EPRI/NRC-RES Fire Human Reliability 

Analysis Guidelines 

Draft Report for Comment

Electric Power Research Institute

3420 Hillview Avenue

Palo Alto, CA 94304

U.S. Nuclear Regulatory Commission 

Office of Nuclear Regulatory Research

Washington, DC 20555-0001

EPRI 1019196 NUREG-1921

EPRI Project Managers

D. Hance 

R. Kassawara 

ELECTRIC POWER RESEARCH INSTITUTE 

3420 Hillview Avenue, Palo Alto, California 94304-1338 • PO Box 10412, Palo Alto, California 94303-0813 • USA 

800.313.3774 • 650.855.2121 • askepri@epri.com • www.epri.com 

EPRI/NRC-RES Fire Human 

Reliability Analysis Guidelines 

1019196 NUREG-1921 

Technical Update, November 2009 

Cosponsor 

U.S. Nuclear Regulatory Commission 

Office of Nuclear Regulatory Research 

Washington, DC 20555-0001 

Project Manager 

S. Cooper 
DISCLAIMER OF WARRANTIES AND LIMITATION OF LIABILITIES 

THIS DOCUMENT WAS PREPARED BY THE ORGANIZATION(S) NAMED BELOW AS AN 

ACCOUNT OF WORK SPONSORED OR COSPONSORED BY THE ELECTRIC POWER RESEARCH 

INSTITUTE, INC. (EPRI). NEITHER EPRI, ANY MEMBER OF EPRI, ANY COSPONSOR, THE 

ORGANIZATION(S) BELOW, NOR ANY PERSON ACTING ON BEHALF OF ANY OF THEM: 

(A) MAKES ANY WARRANTY OR REPRESENTATION WHATSOEVER, EXPRESS OR IMPLIED, (I) 

WITH RESPECT TO THE USE OF ANY INFORMATION, APPARATUS, METHOD, PROCESS, OR 

SIMILAR ITEM DISCLOSED IN THIS DOCUMENT, INCLUDING MERCHANTABILITY AND FITNESS 

FOR A PARTICULAR PURPOSE, OR (II) THAT SUCH USE DOES NOT INFRINGE ON OR 

INTERFERE WITH PRIVATELY OWNED RIGHTS, INCLUDING ANY PARTY'S INTELLECTUAL 

PROPERTY, OR (III) THAT THIS DOCUMENT IS SUITABLE TO ANY PARTICULAR USER'S 

CIRCUMSTANCE; OR 

(B) ASSUMES RESPONSIBILITY FOR ANY DAMAGES OR OTHER LIABILITY WHATSOEVER 

(INCLUDING ANY CONSEQUENTIAL DAMAGES, EVEN IF EPRI OR ANY EPRI REPRESENTATIVE 

HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES) RESULTING FROM YOUR 

SELECTION OR USE OF THIS DOCUMENT OR ANY INFORMATION, APPARATUS, METHOD, 

PROCESS, OR SIMILAR ITEM DISCLOSED IN THIS DOCUMENT. 

ORGANIZATION(S) THAT PREPARED THIS DOCUMENT 

Scientech, a Curtiss Wright Flow Control Company 

Science Applications International Corporation (SAIC) 

Nuclear Regulatory Commission 

Sandia National Laboratories 

NOTE 

For further information about EPRI, call the EPRI Customer Assistance Center at 800.313.3774 or 

e-mail askepri@epri.com. 

Electric Power Research Institute, EPRI, and TOGETHER...SHAPING THE FUTURE OF ELECTRICITY 

are registered service marks of the Electric Power Research Institute, Inc. 

Copyright © 2009 Electric Power Research Institute, Inc. All rights reserved. 
iii

ABSTRACT 

During the 1990s, the Electric Power Research Institute (EPRI) developed methods for fire risk 

analysis to support its utility members in the preparation of responses to Generic Letter 88-20, 

Supplement 4, “Individual Plant Examination - External Events” (IPEEE). This effort produced 

a Fire Risk Assessment methodology for operations at power that was used by the majority of 

U.S. nuclear power plants (NPPs) in support of the IPEEE program and several NPPs overseas. 

Although these methods were acceptable for accomplishing the objectives of the IPEEE, EPRI 

and the U.S. Nuclear Regulatory Commission (NRC) recognized that they required upgrades to 

support current requirements for risk-informed, performance-based (RI/PB) applications. 

In 2001, EPRI and the USNRC’s Office of Nuclear Regulatory Research (RES) embarked 

on a cooperative project to improve the state-of-the-art in fire risk assessment to support a new 

risk-informed environment in fire protection. This project produced a consensus document, 

NUREG/CR-6850 (EPRI 1011989), entitled “Fire PRA Methodology for Nuclear Power 

Facilities” which addressed fire risk for at power operations. NUREG/CR-6850 developed high 

level guidance on the process for identification and inclusion of human failure events (HFEs) 

into the fire PRA (FPRA), and a methodology for assigning quantitative screening values to 

these HFEs. It outlined the initial considerations of performance shaping factors (PSFs) and 

related fire effects that may need to be addressed in developing best-estimate human error 

probabilities (HEPs). However, NUREG/CR-6850 did not describe a methodology to develop 

best-estimate HEPs given the PSFs and the fire-related effects. 

In 2007, EPRI and RES embarked on another cooperative project to develop explicit guidance 

for estimating HEPs for human failure events under fire generated conditions, building upon 

existing human reliability analysis (HRA) methods. This document provides a methodology and 

guidance for conducting a fire HRA. This process includes identification and definition of 

post-fire human failure events, qualitative analysis, quantification, recovery, dependency, and 

uncertainty. This document provides three approaches to quantification: screening, scoping, and 

detailed HRA. Screening is based on the guidance in NUREG/CR-6850, with some additional 

guidance for scenarios with long time windows. Scoping is a new approach to quantification 

developed specifically to support the iterative nature of fire PRA quantification. Scoping is 

intended to provide less conservative HEPs than screening, but requires fewer resources than a 

detailed HRA analysis. For detailed HRA quantification, guidance has been developed on how 

to apply existing methods to assess post-fire fire HEPs. 

v

FOREWORD 

Fire probabilistic risk assessment (PRA) methods were used in the Individual Plant Examinations 

of External Event (IPEEE) program to facilitate a nuclear power plant examination for 

vulnerabilities. However, in order to make refined, more realistic decisions for risk-informed 

regulation, fire PRA methods needed to be improved. More robust fire PRA methods will 

benefit licensee applications and U.S. Nuclear Regulatory Commission (USNRC) review 

guidance with respect to many regulatory activities such as the risk-informed, performance-based 

fire protection rulemaking (endorsing National Fire Protection Association Standard 805). In 

order to address the need for improved methods, in 2001, the NRC Office of Nuclear Regulatory 

Research (RES) and Electric Power Research Institute (EPRI) collaborated under a joint 

Memorandum of Understanding (MOU), to develop NUREG/CR-6850, “EPRI/NRC-RES 

Fire PRA Methodology for Nuclear Power Facilities,” a state-of-art Fire PRA methodology. 

