwanted.

10.1.2 Motivation

Work motivation has been defined as “the conditions responsible for variations in the intensity,

quality, and direction of ongoing behavior." Intensity refers to how hard personnel work and

how productively work hours are used. Quality refers to both the manner in which work is

performed (e.g., safely, conscientiously) and the extent to which work products meet

expectations. The direction of work behavior is determined by the values, needs and

expectations that personnel bring to the job and the individual’s interpretation of the

organization’s values, reward structures and the goals that are communicated.

Personnel generally require more than a paycheck from their jobs to sustain motivation. Other

job characteristics, such as opportunities to maintain and enhance self-esteem, to meet social

needs and to grow professionally, have also been shown to be important. In fact, the highest

levels of work motivation are found when the organization’s and individual’s values, needs,

expectations and goals are congruent, so that the organization fosters the individual’s ability to

meet personal needs and goals on the job.

It is important to note, however, that high levels of motivation do not always translate into errorfree performance. There are many prerequisites that must be met in a work environment before

motivation has much effect. For example, motivation to perform a task correctly is of little value

without the knowledge of how to do it. Motivation to perform work safely will not ensure safe

performance if the potential risks associated with the work activity and methods to minimize or

avoid them are not known. Motivation to perform work in accordance with procedures will be

stymied if the procedures for a task are out-of-date, do not apply to current plant status, or cannot

be used in the work environment. Motivation to use the required personal protective

equipment (PPE) or tools and equipment for a job will not ensure safe performance if the

necessary PPE, tools and equipment are not available. A key issue for NRC inspectors who are

reviewing an investigation in which motivation has been cited as a cause, then, is to rule out

other causes for error that may have made worker motivation irrelevant.

One way in which high levels of motivation may reduce errors is that motivated personnel may

be more likely to take responsibility for bringing attention to any barriers to correct task

performance that they encounter and to fixing those that are within their span of control. But, if

the problems identified are not within the workers’ span of control and are not addressed by the

organization, high levels of motivation may also lead personnel to develop workarounds to get

work done despite the barriers. Or, motivation may be decreased and workers become

disaffected, if concerns and problems are repeatedly raised but not addressed.

An important source of motivational errors is in defining the goals to be accomplished in task

performance. Supervision plays a key role in establishing and communicating the goals to be
10-4

met in a work activity. Section 14 discusses the effects of supervisory direction, oversight and

leadership on motivation.

Peers may also influence motivation. Crosschecking may detect and correct errors that occur.

Peer group norms as they apply to work intensity and quality may also affect individual

motivation. Behavior-based safety programs include peer observation and feedback to reduce

unsafe acts, although these programs are controversial because of their perceived emphasis on

“fixing the worker” rather than “fixing the work environment.”

10.2 DIRECT CAUSES OF ATTENTION AND MOTIVATION ERRORS

A direct cause of an attention and motivation error describes the characteristics of a worker’s

internal state that caused or contributed to an error. Specific examples of errors that may be due

to attention and motivation are presented below.

10.2.1 Detection and Monitoring

Information not detected – Task-relevant information was available, but it was not

detected. For example, a conversation between an operator and a security guard

distracted the operator on her rounds and she failed to detect that a pipe was leaking.

Information discounted – Task-relevant information was available, but it was ignored or

interpreted incorrectly. For example, an operator may mentally adjust a reading from an

instrument that typically reads high, when the instrument was recently re-calibrated and

is reading correctly.

Information lost – Task-relevant information was detected, but was not recalled when

needed. For example, an operator may have taken a reading on an instrument, but did not

write it down, and so did not remember the earlier reading when he or she checked it

again, and failed to detect a trend.

10.2.2 Situation Assessment

Assessment incomplete – Errors were committed because the situation was assessed

incompletely due, for example, to incomplete information or the inability to interpret and

analyze the information available because of time constraints. As a result, for example,

the crew did not recognize that they had entered a Limiting Condition for Operation.

Assessment inaccurate – Errors were committed because the situation assessment was

incorrect. The information on which the assessment was based may have been

inaccurate, for example, or personnel may have misinterpreted the information received.

Or, personnel may not have possessed the knowledge required to assess the situation

accurately (refer to Section 9, Knowledge, Skills and Abilities).
10-5

10.2.3 Response Planning

Plan incorrect – Errors were committed because, for example, the plan was incomplete or

could not be implemented as intended under current plant conditions. For example,

workers assigned to a preventative maintenance task were unable to complete it because a

control room operator recognized that taking the component out of service would have

conflicted with other plant activities.

Plan not modified – Errors occurred because circumstances changed and the plan was no

longer appropriate for the circumstances. For example, a construction task could not be

completed when an electrical conduit that was not on the drawings was discovered.

10.2.4 Execution

Slip – An error occurred because an unintended action was taken. For example, a

technician placed a switch in the OFF position when he had intended to place it in

AUTO.

Lapse – An error occurred because the required action was momentarily lost from

working memory. As a result, the action was not performed or was performed

incorrectly.

Intrusion – An error occurred because an overlearned sequence of actions was performed

without conscious control and the habit was inappropriate for the circumstances. For

example, personnel risked exposure to hazardous fumes when they followed their usual

path to the break room, which required them to pass through a locked door. When they

unlocked the door, the fumes reminded them that the room they were about to enter was

the site of a recent chemical spill that had not yet been contained.

10.2.5 Motivation

Expectations – Management expectations regarding productivity, quality workmanship

and safety were not effectively communicated to personnel and examples of the desired

behaviors were not provided. As a result, personnel may have been confused or

misinterpreted expectations so that their decisions and actions deviated from what was

desired.

Reward structure – The desired behaviors with regard to productivity, quality

workmanship and safety were not appropriately rewarded. As a result, individuals’

motivation to perform to expectations was decreased, leading to errors.

Feedback – Personnel did not raise concerns or identify barriers to effective performance

with the result that errors occurred. Concerns were not raised, for example, due to a

perception that nothing would be done to correct the problems or that personnel would be

punished for raising concerns.
10-6

Workarounds – Concerns were raised and barriers to effective performance were

identified, but not corrected. As a result, personnel developed unauthorized and

unanalyzed work practices to accomplish tasks and the workarounds resulted in errors.

Or, management authorized the workaround because a repair would be too expensive,

leading to errors.

Peers – Errors were committed because crosschecking was not performed or peer

influence adversely affected productivity, quality workmanship or safety behavior. For

example, a staff member who consistently wore hearing protection where required was

ridiculed by other staff for doing so.

10.3 PROGRAMMATIC CAUSES OF ATTENTION AND MOTIVATION ERRORS

Many licensee programs, policies and practices are intended to reduce errors associated with

attention and motivation. Some programs directly focus on these potential causes and

contributors to error, such as the human factors engineering program at a site or a

behavior-based safety program. Others may indirectly affect attention and motivation

during task performance. Licensee programs that may be implicated in errors caused by

attention or motivation include:

Human Factors Engineering – Weaknesses in the design of human-system interfaces, for

example, may make it difficult for personnel to detect changes in important parameters or

to interpret the information displayed correctly. Difficult-to-use human-system interfaces

also may frustrate personnel and inadvertently communicate a management message that

accurate, timely human performance is not important.

Procedures – Accurate, accessible and usable procedures also play an important role in

directing attention, assisting in the development of an accurate situation assessment and

in developing and executing response plans. For example, the entry conditions to

operating procedures assist personnel to assess the situation accurately. If entry

conditions and prerequisites are not provided, personnel are more likely to miss relevant

information about the situation and execute an incorrect response plan.

Training – Because knowledge guides information processing at every stage, weaknesses

in the training program may have a key effect on the likelihood of attention-related

errors. A programmatic weakness in ensuring proficiency training, for example, may

prevent personnel from maintaining mastery of the knowledge required to develop an

accurate situation assessment or develop effective response plans for tasks that are

infrequently performed.

Human Resources – Personnel selection processes play a role in ensuring that staff is

qualified (i.e., possess the KSAs required for the job). Weaknesses in the personnel job

performance evaluation and reward systems also may fail to communicate management

expectations or may reward behavior that does not meets those expectations. If
10-7

disciplinary actions are not perceived as being administered lawfully and fairly, employee

motivation to work productively and safely may be reduced.

Supervision – Supervision communicates and reinforces management expectations and

establishes goals and requirements for task performance. Supervisory oversight may

increase motivation to perform in accordance with expectations as well as detect and

correct any errors that occur. Weaknesses in supervision, for example, may cause staff to

choose production over safety goals in their work or to tolerate workarounds that may

lead to errors.

Problem Identification/Resolution – Licensee programs for reporting, documenting and

resolving barriers to effective performance maintain staff motivation levels when

problem reports result in elimination or mitigation of the barriers. Weaknesses in these

programs may not only frustrate personnel, but also encourage the development of

workarounds that may lead to errors.

Employee Concerns – Employee concerns programs provide another avenue for

personnel to raise safety issues. Weaknesses in the employee concerns program will

discourage personnel from raising problems when they fear adverse consequences and

will call stated management expectations into question, resulting in lower compliance.

Behavioral Safety – Behavioral safety programs focus on identifying and correcting work

behaviors that may result in adverse consequences through behavioral observation and

feedback from supervisors and peers. Some programs also emphasize self-checking,

such as the Institute for Nuclear Power Operations’ STAR program (stop-think-actreview). Focusing on potentially unsafe acts appears to improve human performance at

some sites.

10.4 ADDITIONAL RESOURCES ON ATTENTION AND MOTIVATION

• U.S. Code of Federal Regulations, Part 19.20, Employee protection, Title 10, Energy

(revised periodically). Washington, DC: U.S. Government Printing Office.

• Mumaw, R.J. (1994). The effects of stress on nuclear power plant operational decision

making and training approaches to reduce stress effects (NUREG/CR-6127).

Washington, DC: U.S. Nuclear Regulatory Commission.

• Mumaw, R., Swatzler, D., Roth, E. and Thomas, W. (1994). Cognitive Skill Training for

Nuclear Power Plant Operational Decision Making (NUREG/CR-6126). Washington,

D.C.: U.S. Nuclear Regulatory Commission.

• Roth, E., Mumaw, R. and Lewis, P. (1994). An Empirical Investigation of Operator

Performance in Cognitively Demanding Simulated Emergencies (NUREG/CR-6208).

Washington, D.C.: U.S. Nuclear Regulatory Commission.
10-8

• Woods, D., Pople, H.E. and Roth, E.M. (1990). The Cognitive Environment Simulation

as a Tool for Modeling Human Performance and Reliability (NUREG/CR-5213, Vols. 1

and 2). Washington DC: U.S. Nuclear Regulatory Commission.
11-1

11 PROCEDURES

11.1 PROCEDURE-RELATED ERRORS AND THEIR CAUSES

Procedures are instructions for performing a task. The instructions may be provided in formal

written procedures or as hand-written information included in a work package. Procedurerelated errors are errors that occur because some characteristic of the procedure caused task

performance to fail.

The primary purpose of procedures is to ensure that tasks are performed correctly. Procedures

also can document the best way to perform a task, so work is performed more efficiently.

Procedures may also serve a record-keeping function to document when and how a task was

performed.

Procedures reduce the likelihood of human errors under several conditions. When a task is

complex or performed infrequently, even the most experienced workers may forget the steps

required or the order in which certain steps must be performed. Procedures can also fill gaps in a

worker's knowledge about a task, component or system. Procedures are particularly helpful

when plant systems are in an unusual configuration and routine actions that may normally be

performed without a procedure can result in adverse consequences.

For procedures to be effective in ensuring that tasks are performed correctly, they must be used.

There are a number of reasons that workers may not use procedures:

• Procedures are inaccurate

• Procedures are out of date

• No procedure has been written for the task

• Users cannot find the procedure they want to use

• Users don't need a procedure because the task is simple

• Users need more information than the procedures contain

• Users see procedures as an affront to their skill

• Procedures are difficult to use in the work environment

• Procedures are difficult to understand.

It is important to note that using a procedure introduces an additional task to the work being

performed. Using a procedure in a step-by-step manner, and checking off each step as it is

performed, may ensure that tasks are performed deliberately and correctly. However, there

are many circumstances in a plant in which the physical demands of using a procedure in

this way complicates the job and can contribute to the likelihood of errors rather than

reducing them. Using a procedure also increases mental demands by requiring that the users

read the procedure, comprehend it and then act on what they have understood. When this

read-comprehend-act loop is added to the primary tasks that operators must perform during

upset conditions (e.g., monitoring and detection, situation assessment, response planning and

response implementation), it is particularly important that the procedures are easy to

understand and use.
11-2

The list of reasons for not using procedures also points out some of the ways in which errors

can occur when they are used. For example, if a procedure contains inaccurate instructions

or a drawing is out-of-date because a system or component has been modified since the

document was written, personnel who use the procedure may take incorrect actions. Or, if a

procedure step is written in an ambiguous and confusing manner, workers may try to follow

it, but take incorrect actions because they misinterpret a step.

Human performance problems are often erroneously attributed to procedures or a failure to

follow procedures. Procedures are frequently identified as a cause for human performance

problems because they describe the standards and requirements for task performance, and

when task performance fails, there is likely some procedure or policy that appears to have

been violated. It may not be the case, however, that an attribute of the procedure, or the lack

of a procedure, or the failure to use a procedure or reference document caused the error.

Rather, what appears to be a failure to follow the procedure may be a symptom of another

underlying cause, such as a training need or inadequate labeling, rather than the result of the

procedure's characteristics. It is important, therefore, that the licensee provides evidence

linking the human error specifically to characteristics of the document or weaknesses in how

it was used when identifying a procedure-related error.

11.2 DIRECT CAUSES OF PROCEDURE-RELATED ERRORS

A direct cause of a procedure-related error describes characteristics of the procedures that caused

task performance to fail or how the procedure was used or not used that caused task performance

to fail. There are a number of ways in which procedures may cause, contribute to or fail to

prevent an error. These include:

11.2.1 No Procedure Used

No procedure - Task performance failed because no procedure was written for the task

and the workers' reliance on memory or “skill of the craft” resulted in, for example,

forgetting important steps, performing steps out of sequence or taking incorrect actions.

Procedure not available - A procedure for the task existed, but was not used and should

have been. For example, a procedure may not be available for a task because it was not

included in the work package or the workers were not aware that the document existed

and so did not find and use it.

Procedure inconvenient to use - Task performance failed because using a procedure was

difficult in the work environment. For example, procedure use may be inconvenient in

confined spaces, in contamination zones or when wearing protective equipment.

Procedure too difficult to use - Task performance failed because workers considered the

procedure too difficult to use and so did not use it. For example, workers may avoid

using procedures that are written in excessive detail or that include what they consider to

be unnecessary steps that interfere with performing the task. Or, a procedure may be
11-3

written with too little detail for the knowledge levels of the workers, so that they do not

understand the procedure or misinterpret it.

Procedure use not required - Task performance failed because an existing procedure was

not used. For example, licensee policy may have required that the procedure be reviewed

before use or that it be available at the work site, but did not require that the procedure be

in-hand and followed step-by-step during task performance.

11.2.2 Wrong Procedure Used

Wrong unit, train, component - Task performance failed because the procedure was not

intended for use with the equipment that was being operated or maintained. The wrong

procedure may be included in the work package or workers may select the wrong

document for use. Or, a procedure may not clearly indicate the equipment to which it

applies. In some cases, the wrong procedure may be used because labeling is deficient

and the workers cannot verify that the procedure applies.

Wrong revision - Task performance failed because the most recent revision to the

procedure was not used. If modifications were made to equipment, but the affected

documents were not updated, incorrect instructions in the procedure may cause an error.

Or, workers may inadvertently access and use an earlier revision.

Wrong procedure for plant/equipment state - Task performance failed because

prerequisites for using the procedure were not met by current equipment or system

configuration.

11.2.3 Procedure Used, But Wrong or Incomplete

Typographical error - An error was made because information presented in the procedure

was incorrect due to a typographical error. For example, the numbers or letters in

equipment identifiers, such as valve names, or required values for instrument readings

may be transposed or incomplete.

Facts incorrect - Task performance failed because the instructions or the information

presented in procedure steps was incorrect. For example, the procedure may include

improper set points or describe actions that cannot be taken under normal conditions of

use.

Incomplete - Task performance failed because facts or useful information were omitted

from the procedure. For example, the procedure writer may have assumed that workers

would know the steps required to prepare for conducting a maintenance activity and so

did not include them in the procedure. Or, important cautionary information about how

to perform a step was not included in the procedure.

Sequence wrong - Task performance failed because the sequence in which the steps were

presented in the procedure was incorrect.
11-4

Second checker needed, but absent - Task performance failed because the task was

important enough to warrant independent verification that the objective of a task or series

of actions was achieved, but verification was not required. As a result, errors were

committed during task performance, but not detected and corrected.

No placekeeping - Task performance failed because the procedure did not provide a

method for placekeeping. Sign-off spaces next to critical steps or other methods for

assisting the user to track progress through the procedure were not used. Omitting a

procedure step is the most common consequence of not providing placekeeping aids.

11.2.4 Procedure Used, But Followed Incorrectly

Format confusing - The layout of procedure elements on the page was confusing to

workers. For example, cautions or notes were not separated from action steps and

highlighted with distinctive formatting. Or, the relationship of steps to substeps or lists

was unclear because no indenting was used.

Content confusing - The information presented in the procedure or reference document

was confusing to workers. For example, the abbreviations or acronyms used were

unfamiliar to the users. Or, short, simple action steps in the imperative voice were not

used. Conditional statements (i.e., logic steps used to present decision points in

procedures) can be particularly confusing if formal Boolean logic statements are not

used. Cross-references to other procedures, to reference documents or to other steps

within the same procedure may be confusing and can cause workers to lose track of the

sequence in which they are to perform steps.

Graphics confusing - Graphics used in the procedures were confusing to workers. Tables

or figures were difficult to read and understand. Or, too many emphasis techniques were

used in the procedure text so that unimportant information was highlighted, while

important information was not.

11.3 PROGRAMMATIC CAUSES OF PROCEDURE-RELATED ERRORS

Programmatic causes of procedure-related errors are typically found in the licensee's

processes for managing the development, use and control of procedures. A number of good

practices have been identified to assure that procedures will be effective in preventing

errors, many of which are documented in NRC guidance for emergency operating

procedures programs. Other programs may also contribute to procedure-related errors.

11.3.1 Procedures Program

The following weaknesses in procedures programs have been shown to result in ineffective

procedures:

Multidisciplinary team not used - Development of technically accurate and usable

procedures is enhanced by the involvement of a multidisciplinary team. Procedure

development teams should include specially trained procedure writers working with
11-5

subject matter experts, such as a representative of the intended users and engineers with

specific expertise regarding the equipment to be operated or maintained. A single

procedure writer working alone may miss important technical information, may use

terminology that is unfamiliar to the intended users, or sequence the procedure steps

inefficiently. As a result, the procedure may be inaccurate or difficult to comprehend,

increasing the likelihood of errors.

Writer's guide - Writers' guides provide information to procedure writers regarding

techniques for formatting procedures, presenting different types of content (e.g., action

and decision steps) and for developing usable graphics. If a writer's guide is not

followed or it is incomplete, the resulting procedures may be difficult to comprehend

and follow.

Verification - Procedure verification is a process that provides a final check on the

technical accuracy of the procedure steps and on the procedure's compliance with

writers' guide requirements. In most plants, an individual who was not involved in

authoring the procedure typically verifies that the procedure correctly incorporates

information from the technical basis documents and meets the writer's guide

requirements. Verification may also involve walking down the procedure at the work

site to ensure that equipment identifiers in the procedure match the labels and tags on the

equipment, that the procedure can be used under the expected conditions at the work

site, that the steps are sequenced correctly and efficiently considering the layout of the

worksite, and that the tools list is complete. Procedures that have not been verified are

often incomplete, inaccurate and difficult to use.

Validation - Procedure validation is a process to check that the procedure can be used as

written. Validation exercises in a control room simulator with crews of operators may

be used to validate operating procedures. Maintenance simulators or mock-ups may be

used to validate maintenance procedures. Procedures that have not been validated may

result in unintended consequences or may not be usable under actual work conditions.