The fire HRA guidance provided in NUREG/CR-6850, included: 1) the process for identification 

and inclusion of the fire-related human failure events (HFEs), 2) the methodology for assigning 

quantitative screening values to these HFEs, and 3) the initial considerations of performance 

shaping factors (PSFs) and related fire effects that may need to be addressed in developing 

best-estimate human error probabilities (HEPs). HRA guidance in NUREG/CR-6850, EPRI 

1008239, recommends use of “detailed HRA methods” to address cases where best estimate 

HEPs are needed. However, detailed HRA methods do not provide fire specific HRA guidance 

to systematically address fire specific PSFs and related effects, but rely on judgment of the 

analyst(s) to select PSFs, to evaluate the fire effects, to define HFEs and to assess HEPs. 

The NFPA 805 transition initiative has encouraged the development of additional guidance for 

performing HRA for fire probabilistic risk assessment (FPRA). This project builds upon what is 

documented in NUREG/CR-6850, Volume 2, Section 12, and addresses the development of 

human reliability analyses, which satisfy available standards. These Fire HRA guidelines were 

originally written to the December 2006 draft version of the Fire PRA Methodology standard, 

which ultimately became ANSI/ANS-58.23-2007 in November 2007. Some sections of the 

report also cite ASME RA-S-2000, “Standard for PRA for Nuclear Power Plant Applications,” 

and its addenda, ASME RA-Sa-2003 and ASME RA-Sb-2005, as they relate to internal 

events PRA issues that apply to Fire PRA/HRA. It was decided to issue this version of the 

Fire HRA Guidelines for public review and comment rather than delay it further to resolve any 

inconsistencies between the draft and final versions of the ANS standard, or to review and 

incorporate information from the recently published ASME/ANS RA-Sa-2009, “Level 1 and 

Large Early Release Frequency (LERF) PRA Standard,” which applies to at power internal 

events, internal fire events, and external events for operating reactors. The necessary reviews 

and revisions to reflect the latest standard will be addressed prior to issuing the final Fire HRA 

Guidelines. 
vi 

This report is the third product of the collaboration between EPRI and RES and comes under 

the auspices of the “Memorandum of Understanding (MOU) on Cooperative Nuclear Safety 

Research between NRC and EPRI, Addendum on Fire Risk (Rev. 2).” For this report, a more 

in-depth, realistic treatment has been developed to explicitly account for key fire-induced 

influencing factors that impact the human actions needed to prevent core damage or large 

early releases. It is anticipated that this guidance will be used by the industry as part of transition 

to NFPA 805 and possibly in response to other regulatory issues such as multiple spurious 

operation (MSO) and operator manual actions (OMAs). This is the first report addressing 

fire-related human reliability analysis for fire PRAs that goes beyond the screening level. 

As the methodology is applied at a wide variety of plants, the document may benefit from 

future improvements to better support industry-wide issues being addressed by fire PRAs. 

This document does not constitute regulatory requirements. RES participation in this 

study does not constitute or imply regulatory approval of applications based upon this 

methodology. 
vii

CONTENTS 

ABTRACT....................................................................................................................................III 

FOREWORD.................................................................................................................................V 

CONTENTS ................................................................................................................................VII 

LIST OF FIGURES .................................................................................................................... XV 

LIST OF TABLES.................................................................................................................... XVII 

REPORT SUMMARY ............................................................................................................... XIX 

CITATION ................................................................................................................................. XXI 

LIST OF ACRONYMS ............................................................................................................ XXIII 

1 INTRODUCTION ....................................................................................................................1-1

1.1 Background .....................................................................................................................1-1

1.2 Programmatic Overview..................................................................................................1-1

1.2.1 Objectives................................................................................................................1-2

1.2.2 Project Tasks...........................................................................................................1-2

1.2.2.1 Fire Data Review .............................................................................................1-2

1.2.2.2 Fire HRA Development....................................................................................1-3

1.2.2.3 Fire HRA Testing Tasks...................................................................................1-3

1.3 Scope ..............................................................................................................................1-4

1.4 Intended Audience and Prerequisite Expertise ...............................................................1-6

1.5 Report Structure..............................................................................................................1-6

1.6 References......................................................................................................................1-7
viii 

2 FIRE HRA FRAMEWORK......................................................................................................2-1

2.1 Introduction .....................................................................................................................2-1

2.2 Fire HRA Process............................................................................................................2-1

2.3 Relationship to Other Fire PRA Tasks ............................................................................2-4

2.4 General Assumptions......................................................................................................2-7

2.5 Technical Bases..............................................................................................................2-8

2.6 References......................................................................................................................2-8

3 IDENTIFICATION AND DEFINITION .....................................................................................3-1

3.1 Introduction .....................................................................................................................3-1

3.2 Internal Events Operator Actions ....................................................................................3-2

3.3 Fire Response Operator Action Categorization...............................................................3-4

3.3.1 Fire Response Actions to Mitigate the Expected Consequences of Fire 

Damaged Equipment Needed in the FPRA......................................................................3-4

3.3.2 Pre-Emptive Fire Response Actions to Prevent Fire Damage to Equipment 

(Protect Equipment) Needed in the FPRA........................................................................3-5

3.3.3 Fire Response Actions Recovering PRA Sequences or Cutsets ............................3-6

3.3.4 Main Control Room Abandonment Actions .............................................................3-6

3.3.5 Manual Actuation of Fixed Fire Suppression Systems ............................................3-7

3.4 Fire Response Operator Action Identification and Definition...........................................3-7

3.5 HFEs Corresponding to Undesired Operator Responses to Spurious Actuation ............3-9

3.5.1 Examples of Operator Actions that Result in Undesired Response ......................3-11

3.5.2 Process for Identifying and Defining HFEs that Result in Undesired Operator 

Response .......................................................................................................................3-13

3.6 Initial Assessment of Feasibility ....................................................................................3-14

3.7 HRA/PRA Modeling.......................................................................................................3-15

3.8 References....................................................................................................................3-16

4 QUALITATIVE ANALYSIS.....................................................................................................4-1

4.1 Introduction .....................................................................................................................4-1

4.2 HFE Narrative..................................................................................................................4-1

4.2.1 Accident Sequence Preceding Function Failures and Success ..............................4-2

4.2.2 Timing Information...................................................................................................4-2

4.2.3 Accident Specific Procedural Guidance ..................................................................4-3

4.2.4 Availability of Cues and Other Indications for Detection and Evaluation Errors ......4-3
ix 

4.2.5 Preceding Operator Errors or Successes in Sequence...........................................4-3

4.2.6 Operator Action Success Criteria ............................................................................4-4

4.2.7 Physical Environment..............................................................................................4-4

4.2.8 Fire PRA Context.....................................................................................................4-4

4.3 Performance Shaping Factors (PSF) ..............................................................................4-5

4.3.1 Cues and Indications...............................................................................................4-5

4.3.2 Timing......................................................................................................................4-7

4.3.3 Procedures and Training .......................................................................................4-12

4.3.4 Complexity.............................................................................................................4-13

4.3.5 Workload, Pressure, and Stress............................................................................4-14

4.3.6 Human Machine Interface .....................................................................................4-15

4.3.7 Environment ..........................................................................................................4-16

4.3.8 Special Equipment.................................................................................................4-16

4.3.9 Special Fitness Needs...........................................................................................4-17

4.3.10 Crew Communications, Staffing, and Dynamics .................................................4-17

4.4 Review of Relevant Experiences...................................................................................4-19

4.5 Review of Plant Operations...........................................................................................4-20

4.6 References....................................................................................................................4-20

5 QUANTIFICATION .................................................................................................................5-1

5.1 Screening HRA Quantification.........................................................................................5-2

5.1.1 Method for Assigning Screening Values to HFEs (Sets 1, 2, 3, and 4) ...................5-3

5.1.1.1 Screening Values Under Set 1.........................................................................5-3

5.1.1.2 Screening Values Under Set 2.........................................................................5-5

5.1.1.3 Screening Values Under Set 3.........................................................................5-6

5.1.1.4 Screening Values Under Set 4.........................................................................5-6

5.1.2 Examples and Basis for Quantitative Screening Values .........................................5-7

5.1.3 Single Overall Failure Probability Approach for MCR Abandonment or 

Alternative Shutdown........................................................................................................5-8

5.2 Scoping Fire HRA Quantification.....................................................................................5-9

5.2.1 Determine Minimum Criteria..................................................................................5-10

5.2.2 Demonstrate the Feasibility of the Operator Actions .............................................5-11

5.2.3 Calculation of Time Margin....................................................................................5-15

5.2.4 Assess Key Conditions and PSFs .........................................................................5-17

5.2.5 Basis for Scoping Fire HRA Quantification HEPs..................................................5-21
x 

5.2.6 Guidance for Using the Search Scheme (Figure 5-2) ...........................................5-22

5.2.6.1 MCR Abandonment/Alternative Shutdown (D2 and D3)................................5-24

5.2.6.2 Actions Caused by Spurious Instruments (D4)..............................................5-26

5.2.6.3 In MCR and Ex-Control Room Actions ..........................................................5-27

5.2.7 Guidance for Using the INCR Flowchart for in MCR Actions (Figure 5-3).............5-31

5.2.8 Guidance for Using the EXCR Flowchart for ex-CR Actions (Figure 5-4) .............5-33

5.2.9 Guidance for Using the CRAB Flowchart for Main Control Room 

Abandonment and/or Shutdown Using Alternate Means Actions (Figure 5-5) ...............5-35

5.2.10 Guidance for Using the SPI Flowchart for EOC or EOO Due to Spurious 

Instrumentation (Figure 5-6) ...........................................................................................5-37

5.3 Detailed HRA Quantification..........................................................................................5-41

5.4 Special Cases where Little or No Credit should be Allowed .........................................5-42

5.5 References....................................................................................................................5-43

6 RECOVERY............................................................................................................................6-1

6.1 Introduction .....................................................................................................................6-1

6.2 Identify and Define ..........................................................................................................6-2

6.2.1 Recovery Action Requirements ...............................................................................6-2

6.2.2 Limits on use of Recovery Actions ..........................................................................6-3

6.2.3 Recovery Action Feasibility Factors ........................................................................6-4

6.3 Quantification ..................................................................................................................6-5

6.4 References......................................................................................................................6-6

7 DEPENDENCY ANALYSIS....................................................................................................7-1

7.1 Qualitative Dependency Analysis....................................................................................7-1

7.2 Screening and Scoping HEPs.........................................................................................7-4

7.3 References......................................................................................................................7-5

8 UNCERTAINTY ANALYSIS ...................................................................................................8-1

8.1 Background .....................................................................................................................8-1

8.1.1 Uncertainty Versus Randomness............................................................................8-1

8.1.2 Aleatory Versus Epistemic.......................................................................................8-1

8.1.3 Parametric, Modeling and Completeness................................................................8-2

8.1.3.1 Parameter Uncertainty.....................................................................................8-2

8.1.3.2 Modeling Uncertainty .......................................................................................8-4

8.1.3.3 Completeness uncertainty ...............................................................................8-5
xi 

8.1.4 Sensitivity Analysis Versus Uncertainty Analysis ....................................................8-5

8.2 Fire HRA Applications of Uncertainty..............................................................................8-6

8.2.1 Screening ................................................................................................................8-6

8.2.2 Scoping....................................................................................................................8-6

8.2.3 Detailed HRA...........................................................................................................8-7

8.2.3.1 EPRI Model......................................................................................................8-8

8.2.3.2 ATHEANA........................................................................................................8-9

8.3 Additional Guidance for Uncertainty..............................................................................8-10

8.4 References....................................................................................................................8-10

9 DOCUMENTATION ................................................................................................................9-1

9.1 References......................................................................................................................9-1

A FIRE PRA STANDARD AND THE FIRE HRA GUIDANCE ................................................. A-1

A.1 Objective........................................................................................................................ A-1

A.2 Fire PRA Standard Requirements Relevant to Fire HRA .............................................. A-1

A.2.1 Identification of Actions and Definition of HFEs ..................................................... A-1

A.2.2 Estimating Screening/Scoping/Detailed HEPs....................................................... A-2

A.3 Review of the EPRI/NRC-RES Fire HRA Guidance against the Relevant 

Requirements of the Fire PRA Standard.............................................................................. A-3

A.4 References..................................................................................................................... A-3

B FIRE EVENT REVIEW .......................................................................................................... B-1