Review and approval - The procedure review and approval process ensures that

personnel in all other departments whose work may be affected by the procedure have

the opportunity to review it to assure that activities in their departments are not adversely

affected. Review and approval should also assure that any other procedures affected by

the procedure are identified and modified, if necessary. Out-dated cross-references

between procedures are a common source of error. Management reviews of procedures

or procedure revisions will ensure that the procedure is consistent with management

goals and policies.

Procedure revisions - The procedure program should include a process for reviewing and

revising procedures when changes occur at the plant that may affect the technical

accuracy or usability of the procedures. For example, if plant equipment is modified, the

procedures and drawings that apply to the equipment may require revision. Or, if the

knowledge and skills of the workforce change due to new hires, layoffs, an aging and

retiring workforce, then the level of detail in the procedures may need to be increased to
11-6

better accommodate the new users. Changes in management goals and policies may also

require procedures to be revised to ensure they are consistent with new directives. And,

if other documents change that are referenced in the procedure, the procedure should be

reviewed to determine whether any revisions are required.

11.3.2 Other Programmatic Weaknesses

Training – Coordination between the training and procedures programs is necessary to

ensure that user training needs are assessed for a new or revised procedure. Changes to

existing training may be necessary to ensure that the users are, at a minimum, familiar

with the new or revised procedure and are qualified to use it before the procedure is

implemented. Weaknesses in training on a new or revised procedure may

Operating Experience – Lessons learned from users’ experiences with the procedures is

necessary to ensure that any problems or limitations in procedures are detected and

corrected. If operating experience does not lead to timely procedure revisions, personnel

may avoid using the procedures or develop workarounds.

Information Management - Technically accurate procedures depend on the availability

of up-to-date reference documents, such as vendor manuals, engineering analyses, and

drawings. If the reference documents used to develop procedures are incomplete or

contain errors, those omissions and errors may be translated into the procedures. A

document control process is also necessary to ensure that workers have access to a

complete and the most recent revision of the procedure.

Maintenance – Procedures are written on the basis of assumptions about the operability

and condition of the equipment to which they apply. If the equipment has not been

maintained and is inoperable or in a degraded condition, errors may occur if the

procedure is not revised to reflect actual equipment conditions.

11.4 ADDITIONAL RESOURCES ON PROCEDURES

• U.S. Code of Federal Regulations, Appendix B to Part 50, Quality assurance criteria for

nuclear power plants and fuel reprocessing plants, Criterion V, Instructions, procedures

and drawings, Title 10, Energy (revised periodically). Washington, DC: U.S.

Government Printing Office.

• U.S. Nuclear Regulatory Commission (1978). Quality assurance program requirements

(Operation) (Regulatory Guide 1.33, Rev. 2). Washington, DC: U.S. Nuclear

Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1982). Guidelines for the preparation of

emergency operating procedures (NUREG-0899). Washington, DC: U.S. Nuclear

Regulatory Commission.
11-7

• U.S. Nuclear Regulatory Commission (1989). Lessons learned from the special

inspection program for emergency operating procedures (NUREG-1358). Washington,

DC: U.S. Nuclear Regulatory Commission.

• O’Hara, J.M., Higgins, J.C., Stubler, W.F. and Kramer, J. (2000). Computer-based

procedure systems: Technical basis and human factors review guidance (NUREG/CR6634). Washington, DC: U.S. Nuclear Regulatory Commission.

• Barnes, V.E., Moore, C.J. Wieringa, D.R., Isakson, C.S., Kono, B.K. and Gruel, R.L.

(1989). Techniques for preparing flowchart-format emergency operating procedures:

Vol.s 1 and 2 (NUREG/CR-5228, PNL-6653, BHARC-700/88/017). Washington, DC:

U.S. Nuclear Regulatory Commission.

• Morgenstern, M., Barnes, V., McGuire, M., Radford, L. and Wheeler, W. (1985)

Operating procedures in nuclear power plants: Practices and problems

(NUREG/CR-3968, PNL-5648). Washington, DC: U.S. Nuclear Regulatory

Commission.

• Morgenstern, M., Barnes, V., Radford, L., Wheeler, W. and Badalamente, R. (1984). The

development, use and control of maintenance procedures in nuclear power plants:

Problems and recommendations (NUREG/CR-3817, PNL-5121). Washington, DC: U.S.

Nuclear Regulatory Commission.
12-1

12 TOOLS AND EQUIPMENT

12.1 EFFECTS OF TOOLS AND EQUIPMENT ON HUMAN PERFORMANCE

The design and use of tools, equipment and personal protective equipment (PPE) in the

workplace are typically considered industrial safety and health issues. But, tools, equipment or

PPE may impact risk if they cause or allow personnel to make errors that may affect safety

systems.

12.1.1 Tool Design and Use

Tool use is often necessary for work activities at licensee sites. Numerous checklists containing

evaluation criteria for tools have been published as a result of increased public concern over

workplace injuries, particularly those resulting from repetitive motion (e.g., carpal tunnel

syndrome). In general, any tool characteristic that increases the risk of worker injuries will also

increase the risk of errors during task performance.

The proper tools for a task depend upon the characteristics of the workplace, the individual

workers and the task demands. For example, in confined areas, tools must be small enough to be

usable in the workspace available while retaining their functionality. Errors may result if tools

do not fit a user’s hand size or handedness (i.e., use of a right-handed tool by a left-handed

worker), skill levels or strength. Errors are also more likely if the task requires the use of force

or repetitive motion in using the tool.

Poorly designed tools, tools that are inappropriate for the workplace, worker or task, or tools that

are not maintained may affect human performance in several ways. The primary effect of poorly

designed tools is on motor performance. Poorly designed tools may be dropped, cause physical

slips and erroneous actions, or lead to fatigued or injured muscles that are more difficult to

control. Some tools may interfere with visibility or increase discomfort and cause workers to

rush through jobs. Tools that are not maintained will not function as intended and may cause

errors when they are used.

12.1.2 Equipment

The use of various types of equipment and machinery necessary to perform some work activities

may also cause or contribute to errors. Equipment may be temporary or permanently staged at a

worksite. Ladders, scaffolds or lifts may be used for aboveground work. Cranes, trucks,

forklifts, loaders, or robots, for example, may be brought to a worksite for some tasks. Some

tasks require the temporary deployment of additional lighting, parts, and the electrical cabling to

energize necessary machinery. The introduction of equipment and machinery to a worksite may

complicate task performance and represents a change. Equipment and machinery may also affect

task performance if personnel expect it to be available and it is not, such as a missing ladder that

was pre-staged for emergency operations but was removed and used for other purposes.

Aboveground work is particularly hazardous and may have adverse effects on some workers.

For example, personnel may experience dizziness, instability or vertigo when working at heights.
12-2

These responses may be intensified if the surface on which they are standing moves. Work at

any height also introduces the potential for tools and other materials to be dropped, which may

damage equipment or personnel below, or create foreign material issues.

Extensive regulations and guidance have been published by the Occupational Safety and Health

Administration and other government agencies regarding the safe work practices and design

characteristics of equipment that prevent worker injuries and other workplace hazards. In

general, the practices and equipment designs necessary to prevent injuries also serve to prevent

errors that may impact safe operations.

12.1.3 Personal Protective Equipment

Personal protective equipment is necessary to perform many tasks at licensee sites. Depending

upon the type of hazard to which workers may be exposed, PPE may include eye, hand, ear and

foot protection, aprons or full suits, such as anti-contamination clothing. Protection from heat

stress and cold may be necessary at times, as well as respiratory protection or protection from

open flames for hot work. Aboveground work may require safety harnesses.

The design and use of PPE may cause or contribute to errors in several ways. The most

important concerns are that PPE may reduce sensory input, limit feedback and impair motor

capabilities. For example, darkly tinted safety glasses may hinder vision if used indoors. Gloves

reduce fine motor control. Hearing protection may prevent personnel from hearing alarms or

verbal communications. Personnel may become entangled in fall protection gear. Some forms

of protective clothing may contribute to heat stress, which may affect both cognitive and motor

functioning, leading to errors. Combinations of PPE may interact and interfere with

performance. Wearing PPE is also often uncomfortable and may distract workers or cause them

to hurry through tasks, increasing the potential for errors.

Personal protective equipment that is not maintained properly may also lead to errors. For

example, safety glasses and face shields that have become scratched distort or interfere with

vision. In general, the use of PPE is the least preferred alternative for protecting workers

because of the impacts on performance most types of PPE will have.

12.2 DIRECT CAUSES OF ERRORS RELATED TO TOOLS AND EQUIPMENT

A direct cause of an error related to tools and equipment describes the characteristics of the tools

or equipment that caused task performance to fail. There are a number of ways in which the

design and use of tools and equipment may impair performance. Examples of these are

presented below.

12.2.1 Tools

Tool mismatched to task environment – The tool used for the task was too large, too

small or otherwise inappropriate for the work environment. It may have obscured the

parts or equipment on which work was being performed, causing errors, or created

discomfort.
12-3

Tool mismatched to worker – The tool was too large, too small or inappropriate for the

worker’s physical characteristics, such as hand-size, strength or agility. Some tools

require skills to be used. If a worker has not been trained to use the tool or the tool is

mismatched to the individual's characteristics, he or she may commit errors by using it

improperly, break equipment or become injured.

Tool poorly designed - Poorly designed tools may increase discomfort. Tools that are

uncomfortable to use may cause personnel to rush through a task and commit errors.

Tools that are poorly designed may also impair motor control and cause errors, such as

breaking equipment or applying excessive torque on a screw.

Tool degraded - Tools that are not maintained may not function as intended or in

accordance with the workers’ expectations. Miscalibrated or broken tools may cause

personnel to take incorrect actions or may damage other equipment.

Correct tools not available or used - When special tools have been designed for

performing a task, an administrative challenge is created to ensure that they are available

at the worksite when needed. If other tools are substituted for the special tool, task

performance may be delayed by the workaround or it may not be possible to accomplish

the task to specifications.

12.2.2 Equipment

Deployment wrong – Errors occurred because the equipment or machinery was deployed

incorrectly. For example, the ground underneath a ladder or scaffolding was uneven,

angled or could not support the weight. Or, machinery was deployed too near electrical

power lines, possibly resulting in an electrical, or too near overhead obstructions,

possibly causing damage to other equipment or injuries to personnel.

Design or construction wrong – Errors occurred because the equipment or machinery was

poorly designed or constructed. For example, toeboards were not provided on platforms

erected in areas where dropping tools or material could cause harm. Or, the scaffolding

materials used were insufficiently sturdy for the weight placed on them.

Used improperly – The equipment or machinery was used in a manner for which it was

not designed or not authorized. For example, a load contained too much weight or a

crane was used to lift personnel without following proper procedures, increasing the

likelihood of equipment damage or injuries.

Not available - Equipment or machinery required to perform a task was not available

when needed. Errors may occur if task performance is delayed while personnel search

for the required equipment and if other equipment or machinery is substituted for the

missing equipment.
12-4

12.2.3 Personal Protective Equipment (PPE)

Mismatched to task – Task performance failed because the design or use of the PPE made

it more difficult than necessary. For example, work was performed in a high temperature

environment with multiple layers of anti-contamination clothing and other PPE, resulting

in cognitive impairment due to heat stress. Or, the use of tinted safety glasses indoors

impaired vision and prevented a worker from correctly reading a tag.

Mismatched to worker – Task performance failed because ill-fitting PPE caused

discomfort and interfered with task performance. For example, gloves that were too large

further reduced fine motor control and tactile feedback, leading to errors. Workers were

uncomfortable and rushed through tasks, with the result that post-maintenance testing

was not completed.

Poorly designed – Task performance failed because required PPE was poorly designed

and so was ineffective, allowing workers to be exposed to hazards that cause errors. For

example, a poorly designed respirator may allow a worker to be overcome by caustic

fumes.

Not used – Task performance failed because PPE was not used when required, with the

result that personnel were exposed to hazards that caused injuries and errors. For

example, an instrumentation and control technician received an electrical shock, which

also destroyed some wiring in the electrical panel.

Not available – Task performance failed because PPE was not available when required.

As a result, personnel were unable to complete a surveillance timely and Technical

Specifications were violated. Or, respirators were not readily available for emergency

use and workers were unable to enter an area to respond.

Used incorrectly – Task performance failed because personnel used the incorrect PPE for

a task or used PPE incorrectly. For example, a worker allowed his safety glasses to slide

down the bridge of his nose and spilled a caustic chemical when fluid splashed into his

eyes.

Degraded – Task performance failed because PPE was not maintained and failed to

protect workers from hazards. For example, a degraded respirator allowed an uptake.

Combined – Task performance failed because combinations of PPE were required for a

task and interacted to interfere with performance. For example, safety glasses worn

under a face shield distorted vision, causing errors.

12.3 PROGRAMMATIC CAUSES FOR ERRORS RELATED TO TOOLS AND

EQUIPMENT

Programmatic causes of errors related to tools and equipment are typically found in the

licensee's procurement processes, and industrial hygiene, radiation protection and
12-5

maintenance programs. Other programs may also be implicated. Common programmatic

causes of errors related to tools and equipment include:

Work Planning and Control - Work planning and control processes may fail to identify the

tools and equipment needed at the work site. For example, working in a high temperature

environment with multiple layers of anti-contamination clothing and other PPE, without

assuring adequate body cooling or personnel rotation, may cause cognitive impairment due to

heat stress.

Procurement – The licensee’s procurement program ensures that the tools, equipment or PPE

that are required to perform a work activity have been purchased and meet specifications.

For mobile equipment that may be brought to the site, such as cranes, the procurement

program is also typically responsible for ensuring that contractor equipment meets

requirements and that contractor personnel are qualified to operate the equipment.

Weaknesses in the procurement program may lead to the use of inappropriate, uncomfortable

or ineffective tools, equipment or PPE.

Industrial Hygiene and Radiation Protection – These licensee programs are responsible for

ensuring that the hazards associated with a work activity have been identified, communicated

to the workers, and that proper hazard controls are implemented. These programs are also

typically responsible for ensuring that PPE is fitted to individual workers. Weaknesses in

these programs may not only result in the unnecessary exposure of workers to hazards, but

may also set the stage for errors.

Procedures - As part of the licensee's procedure development process, the tools, equipment

and PPE required for a work activity should be considered when designing the procedures

and defining how they will be used. For example, effective procedures are designed so that

their use is compatible with the use of tools, equipment and PPE. Procedures that do not

specify the tools, equipment and PPE required to perform a task may cause delays or errors if

incorrect tools and equipment are used.

Training – Personnel often need specialized training to use some types of tools, equipment

and PPE. If these training needs have not been met, workers may use incorrect tools,

equipment or PPE or use them improperly, resulting in errors.

Human Factors Engineering – Requirements for special tools, equipment and PPE

should be considered whenever new equipment or systems are installed. As a general

rule, engineering controls for hazards are more effective than PPE. The need for special

tools or equipment creates an administrative burden and can often be avoided if the

potential impacts on human performance are considered during the design stage.

Reducing the need for special tools, equipment and PPE reduces opportunities for delays

and errors in task performance.

Operating Experience - Reviews of relevant operating experiences from the plant and other

facilities with similar work activities may reveal problems associated with tools and

equipment as well as solutions to those problems. Weaknesses in the operating experience
12-6

program may Personnel may have reported problems with tools and equipment that

previously interfered with performance, and further issues may be avoided if the problems

are corrected.

Maintenance – Maintenance of tools, equipment and PPE is necessary to ensure that they are

in working condition when needed. Inadequate maintenance will allow tools, equipment and

PPE to degrade so that they are difficult to use, ineffective or cannot be used.

12.4 ADDITIONAL RESOURCES ON TOOLS AND EQUIPMENT

• U.S. Nuclear Regulatory Commission (1988). Memorandum of understanding between

NRC and OSHA relating to NRC-licensed facilities (Information Notice 88-100).

Washington, DC: U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1998). Potential for degradation of the

emergency core cooling system and the containment spray system after a loss-of-coolant

accident because of construction and protective coating deficiencies and foreign material

containment (Generic Letter 98-04). Washington, DC: U.S. Nuclear Regulatory

Commission.

• U.S. Nuclear Regulatory Commission (1999). Acceptable programs for respiratory

protection (Regulatory Guide 8.15, Rev. 1). Washington, DC: U.S. Nuclear Regulatory

Commission.

• U.S. Nuclear Regulatory Commission (1996). Human-system interface design review

guideline (NUREG-0700, Rev. 1, Vol.s 1-3). Washington, DC: U.S. Nuclear Regulatory

Commission.
13-1

13 STAFFING

13.1 EFFECTS OF STAFFING ON HUMAN PERFORMANCE

Staffing is the process of accessing, maintaining and scheduling personnel resources to

accomplish work. An adequately staffed organization ensures that personnel are available with

the proper qualifications for both planned and foreseeable unplanned activities. Staffing is a

dynamic process in which plant management monitors personnel performance to ensure that

overall organizational performance goals are met or exceeded. The result of an effective staffing

process is a balance between personnel costs and the achievement of broader organizational

goals.

13.1.1 Staffing Requirements

The NRC has established several regulations regarding the staffing of nuclear power plants.

Title 10 CFR 50.54(m) establishes the regulatory minimum crew composition for licensed

operators. Title 10 CFR 50 Appendix R establishes the requirements for a Fire Brigade.

NUREG 0737, “Clarification of TMI Action Plan Requirements,” sets the requirement for a Shift

Technical Advisor (STA). Each licensee has further established requirements in Technical

Specifications or Site Licensee Commitments for a minimum level of shift staffing as well as a

general description of the site organization. The regulatory requirements are often lower than the

licensee’s administrative requirements for minimum shift staffing levels.

NRC Information Notices 91-77 (Shift Staffing at Nuclear Power Plants) and 95-48 (Results of

Shift Staffing Study) both stated in part:

"The number of staff on each shift is expected to be sufficient to accomplish all necessary

actions to ensure a safe shutdown of the reactor following an event. Those actions

include implementing emergency operating procedures, performing required

notifications, establishing and maintaining communications with the NRC and plant

management, and any additional duties assigned by the licensee's administrative

controls....”

13.1.2 Staffing Decision-Making

Personnel costs comprise a significant proportion of an organization’s operating budget.

Managing staff size to manage costs is a necessity for any business. There are a number of

issues to be addressed when staffing decisions are made. These include the range of expertise

required, the number of personnel needed, and the anticipated workload, so that the necessary

staff and expertise are available when needed.

13.1.2.1 Range of Expertise

Each organization requires the proper amount and type of expertise to safely and competently

operate the plant under a variety of conditions. The term “expertise” includes the attributes of
13-2

talent, effectiveness, knowledge, skills, abilities and experience necessary to operate and

maintain plant systems, structures and components.

Organizations balance the costs of maintaining full-time expertise on staff with the probability

that the expertise can be obtained from outside the organization when the need arises. For

example, it may be cost-effective to hire three junior engineers in a discipline for the same costs

as two senior engineers, if the normal engineering workload requires three full-time staff.

However, complex issues may occasionally arise that junior staff cannot resolve effectively. A

lack of access to the expertise of senior personnel could increase the workload, costs, or the

likelihood of human errors if, for example, a corrective action developed by junior staff was not

the optimum approach.

Another factor that may impact access to expertise is the aging workforce in the nuclear power

industry. Many of the individuals who were involved in plant construction and start-up activities

are reaching retirement age. As they leave the workforce, these individuals often take with them

extensive and irretrievable information about the design, construction, operation and

maintenance of the specific systems and components with which they worked over the years.

Efforts to document their knowledge and extended turnovers to the junior staff may capture some

of the knowledge they have accumulated. It has been the case at times, however, that the

knowledge was simply lost, with the result that errors have occurred as junior staff “learn the

ropes.”

13.1.2.2 Staff Size

The number of individuals who are available to support planned and unplanned activities is a key

staffing issue. Organizations must ensure that adequate numbers of personnel are available to

accomplish on-going work activities timely and to address the unplanned activities, or plant

events, that may occur. On the other hand, too many staff may hamper performance on some

tasks. Manpower planning and analyses ensure that the staff size supports human performance.

Surges in workload, such as outages at nuclear power plants, typically require staff augmentation

as well as longer work hours for permanent staff. The introduction of contractor personnel or

licensee personnel from other sites may increase the likelihood of errors due to unfamiliarity

with the plant, its procedures and hardware, for example. Longer work hours have the potential

to increase fatigue, which also contributes to the likelihood of error.

A key consideration in establishing the shift schedule is the staff size and composition that would

be required to respond to an event during the period in which the Emergency Response

Organization is recalled. This period generally lasts for the first hour of the event due to

activation and personnel transit time to the site, especially on the back shift. The occurrence of

an event typically involves a substantial increase in workload. Insufficient staff to meet the

increased demands will exacerbate the stress naturally experienced by personnel on-shift at the

time an event occurs and increase the potential for errors, as discussed below.

Workload may also be increased by organizational changes. For example, in order to reduce

costs, some organizations reorganize and re-assign job responsibilities. Others may implement a

local or across-the-board hiring freeze and attractive early retirement packages, to reduce staff
13-3

size through attrition. In the absence of careful planning and workload analysis, these efforts to

reduce personnel costs may result in an increase in human performance problems. Morale may

suffer if personnel are “required to do more with less” and are unable to complete their assigned

work on schedule. Or, staff may feel constant pressure to “do more” and so take shortcuts or

rush through their tasks, leading to errors. Personnel may find themselves working longer hours

over the long-term, which may result in increased fatigue and an increase in the likelihood of

errors. And, if the potential loss of expertise associated with buy-out packages for senior staff is

not considered, errors may increase as junior staff members assume new responsibilities.

Maintaining a larger staff or assigning more staff to a task does not always improve performance.

Organizations can become “bloated” and develop inefficient, bureaucratic work methods if the

number of personnel available is greater than the workload. In addition, the assignment of

multiple staff to a task may increase task complexity by increasing the amount of communication

and coordination required among personnel. For example, some maintenance tasks may require

expertise in both mechanical and electrical maintenance. If two specialists are used to perform

the task, it is likely that they will need to communicate about the work and coordinate their

activities. These ancillary tasks of coordinating and communicating introduce increased

opportunities for error. One individual who is qualified in both specialties may be able to

perform the task more effectively.

13.1.3 Task Overload

The primary consequence of inadequate shift staffing is task overload. Task overload exists

when the number of tasks that must be accomplished in a given period of time exceeds the

available personnel resources. There are various work management strategies for responding to

task overload including:

• task prioritization and deferral or slippage

• increasing the work pace

• task delegation.

These strategies may lead to errors in some circumstances. For example, tasks may be

inappropriately deferred so that systems or components are unavailable when needed. Increasing

the work pace may lead to shortcuts or errors due to rushing. Task delegation may result in tasks

being performed by individuals who do not have the expertise to perform them correctly. Task

overload may increase stress, leading to errors.

13.2 DIRECT CAUSES OF STAFFING-RELATED ERRORS 

A direct cause of a staffing-related error describes the characteristics of staffing practices that

caused or contributed to the error. Examples of direct causes for staffing-related errors are

presented below.

Expertise Not Available – The correct mix of qualified personnel was not available on

staff to perform the work. For example, a lack of available expertise resulted in delaying
13-4

task performance until a qualified person could be called in, or the task was assigned to a

less qualified person who committed an error.

Insufficient Staff Available – Task performance failed because adequate numbers of

personnel were not available to perform the work. As a result, work management

strategies were employed and the level of stress increased, leading to errors.

Too Many Staff – Task performance failed because too many workers were assigned to

the job. As a result, communication and coordination burdens were increased, which

increased the opportunity for errors.

13.3 PROGRAMMATIC CAUSES FOR STAFFING-RELATED ERRORS

Programmatic causes of errors related to staffing are typically found in the licensee's business

planning and work scheduling programs. Other programs may also be implicated. Common

programmatic causes of errors related to staffing include:

Human Resources – Most licensees develop some form of a business plan that defines

organizational goals and objectives. Business plans are often used to estimate the

resources required to achieve the goals and run the business. Business plans may be used

to determine staffing levels for the various parts of the corporate organization, sometimes

without manpower planning and analyses of anticipated workload levels. As a result,

there may be insufficient staff or staff may not have the required expertise.

Work Planning and Control - The work planning and control system is often used as an

integrated scheduling tool to match the workers to support specific jobs. Weaknesses in

the work planning and control system may result in the assignment of too few or too

many personnel for a job or fail to ensure that only qualified personnel are assigned.

Shift Staffing - All licensees establish a shift staffing policy that defines the minimum

required levels of shift personnel. This policy is often integrated with the scheduling of

individuals to shifts and overtime management. If these policies are not clearly defined,

the lack of clarity can cause staffing deficits that set the stage for human errors.

Training – The training program ensures that personnel are qualified for their jobs and

that managers are trained to implement shift staffing and overtime policies. Sometimes,

these policies may be difficult to understand. Weaknesses in the training program may

fail to assure that supervisory personnel understand staffing requirements, for example.

Human Factors Engineering – The human factors engineering program ensures that

the number of personnel required and the expertise they will need are considered

whenever new equipment or systems are installed. Weaknesses in this program may

result in too few or too many personnel assigned to a job or in the installation of

systems that staff cannot operate with their existing KSAs.
13-5

13.4 ADDITIONAL RESOURCES ON STAFFING

• U.S. Code of Federal Regulations, Part 50.54(m), Conditions of licenses, Title 10,

Energy (revised periodically). Washington, DC: U.S. Government Printing Office.

• U.S. Code of Federal Regulations, Appendix R to Part 50, Quality assurance criteria for

nuclear power plants and fuel reprocessing plants, Criterion III (H), Fire brigade, Title

10, Energy (revised periodically). Washington, DC: U.S. Government Printing Office.

• U.S. Nuclear Regulatory Commission (1995). Results of shift staffing study (Information

Notice 95-48). Washington, DC: U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1991). Shift staffing at nuclear power plants

(Information Notice 91-77). Washington, DC: U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1983). NUREG-0737 technical specifications

(Generic Letter 83-02). Washington, DC: U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1983). Clarification of TMI action plan

requirements (NUREG-0737, Supplement 1). Washington, DC: U.S. Nuclear

Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1982). NUREG-0737 technical specifications

(Generic Letter 82-16). Washington, DC: U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1981). Standard review plan, (NUREG-0800),

Chapter 13, Conduct of operations, Sections 13.1.1-13.1.3. Washington, DC: U.S.

Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1980). TMI action plan (NUREG-0737).

Washington, DC: U.S. Nuclear Regulatory Commission.

• Hallbert, B.P., Sebok, A. and Morisseau, D. (2000). A study of control room staffing

levels for advanced reactors (NUREG/IA-0137). Washington, DC: U.S. Nuclear

Regulatory Commission.
14-1

14 SUPERVISION

14.1 SUPERVISION AND HUMAN PERFORMANCE

Supervision is the process by which work is directed and overseen by first-line management.

Successful supervision requires a combination of leadership skills and technical competence.

Supervision differs from peer checking or quality control because a supervisor has line

management responsibility for the worker(s) as well as responsibility for the work activity.

Supervision is more than the moment-to-moment direction of a work activity. Successful

supervision requires the assessment and shaping of worker attitudes and motivation,

communication and implementation of management expectations for performing work, the

assignment of the best-qualified workers to various tasks, as well as the technical competence to

identify incorrect actions and stop improper activities before an error is committed. Effective

supervision involves directing the work, overseeing how it is performed and leadership.

14.1.1 Direction

Directing work activities includes defining desired outcomes, planning, organizing and

controlling work, and problem solving. Direction occurs during preparation for a task and during

task performance.

The role of supervision during work preparation is to assure that the personnel who will be

performing the task have the information and resources required to perform effectively. These

resources include knowledge of the goal(s) of the work activity as well as management

expectations for how the work is to be performed. Goals and expectations are often

communicated during pre-job walkthroughs of the task environment and in pre-job briefings.

Supervisors may also be required to ensure that the personnel assigned to perform the task are

qualified, that the necessary tools and equipment are available, and that procedures and other

instructions for performing the task, such as those included in a work package, are complete and

understood by the workers. Supervisors may be responsible for verifying that the prerequisite

conditions for tagging equipment out-of-service are met before the work begins and for obtaining

authorization to start the task.

Supervisors act as a resource during performance of the work activity. Workers may call on

them to answer questions, provide instructions in ambiguous or unanticipated situations and

problem-solve. Supervisors also are the interface between the work group performing the task

and other parts of the organization, including more senior management. Interface responsibilities

may include requesting additional resources to complete the task, obtaining authorization to

change the work plan or stopping work if unexpected conditions arise.

Personnel generally respond well to a supervisor when they have confidence in his or her

technical background. Conversely, a supervisor with inadequate technical qualifications can

foster resentment and degrade team performance because the supervisor cannot fulfill some of

his or her responsibilities to the team. A first-line supervisor who is not technically competent

may direct the work incorrectly.
14-2

Errors due to poor supervisory direction may arise when any of the supervisor’s responsibilities

for directing the work are not met. For example, on a task that will be repeated several times on

different components, a supervisor may decide that a walkthrough and the pre-job briefing need

only be done once before the task is performed the first time. If the same task is performed over

several weeks or days, system configurations may change between jobs or the personnel who are

on-shift and assigned to perform the work may change. Without the walkthrough and briefing

before the task is performed each time, personnel may commit errors because they are unaware

of changed plant conditions or newly assigned personnel may not have a full understanding of

the task requirements.

14.1.2 Oversight

In addition to directing work activities, first-line supervisors typically are responsible for

overseeing performance of the work. Supervisory oversight entails monitoring the work activity

to ensure it is performed in accordance with the work plan, procedures and management

expectations.

Effective supervisors are technically qualified to independently detect and correct errors, with

the same or a superior level of technical knowledge as the worker performing the task. Although

this is not always possible, it is important for high risk, complex activities. The best supervisor

for a particular task is not always a higher-level manager who may be less familiar with the

details of the task. A worker who was recently promoted to the ranks of first-line supervisors

may provide more effective oversight if he or she has recent technical knowledge of the activity

and has mastered the necessary supervisory skills.

The supervisor may or may not participate in the work assignment, but if he or she participates,

the ability to concurrently provide oversight may be momentarily lost or reduced. The key

element of supervisory oversight is that it provides a “second pair of eyes” not involved in the

work activity that can detect errors and act promptly to correct them.

14.1.3 Leadership

Leadership involves motivating personnel, building trust, maintaining accountability and

empowering action. As the first level of line management, the supervisor plays a key role in

establishing and maintaining the work group’s norms, values and safety culture. In addition, the

supervisor’s leadership style will affect the team’s performance.

Supervisors translate and apply general organizational goals and management expectations to the

specific activities of the work group. This process occurs both overtly, with explicit

communications about goals and expectations, as well as indirectly. Goals and expectations, for

example, may be communicated indirectly by the example the supervisor sets with his or her

work behavior, such as the extent to which he or she takes short-cuts when performing tasks.

Expectations may also be indirectly communicated through tacit behaviors, such as a failure to

correct worker actions that achieve production goals while circumventing safe work practices.

Supervisors also communicate goals and enforce management expectations through the worker

behaviors that they reward with recommendations for promotions, merit raises and/or bonuses,

desirable work assignments, training opportunities and overtime allocations, and even with such
14-3

subtle rewards as individual attention for some subordinates. Supervisors may overtly or

covertly discourage a questioning attitude among workers, for example, by not taking time to

fully answer questions during meetings, or, at an extreme, by ridiculing staff members who raise

questions and concerns.

In addition to communicating organizational goals and management expectations, the

supervisor’s leadership style affects team performance. The research literature shows that

leadership styles generally range from participative, with a focus on establishing and maintaining

good interpersonal relations, to authoritarian and task-focused. The most effective leadership

style in a given work situation depends upon the characteristics of the work situation and of the

team members.

A participative leadership style is effective when team members are experienced, the task is

moderately structured, and time pressure is absent. For example, a brainstorming session for the

development of an improved work control process will benefit from participative leadership

where the formal operational lines of authority are suppressed and the participants interact as

equals.

A more authoritarian leadership style is effective when team members are new to the task, the

work is either unstructured or is highly structured, or the work must be completed under time

pressure. In a nuclear power plant control room, for example, authoritarian leadership would be

critical during emergency operations if a crew were faced with new and unanticipated

circumstances and had to respond rapidly.

An effective supervisor adapts his or her personal style to the requirements of the task at hand.

This flexibility does not come naturally to many people and supervisory training may be required

to modify an individual’s leadership style. For example, an experienced first-line supervisor

with a strong authoritarian personality that served him or her well in the maintenance department

may have to adopt a more participative, coaching style of leadership when he or she is promoted

to a management position. Supervisors who are able to change leadership style to adapt to the

demands of the situation lead consistently high performing teams.

Mismatches between the leadership style applied in a given work situation and the task demands

may cause or contribute to errors in several ways. For example, team members may attempt to

debate a verbal instruction from a supervisor who has been consistently participative at a time

when it is necessary to implement an order promptly. A consistently authoritarian leadership

style may discourage team members from offering ideas that could solve a problem or from

raising valid concerns when their input could prevent an unwanted outcome.

14.2 DIRECT CAUSES OF SUPERVISION ERRORS

A direct cause of a supervision error describes the characteristics of supervision that either

caused the human error or failed to prevent a human error when prevention was possible.

Supervision may play a role in errors through weaknesses in direction, oversight or leadership.

Specific examples of direct supervisory causes for errors are presented below.
14-4

14.2.1 Direction

Task goals not defined – Task performance failed because personnel were not informed

of the goals of the task by supervision prior to starting the job. As a result, for example,

the job may be performed on the wrong system or equipment or performed incorrectly.

Task methods not defined – Task performance failed because personnel did not receive

necessary guidance from supervision regarding management expectations for how the

task was to be performed. The supervisor may not have provided a pre-job briefing or

ensured that the work package was complete and included the necessary drawings or

procedures.

Unusual or hazardous conditions not identified – Task performance failed because

unusual or hazardous conditions at the worksite were unknown to the workers.

Supervision may not have walked down the job in advance with the workers to identify

any unusual equipment or environmental conditions that could require special tools or

equipment or a change to the planned work methods. As a result, errors may occur when

the workers encounter unexpected conditions.

Prerequisites not met – Task performance failed because supervision did not ensure that

all of the prerequisite conditions were met prior to allowing the job to start. As a result,

for example, necessary tools and equipment were not available to perform the work

timely, or the equipment was not tagged out and ready for the work to be performed.

Authorization not obtained – Task performance failed because supervision did not ensure

that authorization was received before the job was started, or, if the work was delayed,

that the authorization continued to be valid. As a result, for example, the job may have

conflicted with other work being performed or safety systems may have been taken out of

service without the control room's knowledge.

Resources not provided – Task performance failed because supervision did not ensure

that workers had the resources required to perform the task. These resources could

include information, procedures, guidance or assistance in solving problems that arise.

Qualifications not assured – Task performance failed because supervision assigned

workers to tasks for which they were not qualified. As a result, errors were committed

and the task was performed incorrectly or incompletely.

Decisions/guidance incorrect – Task performance failed because supervision was not

technically competent to direct the work activity and so made decisions or provided

guidance that was technically incorrect.

14.2.2 Oversight

No oversight – Task performance failed because supervision was not present during the

performance of important tasks or critical portions of a job, with the result that errors

were not detected, corrected or prevented.
14-5

Oversight unqualified – Task performance failed because supervisory oversight was

present, but was not sufficiently familiar with the work to detect and correct or prevent

errors.

Oversight distracted – Task performance failed because supervision was involved in

performing the job or attending to other matters.

14.2.3 Leadership

Wrong goals – Task performance failed because supervision communicated, directly or

indirectly, an emphasis on production or cost goals over safety. As a result, for example,

workers may have skipped steps or used alternate methods to those prescribed in the

procedures or work package to complete the job quickly.

Questioning attitude discouraged – Task performance failed because supervision, directly

or indirectly, discouraged workers from questioning work practices or instructions. As a

result, workers may have taken actions that they believed were incorrect or possibly

unsafe, or started work without fully understand the task.

Mismatched leadership style – Task performance failed because there was a mismatch

between the supervisor’s leadership style and the task demands. As a result, teamwork or

morale were adversely affected and led to errors.

14.3 PROGRAMMATIC CAUSES OF SUPERVISION ERRORS

Programmatic causes for supervision errors are typically found in the licensee’s human resources

and training programs. Licensee human resources programs are responsible for ensuring that

personnel selected and promoted to supervisory positions are qualified to supervise. Selection

and promotion processes screen for technical qualifications and often also assess candidates’

decision-making capabilities, leadership skills and other attributes that predict success in the

position. Technical training and training in supervisory skills assure that supervisors can fulfill

their functions. Other programs may also be implicated.

14.4 ADDITIONAL RESOURCES ON SUPERVISION

• U.S. Nuclear Regulatory Commission (2000). Qualification and training of personnel for

nuclear power plants (Regulatory Guide 1.8, Rev. 3). Washington, DC: U.S. Nuclear

Regulatory Commission

• U.S. Nuclear Regulatory Commission (2000). Medical misadministrations caused by

human errors involving gamma stereotactic radiosurgery (gamma knife) (Information

Notice 2000-22). Washington, DC: U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1981). Standard review plan, (NUREG-0800),

Chapter 13, Conduct of operations, Sections 13.1.1-13.1.3. Washington, DC: U.S.

Nuclear Regulatory Commission.
15-1

15 HUMAN-SYSTEM INTERFACE

15.1 THE HUMAN-SYSTEM INTERFACE AND HUMAN PERFORMANCE 

In NUREG-0711, " Human Factors Engineering Program review Model," the human-system

interface (HSI) is defined as the technology through which personnel interact with plant systems

to perform their functions and tasks. The major types of HSIs include alarms, information

systems, and control systems. Each type of HSI is made up of hardware and software

components that provide information displays, which are the means for user-system interaction,

and controls for executing these interactions. Personnel use of HSIs is influenced directly by (1)

the organization of HSIs into workstations (e.g., consoles and panels); (2) the arrangement of

workstations and supporting equipment into facilities, such as a main control room, remote

shutdown station, local control station, technical support center, and emergency operations

facility; and (3) the environmental conditions in which the HSIs are used, including temperature,

humidity, ventilation, illumination, and noise.

Use of the HSI is also affected indirectly by other aspects of plant design and operation,

including training (Section 9), supervision (Section 13), staffing (Section 14), and

communications (Section 17), which are addressed in other modules. Plant procedures also are

considered part of the HSI, as defined by NUREG-0711. However, in the HPEP, a separate

module (Section 11) addresses the information content and design of procedures, while this

section addresses the user-system interface considerations of computer-based procedure systems

as part of the HSI.

In determining the causes of a human performance problem, the licensee may identify specific

characteristics of the HSI that led to error. Methods for evaluating HSI characteristics and

detailed review guidelines are available in NUREG-0700, "Human System Interface Design

Review Guideline." The major topics to consider in evaluating the HSI and determining whether

HSI characteristics had an impact on an error are summarized below.

15.1.1 HSI Design Process

Licensees are responsible for the original design of an HSI and any subsequent upgrades and

modifications, whether the licensee, a contractor or vendor did the work. A central concern of

the design process is ensuring that the HSI will support correct human performance.

There are three important goals to be achieved in the design and implementation of an HSI.

These are:

• Design for operability refers to designing the HSI to be consistent with the abilities and

limitations of the personnel who will be operating it. Weaknesses in the design processes

can result in an HSI that is not well suited to the tasks that personnel must perform to

ensure plant safety, resulting in increased workload, decreased performance by personnel,

and an increased likelihood of errors.
15-2

• Design for maintainability refers to designing the HSI and associated plant equipment

to ensure that personnel are able to perform necessary maintenance activities efficiently.

Weaknesses in the design process can result in systems that impose excessive demands

on personnel for maintenance and, therefore, are prone to maintenance errors or problems

with reliability and availability.

• Design for implementation refers to the way that changes, such as upgrades to the HSI,

are planned and put into use. A new HSI component may require the user to perform

functions and tasks in new ways. Skills that the user developed for managing workload

when using the former design, such as ways for scanning information or executing

control actions, may no longer be compatible with the new design. The new HSIs must

also be compatible with the remaining HSIs so that operators can use them together with

limited possibilities for human error. Also, HSI modifications may not be installed or put

into service all at one time, causing the user to adapt to temporary configurations that are

different from both the original and final configurations. Weaknesses in HSI

implementation can increase operator workload and the likelihood of errors.