B.1 Objective........................................................................................................................ B-1

B.2 Fire Events Review........................................................................................................ B-1

B.3 Summary of Fire Events Review Findings and Implications.......................................... B-1

C DETAILED QUANTIFICATION OF POST-FIRE HUMAN FAILURE EVENTS USING 

EPRI FIRE HRA METHODS..................................................................................................... C-1

C.1 Objective........................................................................................................................ C-1

C.2 EPRI Performance Shaping Factors.............................................................................. C-1

C.3 Post Initiator EPRI HFE Analysis Framework.............................................................. C-10

C.4 Timing and Crew Response Structure......................................................................... C-11

C.5 Instrumentation Impact on Fire HFEs.......................................................................... C-13

C.6 Quantification............................................................................................................... C-14

C.6.1 Method Selection ................................................................................................. C-14
xii 

C.6.2 EPRI HFE Approach and Documentation............................................................ C-14

C.6.2.1 HFE Approach.............................................................................................. C-14

C.6.2.2 Cues............................................................................................................. C-16

C.6.2.3 Procedures................................................................................................... C-17

C.6.2.4 Scenario Description .................................................................................... C-19

C.6.2.5 Operator Interviews...................................................................................... C-20

C.6.2.6 Manpower Requirements ............................................................................. C-20

C.6.2.7 Time ............................................................................................................. C-21

C.6.3 Cognitive Modeling Using CBDTM ...................................................................... C-22

C.6.3.1 Failure Mechanism a, Data Not Available .................................................... C-23

C.6.3.2 Failure Mechanism b, Data Not Attended to ................................................ C-27

C.6.3.3 Failure Mechanism c, Data Misread or Miscommunicated........................... C-30

C.6.3.4 Failure Mechanism d, Information Misleading.............................................. C-32

C.6.3.5 Failure Mechanism e, Relevant Step in Procedure Missed.......................... C-34

C.6.3.6 Failure Mechanism f, Misinterpret Instruction............................................... C-36

C.6.3.7 Failure Mechanism g, Error in Interpreting Logic ......................................... C-38

C.6.3.8 Failure Mechanism h, Deliberate Violation................................................... C-40

C.6.3.9 CBDTM Cognitive Recovery ........................................................................ C-41

C.6.4 Cognitive Modeling Using HCR/ORE................................................................... C-42

C.6.4.1 Estimation of σ for Fire HRA ........................................................................ C-44

C.6.5 Execution Modeling .................................................................................................. C-45

C.6.5.1 PSF Execution ............................................................................................. C-45

C.6.5.2 Execution Stress .......................................................................................... C-46

C.6.5.3 Execution Unrecovered and Recovered....................................................... C-47

C.6.6 Summary Modeling Existing EOP Actions within the EPRI HRA Methodology ... C-50

C.6.7 Summary Modeling Fire Response Actions within the EPRI HRA 

Methodology.................................................................................................................. C-52

C.6.8 Summary Modeling MCR Abandonment Actions within the EPRI HRA 

Methodology.................................................................................................................. C-55

C.6.9 Summary Modeling Undesired Operators Response Actions within the EPRI 

HRA Methodology ......................................................................................................... C-55

C.7 Discussion on how Fire Effects are Modeled Using the EPRI Approach..................... C-55

C.7.1 Cues and Indications ........................................................................................... C-56

C.7.2 Timing .................................................................................................................. C-57

C.7.3 Procedures and Training...................................................................................... C-63
xiii 

C.7.4 Complexity ........................................................................................................... C-66

C.7.5 Workload and Stress............................................................................................ C-68

C.7.6 Human Machine Interface.................................................................................... C-69

C.7.7 Environment......................................................................................................... C-70

C.7.8 Special Equipment............................................................................................... C-71

C.7.9 Special Fitness Needs ......................................................................................... C-71

C.7.10 Crew Communications, Staffing and Dynamics................................................. C-72

C.8 Example of Fire HFE quantified using the EPRI HRA Methodology............................ C-75

C.9 References .................................................................................................................. C-84

D DETAILED QUANTIFICATION OF POST-FIRE HUMAN FAILURE EVENTS USING 

ATHEANA ................................................................................................................................ D-1

D.1 Objective........................................................................................................................ D-1

D.2 Summary of Method ...................................................................................................... D-1

D.3 Application of Method .................................................................................................... D-3

D.4 References .................................................................................................................... D-5

E DEFINITION OF TERMS....................................................................................................... E-1

F SUMMARY OF TESTING AND PEER REVIEW....................................................................F-1

F.1 Objective .........................................................................................................................F-1

F.2 Peer Review Exercise.....................................................................................................F-1

F.3 Testing Objectives and Scope ........................................................................................F-2

F.3.1 Test Plan .................................................................................................................F-3

F.3.2 Testing Scenarios Plant #1 .....................................................................................F-5

F.3.2.1 Existing Internal Events HEPs Important to FPRA Fire Scenario....................F-5

F.3.2.2 New FPRA HEP Not in the Internal Events PRA.............................................F-7

F.3.2.3 Spurious Induced Scenario..............................................................................F-7

F.3.2.4 Spurious/False Indication Causes Inappropriate Operator Action Fire 

Scenario.......................................................................................................................F-8

F.3.2.5 Control Room Abandonment Fire Scenario.....................................................F-8

F.3.3 Testing Scenarios Plant #2 .....................................................................................F-8

F.3.4 Operator Interviews ...............................................................................................F-12

F.3.5 Testing Results/Lessons Learned .........................................................................F-13
xiv 

G HRA ASSOCIATED WITH FIRE-RELATED ELECTRIC BUS CLEARING AND 

RESTORATION PROCEDURES .............................................................................................G-1

G.1 Objective .......................................................................................................................G-1

G.2 Identifying and Defining HFEs.......................................................................................G-3

G.3 Quantitative Screening ..................................................................................................G-5

G.3.1 Set 3 Criteria..........................................................................................................G-5

G.4 Qualitative Assessment.................................................................................................G-6

G.5 Quantification.................................................................................................................G-7

G.6 References ....................................................................................................................G-8

H JUSTIFICATION FOR SCOPING APPROACH.................................................................... H-1

H.1 Demonstration of Feasibility .......................................................................................... H-1

H.2 Time Margin................................................................................................................... H-2

H.3 Performance Shaping Factors....................................................................................... H-3

H.4 HEP Values ................................................................................................................... H-5

H.4.1 Optimal HEP Value ................................................................................................ H-5

H.4.2 HEP Multipliers for PSFs ....................................................................................... H-7