15.1.2 HSI Characteristics

The characteristics of HSIs that have been found to affect human performance are discussed

below. In this section, each HSI characteristic is introduced and defined, and the potential

impacts of HSI weaknesses on performance are briefly discussed.

15.1.2.1 Information Display

Information display refers to the way that information is presented to personnel. Both the

display devices and the displays contained in the devices are addressed by this topic. Display

device considerations include their location in the work environment and factors that affect

legibility, such as brightness and flicker. Display considerations include how information is

organized and presented within the display device. A display page is a set of information that is

presented at one time by a display device. Display formats refer to standard groupings of

information within pages, including text, tables, graphs, and mimics. Display elements refer to

the items that make-up the formats, such as characters, numbers, symbols, and icons. Other

considerations include whether needed information is present and available, and the quality (i.e.,

reliability) of the plant data provided to the user. Weaknesses in information display can affect

the ability of personnel to promptly and correctly detect, read, and understand information

needed to perform their tasks.

15.1.2.2 User-System Interaction

User-system interaction is the set of methods provided in a computer system through which

personnel and the computer communicate with each other. The following topics are included.

User input formats refers to the type of dialogue between the user and the computer. Cursors

are pointers that indicate the position of the user’s operation on a display screen. System

response refers to the manner in which the computer system behaves after receiving inputs from

the user. Managing displays refers to the actions performed by a user to control the way that

individual displays are presented on a device. Managing information refers to capabilities that
15-3

allow the user to create, change, store, and retrieve documents via the computer. Managing

errors refers to features that support the prevention, detection, and correction of errors. Help

refers to features that provide guidance to the user (e.g., describes how the user interface works).

System security includes features that restrict personnel access to aspects of the computer

system to prevent accidental or deliberate damage. Weaknesses in user-system interaction can

increase the amount of effort for the user to find and arrange needed information. These

weaknesses can also inhibit the user’s ability to prevent, detect, correct, and recover from errors.

15.1.2.3 Controls

Controls are devices that personnel use to interact with the HSI and the plant. They may be

conventional, hardwired control devices or computer-based input devices. Weaknesses in the

design of control devices, whether conventional or computer-based, can interfere with the ability

of users to perform control or input actions promptly and without errors.

15.1.2.4 Alarm Systems

Alarm systems are automated systems consisting of processing and display hardware and

software, which analyze signals from plant sensors and alert the operator via visual or auditory

displays (i.e., when the monitored parameters deviate from specified limits). Important

characteristics include processing functions; information display; user-system interaction;

controls; reliability; test and maintenance capabilities; failure indications; alarm response

procedures; control-display coordination; and its integration with the rest of the HSI. Alarm

system weaknesses can increase personnel workload associated with finding and assessing plant

information and decrease operator awareness of plant status.

15.1.2.5 Soft Control Systems

These are computer-based systems that provide operators with control interfaces that are

mediated by software rather than direct physical connects, as in hard-wired knobs and buttons.

Soft controls can be used to control plant equipment, such as a pump, or the HSI, such as in

selecting a display. Important characteristics of soft control systems include the information

display, user-system interaction, controls, and integration with the rest of the HSI. Weaknesses

in the design of soft control systems can increase the likelihood of human performance problems,

such as unintentional actuation, incorrect inputs (i.e., wrong control, wrong input value), and

delayed completion of control actions.

15.1.2.6 Computer-Based Procedure Systems

These systems present plant procedures in computer-based rather than paper-based formats.

Computer-based procedures (CBP) systems can present procedures steps and plant status

information in ways that better support decision-making. They can also include capabilities for

managing multiple procedures and procedure steps. Important characteristics include processing

capabilities (automation for procedure functions), information display, user-system interaction,

controls, and integration with the rest of the HSI. Weaknesses in the design of CBP systems can

increase workload associated with assessing plant status and selecting appropriate responses and

decrease operator awareness of plant status.
15-4

15.1.2.7 Computerized Operator Support Systems

These systems use computer technology to support operators or maintenance personnel in

situation assessment and response planning. They can monitor status and provide

recommendations or warnings. Example applications include: fault detection and diagnosis,

safety function monitoring, plant performance monitoring, core monitoring, maintenance

advising, and operator support for plant control. Important characteristics include processing

capabilities, information display, user-system interaction, controls, and integration with the rest

of the HSI. Weaknesses in the design of computerized operator support systems can increase

workload associated with assessing plant status and selecting appropriate responses and decrease

operator awareness of plant status.

15.1.2.8 Workstations

Control, display, and alarm devices of the HSI are often organized into workstations where crew

functions and tasks are performed. Examples include sit-stand workstations, stand-up consoles,

sit-down consoles, vertical panels, and desks. Workstation characteristics affect reach, vision,

comfort, the ability to gather and compare information across display devices, and the ability to

use control and display devices in a coordinated fashion. Weaknesses in workstation design can

interfere with the ability of personnel to detect important information or accurately perform

control and computer input actions.

15.1.2.9 Control Room

A control room is a facility in which controls and displays of the HSI are centralized (e.g., the

main control room and the technical support center). Two important aspects of a control room

are its configuration (i.e., its arrangement of workstations and other equipment) and its

environment (i.e., the adequacy of lighting, temperature, humidity, and ventilation for normal

and emergency conditions). Weaknesses in control room layout may interfere with the ability of

personnel to detect and monitor information and interact with each other. Weaknesses in

lighting may affect the ability of personnel to accurately read displays, procedures, and other

information sources. Weaknesses in lighting, temperature, humidity, or ventilation may also

affect personnel alertness, comfort, and health.

15.1.2.10 Local Control Stations

Local control stations are places outside of the main control room, where operators interact

with the plant. They may include multifunction workstations and panels, as well as individual

interfaces, such as controls (e.g., valves, switches, and breakers) and displays (e.g., meters and

VDUs). When implemented in environments that are not as carefully controlled as the main

control room, local control stations may have special considerations such as high levels of

background noise and severe environmental conditions. Weaknesses in control station layout

may interfere with the ability of personnel to detect and monitor information, perform control

actions, and interact with other personnel. Weaknesses in lighting may affect the ability of

personnel to accurately read displays, procedures, and other information sources. Weaknesses in

temperature, humidity, or ventilation may affect personnel performance, comfort, health, and

safety.
15-5

15.1.2.11 Maintainability Features

All plant equipment, including the HSI, must be periodically maintained. The design of the

maintenance interfaces of plant equipment and the tools used in maintenance tasks can affect

personnel performance for these tasks. Maintainability refers to the design of features and

capabilities that support personnel in detecting equipment failures and performing necessary

preventive, routine, and corrective maintenance. This includes the layout of components that

must be maintained, labels and markers, controls for adjusting equipment, test points, service

points, and test equipment (e.g., the user interfaces and capabilities of diagnostic devices). An

area that is posing increasing human performance challenges in NPPs is the maintenance of

digital systems, due to the complexity of these systems and their susceptibility to incorrect

actions. Some maintainability considerations for digital systems include the design of:

instrument cabinets and racks, equipment packaging within these enclosures, and fuses and

circuit breakers. Weaknesses in the design of maintenance interfaces and tools can increase the

likelihood of maintenance errors and the amount of time needed to complete maintenance tasks.

This may increase the occurrence of plant transients or decrease the availability of plant

equipment needed to ensure plant safety.

15.2 DIRECT CAUSES OF HSI-RELATED ERRORS

A direct cause of an HSI-related error describes characteristics of the HSI that caused task

performance to fail. There are a number of ways in which the HSI may cause, contribute to or

fail to prevent an error. These include:

15.2.1 Information Display

No display or information not available – Needed information was not displayed or the

information that a display was intended to provide was not available. As a result, the user

did not have access to the information needed to perform the task.

Display formats, elements or pages unsuitable – The display was formatted (e.g., text,

tables, graphs, mimics, speech output) or display elements (e.g., characters, numbers,

symbols, icons) were presented in a manner that made them difficult to read, understand

or use. As a result, personnel did not or could not use the information displayed when

performing the task.

Data quality and update rate inadequate – The display did not provide useful indications

of the quality of the data that was provided or the update rate of the data was too slow to

be useful. As a result, users were unable to depend on and use the information displayed

to guide task performance.

Display equipment inadequate – The equipment used to display information (e.g., VDUs,

printers, plotters, meters, light indicators, numerical readouts, and audio devices) did not

work or was unsuitable for performing the task. As a result, users did not have access to

necessary information.
15-6

15.2.2 User-System Interaction

User input formats unsuitable – The format provided by which personnel interacted with

the system (e.g., command language, menus, function keys, response entry forms, direct

manipulation, query language) was unsuitable for the task. As a result, user inputs were

delayed or input errors occurred.

Cursor inadequate – The type of cursor provided was too small or otherwise difficult to

see on the screen, or was difficult to manipulate and understand. As a result, task

performance was delayed or input errors were committed.

System response inadequate – The HSI did not provide adequate feedback to the user or

response times were too slow. For example, prompts regarding the expected input were

not provided, no feedback was given when the user entered an input, or the time between

an input and the system’s response to it was too slow to maintain control.

Display management difficult – Methods for managing displays (e.g., selection,

navigation, freeze/update, scroll, page, pan and zoom) were not provided or difficult to

use. As a result, personnel could not access needed information or could not access it

timely.

Information management inadequate – Means to create, change, store and retrieve

documents were not provided or were difficult to use. As a result, needed information

was lost.

Errors difficult to detect and correct – The HSI did not provide means to catch input

errors or provide easy means to correct them. As a result, errors were made and neither

detected nor corrected.

Help function missing or inadequate – Assistance in using the system was not provided or

was difficult to access. As a result, personnel could not use the system to perform their

tasks.

System not secure – Security features were missing. As a result, personnel caused

accidental or deliberate damage.

15.2.3 Controls and Soft Control Systems

Controls not available – The HSI did not provide all the controls necessary to perform the

task. For example, controls were not available for selecting plant variables to view or to

act upon or means were not provided for monitoring feedback.

Controls not integrated – Control actions or control devices were inconsistent or

incompatible with other aspects of the HSI. As a result, personnel took incorrect actions

when operating the controls.
15-7

Computer-based input devices inadequate – The input devices (e.g., keyboards,

trackballs, joysticks, mice, touch screens, light pens, graphic tables and speech input

devices) did not work or were unsuitable for the task. As a result, user inputs were

delayed or errors committed.

Conventional control devices inadequate – The hardwired control devices (e.g., push

buttons, rotary controls, thumbwheels and switches) did not work or were unsuitable for

the task. As a result, control actions were delayed or errors occurred.

No backups – Alternate means for taking control actions on critical tasks were not

provided should the controls fail. For example, no hardwired backups for soft controls

were available, if the soft controls failed.

15.2.4 Alarm Systems

Alarm functions missing – Alarms to alert, inform, guide or assist personnel were not

provided. As a result, personnel did not detect important changes in system state or did

not have access to needed information to perform their tasks.

Alarm display inadequate – Necessary information was not presented in either an

auditory or visual format that was effective in drawing attention and conveying detailed

information. As a result, personnel had difficulty detecting and diagnosing system states,

leading to errors.

User-alarm interactions inadequate – Silence, acknowledge, reset and test controls were

not provided or did not function correctly. As a result, the user was unable to interact

effectively with the alarm.

Failure indications missing – The alarm system did not indicate when it was not

functioning or it was difficult to determine whether the alarm was operable. As a result,

personnel were not aware that alarms were not operable and so did not detect important

changes in plant state.

Alarm response guidance missing – Detailed information about alarm conditions and

appropriate actions to take in response to alarms (e.g., alarm response procedures) was

not available to personnel. As a result, response was delayed or incorrect.

Alarms not integrated – Display and control arrangements for the alarm system were

difficult to use or were inconsistent or incompatible with the rest of the HSI. As a result,

incorrect actions were taking when interacting with the alarms or use of the alarm system

interfered with actions required by other aspects of the HSI.

15.2.5 Computer-based Procedures and Operator Support Systems

Information missing or inadequate – The computer-based procedures or computerized

operator support systems did not provide the information users required or it was not
15-8

presented in a format that supported performance. For example, the level of detail was

insufficient to assist personnel in decision-making.

User-system interactions inadequate – The computer-based procedures or computerized

operator support system displays and controls were difficult to understand or manipulate.

As a result, personnel responses were delayed or incorrect.

Not integrated – The computer-based procedures or computerized operator support

systems were inconsistent or incompatible with the rest of the HSI. For example, control

and display devices operated differently from those used for other systems leading to

errors.

No backups – No alternate hard-copy procedures or hardwired systems were provided in

case of computer-based procedures or computerized operator support system failures. As

a result, if the systems failed, personnel had no procedural guidance for performing their

tasks.

15.2.6 Workstations

Configuration inadequate – The workstation design did not support user reach, vision or

comfort. As a result, for example, personnel became fatigued, could not see important

information or were delayed in taking control actions.

Layout inadequate – The layout of controls and displays on the workstation did not

support control actions. As a result, personnel became fatigued or made errors when

using the controls.

Labeling and demarcation inadequate – Labels and markings did not assist users in

finding and identifying controls, displays and other equipment. As a result, for example,

personnel used the wrong controls for the intended action or read the wrong display.

15.2.7 Control Room

Space and layout inadequate – Sufficient space was not available or equipment was laid

out in ways that it was difficult for personnel to view or access information, communicate

or walk around. Or, there was inadequate space available to store needed procedures,

other documents, spare parts, expendables, tools, protective equipment and personal

items. As a result, for example, procedures could not be laid out so that placekeeping

was difficult or needed items were lost and prevented task completion.

Supervisor inaccessible – Access to the shift supervisor’s office via walking or

communication links was difficult. As a result, the supervisor was unavailable when

needed or was unable to maintain awareness of control room activities.
15-9

Multi-units not distinguishable – Features to distinguish between controls and displays

for different units, or mirror-image control rooms, caused personnel to incorrectly

monitor plant parameters or take control actions on the wrong unit.

15.2.8 Local Control Stations

No display or information not available – Needed information was not displayed or the

information that a display was intended to provide was not available. As a result, the user

did not have access to the information needed to perform the task.

No controls or controls not available - The controls necessary to perform the task were

either missing or not working at the local control station. As a result, necessary control

actions could not be performed.

Layout inadequate – The layout of controls and displays at the local control station did

not support control actions. As a result, personnel could not accurately determine system

status and made incorrect operational decisions.

Labeling and demarcation inadequate – Labels and markings did not assist users in

finding and identifying controls, displays and other equipment. As a result, for example,

personnel used the wrong controls for the intended action or read the wrong display.

15.2.9 Maintainability

Equipment inaccessible – The arrangement of components and access to them for

inspection, testing, replacement and repair was inadequate. As a result, maintenance

activities were delayed or errors were committed.

Labeling and demarcation inadequate – Labels or markings did not support proper

identification of equipment and components. As a result, task performance was delayed

while personnel attempted to identify the correct piping.

Adjustment controls missing or inadequate – Control devices for performing adjustments

on equipment were not provided or were inconvenient to use. As a result, setpoints could

not be accurately maintained.

Test and service points missing or inadequate – Test and service points were not provided

or were inconvenient to access and use. As a result, personnel skipped a surveillance

rather than attempt to access a test point.

Test equipment inadequate – Equipment needed for testing was not available, was

difficult to use, was miscalibrated or was otherwise not properly configured for the

maintenance task. As a result, the maintenance task was not completed or equipment

operability following maintenance could not be verified.
15-10

15.3 PROGRAMMATIC CAUSES FOR HSI-RELATED ERRORS

Licensees may have many programs, processes, and practices to ensure that human factors

engineering considerations are properly addressed in the design and installation of the HSI and

other plant equipment, and that human performance considerations continue to be met in ongoing operations after installation. There are three primary programs or processes that may set

the stage for HSI weaknesses that cause errors. These are the HSI design and implementation

process, and maintenance and housekeeping activities. If the display system is not fully

operational, contains outdated information, or has labels that are either illegible due to

accumulated dirt or missing, the licensee should consider programmatic causes related to its

repair, maintenance, and general housekeeping.

HSI Design – The HSI design and implementation process assures that original HSI

designs and upgrades fully meet the needs of operations and maintenance personnel and

that problems are avoided when the new design is put into service. If design and

implementation processes are deficient, weaknesses will exist in the HSI. For example, a

poorly designed display system or controls that are difficult to use may result from an

inadequate design process.

Maintenance – A licensee may have a variety of programs for ensuring that the HSI and

plant equipment are in working order and available for use. These include preventative,

routine, and corrective maintenance programs for both hardware and software

components. An important concern for software maintenance is ensuring that the

computer system is updated with the most current and correct set of instructions and data.

Another maintenance concern is the replacement of missing or degraded labels

throughout the plant. Weaknesses in these programs can result in the HSI being

inadequately or incorrectly serviced, resulting in problems with reliability and

availability.

Housekeeping – Housekeeping includes activities performed to maintain a clean and

orderly work environment. Examples include cleaning labels and displays so they can be

easily read, cleaning input devices so they can be used properly, removing trash and used

materials to eliminate unnecessary clutter, and storing documents so they can be readily

accessed when needed. Housekeeping practices refers to the way these tasks are

performed on an ongoing basis to maintain a productive work environment. Weaknesses

in housekeeping practices can increase operator response time and the likelihood of

errors.

15.4 ADDITIONAL RESOURCES ON THE HSI

• U.S. Nuclear Regulatory Commission (1996). Standard review plan for the review of

safety analysis reports for nuclear power plants (NUREG-0800). Washington, D.C.: U.S.

Nuclear Regulatory Commission.
15-11

• U.S. Nuclear Regulatory Commission (1996). Human System Interface Design Review

Guideline (NUREG-0700, Rev 1.). Washington, DC: U.S. Nuclear Regulatory

Commission.

• U.S. Nuclear Regulatory Commission (1994). Human factors engineering program

review model (NUREG-0711). Washington, DC: U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1994). Human Factors Engineering Guidance for

the Review of Advanced Alarm Systems (NUREG/CR-6105). Washington, DC: U.S.

Nuclear Regulatory Commission.

• Brown, W.S., O'Hara, J.M. and Higgins, J.C. (2000). Advanced alarm systems: Revision

of guidance and its technical basis (NUREG/CR-6684). Washington, DC: U.S. Nuclear

Regulatory Commission.

• O’Hara, J.M., Higgins, J.C., Stubler, W.C. and Kramer, J. (2000). Advanced information

systems design: Technical basis and human factors review guidance (NUREG/CR6633). Washington, DC: U.S. Nuclear Regulatory Commission.

• O’Hara, J.M., Higgins, J.C., Stubler, W.F. and Kramer, J. (2000). Computer-based

procedure systems: Technical basis and human factors review guidance (NUREG/CR6634). Washington, DC: U.S. Nuclear Regulatory Commission.

• Stubler, W.F., O’Hara, J.M., and Kramer, J. (2000). Soft controls: Technical basis and

human factors review guidance (NUREG/CR-6635). Washington, DC: U.S. Nuclear

Regulatory Commission.

• Stubler, W.F., Higgins, J.C. and Kramer, J. (2000). Maintainability of digital systems:

Technical basis and human factors review guidance (NUREG/CR-6636). Washington,

DC: U.S. Nuclear Regulatory Commission.

• Stubler, W.F., O’Hara, J.M., Higgins, J.C. and Kramer, J. (2000). Human Systems

Interface and Plant Modernization Process: Technical Basis and Human Factors Review

Guidance (NUREG/CR-6637). Washington, DC: U.S. Nuclear Regulatory Commission.

• Higgins, J. and Nasta, K. (1997). Human factors engineering (HFE) insights for

advanced reactors based upon operating experience (NUREG/CR-6400). Washington,

DC: U.S. Nuclear Regulatory Commission.

• Brown, W., Higgins, J., and O’Hara, J. (1994). Local Control Stations: Human

Engineering Issues and Insights (NUREG/CR-6146, BNL-NUREG-52400).

Washington, D.C.: U.S. Nuclear Regulatory Commission.
15-12

• O’Hara, J.M., Brown, W.S., Baker, C.C., Welch, D.L., Granda, T.M. and Vingelis, J.P.

(1994). Advanced human-system interface design review guideline: Evaluation

procedures and guidelines for human factors engineering reviews (NUREG/CR-5908,

Vol. 2). Washington, DC: U.S. Nuclear Regulatory Commission.
16-1

16 TASK ENVIRONMENT

16.1 EFFECTS OF ENVIRONMENTAL FACTORS ON HUMAN PERFORMANCE

The task environment refers to the physical conditions in which work is performed.

Environmental conditions that can affect performance include excessive vibration and noise,

temperature extremes and insufficient lighting. These adverse environmental conditions can

stress personnel, interfere with performance and increase the likelihood that they will commit

errors while performing a task. Work conditions that require protective gear, such as high

radiation or some confined space environments, or that require unusual physical postures, also

can interfere with task performance, as may poor housekeeping.

16.1.1 Vibration

There are two types of vibration that may cause errors. The first is whole-body vibration, in

which vibration is transferred to the worker from standing or sitting on a vibrating surface. The

second is object vibration, in which a stationary worker interacts with a vibrating object in some

fashion. The effects of vibration depend upon its frequency and acceleration. Frequency is the

number of oscillations (cycles) that occur in one second. Acceleration is the force, or intensity,

of the vibration.

Whole-body vibration affects personnel comfort levels. As discomfort increases, errors may

occur. Personnel are most uncomfortable when the frequency of the vibration approaches the

resonance point of the human body (5 Hz) and can tolerate only short exposures. Discomfort

also increases as acceleration increases. Discomfort may induce errors by causing personnel to

rush through their work or by distracting them.

Whole-body vibration also affects the ability to control fine hand and arm movements. Vibration

will induce errors in tasks that require accurate hand and arm movement, such as writing, placing

and tightening screws, or attaching jumpers.

Vibration also blurs vision. Errors may occur from vibration on tasks that require accurate

vision, such as reading instruments, procedures or drawings.

Object vibration may also adversely affect performance. For example, errors may occur when

making fine adjustments or in reading instruments, if equipment is vibrating.

16.1.2 Noise

Noise is unwanted sound. Noise can cause errors in several ways. It may disrupt

communications, affect the ability to perform tasks and annoy personnel.

The effects of noise on communications are complex. Even relatively low levels of noise can

mask speech, but only under some circumstances. For example, speakers naturally raise their

voices when there is background noise and may be able to overcome some of its effects on
16-2

communication. Being able to see the speaker's face or using standardized phrases also improves

communication in a noisy environment. The type of background noise also affects

communication. It is easier to communicate over noise that is steady and uniform than noise that

includes sharp tonal peaks, such as background speech.

Noise has been shown to affect decision-making, memory, vigilance, attention and motor skills.

Whether noise will cause errors depends upon (1) the degree of familiarity with the noise, (2) the

complexity of the task the worker is performing and (3) the frequency and intensity of the noise,

measured in decibels.

Familiar noises are usually continuous, such as the sound of freeway traffic or the hum of a

motor. Even high levels of familiar noise typically do not impair performance on simple tasks

and will cause only minor effects on complex tasks, such as reading or decision-making.

Unfamiliar noise is more disruptive. Unfamiliar noise includes speech, alarms and some kinds of

music. Loud and unfamiliar noise may cause only minor performance effects on simple tasks,

but will disrupt performance of complex tasks. Multiple alarms sounding simultaneously in a

control room, for example, could interfere with performance of complex tasks.

Unfamiliar, loud noise is also annoying. Annoyance may cause workers to rush through their

tasks or disrupt teamwork. Unexpected and unfamiliar loud noise, such as sonic booms from

line breaks, may startle personnel.

16.1.3 Heat

Heat exposure is a common problem in many areas of a plant, such as the turbine building when

the plant is operating. The extent to which workers will be affected by heat depends on many

factors. These include physical characteristics, such as age, weight, acclimation to heat, physical

fitness and dehydration. Other factors that determine the effects of heat on performance include

airflow, humidity, clothing and level of physical activity.

As whole-body temperature (a measure of internal body temperature that is estimated

externally by wet-bulb globe temperature - WBGT) increases, first the workers' comfort levels

are affected, then task performance is affected, followed by the onset of heat stress. Performance

of perceptual/motor tasks, such as tracking, monitoring, and manipulating objects, is affected

even at relatively low temperatures (69°F WBGT). Performance on perceptual/motor tasks

degrades over the first two hours of exposure, and then levels off. Performance of mental tasks,

such as arithmetic computations, logical reasoning, and recalling information from memory,

begins to degrade sharply after about 30 minutes of exposure to temperatures above 90°F

WBGT, but then levels off. When workers begin to experience heat stress, they may become

confused and disoriented, in addition to experiencing physical symptoms, and are very likely to

commit errors if they attempt to continue working.

16.1.4 Cold

Exposure to cold affects the performance of manual tasks. Decreases in the ability to control

hand movements begin at an air temperature of approximately 54° F. The fingers may become
16-3

numb to pain at this temperature and touch sensitivity is reduced. Performance of gross manual

tasks, such as those involving the arms and legs is also degraded at 54° F. The speed at which

manual tasks can be performed is affected by the rate of cooling. Slow temperature drops have a

greater negative impact on manual dexterity than rapid temperature decreases, during the initial

exposure period.

Hypothermia occurs when a worker can no longer maintain an adequate deep-body temperature.

In the early stages, individuals experience lethargy, clumsiness, confusion and irritability. As the

hypothermia deepens, hallucinations or arrested breathing will occur.

The effects of cold temperatures on performance are affected by clothing, whether exposed skin

and clothing are wet or dry, air movement (wind chill) and the length of exposure. Performance

impairments may be experienced at higher air temperatures than those discussed above if

workers are not dressed warmly, their skin or clothing is wet, or they are exposed to air

movement or to cold temperatures for extended periods of time.

16.1.5 Lighting

Adequate lighting is required for accurate performance of nearly every task in a nuclear power

plant. Visibility depends upon several factors:

• The intensity of the light radiated by a light source, measured by candle power

• The amount of light striking an object from a light source, known as its illuminance

• The perceived brightness of an object, known as its luminance, which depends upon the

object's reflectance

• The difference between an object's luminance compared to the luminance of the object's

background, or contrast

• The object's size

• The individual worker's age and visual acuity.

Visibility is also affected by changes in light levels as the eyes adapt. Individuals have particular

difficulty seeing while their eyes are adapting to a different level of illuminance, such as entering

a darkened room from full sunlight.

The ability to accurately perceive colors (color discrimination) is also affected by lighting.

Color discrimination may be reduced by the characteristics of the light source. For example,

high-pressure sodium discharge lamps reduce the ability to discriminate colors, while artificial

daylight fluorescent lamps maintain it. Very low lighting levels also adversely affect color

discrimination.

Glare and flicker will also reduce visual performance. Glare occurs when the luminance level

(the amount of light reflected from an object) is annoying. It may reduce contrast, interfere with

reading and inspection tasks and cause visual fatigue. Flicker causes discomfort and eye fatigue

when reading.
16-4

16.1.6 Other Adverse Task Conditions

Other adverse environmental conditions may also affect task performance. In general, any

physical conditions that require the use of PPE or devices complicate task performance, may be

stressful and so may increase the likelihood of errors (see Section 12, Tools and Equipment.)

For example, working in confined or elevated spaces may encourage personnel to hurry through

their tasks and so commit errors. Working in high radiation environments may require that task

performance be repeatedly interrupted to minimize exposures. Poor housekeeping may increase

the likelihood of trips and falls, or obscure displays and controls. Working on ladders or

platforms, or in cramped working conditions that require unusual physical postures may cause

discomfort, can be distracting and may increase the likelihood of errors.

16.1.7 Combinations of Conditions

Most of the research that has examined the effects of environmental factors on human

performance has been done in the laboratory or in other highly controlled settings. In most

industrial settings, environmental factors are not as rigidly controlled and often fluctuate.

Further, in industry, adverse environmental conditions often occur together, such as high noise

levels and excessive heat when high-energy equipment is operating. Large fluctuations in

conditions and combinations of conditions have not been as thoroughly studied. There is some

evidence to suggest, however, that performance degradations are more severe under fluctuating

and/or combined conditions.

16.2 DIRECT CAUSES OF TASK ENVIRONMENT-RELATED ERRORS

A direct cause of a task environment error describes the physical conditions that caused task

performance to fail. There are a number of ways in which characteristics of the task

environment may impair performance. These include:

Vibration - Task performance failed because high levels of whole-body or object

vibration made displays, instruments or documents difficult to read or caused discomfort.

For example, vibration prevented a worker from accurately reading a piping and

instrumentation diagram.

Noise - Task performance failed because high noise levels interfered with

communications, caused discomfort, or impaired mental or physical performance.

Heat - Task performance failed because excessive exposure to heat caused discomfort or

impaired mental or physical performance. Or, the need for frequent work breaks delayed

task completion or increased the communication burden on personnel due to rotations.

Cold - Task performance failed because excessive exposure to cold caused discomfort or

impaired motor performance. For example, workers dropped tools or were unable to

manipulate controls.
16-5

Lighting - Task performance failed because lighting was excessive, insufficient, the

wrong type for discriminating color, or produced annoyance from glare or flicker. For

example, a computer screen was difficult to read due to glare.

Poor housekeeping - Task performance failed because displays or controls were obscured

by trash or equipment that should have been stored. Workers tripped over or were

required to walk out of their way to avoid tools or equipment that should have been

removed.

Workspace - Task performance failed because the worker had insufficient space to

perform the task or had to assume uncomfortable positions.

High radiation – Task performance failed because workers were hurried or their activities

were repeatedly interrupted to avoid excessive exposures.

Combinations of factors - Task performance failed because a combination of

environmental factors impaired performance. For example, a job in the turbine building

involved exposure to heat, noise and low lighting, none of which individually exceeded

levels at which performance is affected, but the combination of conditions distracted the

workers and caused errors.

16.3 PROGRAMMATIC CAUSES OF TASK ENVIRONMENT ERRORS

Programmatic causes of task environment errors are typically found in the licensee's

processes for designing human-system interfaces or in managing maintenance activities.

Other programs may also be implicated. Common programmatic causes of task

environment errors include:

Industrial Hygiene and Radiation Protection – These programs are responsible for

ensuring that task environments have been evaluated to identify hazards and that

needed controls are implemented to minimize exposures. Weaknesses in these

programs may result in personnel working in task environments that are conducive to

errors.

Work Planning and Control - Weaknesses in the work planning and control system may

allow work to be planned without consideration of adverse environmental conditions and

performed without the necessary compensatory measures. For example, communication

devices may not be provided in noisy environments to support task performance. For

tasks that involve unusual physical positions or cramped workspace, additional time to

complete the task may not be scheduled. Rest breaks for hot and cold environments may

not be planned into the work, or additional temporary lighting may not be provided if the

work site is not adequately lighted.

Procedures - Weaknesses in the licensee's procedure development process may result in

the design of procedures that are inappropriate for the conditions in which they will be

used. For example, procedures that may be used at night, outside and in the rain should
16-6

be laminated and the type size should be larger to ensure the procedure can be read.

Procedures that will be used in vibration conditions may also require larger type size than

procedures read in the stationary environment of the control room, for example.

Human Factors Engineering - Weaknesses in the human factors engineering program

may result in the installation of new equipment or systems without consideration of

task environment characteristics. For example, the impact of control room lighting

on the visibility of digital displays or effects of vibration on the legibility of dials or

gauges at local control stations should be considered before installation.

Operating Experience - Reviews of relevant operating experiences of the plant and other

facilities with similar environmental conditions should be conducted to identify and

analyze task environment problems and successful mitigation efforts. Personnel may

have reported task environment conditions that interfered with performance that are

recorded in the licensee's corrective action database, and corrective actions should have

been implemented. Weaknesses in this program will result in repeated errors.

Labeling - Weaknesses in this program may result in tags and plaques that are illegible in

the task environment, if low lighting levels or vibration are present.

16.4 ADDITIONAL RESOURCES ON TASK ENVIRONMENTS

• U.S. Nuclear Regulatory Commission (1992). Shutdown and low-power operation at

commercial nuclear power plants in the United States (NUREG-1449). Washington,

DC: U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1996). Human-system interface design review

guideline (NUREG-0700, Rev. 1, Vol.s 1-3). Washington, DC: U.S. Nuclear Regulatory

Commission.

• Echeverria, D., Barnes, V., Bittner, A., Durbin, N., Fawcett-Long, J., Moore, C., Slavich,

A. Terrill, B., Westra, C., Wieringa, D., Wilson, R., Draper, D., Morisseau, D. and

Persensky, J. (1994). The impact of environmental conditions on human performance: A

handbook of environmental exposures (NUREG/CR-5680, Vol.s 1 and 2). Washington,

DC: U.S. Nuclear Regulatory Commission.
17-1

17 COMMUNICATIONS

17.1 COMMUNICATIONS IN ORGANIZATIONS

Communication is the exchange of information while preparing for or performing work. Verbal

communication occurs face-to-face, by telephone, sound-powered phones or walkie-talkies, as

well as over public address systems. Written communication occurs, for example, through

policies, standards, work packages, training materials, and e-mail.

Communication involves two sets of behaviors: (1) creating and sending messages and (2)

receiving and interpreting them. Communication always involves at least two individuals, the

sender and the receiver, and occurs:

• Between individuals

• Within and among work groups

• In meetings

• In pre-job or pre-evolution briefings

• During shift turnover

Successful communication requires several steps. The sender first develops the intention to

communicate either verbally or in writing. The sender then composes a message that presents

the meaning as clearly as possible. The receiver must pay attention to the message and then

interpret its meaning. If the communication is successful, the receiver interprets the message

consistently with the sender's intended meaning.

The similarity of the meanings given to the message by the sender and receiver can be verified

through feedback. An example of feedback verification in verbal communication is when the

receiver "repeats back" the message and the sender either agrees with the receiver's repeat back

or corrects it. Verification feedback serves an important error-checking function in the

communication process. It also allows supervisory oversight of communications to catch errors

before they have consequences.

A sender and receiver must both be active for communication to be effective. The sender and

receiver share responsibility for ensuring successful communication. However, when licensees

analyze the causes of events, errors in sending messages are more often identified than errors in

receiving. The reasons for the difference are unclear. A licensee's investigation should consider

sending and receiving errors and corrective actions should address both to be effective.

17.2 DIRECT CAUSES OF COMMUNICATIONS-RELATED ERRORS

A direct cause of a communication error describes the characteristics of the communication that

caused it to fail. The direct cause of the error may be characteristics of how the message was

sent or how it was received and interpreted. In some cases, a communication error will be

compounded by failures in verification feedback or supervisory oversight.
17-2

There are a number of ways in which communication can fail. Research regarding

communication errors in nuclear licensee facilities identified eleven direct causes of sending and

five direct causes of errors in receiving:

17.2.1 Sending Errors

Content wrong - Communication failed because the information contained in the message

was incorrect. For example, an operator in the control room refers to the wrong unit

when giving instructions to an operator in the field.

Content inconsistent -Communication failed because, although the information in a

message was correct, it was partially or completely inconsistent with other information

available to the receiver. For example, a required surveillance test appears on a

maintenance worker's schedule but his supervisor assigns him to another job and the

surveillance is missed.

Content inappropriate for the job - Communication failed because the information in a

message was irrelevant or inappropriate for the job at-hand. For example, a work order

references a procedure that contains prerequisite conditions that cannot be met during atpower operations, but the maintenance worker attempts to perform the procedure

anyway.

Content inappropriate for the receiver - Communication failed because the message was

not tailored to the receiver's background, training or level of technical knowledge. For

example, a non-licensed operator is instructed to perform a task on an unfamiliar system

and cannot find it.

Standard terminology not used - Communication failed because complete identification

information was not provided in the message. For example, a maintenance supervisor

refers to a valve using a generic pronoun (e.g., "it"), rather than using the valve's proper

name and number, and the maintenance crew works on the wrong valve.

Familiar terminology not used - Communication failed because unfamiliar terms were

used in the message. For example, the formal name of a building, rather than the sitespecific nickname, is used in a pre-job briefing and the crew is confused about which

building is being discussed.

Message production inadequate - Communication failed because the message was not

produced adequately. For example, a message is garbled when transmitted over the

public address system or cannot be heard against background noise. A written

communication contains typographical errors or copies are illegible.

Necessary information not sent - Communication failed because the information needed

to perform a task was not provided to the worker. For example, a work order omits an

instruction to obtain control room authorization before taking the component out of

service.
17-3

Wrong place or person - Communication failed because necessary information did not

reach the intended receiver. For example, a sender dials the wrong phone number or

incorrectly addresses an e-mail message.

Wrong time - Communication failed because the message was sent too early or too late to

be used by the receiver. For example, a maintenance worker finishes one job early and

starts on the next before her supervisor has the opportunity to communicate that the job

has been rescheduled.

Sending verification failure - Communication failed because the sender did not ensure

that the receiver accepted and accurately interpreted the message. For example, a nonlicensed operator calls the control room to report a leak and can tell that the control room

operator is busy and distracted, so does not request that the control room operator repeat

back the location and rate of the leak.

17.2.2 Receiving Errors

Information not sought - Communication failed because a receiver did not seek the

information necessary to perform a task. For example, a work order references drawings

needed to verify the location of a component, but the planner does not include them in the

work package and maintenance technicians do not obtain and review them before starting

work.

Information not found - Communication failed because the receiver, intentionally or

unintentionally, did not find necessary information for performing a task. For example,

an identification tag on a cable is hidden and the crew decides to perform the task without

positively identifying the cable referenced in the work package, resulting in errors.

Information not used - Communication failed because the information necessary to

perform a task was not used. For example, the need to wear electrical safety PPE is

discussed at a pre-job briefing, but the instrumentation and control technician is in a

hurry and performs the task without it.

Message misunderstood - Communication failed because the receiver misunderstood the

message. For example, a control room supervisor and an operator discuss two related

jobs, one of which requires establishing a fire watch. In the course of the discussion, the

operator becomes confused about which job requires the fire watch and establishes the

watch for the wrong job.

Receiving verification failure - Communication failed because the receiver did not take

actions to test his or her understanding of the message received. For example, the control

room operator in the fire watch example failed to repeat back or paraphrase the

supervisor's message to check concurrence and to identify any gaps in the message or in

his understanding of it.
17-4

17.3 PROGRAMMATIC CAUSES OF COMMUNICATIONS-RELATED ERRORS

Most work activities in organizations require coordination within and among work groups.

Coordination requires effective verbal and written communication. Communication is necessary

to define the work to be done and how to do it, so communication errors are frequently found to

be causal factors in events. But, because so many work activities depend on effective

communication, a wider variety of programmatic causes are associated with communication

errors than with other types of human errors.

Programmatic causes that have been shown to cause or contribute to communication errors at

nuclear licensee facilities are described below. Weaknesses in other programs at a licensee's site

may also cause communication errors.

Information management - Flaws in programs for developing and managing technical

documentation are a common source of communication errors. Omissions and technical

inaccuracies in vendor manuals, engineering analyses, design basis or other reference

documents may be translated into inaccuracies in procedures and work orders that are

used to perform jobs. Failures to update drawings and procedures when new hardware is

installed or existing hardware is modified can result in communication errors.

Work Planning and Control - Planning and scheduling maintenance activities is a

complex task. Weaknesses in work planning and control programs may result in both

written and verbal communication errors associated with, for example, inadequate work

orders, inadequate pre-job briefings, or communication failures during job performance.

Shift Staffing - Insufficient staffing can increase the workload for those performing a job,

and so interfere with required communications. Increased workload during plant outages

and the increased numbers of workers on-site, or increased workload during off-normal

events, can tax the supervisory abilities of those responsible for coordinating the work,

resulting in incomplete or too few communications. Too many staff involved in

performing a job can increase the communication burden on all involved and result in

communication failures.

Training - Effective communication requires some degree of shared understanding of the

work to be performed. Inadequate job knowledge, resulting from deficient training or

qualifications, can lead to both sending and receiving errors. Effective communication

also depends upon an understanding of the information needs of those involved in

performing a job. Communication across organizational boundaries (e.g., between

individuals in different departments, in different job roles, or on different shifts) can

cause problems because senders and receivers may not understand one another's

terminology or the contexts and constraints of the other's job.

Procurement and Maintenance – Some communications occur across physical distances

through communication devices. Procurement and maintenance programs ensure that

communication devices are suitable for their intended uses and are working properly.

Communication errors can arise here, for example, when there is too much background
17-5

noise for a receiver to hear a public address announcement or what is being said on the

radio or over the telephone. An insufficient number of radio frequencies to support

communication needs may also cause or contribute to communication errors.