H.4.3 HEP Multipliers Across Flowcharts ........................................................................ H-8

H.5 References .................................................................................................................. H-10
xv

LIST OF FIGURES 

Figure 2-1 Fire HRA process .....................................................................................................2-3

Figure 2-2 Mapping of fire HRA task 12 to NUREG/CR-6850 [1] PRA tasks.............................2-6

Figure 5-1 Timeline Illustrating total time available, time required, and the resulting time 

margin ..............................................................................................................................5-16

Figure 5-2 Scoping HRA analysis search scheme...................................................................5-23

Figure 5-3 INCR - scoping HRA analysis for in MCR actions ..................................................5-28

Figure 5-4 EXCR - scoping HRA analysis for EX-CR actions..................................................5-29

Figure 5-5 CRAB - scoping HRA analysis for MCR abandonment or alternative shutdown 

actions..............................................................................................................................5-30

Figure 5-6 SPI - scoping HRA analysis for EOC or EOO due to spurious instrumentation .....5-39

Figure C-1 Post-initiator general HFE analysis framework ..................................................... C-10

Figure C-2 Cue-response structure timelines for type CP operator actions ........................... C-12

Figure C-3 EPRI HRA methodology basic event setup for fire HFE analysis ......................... C-15

Figure C-4 EPRI HRA methodology screen shot showing multiple variations of a base 

case HFE ........................................................................................................................ C-16

Figure C-5 EPRI HRA methodology identification of cues...................................................... C-17

Figure C-6 EPRI HRA methodology documentation of procedures........................................ C-18

Figure C-7 EPRI HRA methodology documentation of fire procedure review ........................ C-18

Figure C-8 EPRI HRA methodology scenario description window.......................................... C-19

Figure C-9 EPRI HRA methodology operator interview insights window................................ C-20

Figure C-10 EPRI HRA methodology manpower requirements window................................. C-21

Figure C-11 EPRI HRA methodology timing window.............................................................. C-21

Figure C-12 Time window – time available for recovery is less than zero .............................. C-22

Figure C-13 Decision tree for pca, data not available.............................................................. C-23

Figure C-14 EPRI HRA methodology pca branch selection to account for instrumentation 

partially impacted by fire and general training credited................................................... C-26

Figure C-15 Decision tree for pcb, data not attended to.......................................................... C-27

Figure C-16 EPRI HRA methodology pcb branch selection to account for high workload 

due to use of fire procedures in parallel to EOPs............................................................ C-29

Figure C-17 Decision tree for pcc, data misread or miscommunicated ................................... C-30

Figure C-18 EPRI HRA methodology pcc, branch selection to account for difficulties in 

communication ................................................................................................................ C-32

Figure C-19 Decision tree pcd, information misleading ........................................................... C-32
xvi 

Figure C-20 EPRI HRA methodology pcd branch selection to account for instrumentation 

partially impacted by fire ................................................................................................. C-34

Figure C-21 Decision tree for pce, relevant step in procedure missed.................................... C-34

Figure C-22 EPRI HRA methodology pce- branch selection to account for fire procedures 

that are used in parallel to EOPs .................................................................................... C-36

Figure C-23 Decision tree for pcf, misinterpret instruction....................................................... C-36

Figure C-24 Decision tree for pcg, error in interpreting logic ................................................... C-38

Figure C-25 Decision tree for pch, deliberate violation............................................................ C-40

Figure C-26 Cognitive recovery .............................................................................................. C-42

Figure C-27 HCR/ORE sigma modeling in HRA methodology ............................................... C-43

Figure C-28 Timing information in the EPRI HRA methodology ............................................. C-44

Figure C-29 EPRI HRA methodology execution PSFs ........................................................... C-46

Figure C-30 EPRI HRA methodology execution stress .......................................................... C-47

Figure C-31 EPRI HRA methodology execution unrecovered ................................................ C-49

Figure C-32 EPRI HRA methodology execution recovered .................................................... C-49

Figure C-33 EPRI HRA methodology execution summary ..................................................... C-50

Figure C-34 Modeling of SG level indicators for internal events action in which there is 

no impact on instrumentation .......................................................................................... C-56

Figure C-35 Modeling to reflect partial impact on instrumentation due to fire effects ............. C-57

Figure C-36 Modeling for timing scenario 1 ............................................................................ C-61

Figure C-37 Modeling of HCR/ORE for scenario 1 ................................................................. C-61

Figure C-38 Timing for Scenario 2- not enough time to complete the action.......................... C-62

Figure C-39 Stress decision tree ............................................................................................ C-68

Figure C-40 Crediting proceduralized recovery within Pexe ...................................................... C-74

Figure D-1 Steps in the ATHEANA methodology ..................................................................... D-2
xvii

LIST OF TABLES 

Table 3-1 Examples of operator actions in EOPs that could result in undesired 

responses.........................................................................................................................3-12

Table 3-2 Examples of operator actions based on spurious annunciators that could result 

in undesired responses ....................................................................................................3-12

Table 5-1 Example HEP adjustments and values using fire zone screening criteria.................5-8

Table 5-2 In MCR actions HEP lookup tables..........................................................................5-32

Table 5-3 Ex-CR actions HEP lookup tables ...........................................................................5-34

Table 5-4 MCR abandonment or alternative shutdown actions HEP lookup tables.................5-36

Table 5-5 EOC or EOO due to spurious instrumentation HEP lookup tables ..........................5-41

Table 7-1 THERP Dependency Equations ................................................................................7-4

Table 8-1 Summary of measurements used to evaluate HEP uncertainty in NUREG/CR1278 [3] ..............................................................................................................................8-3

Table 8-2 Uncertainty assignment for screening values ............................................................8-6

Table 8-3 Uncertainty categories for scoping analysis ..............................................................8-7

Table 8-4 EPRI uncertainty categories for EPRI detailed analysis ............................................8-9

Table A-1 Internal events PRA standard requirements HR-G3, HR-G4, and HR-G5 .............. A-2

Table A-2 ANS 58.23-2007 standard requirements vs. HRA steps identified in this 

document .......................................................................................................................... A-4

Table B-1 Summary of the fire event 1 review.......................................................................... B-3

Table B-2 Summary of the fire event 2 review.......................................................................... B-7

Table B-3 Summary of the fire event 3 (1975) review8 ........................................................... B-20

Table C-1 ASME PRA standard performance shaping factors ................................................. C-2

Table C-2 EPRI HRA methodology performance shaping factors ............................................ C-3

Table C-3 CBDTM[5] performance shaping factors.................................................................. C-4

Table C-4 Performance shaping factors mapping .................................................................... C-5