Supervision - Some communication failures occur as a result of human errors in job

performance. These errors can often be caught and corrected through independent

observation and supervisory oversight of the work being done. Weaknesses in plant

programs for deciding which jobs require independent oversight or for ensuring that

appropriate supervision is available to watch for errors can allow communication errors

to occur.

Procedures - Lack of communication skills or failure to apply standard verbal and written

communication practices are often associated with communication errors. A lack of

training in standard communication techniques and the absence of procedures to

prescribe the circumstances in which standard communication techniques will be used

often contribute to the occurrence of errors.

17.4 ADDITIONAL RESOURCES ON COMMUNICATIONS

• U.S. Nuclear Regulatory Commission (1996). Human-system interface design review

guideline (NUREG-0700, Rev. 1, Vol.s 1-3). Washington, DC: U.S. Nuclear Regulatory

Commission.

• U.S. Nuclear Regulatory Commission (1997). Evaluation criteria for communicationsrelated corrective action plans (NUREG-1545). Washington, DC: U.S. Nuclear

Regulatory Commission.
18-1

18 COORDINATION AND CONTROL

Note that the structure of this module differs from the others and does not include a section

discussing direct causes of errors associated with coordination and control. Errors do not

typically result directly from weaknesses in coordination and control at licensee sites. Rather,

coordination and control processes, along with other programs, policies and processes, are

responsible for establishing and maintaining a licensee's barriers to error. Therefore, in most

events, there will be elements of coordination and control processes that failed to prevent the

error from occurring. However, the element of coordination and control that failed is typically

insufficient to cause the error by itself and so serves as a contributing, rather than direct cause of

an error.

18.1 COORDINATION AND CONTROL: SETTING THE STAGE FOR ERRORS

Control can be defined as ensuring that work activities at a site have the intended results and no

others. Maintaining control requires that:

• The desired consequences of a work activity are known in advance

• The risks and hazards inherent in the activity are known and addressed

• The external conditions that increase the risks/hazards of the activity are known and can

be controlled, and

• The activity is coordinated with other work activities so that they do not interfere with

one another and the combination of activities does not create an unexpected plant state.

Operations are controlled at a licensee facility when work activities are routinely conducted

without surprises.

There are three elements necessary to maintain operational control:

• Administrative processes that formalize activities commensurate with their risk impact

and complexity.

• Effective methods of coordinating the activities of diverse work groups within the

organization as well as the activities of individuals within work groups.

• Information management to capture, communicate and retain important information over

time and changes in equipment and personnel.

These elements ensure that an organization has the tools required to establish and maintain

control over maintenance, engineering and plant operational activities. They are also the

hallmark of a reliable organization.

18.1.1 Work Control

The first element of control includes the administrative processes by which work is

conceptualized, reviewed, approved, authorized and performed. Licensees have adopted a

variety of programs to structure the manner in which work is to be performed. Often the names
18-2

and terminology of the processes are different at different sites. However, there are some

fundamental characteristics of effective administrative work control processes that should be

incorporated into the individual programs.

The control process involves a series of steps that define how work activities in maintenance,

engineering and operations are accomplished to ensure that management expectations are met.

These steps include:

1. Requirement determination – the decision to perform the activity

2. Development – work design and preparation of the procedures or work package

3. Approval – supervisory review of the work plan

4. Authorization – approval to perform the work after consideration of conditions

5. Implementation – performing the work or activity

6. Oversight – supervisory review of the work or activity including QA/QC

7. Closeout – review of documentation and acceptance of quality of work

Effective work control requires the selection of an appropriate level of formality, deliberateness

and precision for each step in the process. The level of formality must be commensurate with the

risk, complexity and importance of the activity. Greater degrees of formality ensure higher

levels of performance and quality at the cost of additional time and resources. Typically, the

greater potential risk, complexity or economic importance of an activity, the greater the formality

in planning and implementing the work. For more complex or important jobs, licensee

administrative processes may require more extensive reviews of work plans, higher levels of

management involved in approving the plans and authorizing the start of work, increased

oversight of the work as it is being performed and more thorough testing and evaluation prior to

job close-out.

Another significant aspect of operational control is the preplanning that must be accomplished in

order to allow simple evolutions to be performed with a reasonable level of effort and to allow

rapid and correct action to be taken when off-normal or emergency conditions occur. An

example of this preplanning may be observed in the control room when an operator must respond

to an annunciator. In this case, plant management has predetermined that the operator can

invoke the annunciator response procedure and take the necessary actions without further

planning or control steps. The operator has achieved a level of mastery that qualified him or her

to respond to the annunciator without further management involvement. The annunciator

response procedure has been verified and validated in advance to ensure that the procedure will

address the alarm condition. However, each of the seven steps in the control process is still

applicable and invoked by management decisions, many of which were made long before the

annunciator alarmed and the operator took action to respond to the condition.

Administrative processes are also required to address unanticipated conditions. Even with

extensive preplanning, conditions often arise that deviate from those specified or assumed in a

work plan when it is implemented. Clear delineation of roles, responsibilities and authorities is

necessary for personnel to understand the types of unexpected situations in which they are

authorized to make decisions, resolve problems or to change work plans to address existing

conditions. Clear assignment of authority to stop work when unexpected conditions arise is also

necessary to maintain control. Changes to work plans that have not been analyzed and approved
18-3

by individuals who are qualified to evaluate the implications of the changes are a common cause

of errors at licensee facilities.

18.1.2 Coordination

Coordination is the process by which resources (people, equipment, tools, procedures, parts,

facilities) are identified, scheduled and assigned to a work activity. The scope of work activities

may range from station-wide projects (such as steam generator replacements) to individual tasks

(such as drafting a work order) and the time frames in which the work occurs may range from

minutes to years.

Effective performance requires coordination at two organizational levels. The activities of

different organizational units (e.g., maintenance, operations, engineering, and subgroups within

those departments) must be coordinated, and the activities of individuals within work groups

(e.g., control room or maintenance crews) must be coordinated when more than one individual is

assigned to a task. In general, the licensee's managers and work planning and scheduling

processes coordinate work activities between organizational units. First-line supervision is

typically responsible for coordinating the activities of individuals and teams within a department.

In general, the goals of coordination are to ensure that:

• work activities are planned and scheduled so that they do not interfere with one another

• the combination of activities occurring concurrently does not create unexpected,

unknown or unanalyzed conditions

• the necessary resources required to perform a task are available to perform the task when

required (e.g., necessary tools, parts and equipment, procedures, sufficient numbers of

qualified personnel)

• the work will be completed on time.

Coordination methods range from highly complex, detailed and formalized interactive software

planning tools to simple “to do” lists. The licensee will often require the use of several different

scheduling tools or methods in station administrative procedures for different types of work

activities. For example, most licensees typically use interactive, real time, critical path planning

software to coordinate outage work activities. However, they often use less formalized planning

and scheduling tools for the daily, at-power operations and other internal departmental activities.

In each case, the elements of a successful coordination process are consistent with the

complexity and the risk significance of the activity.

Work planning determines the specific human performance elements that are necessary for each

work package or job and ensure that they are available and integrated. Human performance

elements required to conduct a specific job may include requirements for communication,

procedures, skilled personnel, documentation, supervisory oversight, quality assurance, special

tools and equipment or other resources.

An example of a coordination error would be a fuel rod placed into the wrong position because

the refueling operator did not obtain independent verification of correct grid position prior to

lowering the assembly into the core. Clearly, an error of this type could also result from the
18-4

operator’s inability to select the correct grid position in the core or skipping the step in the

procedure that required independent verification. However, if the refueling procedure did not

require independent verification of the grid position prior to lowering the assembly, or no one

was available to perform the verification even though the operator might otherwise have waited

for it to be verified before proceeding, the cause of the error would lie in coordination.

The most common consequences of weaknesses in coordination are that work is delayed. For

example, a maintenance crew may have to stop a job for two hours while waiting for a quality

control (QC) inspector to be available. Or, work on a piece of equipment cannot start on time

because the tags were not hung by the previous shift. Delays typically affect productivity rather

than cause errors. However, the likelihood of errors increases if plant conditions change during

the delay so that the work plan can no longer be implemented as written, or if the job must be

extended over more than one shift and important information is not communicated during shift

change.

18.1.3 Information Management

The third element necessary to effective control is the information management systems that

capture, communicate and maintain important information that is required to conduct work

activities safely. The organization identifies information that will be required to safely and

effectively operate or repair the plant, disseminates it and maintains this information to assure

that it can be accessed when required. The type of information to be managed includes such

diverse areas as operations configuration control of equipment alignments, engineering design

control of systems and components, quality assurance of spare parts, and quality control of

nondestructive testing. In each case, the information required to safely operate or maintain the

equipment must be identified, captured, retained and made readily available as the plant

personnel change over time. This process includes configuration management of short-term

equipment alignments to ensure compliance with technical specifications as well as long-term

engineering design control changes that may impact the plant safety envelope over the life of the

reactor.

Identification of important information is a dynamic process. As new conditions and events

occur, information requirements will change. For example, industry codes and standards may be

updated. Information may become available from Significant Operational Events Reviews

(SOERs), licensee reports to the NRC and lessons learned from NRC inspection activities that

should be disseminated and retained. Changes in the workforce at a site may also require that

more or different types of information be made available to new personnel.

An example of a human error related to information management would be if a vendor

determined that a certain preventive maintenance action was required and the plant maintenance

staff did not have an active vendor manual program to identify the change and incorporate this

preventive maintenance item into the plant’s schedule. The result was a component that failed

because a process had not been adequately established to update the vendor manuals.
18-5

18.2 EFFECTS OF COORDINATION AND CONTROL WEAKNESSES

The following are examples of ways in which coordination and control may set the stage for

other performance shaping factors to cause errors.

18.2.1 Work Control

Requirements not identified or incomplete – The risks and hazards associated with the

work activity were not identified or were identified incompletely. For example,

applicable standards and codes were not reviewed or the job site was not walked down

prior to developing the work plan. As a result, controls for the risks/hazards were not

incorporated into the work plan.

Work planning informal – The degree of deliberateness, formality and thoroughness in

work planning and preparation was not commensurate with the risks/hazards the work

entailed. For example, a work package was not developed for the job or was incomplete,

resource requirements were not analyzed in advance, or timing requirements were not

identified. As a result, the resources required to complete the work on time and safely

were not available.

Approval process inadequate – Review and approval of the work plan was weak. For

example, personnel not qualified to evaluate it reviewed the work plan, not all of the

affected work groups reviewed the plan, or approval was not obtained or was obtained

from an individual without the authority to do so. As a result, missing or conflicting

elements in the work plan were not identified or risk implications of the work were not

identified and addressed.

Authorization inadequate – Authorization to begin the work was not obtained or was

obtained on the basis of conditions that had changed or ceased to exist by the time the job

started. For example, despite requirements documented in procedures, taught in training

and communicated as management expectations, an instrumentation and control

technician did not call the control room for permission to power down a controller for

testing. Or, a control room operator determined that another emergency operating

procedure was applicable to the circumstances and began implementing it without

authorization from the unit supervisor.

Implementation not controlled – The work was planned, approved and authorized, but

was not performed in accordance with the work plan. For example, individuals without

the proper authority changed the plan to accommodate unexpected circumstances.

Oversight inadequate – The amount or type of oversight of the work, including

management, supervision or QA/QC, was less than the risks and hazards of the work

warranted. As a result, for example, decisions were made without adequate authorization

or errors were not caught and corrected.
18-6

Closeout inadequate – Documentation of the job was not completed or was completed

incorrectly, required tests were not performed, lessons learned were not identified and

communicated. As a result, for example, equipment was left in an inoperable condition

following maintenance.

18.2.2 Coordination

Job conflicts – Work activities were scheduled in a manner that caused them to interfere

with one another. For example, due to schedule slippage, two jobs were scheduled to

work on the same component on the same shift.

Job combinations – Work activities that were scheduled concurrently had unanticipated

and adverse consequences. For example, a component was taken out of service that

operators needed to complete a scheduled tech spec surveillance. Or, all trains of safety

system were inadvertently disabled at the same time.

Resources unavailable – The resources required to perform a job were not scheduled to

be available when needed. For example, the same health physics technician was assigned

to monitor two jobs concurrently on different units. Or, tools and equipment required for

a job were in use on another job when needed.

Work untimely – Work activities or work products were not available when needed. For

example, new drawings that were required to finish planning a construction job were

three weeks late in being delivered from the engineering department.

18.2.3 Information Management

Documentation missing – Required information was not obtained or was not accessible

when needed. For example, reference documentation needed to develop a new procedure

had not been purchased from the vendor or could not be located.

Documentation inaccurate – Information about equipment, drawings, valve lists, or

design basis documents, for example, was out-of-date or wrong. As a result, work

packages were incomplete, procedures were incomplete or inaccurate, or training did not

address required KSAs.

18.3 ADDITIONAL RESOURCES ON COORDINATION AND CONTROL

• U.S. Code of Federal Regulations, Part 50.65, Requirements for monitoring the

effectiveness of maintenance at nuclear power plants, Title 10, Energy (revised

periodically). Washington, DC: U.S. Government Printing Office.

• U.S. Code of Federal Regulations, Appendix B to Part 50, Quality assurance criteria for

nuclear power plants and fuel reprocessing plants, Title 10, Energy (revised periodically).

Washington, DC: U.S. Government Printing Office.
18-7

• U.S. Nuclear Regulatory Commission (1978). Quality assurance program requirements

(Operation) (Regulatory Guide 1.33, Rev. 2). Washington, DC: U.S. Nuclear

Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1997). Monitoring the effectiveness of

maintenance at nuclear power plants (Regulatory Guide 1.160, Rev. 2). Washington,

DC: U.S. Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (1985). Quality assurance program requirements

for nuclear power plants (Regulatory Guide 1.28, Rev. 3). Washington, DC: U.S.

Nuclear Regulatory Commission.

• U.S. Nuclear Regulatory Commission (2000). Assessing and managing risk before

maintenance activities at nuclear power plants (Regulatory Guide 1.182). Washington,

DC: U.S. Nuclear Regulatory Commission.
A-1

Appendix A

Glossary
A- 2

Glossary of Terms

An ability is the combination of knowledge and skill required to perform a task correctly.

An alarm system is an automated system consisting of processing and display hardware

and software, which processes or analyzes signals from plant sensors and alerts the

operator via visual and/or auditory displays when monitored parameters deviate from

specified limits (setpoints).

A barrier is any means used to protect personnel and equipment from hazards. There are

two types: physical and management barriers. Examples of physical barriers are fences,

guard rails around moving equipment, protective clothing and safety devices, or shields.

Examples of management barriers are risk and hazard analyses, supervision, training, or

procedures.

Barrier analysis is a root cause analysis method. It is performed once the basic facts of

an event or human performance problem are understood and asks the question, “What

physical or management barriers could have prevented this event or problem from

occurring?”

A causal factor is any action or condition that occurred or existed prior to the initiation

of an event and without which the event may not have occurred. The term "causal factor"

is synonymous with the term "cause," and may refer to direct, contributing, programmatic

or root causes.

Circadian rhythms are also known as “biological clocks” and are patterns in

physiological functioning over the course of a day.

Cognitive performance refers to mental activities and includes perception, interpretation,

judgment and decision-making.

A communication error is a failure in the exchange of information between a sender and

receiver, in which the receiver fails to receive or interpret a message consistently with the

sender's intended meaning. The failure can occur in creating and sending messages or in

receiving and interpreting them.

Communication systems are physical systems that support communications, such as

between personnel in the main control room, between the main control room and local

sites within the plant, and across sites within the plant. The broad variety of

communication media may be generally categorized as speech-based and computer-based

systems.

Computer-based procedure system present plant procedures in computer-based, rather

than paper-based, formats.

Computerized operator support systems use computer technology to support operators

or maintenance personnel in situation assessment and response planning. They can

monitor status and provide recommendations or warnings.
A- 3

A test has content validity if the test items are directly related to job performance by

ensuring they match the instructional objectives and are appropriately weighted.

A control is a mechanism used to regulate, and/or guide the operation of a component,

equipment, subsystem, or system.

A contributing cause is an action or condition that sets the stage for the event to occur.

A contributing cause may be a long-standing condition or a series of prior events that,

while unimportant in themselves, increase the probability that the event would occur.

A corrective action is an action authorized by and under the control of management

intended to solve problems identified as the result of an event investigation. Effective

corrective actions for an event prevent the recurrence of the same or a similar event.

A causal analysis is a systematic method for evaluating the evidence gathered about an

event from an event investigation. The purpose of a causal analysis is to identify the basic

set of actions and conditions that, if eliminated or modified, would prevent the same

event and similar events from happening again.

A cursor is a display graphic that is used to indicate the position of the user's operation

on the display (such as an arrow or flashing bar).

A direct cause of an event is the actions or conditions immediately preceding the event

that caused or allowed it to occur.

The direct cause of an error is the actions or conditions immediately preceding the error

that caused or allowed the error to occur. Direct causes of errors are also known as

performance-shaping factors.

A test has discriminate validity if it differentiates between workers who have mastered

KSAs required to perform the job and those who have not.

A display is a specific integrated, organized set of information. A display can include

several display formats (such as a system mimic which includes bar charts, trend graphs,

and data fields).

A display device is the hardware used to present the display to users. Examples include

video display units and speakers for system messages.

Display elements are the basic components used to make up display formats, such as

abbreviations, labels, icons, symbols, coding, and highlighting.

Display format refers to the general class of information presentation. Examples of

general classes are continuous text (such as a procedure display), mimics and piping and

instrumentation diagram (P&ID) displays, trend graphs, and flowcharts.
A- 4

A display network is a group of display pages within an information system and their

organizational structure.

A display page is a defined set of information that is intended to be displayed as a single

unit. Typical display pages in a nuclear power plant may combine several different

formats on a single VDU screen, such as putting bar charts and digital displays in a

graphic P&ID format. Display pages typically have a label and designation within the

computer system so operators can assess them as a single display.

Documentary evidence includes paper and electronic information, such as records,

reports, procedures, work orders, memoranda, and vendor manuals.

Evidence reliability refers to whether or not different investigators would be able to find

the same information and reach the same conclusions from it. Conflicting stories from

different interviewees is an example of unreliable evidence that requires further

validation.

Evidence validity refers to the accuracy of the information gathered in the course of an

investigation. Valid evidence is information gathered from more than one source that

supports the “truth” of an assertion.

Functional requirements analysis and allocation is an analysis for identifying the

plant's safety functional requirements and ensuring that the functions have been allocated

to support an acceptable role for plant personnel.

A general organizational improvement plan is developed by plant or corporate senior

management and is intended to make significant changes in how work is done and how it

is managed in order to improve operational performance and to reverse declining

performance trends.

The Help function in a software program refers to features that provide guidance to the

user (e.g., describes how the user interface works).

HFE program is a plan for ensuring that HFE considerations will be integrated into the

development, design, evaluation, and implementation of the HSI.

Housekeeping refers to activities performed to maintain a clean and orderly work

environment.

HSI design is the systematic application of HFE principles and criteria to translate the

user's function and task requirements into the details of the HSI design. It includes the

use of HFE tests, evaluations, guidelines, and design documentation in the development

of the HSI design.
A- 5

Human errors are inappropriate or inadequate human actions, including failures to take

action when required.

Human factors is a body of scientific facts about human characteristics. The term

covers all biomedical, psychological, and psychosocial considerations; it includes, but is

not limited to, principles and applications in the areas of human factors engineering,

personnel selection, training, job performance aids, and human performance evaluation.

Human factors engineering (HFE) is the application of knowledge about human

capabilities and limitations to the design of a plant, system, and equipment. HFE ensures

that such designs, human tasks, and work environment are compatible with the sensory,

perceptual, cognitive, and physical attributes of the personnel who operate, maintain, and

support them (See human factors).

A human performance problem is a term used to collectively refer to human errors and

human performance trends.

A human performance trend is a pattern of related errors resulting from the same

causal factor(s).

Human reliability analysis is an analysis of the human error mechanisms relevant to the

design of the HSI, procedures, staffing, and training to reduce their likelihood and

consequences.

Human-system interface (HSI) is the means through which personnel interact with the

plant, including the alarms, displays, controls, and job-performance aids. Generically,

this also includes maintenance, test, and inspection interfaces.

Impairment refers to decrements in cognitive and physical capabilities that are usually

the result of substance abuse, fatigue, illness, stress or other factors that temporarily

affect an individual’s ability to perform tasks.

Information is organized data that users need to successfully perform their tasks.

Information can include (a) a representation of facts, concepts, or instructions in a

formalized manner suitable for communication, interpretation, or processing by humans

or automatic means; and (b) any representations, such as characters or analog quantities,

to which meaning is, or might be, assigned.

Integrated system validation entails performance-based evaluations conducted to ensure

that the integration of the HSI, procedures, and training adequately supports plant

personnel in the safe operation of the plant.

An intermediate corrective action plan is more limited in scope than a general

organizational improvement plan and focuses on erecting or strengthening barriers to

human performance problems.
A- 6

Investigation methods are the techniques used to gather evidence about an event.

Investigation methods include establishing and pursuing lines of inquiry about the event

by gathering physical, documentary and testamentary evidence.

A job and task analysis (JTA) is the process used to systematically determine the jobs

that are assigned to workers and the tasks that must be performed in order to satisfactorily

complete the job.

Just-in-time training is training that is provided to workers immediately prior to

performing the job.

Knowledge is a set of facts, factual information, a method of analysis or the application

of methods and facts to successfully perform a task.

KSAs are the knowledge, skills and abilities required for a job incumbent to safely and

competently perform a job.

Labeling and marking refer to the use of labels and demarcations to identify units of

equipment, modules, components, and parts.

Learning objectives provide a brief description of the training course material that must

be taught by the training program to ensure mastery of all KSAs required to perform a

certain job, task or to meet a training requirement.

Limited scope corrective action plans focus on fixing the direct cause of an error. For

example, a limited scope corrective action for an ambiguous step in a procedure that

confused a worker and caused her to commit an error would be to revise that step in the

procedure.

A local control station(LCS) is an operator interface related to nuclear power plant

process control that is not located in the main control room. This includes multifunction

panels, as well as single-function LCSs, such as controls (e.g., valves, switches, and

breakers) and displays (e.g., meters) that are operated or consulted during normal,

abnormal, or emergency operations.

Maintainability refers to the design of equipment to support effective and efficient

maintenance activities.

Managing displays refers to actions performed by a user to control the way that

individual displays are presented on a device.

Managing errors refers to actions performed by a user to prevent, detect, or correct

errors.

Managing information refers to the capabilities of software that allow the user to create,

change, store, and retrieve documents via the computer.
A- 7

Mastery is the process of achieving the requisite knowledge, skills and abilities to

perform a job or task safely and competently.

A mental lapse is a momentary gap in recall for the correct knowledge or ability when it

is required to perform a job.

National Nuclear Accrediting Board is a body of experts chartered by the Institute of

Nuclear Power Operations (INPO) to review, accept and accredit the training programs at

every nuclear power station.

An operating experience review is a review of relevant operating history from the

plant's on-going collection, analysis, and documentation of operating experiences.

Operational validity ensures that test items address the mental and psychomotor

activities that are performed on the job.

Performance-based training (PBT), also called the Systematic Approach to Training,

includes the following five elements:

1 Systematic analysis of the jobs to be performed

2 Learning objectives derived from the analysis, which describe desired

performance after training

3 Training design and implementation based on the learning objectives

4 Evaluation of trainee mastery of the objectives during training

5 Evaluation and revision of the training based on the performance of trained

personnel in the job setting.

Personal protective equipment (PPE) is equipment worn by a worker to minimize

exposure to specific occupational hazards. Examples of PPE are respirators, gloves,

aprons, fall protection, and full body suits, as well as head, eye and foot protection.

Physical evidence is matter related to the event, such as equipment, parts, debris, liquids,

hardware or tools.

Procedures development refers to the integration of HFE principles and criteria in a

procedure development program to ensure that the resulting procedures: (1) support and

guide human interaction with plant systems and plant-related events and activities, and

(2) are technically accurate, comprehensive, explicit, easy to use, and validated.

A programmatic cause is a deficiency in one of the licensee's policies, programs and

processes for managing work activities at a site that allows human errors to occur. For

example, a deficiency in a licensee's training program could set the stage for errors

because workers may not have the knowledge or required skills to perform a job

correctly.
A- 8

The root cause of an event is the actions or set of conditions that, if eliminated or

modified, would keep the event from recurring as well as prevent similar events from

occurring. A root cause is often responsible for multiple human errors or hardware

failures, rather than single problems or faults. Root causes are more fundamental causes

than direct causes, and are typically programmatic or management weaknesses.

Root cause analysis is a structured, repeatable, systematic method for synthesizing

information about an event and its causal factors to identify the critical set of conditions

that, if eliminated or modified, would prevent the same event and similar events from

recurring.

Service points are equipment locations used for performing routine maintenance tasks,

such as adjusting, cleaning, or replacing components.

A loss of situational awareness occurs when a worker has mastered the relevant

knowledge, but fails to recognize that the knowledge applies to the task at time of

performance.

A skill is a motor or mental capability such as the ability to open a valve or operate a

controller.

A soft control is a control device that has connections with the control or display system

mediated by software rather than direct physical connections. As a result, the functions

of a soft control may be variable and context-dependent rather than statically defined.

Also, the location of a soft control may be virtual (e.g., within the display system

structure) rather than spatially dedicated. Soft controls include devices activated from

display devices (e.g., buttons and sliders on touch screens), multi-function control

devices (e.g., knobs, buttons, keyboard keys, and switches that perform different

functions depending upon the current condition of the plant, the control system, or the

HSI), and devices activated via voice input.

Span of control refers to the personnel and functions for which a job incumbent has

responsibility and authority. Higher management positions within an organization have

broader spans of control.

Staffing is the process of accessing, maintaining and scheduling the personnel resources

needed to accomplish work under normal and foreseeable off-normal conditions.

Staffing decisions consider regulatory requirements, operating costs, the range of

expertise required, the number of staff needed and scheduling. 

A staffing analysis is a systematic analysis of the requirements for the number and

qualifications of personnel based on an understanding of task and applicable regulatory

requirements.

Stress is a psychological and physiological response to a threatening situation. A

threatening situation is one that an individual has appraised as exceeding his or her
A- 9

capabilities to cope. Stressful situations, or stressors, may be emotional, cognitive,

environmental or physiological.

System response refers to the manner in which the computer system behaves after

receiving inputs from the user.

System security refers to features that restrict personnel access to aspects of the

computer system to prevent accidental or deliberate damage.

Systematic Approach to Training (SAT) – See performance-based training.

Task analysis is a method of detailing the components of a task in terms of the demands

placed upon the human operator, the information required by the operator, the extent to

which the task requires reliance on or coordination with other personnel, and the relation

of the task to other tasks.

The task environment refers to the physical conditions in which work is performed, such

a noise and illumination levels, temperature, or radiation.

Task overload occurs when the number of tasks to be performed in a given period of

time exceeds the available personnel resources. Task overload may increase stress and

often results in the application of various work management strategies. These strategies

may include task deferral, delegation or increasing the work pace, all of which may result

in errors.

Testamentary evidence includes witness statements and the results of interviews.

Test equipment refers to diagnostic tools used to assess the status of equipment and

locate faults that may be present.

Test points are equipment locations used for conducting tests to determine the

operational status of equipment and for isolating malfunctions. Test equipment may be

connected at these points.

Training development refers to the use of a systematic approach in the development of

personnel training.

User-system interaction refers to the set of methods provided in a computer system

through which personnel and the computer communicate with each other.

Validation is: (1) The process of determining whether the design of machine elements

and the organizational design of human elements of a human-machine system are

adequate to support effective integrated performance of established functions. (2) The

capability of a system to check information entry items for correct content of format as

defined by software logic.
A-10

Verification is the process of determining whether procedures, instrumentation, controls,

and other equipment meet the specific requirements of the tasks performed by personnel.

The term is used in the following contexts:

HSI task support verification: The individual HSI components (e.g., control

and display devices) and characteristics (range, accuracy, and safety grade)

needed for the task are compared to those actually provided in the work

environment.

HFE design verification: The characteristics of the HSI, workplace, and HSI

support functions are reviewed by the licensee to determine whether their design

is consistent with accepted HFE principles, guidelines, and standards.

Human factors issue resolution verification: A check to ensure that the HFE

issues identified during the design process have been acceptably addressed and

resolved.

A workstation is the physical console at which a user performs tasks.
B-1

Appendix B

Bibliography
B-2

BIBLIOGRAPHY

ABS Consulting, Inc. (2001). Root cause leader. http://www.jbfa.com/rootcauseleader.html.

Apollo Associated Services (2001). Apollo method of root cause analysis. http://www.apolloas.com.

Baker, K., Olson, J. and Morisseau, D. (1994). Work practices, fatigue, and nuclear power plant

safety performance. Human Factors, 36, 244-257.

Baker, T. (1995). Alertness, performance and off-duty sleep on 8-hour and 12-hour night shifts

in a simulated continuous operations control room setting (NUREG/CR-6046). Washington,

DC: U.S. Nuclear Regulatory Commission.

Barnes, V.E., Fleming, I., Grant, T., Hauth, J., Hendrickson, J., Kono, B., Moore, C., Olson, J.

Saari, L., Toquam, J., Wieringa, D., Yost, P., Hendrickson,P., Moon, D and Scott, W. (1988).

Fitness for duty in the nuclear power industry: A review of technical issues (NUREG/CR-5227).

Washington, DC: U.S. Nuclear Regulatory Commission.

Barnes, V.E., Moore, C.J. Wieringa, D.R., Isakson, C.S., Kono, B.K. and Gruel, R.L. (1989)

Techniques for preparing flowchart-format emergency operating procedures: Vol.s 1 and 2

(NUREG/CR-5228, PNL-6653, BHARC-700/88/017). Washington, DC: U.S. Nuclear

Regulatory Commission.

Barnes, V. E., Mumaw, R. J. and Schoenfeld, I. (1996). Communication errors in nuclear power

plants. In Proceedings of the 1996 American Nuclear Society International Topical Meeting on

Nuclear Plant Instrumentation, Control and Human-Machine Interface Technologies. American

Nuclear Society: La Grange Park, IL, 671-678.

Beedle, Wayne. (1996). Accident investigation: The ergonomic eye. Occupational Health and

Safety Canada, 12, 36-38.

Benner, L., Jr. (1985). Rating accident models and investigation methodologies. Journal of

Safety Research, 16, 105-126.

Bird, F. E. and Germain, G. L. (1985, revised 1990). Practical loss control leadership.

Loganville, Georgia: International Loss Control Institute/DeNorske Veratis).

Bowers, C.A., Jentsch, F., Salas E. and Braun, C.C. (1998). Analyzing communication sequences

for team training needs assessment. Human Factors, 40, 672-679.

Brown, W.S., Higgins, J.C., O’Hara, J.M. (1994). Local control stations: Human engineering

issues and insights (NUREG/CR-6146). Washington, DC: U.S. Nuclear Regulatory

Commission.
B-3

Brown, W.S., O'Hara, J.M. and Higgins, J.C. (2000). Advanced alarm systems: Revision of

guidance and its technical basis (NUREG/CR-6684). Washington, DC: U.S. Nuclear

Regulatory Commission.

Byers, J.C., Hill, S.G and Rothblum, A.M. (1994). U.S. Coast Guard marine casualty

investigation and reporting: Analysis and recommendations for improvement, interim report.

(Report No. CG-D-13-95). National Technical Information Service: Springfield, Virginia.

Cantarella, A. (1997). Incident investigations: Critical to the safety effort. Professional Safety,

42, 10.

Corcoran, W.R. (1999). The thirteen steps of a world class corrective action program. Windsor,

CT: Nuclear Safety Review Concepts.

Decision Systems, Inc. (2001). REASON root cause analysis. http://www.rootause.com

Dew, J.R. (1991). In search of the root cause. Quality Progress, 24, 97-102.

Durbin, N. and Grant, T. (1996). Fitness for duty in the nuclear industry: Update of the

technical issues 1996 (NUREG/CR-6470, BSRC-700/96/004, PNNL-11134). Washington, DC:

U.S. Nuclear Regulatory Commission.

Durbin, N., Moore, C. Grant, T., Fleming, T., Hunt, P., Martin, R. Murphy, S., Hauth, J. Wilson,

R., Bittner, A., Bramwell, A., Macauley, J., Olson, J., Terrill, E. and Toquam, J. (1991). Fitness

for duty in the nuclear power industry: A review of the first year of program performance and

an update of the technical issues (NUREG/CR-5784, PNL-7795, BHARC-700/91/025).

Washington, DC: U.S. Nuclear Regulatory Commission.

Echeverria, D., Barnes, V., Bittner, A., Durbin, N., Fawcett-Long, J., Moore, C., Slavich, A.

Terrill, B., Westra, C., Wieringa, D., Wilson, R., Draper, D., Morisseau, D. and Persensky, J.

(1994). The impact of environmental conditions on human performance: A handbook of

environmental exposures (NUREG/CR-5680, Vol.s 1 and 2). Washington, DC: U.S. Nuclear

Regulatory Commission.

Enconet Consulting, Inc. (2001). ERCAP. http://www.enconet.com/pages/ercap.htm

Failsafe Network, Inc. (2001). Root cause discovery. http://www.failsafe-network.com

Ferry, T. S. (1990). Modern accident investigation and analysis. New York: John Wiley and

Sons, Inc.

Fiedler, F.E. (1967). A theory of leadership effectiveness. New York: McGraw-Hill, 1967.

Fullwood, R. (2000). Probabilistic safety assessment in the chemical and nuclear industries.

Boston, MA: Butterworth-Heinemann.
B-4

Gross, M. & Ayres, T. (1998). Research initiative for human performance management of

nuclear power. Paper presented at the IEEE Workshop: R&D for Cost Reduction. Fukuoka,

Japan: September 30-October 1.

Haber et al. (1995). Nuclear Power Plant Shift Staffing Levels: Site Data Collection Report

(Accession No. 9510030160). Upton, NY: Brookhaven National Laboratory.

Hallbert, B.P., Sebok, A. and Morisseau, D. (2000). A study of control room staffing levels for

advanced reactors (NUREG/IA-0137). Washington, DC: U.S. Nuclear Regulatory

Commission.

Hendrick, H. and Kleiner, B. (2001). Macroergonomics: An introduction to work system design.

Santa Monica, CA: Human Factors and Ergonomics Society.

Howlett, H.C. (1995). The industrial operator’s handbook: A systematic approach to industrial

operations. Pocatello, ID: Techstar.

Higgins, J. and Nasta, K. (1997). Human factors engineering (HFE) insights for advanced

reactors based upon operating experience (NUREG/CR-6400). Washington, DC: U.S. Nuclear

Regulatory Commission.

Institute of Electrical and Electronics Engineers (1999). IEEE guide for the evaluation of

human-system performance in nuclear power generating stations (IEEE Standard 845-1999).

New York: Institute of Electrical and Electronics Engineers

Joint Commission on Accreditation of Healthcare Organizations (1996). Conducting a root cause

analysis in response to a sentinel event. Oakbrook Terrace, IL: Joint Commission on

Accreditation of Healthcare Organizations.

Joint Commission on Accreditation of Healthcare Organizations (2001). Sentinel events.

http://www.jcaho.org/sentinel/sentevnt_frm.html

Jorgensen, Ernest B. (1990). Accident investigations for simple people like me. Professional

Safety, 35, 31.

Kirwan, B. (1994). A guide to practical human reliability assessment. Bristol, PA: Taylor &

Francis.

Klein G., Orasanu J., Calderwood R. and Zsambok, E. (Ed.s) (1993). Decision making in action:

Models and methods. Norwood, New Jersey: Ablex Publishing.

Landy, F. and Trumbo, D. (1976). Psychology of work behavior. Homewood, IL: The Dorsey

Press .

Loftus, E. (1996). Eyewitness testimony. Harvard University Press.
B-5

Loftus, E.F., Miller, D.G. and Burns H.J. (1978). Semantic integration of verbal information into

a visual memory. Journal of Experimental Psychology: Human Learning and Memory, 4, 19-

31.

Managerial Technology Corporation (2001). Risk Management Internet Services,

http://www.rmis.com

Marx, D. (2001). The causation trainer. http://www.causationtrainer.com

McCallum, M.C., Raby, M. and Roghblum, A. (1996). Procedures for investigating and

reporting human factors and fatigue contributions to marine casualties. (Report No. CG-D-09-

97). National Technical Information Service: Springfield, Virginia.

Medical Risk Management Associates, LLC (2001). Sentinel events and root cause analysis in

healthcare. http://www.rootcauseanalyst.com

Merritt, A.C. and Helmreich, R.L. (1996). Creating and sustaining a safety culture. CRM

Advocate, 1, 8-12.

Meyer, O., Hill, S. and Steinke, W. (1993). Studies of human performance during operating

events, 1990-1992 (NUREG/CR-5953). Washington, DC: U.S. Nuclear Regulatory

Commission.

Miller, M.C. (1992). Root Cause Analysis Methodology (NTIS ID No. AD-A256 855, Report

No. CRDEC-SP-053). National Technical Information Service: Springfield, VA.

Moore, C., Barnes, V., Hauth, J., Wilson, R., Fawcett-Long, J., Toquam, J., Baker, K., Wieringa,

D., Olson, J., & Christensen, J. (1989). Fitness for duty in the nuclear power industry: A review

of technical issues (NUREG/CR-5227, Supplement 1, PNL-6652, BHARC-700/88/018).

Washington, DC: U.S. Nuclear Regulatory Commission.

Morgenstern, M., Barnes, V., McGuire, M., Radford, L. and Wheeler, W. (1985) Operating

procedures in nuclear power plants: Practices and problems (NUREG/CR-3968, PNL-5648).

Washington, DC: U.S. Nuclear Regulatory Commission.

Morgenstern, M., Barnes, V., Radford, L., Wheeler, W. and Badalamente, R. (1984). The

development, use and control of maintenance procedures in nuclear power plants: Problems

and recommendations (NUREG/CR-3817, PNL-5121). Washington, DC: U.S. Nuclear

Regulatory Commission.

Mumaw, R.J. (1994). The effects of stress on nuclear power plant operational decision making

and training approaches to reduce stress effects (NUREG/CR-6127). Washington, DC: U.S.

Nuclear Regulatory Commission.
B-6

Mumaw, R., Swatzler, D., Roth, E. and Thomas, W. (1994). Cognitive skill training for nuclear

power plant operational decision making (NUREG/CR-6126). Washington, D.C.: U.S. Nuclear

Regulatory Commission.

Muschara, T. (2000). INPO Human Performance Evaluations and Other Developments. In

Proceedings of the 2000 Human Performance Root Cause Trending Workshop. Philadelphia,

PA: June 12-15, 2000.

Nelms, R. (2001). Root cause live. http://www.rootcauselive.com

Norman, D. (1981). Categorization of action slips. Psychological Review, 88, 1-15.

O’Hara et al. (1999). The development of guidance for the review of plant modifications

involving risk-important human actions (BNL Letter Report W6022-T2-1-11/99). Upton, New

York: Brookhaven National Laboratory.

O’Hara, J.M., Brown, W.S., Baker, C.C., Welch, D.L., Granda, T.M. and Vingelis, J.P. (1994).

Advanced human-system interface design review guideline: Evaluation procedures and

guidelines for human factors engineering reviews (NUREG/CR-5908, Vol. 2). Washington, DC:

U.S. Nuclear Regulatory Commission.

O’Hara, J.M., Brown, W.S., Higgins, J.C. and Stubler, W.F. (1994). Human Factors

Engineering Guidance for the Review of Advanced Alarm Systems (NUREG/CR-6105).

Washington, DC: U.S. Nuclear Regulatory Commission.

O'Hara, J., Higgins, J., Stubler, W., Goodman, C., Eckenrode, R., Bongarra, J., and Galletti, G.

(1994). Human factors engineering program review model (NUREG-0711). Washington, DC:

U.S. Nuclear Regulatory Commission.

O’Hara, J.M., Higgins, J.C., Stubler, W.C. and Kramer, J. (2000). Advanced information

systems design: Technical basis and human factors review guidance (NUREG/CR-6633).

Washington, DC: U.S. Nuclear Regulatory Commission.