Table C-5 CBDTM failure mechanisms .................................................................................. C-23

Table C-6 Guidance on decision nodes for pca, data not available......................................... C-24

Table C-7 Guidance on decision nodes for pcb, data not attended to..................................... C-28

Table C-8 Guidance on decision nodes for pcc, data misread or miscommunicated .............. C-31

Table C-9 Guidance on decision nodes for pcd information misleading.................................. C-33

Table C-10 Guidance on decision nodes for pce, relevant step in procedure missed............. C-35

Table C-11 Guidance on decision nodes for pcf, misinterpret instruction................................ C-37
xviii 

Table C-12 Guidance on decision nodes for pcg, error in interpreting logic............................ C-39

Table C-13 Guidance on decision nodes for pch, deliberate violation..................................... C-41

Table C-14 Estimates of average sigma with upper and lower bounds.................................. C-45

Table C-15 Summary between internal events HFE and fire HFE for existing EOP 

actions............................................................................................................................. C-51

Table C-16 Summary of fire response actions........................................................................ C-53

Table C-17 Example of ambiguously worded procedure (fire zone 100) intake structure ...... C-65

Table C-18 Stress PSF Values ............................................................................................... C-68

Table C-19 Scenario-1 summary ............................................................................................ C-75

Table C-20 Scenario-1 cognitive unrecovered........................................................................ C-80

Table C-21 Scenario-1 cognitive recovery.............................................................................. C-81

Table C-22 Sigma table .......................................................................................................... C-82

Table C-23 Scenario-1 execution unrecovered ...................................................................... C-83

Table C-24 Scenario-1 execution recovery............................................................................. C-83

Table H-1 Multipliers used for increasing HEP values to reflect negative changes in 

conditions or poorer conditions ......................................................................................... H-8

Table H-2 Calculation of HEP values across scoping flowcharts ............................................. H-9
xix

REPORT SUMMARY 

In 2001, EPRI and Nuclear Regulatory Research (RES) collaborated to improve the state of the 

art in fire risk assessment to support the new risk-informed environment in fire protection. This 

project produced a consensus document—NUREG/CR-6850 (EPRI report 1011989), Fire PRA 

Methodology for Nuclear Power Facilities—which addresses fire risk during operations at power 

plants. NUREG/CR-6850 developed high-level guidance on identifying and including human 

failure events (HFEs) into the fire PRA (FPRA) and a methodology for assigning quantitative 

screening values to these HFEs. It also outlines the initial considerations of performance shaping 

factors (PSFs) and related fire effects that may need to be addressed in developing best-estimate 

human error probabilities (HEPs). However, NUREG/CR-6850 does not provide a methodology 

for developing best-estimate HEPs given the PSFs and the fire-related effects. 

In 2007, EPRI and RES embarked on another cooperative project to develop explicit guidance 

for estimating human error probabilities for HFEs under fire-generated conditions, building on 

existing human reliability analysis (HRA) methods. This report provides the methodology and 

guidance for conducting a post-fire HRA. 

Background 

This report is intended primarily for practitioners conducting a post-fire HRA to support an 

FPRA. Because fire HRA builds on the internal event HRA models, the fire HRA analyst needs 

knowledge of HRA and the PRA used in the internal events model. This includes knowledge of 

HRA terminology, a general understanding of methodologies used for internal events HRA, a 

familiarity with general plant operations including procedure usage, and an understanding of the 

internal events scenarios and FPRA scenarios being modeled. A fire HRA typically requires a 

team effort because few individuals have the full range of expertise and knowledge necessary to 

complete the fire HRA analysis. 

The guidance in this report represents the state of the art in fire HRA practice. Certain aspects of 

HRA, especially in the area of quantification, continue to evolve and likely will see additional 

developments. Such developments should be easily captured within the overall analysis 

framework described. 

Objectives 

• To develop the methodology and supporting guidelines for estimating HEPs for HFEs 

following fire-induced initiating events of an FPRA 

Approach 

The EPRI/NRC team decided on the primary tasks for development of the fire HRA 

methodology: fire data review, fire HRA methodology and guideline development, and fire HRA 

review and testing. In developing the methodology, existing guidance was used or adapted where 
xx 

possible. Feedback on the use of NUREG/CR-6850 HRA screening values was incorporated to 

update the screening HEPs. In addition, the team developed a new scoping fire HRA approach 

intended to produce less conservative HEPs than the NUREG/CR-6850 screening but requiring 

fewer resources than a detailed analysis. A draft document was created and peer reviewed by a 

team of industry and NRC members. The scoping approach was tested at two commercial 

nuclear power plants, and the draft guidelines were modified, revised, and developed into the 

current document. 

Results 

This report reflects a state-of-the-art fire HRA approach. It provides fire HRA practitioners with 

specific guidance for each step of the HRA process, and relates the HRA process to the fire PRA 

development, which is typically performed in parallel. This report built on what is documented in 

NUREG/CR-6850 regarding HRA and addresses the development of HRAs that satisfy the 

ASME PRA Standard and requirements of the fire PRA standard. This fire HRA methodology is 

intended to provide an in-depth, realistic way to account for the key fire-induced influencing 

factors that determine human actions needed to prevent core damage or large early releases. 

EPRI Perspective 

This report describes advancements in the understanding of HRA methods as applied to fire 

PRA. This is an interim report developed based on a consensus process involving both EPRI and 

NRC Research and is being issued in support of public comment on a draft NUREG. The HRA 

methods described herein address specific HRA methodological issues such as identification and 

definition, qualitative analysis, quantification, recovery, dependency, and uncertainty related to 

the probabilistic analysis of fire-initiated events. 

This guideline offers improved guidance for fire HRA in support of FPRAs and their riskinformed regulatory applications. It is anticipated both that further improvements will be 

identified through the public comment process and that additional applications of this method 

and guideline will provide input into the final FPRA human reliability analysis methods. 

Keywords 

Human reliability analysis (HRA) 

Probabilistic risk assessment (PRA) 

Fire 
xxi

CITATIONS 

This report was prepared by 

Scientech, a Curtiss Wright Flow Control Company

16300 Christensen Road, Suite 300 

Tukwila, WA 98038 

Principal Investigators 

J. Julius 

J. Grobbelaar 

K. Kohlhepp 

Science Applications International Corporation (SAIC) 

1671 Dell Avenue #100 

Campbell, CA 95008 

Principal Investigators 

B. Hannaman 

B. Najafi 

E. Collins 

Nuclear Regulatory Commission 

Office of Nuclear Regulatory Research 

Washington, DC 20555 

Principal Investigators 

S. Cooper 

K. Hill 

Sandia National Laboratories 

P.O. Box 5800 

Albuquerque, NM 87185 

Principal Investigators 

J. Forester 

S. Hendrickson 

This report describes research sponsored by the Electric Power Research Institute (EPRI), and 

U.S. Nuclear Regulatory Commission. 

The report is a corporate document that should be cited in the literature in the following manner: 

EPRI/NRC-RES Fire Human Reliability Analysis Guidelines. EPRI, Palo Alto, CA, and U.S. 

Nuclear Regulatory Commission, Washington, DC: 2009. 1019196/NUREG-1921. 

xxiii

LIST OF ACRONYMS 

AC Alternating Current 

ACRS Advisory Committee for Reactor Safeguards 

AFW Auxiliary Feedwater 

ANS American Nuclear Society 

AOP Abnormal Operating Procedure 

AP Abnormal Procedure 

AR Annunciator Response 

ARP Alarm Response Procedure 

ASME American Society for Mechanical Engineers 

ATHEANA A Technique for Human Event Analysis 

ATWS Anticipated Transient Without SCRAM 

ATWT Anticipated Transient Without Trip 

BHEP Basic HEP 

BOPCO Balance of Plant Control Operator 

BWR Boiling Water Reactor 

CBDTM Cause Based Decision Tree Method 

CCDP Conditional Core Damage Probability 

CCF Common Cause Failure 

CCW Component Cooling Water 

CDF Core Damage Frequency 

CLERP Conditional Large Early Release Probability 

CO Control Operator 

COPS Cold Overpressure Protection System 

CR Control Room aka Main Control Room 

CS Containment Spray 
xxiv 

CVCS Chemical and Volume Control System 

DAS Data Acquisition System 

DEC Digital Equipment Corporation 

DF Dependent Failure 

DHR Decay heat removal 

ECA Emergency Contingency Action 

ECCS Emergency Core Cooling Systems 

EDG Emergency Diesel Generator 

ELOCA Excessive LOCA 

EOC Error of Commission 

EOM Error of Omission aka EOO 

EOP Emergency Operating Procedure 

EOO Error of Omission aka EOM 

EP Emergency Plan 

EPRI Electric Power Research Institute 

ERF Emergency Response Facility 

ESW Essential Service Water Cooling System 

ET Event Tree 

EOF Emergency Operations Facility 

FPC Fuel Pool Cooling 

FPRA Fire PRA 

FR Functional Restoration 

FRP Functional Restoration Procedure 

HCR/ORE Human Cognitive Reliability/Operator Reliability Experiment 

HEP Human Error Probability 

HFE Human Failure Event 

HI Human Interaction also called Operator Action 

HMI Human-Machine Interface 

HPI High Pressure Injection 

HPSI High Pressure Safety Injection 

HPSR High Pressure Safety Recirculation 

HR High Pressure Injection 

HRA Human Reliability Analysis 
xxv 

HVAC Heating, Ventilating, and Air Conditioning 

ICCDP Incremental Conditional Core Damage Probability 

ICLERP Incremental Conditional Large Early Release Probability 

IE Initiating Event 

IEF Initiating Event Frequency 

ILRT Integrated Leak Rate Test 

IPE Individual Plant Examination 

IPEEE Individual Plant Examination of External Events 

IRT Independent Review Team 

ISL Interfacing Systems LOCA 

ISLOCA Interfacing Systems LOCA 

JPM Job Performance Measure 

LB Lower Bound 

LER Licensee Event Report 

LERF Large, Early Release Frequency 

LLOCA Large LOCA 

LOCA Loss of Coolant Accident 

LOSP Loss of Offsite Power 

LPI Low Pressure Injection 

LPSD Low Power and/or Shutdown 

LPSI Low Pressure Safety Injection from RWST 

LPSR Low Pressure Sump Recirculation 

LTOP Low Temperature Overpressurization 

LWR Light Water Reactor 

MCCB Motor-Controlled Circuit Breaker 

MCR Main Control Room aka Control Room 

MLOCA Medium Loss of Coolant Accident 

MLT Mean-Logistics-Time 

Mode Technical Specification Operating Mode 

MRT Mean-Repair-Time 

MSLBIC Main Steamline Break Inside Containment 

MSLBOC Main Steamline Break Outside Containment 

MSO Multiple Spurious Operations 
xxvi 

MTBF Mean-Time-Between Failure 

NFPA National Fire Protection Association 

NPP Nuclear Power Plant 

NRC Nuclear Regulatory Commission 

NSS Nuclear Steam Supply System 

NUREG Nuclear Regulatory Commission Document 

OA Operator Action also called Human Interaction 

OMA Operator Manual Action (typically in response to a fire) 

- In Appendix R these are local manual actions (outside of the MCR) 

- In fire PRA these may be operator actions added in response to a fire, 

such as to mitigate spurious indications or alarms. 

OP Operating Procedure 

OSC Operations Support Center 

PM Project Manager 

PORV Power Operated Relief Valve 

POS Plant Operational State or Plant Operating State 

PRA Probabilistic Risk Assessment (aka PSA) 

PSA Probabilistic Safety Assessment (aka PRA) 

PSF Performance Shaping Factor 

PTS Pressurized Thermal Shock 

PWR Pressurized Water Reactor 

RAW Risk Achievement Worth 

RCS Reactor Coolant System 

RES U.S. NRC Office of Research 

RI/PB Risk-Informed, Performance-Based 

RNO Response Not Obtained 

RPS Reactor Protection System 

RT Reactor Trip 

RSP Remote Shutdown Panel 

RWST Refueling Water Storage Tank 

S/G Steam Generator 

SCBA Self-Contained Breathing Apparatus 

SD Shutdown 
xxvii 

SDP Significance Determination Process 

SF Shift Foreman 

SG Steam Generator 

SGTR SG Tube Rupture 

SISBO Self-Induced Station Blackout 

SI Safety Injection 

SLOCA Small Loss of Coolant Accident 

STA Shift Technical Advisor 

THERP Technique for Human Error Rate Prediction 

TSC Technical Support Center 

TT Turbine Trip 

UB Upper Bound 

UPS Uninterruptable Power Supply 

WOG Westinghouse Owners Group, now the PWR-OG 

1-1 

1

INTRODUCTION 

1.1 Background 

Over the past two decades the nuclear power fire protection community in the United States and 

overseas has been transitioning towards risk-informed and performance-based (RI/PB) practice 

in design, operation and regulation. 