O’Hara, J.M., Higgins, J.C., Stubler, W.F. and Kramer, J. (2000). Computer-based procedure

systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington,

DC: U.S. Nuclear Regulatory Commission.

Orion Healthcare Technologies, Inc. (2001). Root cause analyst. http://www.rcasoftware.com

Paradies, M., Unger, L., Haas, P. and Terranova, M. (1993). The NRC’s human performance

investigation process (NUREG/CR-5455, Vol.s 1-3). Washington, DC: U.S. Nuclear

Regulatory Commission.

Pedrali, M. and Cojazzi, G. (1994). A methodological framework for root cause analysis of

human errors. In Proceedings of the 21st Conference on Aviation Psychology: Developing

Theory and Extending Practice, Dublin (IE), March 28-31, 1994.
B-7

Peters, V. (May 24, 1995). Personal communication.

Reliability Center, Inc. (2001). PROACT root cause analysis software.

http://www.reliability.com/proact.htm

Reason, J.T. (1990). Human error. Cambridge: Cambridge University Press.

Reason, J.T. (1997). Managing risks of organizational accidents. Burlington, VT: Ashgate

Publishing.

Roth, E.M., Mumaw, R.J. and Lewis, P.M. (1994). An empirical investigation of operator

performance in cognitively demanding simulated emergencies (NUREG/CR-6208). Washington,

DC: U.S. Nuclear Regulatory Commission.

Sayers, D. (1994). Accident investigations. Occupational Health and Safety Canada, 10, S12-

S15.

Schacter, D. (Ed.) (1997). Memory distortion: how minds, brains, and societies reconstruct the

past. Harvard University Press.

Senecal, P. (1994). Root cause analysis: What took us so long? Occupational Hazards, 56, 63-

65.

Shurberg, D et al. (1994). Identification of Issues Associated with Nuclear Power Plant Shift

Staffing Levels, Task 1 Letter Report (Accession No. 951003074). Upton, NY: Brookhaven

National Laboratory.

Steinmeyer, P. (2001). Manual of respiratory protection against airborne radioactive material

(NUREG/CR-0041, Rev. 1). Washington, DC: U.S. Nuclear Regulatory Commission.

Stephenson, J. (1991). System safety 2000: A practical guide for planning, managing, and

conducting system safety programs. New York: Van Nostrand Reinhold.

Stubler, W.F., Higgins, J.C. and Kramer, J. (2000). Maintainability of digital systems:

Technical basis and human factors review guidance (NUREG/CR-6636). Washington, DC: U.S.

Nuclear Regulatory Commission.

Stubler, W.F., O’Hara, J.M., and Kramer, J. (2000). Soft controls: Technical basis and human

factors review guidance (NUREG/CR-6635). Washington, DC: U.S. Nuclear Regulatory

Commission.

Stubler, W.F., O’Hara, J.M., Higgins, J.C. and Kramer, J. (2000). Human Systems Interface and

Plant Modernization Process: Technical Basis and Human Factors Review Guidance

(NUREG/CR-6637). Washington, DC: U.S. Nuclear Regulatory Commission.
B-8

Svenson, O. and Maule, A. J. (Ed.s) (1993). Time pressure and stress in human judgment and

decision making. New York: Plenum Press.

Swartz, G. (1993). Incident report: A vital part of quality safety programs. Professional Safety,

38, 32-34.

System Improvements, Inc. (2001). TapRoot - Changing the way the world solves problems.

http://www.taproot.com

Texaco, Inc. (1994). Root cause analysis in practice. Environmental Manager, 6, 8-10.

ThinkReliability, Inc. (2001). Cause mapping. http://www.causemapping.com

Thomen, J. (1996). Root cause: Holy grail or fatal trap? Professional Safety, 41, 31.

Tritsch, S. (1992). Accident investigations: How to ask why. Safety and Health, 146, 40-43.

Unwin Company (2001). Root cause analysis and incident investigation. http://www.unwinco.com/IncidentInv.cfm

Urian, R. (2000). Organizational unlearning: Detrimental behaviors present in chemical process

incident investigation teams. In Proceedings of Process Industry Incidents: Investigation

Protocols, Case Histories, Lessons Learned. New York: American Institute of Chemical

Engineers, 341-362.

U.S. Code of Federal Regulations, Part 11, Criteria and procedures for determining eligibility for

access to or control over special nuclear material, Title 10, Energy (revised periodically).

Washington, DC: U.S. Government Printing Office.

U.S. Code of Federal Regulations, Part 19.20, Employee protection, Title 10, Energy (revised

periodically). Washington, DC: U.S. Government Printing Office.

U.S. Code of Federal Regulations, Part 26, Fitness for duty programs, Title 10, Energy (revised

periodically). Washington, DC: U.S. Government Printing Office.

U.S. Code of Federal Regulations, Part 50.54(m), Conditions of licenses, Title 10, Energy

(revised periodically). Washington, DC: U.S. Government Printing Office.

U.S. Code of Federal Regulations, Part 50.65, Requirements for monitoring the effectiveness of

maintenance at nuclear power plants, Title 10, Energy (revised periodically). Washington, DC:

U.S. Government Printing Office.

U.S. Code of Federal Regulations, Part 50.120, Training and qualification of nuclear power plant

personnel, Title 10, Energy (revised periodically). Washington, DC: U.S. Government Printing

Office.
B-9

U.S. Code of Federal Regulations, Appendix B to Part 50, Quality assurance criteria for nuclear

power plants and fuel reprocessing plants, Criterion V, Instructions, procedures and drawings,

Title 10, Energy (revised periodically). Washington, DC: U.S. Government Printing Office.

U.S. Code of Federal Regulations, Appendix R to Part 50, Quality assurance criteria for nuclear

power plants and fuel reprocessing plants, Criterion III (H), Fire brigade, Title 10, Energy

(revised periodically). Washington, DC: U.S. Government Printing Office.

U.S. Code of Federal Regulations, Part 55.4, Operators licenses (definitions), Title 10, Energy

(revised periodically). Washington, DC: U.S. Government Printing Office.

U.S. Department of Energy (1998). Conducting accident investigations, Revision 2, a DOE

Workbook. Germantown, MD: U.S. Department of Energy.

http://tis.eh.doe.gov/oversight/missions/air/air_overview.html

U.S. Nuclear Regulatory Commission (1978). Quality assurance program requirements

(Operation) (Regulatory Guide 1.33, Rev. 2). Washington, DC: U.S. Nuclear Regulatory

Commission.

--- (1980). TMI action plan (NUREG-0737). Washington, DC: U.S. Nuclear Regulatory

Commission.

--- (1982). Nuclear power plant staff working hours (Generic Letter 82-12). Washington, DC:

U.S. Nuclear Regulatory Commission.

--- (1982). NUREG-0737 technical specifications (Generic Letter 82-16). Washington, DC:

U.S. Nuclear Regulatory Commission.

--- (1982). Guidelines for the preparation of emergency operating procedures (NUREG-0899).

Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1983). NUREG-0737 technical specifications (Generic Letter 83-02). Washington, DC:

U.S. Nuclear Regulatory Commission.

--- (1983). Clarification of TMI action plan requirements (NUREG-0737, Supplement 1).

Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1985). Quality assurance program requirements for nuclear power plants (Regulatory

Guide 1.28, Rev. 3). Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1988). Memorandum of understanding between NRC and OSHA relating to NRC-licensed

facilities (Information Notice 88-100). Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1989). Fitness for duty in the nuclear power industry: Responses to public comments

(NUREG-1354). Washington, DC: U.S. Nuclear Regulatory Commission.
B-10

--- (1989). Lessons learned from the special inspection program for emergency operating

procedures (NUREG-1358). Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1989). Fitness for duty in the nuclear power industry: Responses to implementation

questions (NUREG-1385). Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1991). Nuclear plant staff working hours (Information Notice 91-36). Washington, DC:

U.S. Nuclear Regulatory Commission.

--- (1991). Shift staffing at nuclear power plants (Information Notice 91-77). Washington, DC:

U.S. Nuclear Regulatory Commission.

--- (1992). Shutdown and low-power operation at commercial nuclear power plants in the

United States (NUREG-1449). Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1993). Training review criteria and procedures (NUREG-1220, Rev.1). Washington, DC:

U.S. Nuclear Regulatory Commission.

--- (1994). Human factors engineering program review model (NUREG-0711). Washington,

DC: U.S. Nuclear Regulatory Commission.

--- (1995). Results of shift staffing study (Information Notice 95-48). Washington, DC: U.S.

Nuclear Regulatory Commission.

--- (1996). Nuclear power plant simulation facilities for use in operator license examinations

(Regulatory Guide 1.149, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1996). Suggested guidance relating to development and implementation of corrective action

programs (Information Notice 96-28). Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1996). Human-system interface design review guideline (NUREG-0700, Rev. 1, Vol.s 1-3).

Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1996). Standard review plan for the review of safety analysis reports for nuclear power

plants (NUREG-0800). Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1997). Monitoring the effectiveness of maintenance at nuclear power plants (Regulatory

Guide 1.160, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1997). Evaluation criteria for communications-related corrective action plans (NUREG1545). Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1998). Medical evaluation of licensed personnel at nuclear power plants (Regulatory Guide

1.134, Rev. 3). Washington, DC: U.S. Nuclear Regulatory Commission.
B-11

--- (1998). Potential for degradation of the emergency core cooling system and the containment

spray system after a loss-of-coolant accident because of construction and protective coating

deficiencies and foreign material containment (Generic Letter 98-04). Washington, DC: U.S.

Nuclear Regulatory Commission.

--- (1998). Knowledge and abilities catalog for nuclear power plant operators: Pressurized

water reactors (NUREG-1122, Rev. 2). Washington, DC: U.S. Nuclear Regulatory

Commission.

--- (1998). Knowledge and abilities catalog for nuclear power plant operators: Boiling water

reactors (NUREG-1123, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1999). Acceptable programs for respiratory protection (Regulatory Guide 8.15, Rev. 1).

Washington, DC: U.S. Nuclear Regulatory Commission.

--- (1999). Operator licensing examination standards for power reactors (NUREG-1021).

Washington, DC: U.S. Nuclear Regulatory Commission.

--- (2000). Medical misadministrations caused by human errors involving gamma stereotactic

radiosurgey (gamma knife) (Information Notice 2000-22). Washington, DC: U.S. Nuclear

Regulatory Commission.

--- (2000). Qualification and training of personnel for nuclear power plants (Regulatory Guide

1.8, Rev. 3). Washington, DC: U.S. Nuclear Regulatory Commission.

--- (2000). Assessing and managing risk before maintenance activities at nuclear power plants

(Regulatory Guide 1.182). Washington, DC: U.S. Nuclear Regulatory Commission.

--- (2000). Technical Basis and Implementation Guidelines for A Technique for Human Event

Analysis (ATHEANA) (NUREG-1624, Rev. 1). Washington, DC: U.S. Nuclear Regulatory

Commission.

--- (2001). Fitness for duty. http://www.nrc.gov/NRC/REACTOR/FFD

--- (2001). Human factors information system (HFIS) database reports homepage.

http://www.nrc.gov/NRR/HFIS/index.htm

--- (2001). Operator licensing program.

http://www.nrc.gov/NRC/REACTOR/OL/OLhome.html

West, S. and Wicklund, R. (1980). A primer of social psychological theories. Monterey, CA:

Brooks/Cole Publishing Company.

Wieringa, D., Moore, C. and Barnes, V. (1998). Procedure writing: Principles and practices,

second edition. Columbus, OH: Battelle Press.
B-12

Wilpert, B., Uth, H.J., Miller, R. and Ninov, E. (2000). Safety management through learning

from experience in the chemical industry: Example of a new incident analysis methodology. In

Proceedings of Process Industry Incidents: Investigation Protocols, Case Histories, Lessons

Learned. New York: American Institute of Chemical Engineers, 303-312.

Woods, D.D., Pople, H.E., Jr. and Roth, E.M. (1990). The cognitive environment simulation as a

tool for modeling human performance and reliability (NUREG/CR-5213, Vols. 1 and 2).

Washington, DC: U.S. Nuclear Regulatory Commission.
C-1

APPENDIX C

BLANK REVIEW TABLES
C-2

Table 2.1 Problem Identification and Characterization

Document Identifier:

Problem Number: __ Problem Number: __

Question

Number

Brief description

of the problem and

date(s) of occurrence:

2.1.1 Was the human performance

problem identified?

Yes

No

NA

Yes

No

NA

2.1.2

If not, was the human

performance problem

tangential to understanding

and resolving the issue under

review?

Yes

No

NA

Yes

No

NA

2.1.3

Were the individuals involved

in the problem identified (by

job role)?

Yes

No

NA

Yes

No

NA

2.1.4

Were the actions and decisions

or failures to act that

comprised the problem

described?

Yes

No

NA

Yes

No

NA

2.1.5

Were precursor errors or

earlier evidence of a

developing trend identified?

Yes

No

NA

Yes

No

NA

2.1.6

Was the problem described in

enough detail to support causal

analyses and the development

of corrective actions?

Yes

No

NA

Notes:

Yes

No

NA

Notes:

Notes:

Total number of Yes's: ____

Total number of NA's: ____
C-3

Table 2.2 Investigation Methods

Question

Number Problem description:

Problem Number: __ Problem Number: __

2.2.1

Was the extent of the

investigation consistent with

the importance of the

problem?

Yes

No

NA

Yes

No

NA

2.2.2

Were licensee criteria for

determining which issues

require an investigation

appropriately applied to this

problem?

Yes

No

NA

Yes

No

NA

2.2.3

Did the licensee validate the

information gathered about

the problem by seeking

information from more than

one source?

Yes

No

NA

Yes

No

NA

2.2.4

Did the licensee seek the

appropriate type(s) of evidence

for investigating the problem?

Yes

No

NA

Yes

No

NA

2.2.5

Did the licensee gather enough

information to understand the

sequence of events and

conditions leading up to the

problem?

Yes

No

NA

Notes:

Yes

No

NA

Notes:

Notes:

Total number of Yes's: ____

Total number of NA's: ____
C-4

Table 2.2 Investigation Methods (continued)

Question

Number Problem description:

Problem Number: __ Problem Number: __

2.2.6

Did the licensee check plant

records to identify other

problems that occurred during

the same work activity?

Yes

No

NA

Yes

No

NA

2.2.7

Did the licensee identify the

programs that applied to the

job(s) during which the human

performance problem arose?

Yes

No

NA

Yes

No

NA

2.2.8

If the licensee found

weaknesses in the applicable

programs, were the

weaknesses investigated in

sufficient detail to understand

their scope and likely effects, if

not corrected?

Yes

No

NA

Yes

No

NA

2.2.9

Were the licensee’s conclusions

clearly supported by the

results of the investigation?

Yes

No

NA

Yes

No

NA

2.2.10 Was there a basis documented

for stopping the investigation?

Yes

No

NA

Notes:

Yes

No

NA

Notes:

Notes:

Total number of Yes's: ____

Total number of NA's: ____
C-5

Table 2.3 Causal Analyses

Question

Number Problem description:

Problem number: __ Problem Number: __

2.3.1

Were causal factors identified for

this human performance

problem?

Yes

No

NA

Yes

No

NA

2.3.2 Was more than one causal factor

identified for the problem?

Yes

No

NA

Yes

No

NA

2.3.3

Was the type of causal analysis of

this problem consistent with its

importance ?

Yes

No

NA

Yes

No

NA

2.3.4

Was there enough information

provided to verify the accuracy of

the causal factors identified?

Yes

No

NA

Yes

No

NA

2.3.5 Were several possible causes for

the problem investigated?

Yes

No

NA

Yes

No

NA

2.3.6 Did the evidence support the

licensee’s choice of causes?

Yes

No

NA

Yes

No

NA

2.3.7

Were the bases for rejecting

possible causes for the problem

documented?

Yes

No

NA

Notes:

Yes

No

NA

Notes:

Notes:

Total number of Yes's: ____

Total number of NA's: ____
C-6

Table 2.3 Causal Analyses (continued)

Question

Number Problem description:

Problem Number: __ Problem Number: __

2.3.8

Did the licensee analyze

programmatic weaknesses to

determine if they could account

for more than one human

performance problem?

Yes

No

NA

Yes

No

NA

2.3.9

Did the licensee perform and

document a root cause analysis

using systematic root cause

analysis techniques?

Yes

No

NA

Yes

No

NA

2.3.10 Was more than one root cause

analysis technique used?

Yes

No

NA

Yes

No

NA

2.3.11

Was the rationale for terminating

the root cause analysis sufficient

and documented?

Yes

No

NA

Yes

No

NA

2.3.12 Were the root causes identified

under management control?

Yes

No

NA

Yes

No

NA

2.3.13

If corrected, would the causes

identified reduce the likelihood of

the same and similar problems

from happening again?

Yes

No

NA

Notes:

Yes

No

NA

Notes:

Notes:

Total number of Yes's: ____

Total number of NA's: ____
C-7

Table 2.4 Corrective Actions

Question

Number Problem description:

Problem Number: __ Problem Number: __

2.4.1

Were corrective actions for the

human performance problem

identified?

Yes

No

NA

Yes

No

NA

2.4.2

Were the corrective actions

effective, or appear likely to be

effective, even if no causal

analysis was performed and/or

documented?

Yes

No

NA

Yes

No

NA

2.4.3

If a causal analysis was

performed, were the links

between the causal factors and

the corrective actions clear?

Yes

No

NA

Yes

No

NA

2.4.4

Was there a corrective action

for every causal factor? (a oneto-one correspondence is not

required)

Yes

No

NA

Yes

No

NA

2.4.5

Was the scope of the

corrective action plan

appropriate?

Yes

No

NA

Yes

No

NA

2.4.6

Were the desired

condition(s) that the

corrective actions are

intended to create clearly

described?

Yes

No

NA

Notes:

Yes

No

NA

Notes:

Notes:

Total number of Yes's: ____

Total number of NA's: ____
C-8

Table 2.4 Corrective Actions (continued)

Question

Number Problem description:

Problem Number: __ Problem Number: __

2.4.7

Did the licensee define

measurable objectives to be

achieved from the corrective

actions?

Yes

No

NA

Yes

No

NA

2.4.8

Did the licensee define

evaluation and

acceptance criteria for

assessing corrective

action effectiveness?

Yes

No

NA

Yes

No

NA

2.4.9

Did the licensee define an

implementation process for the

corrective actions and

specific performance

indicators for evaluating

success?

Yes

No

NA

Yes

No

NA

2.4.10

Did the licensee assign

responsibility to specific,

qualified individuals for

implementing the corrective

actions?

Yes

No

NA

Yes

No

NA

2.4.11

Did the licensee develop a plan

for on-going monitoring of

continued acceptable

performance?

Yes

No

NA

Yes

No

NA

2.4.12

Did the licensee review the

corrective actions before

implementation to ensure that

they will not cause unintended

negative consequences?

Yes

No

NA

Notes:

Yes

No

NA

Notes:

Notes:

Total number of Yes's: ____

Total number of NA's: ____
C-9

Table 2.5 Summary Review Table

Tables

A. Number of human

performance problems

reviewed = ____

2.1 Problem

Identification and

Characterization

2.2 Investigation

Methods 2.3 Causal Analyses 2.4 CorrectiveActions

Number of questions in

each table 6 10 13 12

B. Multiply the number of

questions in each table by

the total number of

problems reviewed

6 X ___=(B)____ 10 X ___=(B)____ 13 X ___=(B)____ 12 X ___=(B)____

C. Record the total

number of Yes answers

circled from each table

(C) = ____ (C) = ____ (C) = ____ (C) = ____

D. Record the total

number of NA answers

circled from each table

(D) = ____ (D) = ____ (D) = ____ (D) = ____

E. Subtract the total in

Row D from the total in

Row B

(B)____-(D)____=(E)____ (B)____-(D)____=(E)____ (B)____-(D)____=(E)____ (B)____-(D)____=(E)____

F. Divide the answer in

Row C by the answer in

Row E

(C)____/(E) ____=(F)____ (C)____/(E) ____=(F)____ (C)____/(E)____=(F)____ (C)____/ (E)____=(F)____

G. Multiply the answer in

Row F by 100 to obtain the

percentage of Yes answers

circled in each review

table

(F)____X 100 = ____% (F)____X 100 = ____% (F)____X 100 = ____% (F)____X 100 = ____%

Notes:
C-10