Under a joint Memorandum of Understanding (MOU), the Electric Power Research Institute 

(EPRI) and the USNRC Office of Research (RES) embarked on a cooperative program to 

improve the state-of-the-art in fire risk studies. This program produced a joint document, EPRI 

1011989/NUREG/CR-6850, entitled “Fire PRA Methodology for Nuclear Power Facilities” 

[1] which addresses fire risk for at-power operations. For the human reliability analysis task, 

NUREG/CR-6580 developed the following. 

1. Process for identification and inclusion of the human failure events (HFEs) 

2. Methodology for assigning quantitative screening values to these HFEs, and 

3. Initial considerations of performance shaping factors (PSFs) and related fire effects 

that may need to be addressed in developing best-estimate human error probabilities (HEPs). 

However, NUREG/CR-6850 did not identify or produce a methodology to develop these 

best-estimate HEPs given the PSFs and the fire-related effects. 

The USNRC Office of Research and EPRI fire research cooperative program also produced 

NUREG-1824 & EPRI 1011999, “Verification and Validation of Selected Fire Models for 

Nuclear Power Plant Applications,” in May 2007 [2]. 

1.2 Programmatic Overview 

This report is the third product of the collaboration between EPRI and the USNRC Office of 

Research and comes under the auspices of the “Memorandum of Understanding (MOU) on 

Cooperative Nuclear Safety Research between NRC and EPRI, Addendum on Fire Risk 

(Rev. 2).” As such, this project follows a process similar to that initiated as part of the MOU 

and followed in the previous two projects. 

It is anticipated that this guidance will be used by the industry as part of transition to NFPA 805 

and possibly in response to other regulatory issues such as multiple spurious operation (MSO) 

and operator manual actions (OMAs). This is the first report addressing post-fire human 

reliability analysis for fire PRAs that goes beyond the screening level. As the methodology is 

applied at a wide variety of plants, the document may benefit from future improvements to more 

fully support industry-wide issues being addressed by fire PRAs. 
Introduction 

1-2 

1.2.1 Objectives 

The objective of this report is to develop the methodology and supporting guidelines for 

estimating human error probabilities (HEPs) for human failure events following fire-induced 

initiating events of a probabilistic risk assessment (PRA). This report builds upon existing human 

reliability analysis (HRA) information such as HRA process and HRA methods, and the 

screening method included in NUREG/CR-6850. The guidance provided in this report is 

intended to be both an improvement of, and an expansion on, the limited guidance given in 

NUREG/CR-6850 [1]. 

1.2.2 Project Tasks 

The post-fire HRA methodology and supporting guidelines were developed using a structured, 

systematic approach. The approach consisted of the following three primary tasks, each of which 

has one or more supporting tasks as described in the text below. 

1. Fire Data Review 

2. Fire HRA Methodology and Guideline Development 

3. Fire HRA Review and Testing 

1.2.2.1 Fire Data Review 

The first task consisted of a review of fire PRA requirements and historical fire data to better 

understand what is currently required in a quality fire PRA, and what is known about the effects 

of fire on human reliability and human performance from historical experience. 

The first sub-task was to conduct a review of the requirements of a quality fire PRA as 

prescribed in the fire PRA standard [3]. The insights associated with this review are documented 

in Appendix A. A fire PRA developed following the guidelines in NUREG/CR-6850 and the 

requirements of the fire PRA standard must address undesired response to spurious signals such 

as instrumentation or component actuation, and this requirement is addressed in this report. 

Additionally, recent historical data from actual fire events was reviewed, as summarized in 

Appendix B, in order to determine if additional failure modes or performance shaping factors 

would need to be considered for fire scenarios beyond those already identified in NUREG/CR6850. This task built upon previous, unpublished work conducted by Sandia Laboratories and the 

NRC. The results of this review are documented in Appendix B. Additionally, in this phase, 

EPRI conducted operator interviews and collected fire response procedures from PWR and BWR 

reactors to more fully understand the fire protection philosophy and the intended use of fire 

procedures in conjunction with normal emergency operating procedures during post-fire plant 

response. 
Introduction 

1-3 

1.2.2.2 Fire HRA Development 

The fire HRA development task used the insights from the fire data review as well as insights 

into human reliability analysis methods, based on NRC and industry experience. Insights from 

the development of NRC documents evaluating the current state-of-the-art in human reliability 

such as the “Good Practices for Implementing Human Reliability Analysis” [4] and “Evaluation 

of Human Reliability Analysis Methods Against Good Practices” [5] were complemented with 

insights gained by EPRI in the development of HRA methods [6] and applying these methods 

using PRA standards [3, 7]. The insights from these reviews identified the following sub-tasks 

to be addressed in developing a post-fire human reliability analysis. 

1. Define the process steps (listed below) that represent the framework for developing a 

post-fire human reliability analysis. 

a. Identification and Definition 

b. Qualitative analysis (context and performance shaping factors) 

c. Quantification: 

i. Screening quantification (update of NUREG/CR-6850 screening) 

ii. Scoping quantification (new approach developed for fire HRA) 

iii. Detailed quantification (applying the EPRI HRA approach and/or 

ATHEANA) 

d. Recovery analysis 

e. Dependency analysis 

f. Uncertainty analysis 

g. Documentation 

2. Develop methods to conduct the steps in the fire HRA process. 

3. Develop guidelines associated with the fire HRA methodology. 

1.2.2.3 Fire HRA Testing Tasks 

The testing phase included an independent peer review, application testing, internal review by 

NRC and EPRI (in addition to the project team), a public comment period, and review by the 

Advisory Committee for Reactor Safeguards (ACRS) prior to its publication. The independent 

peer review and application testing sub-tasks are summarized below. 

Independent Technical Review. An independent technical review of the project deliverables was 

conducted before the document was released to the public for review and comment. This review 

was conducted by an independent review team (IRT) comprised of experts in the subject areas of 

HRA, PRA and/or fire. The specific mission of the IRT was to: 

• Check the validity of the method and technical bases 

• Check the detail and clarity of the guidance to ensure consistent and accurate application of 

the guidance. 

The independent review team was comprised of the following individuals: 
Introduction 

1-4 

Dr. Gareth Parry, U.S. NRC 

Dr. Erasmia Lois, U.S. NRC 

Dr. J.S. Hyslop, U.S. NRC 

Dr. Zouhair Elawar, Arizona Public Service 

Ken Kiper, Florida Power and Light Company 

Dr. Young Jo, Southern Nuclear Operating Company 

Stuart Lewis, Polestar Applied Technology, Inc. 

Testing. Portions of the fire HRA guidance developed in this document were tested through 

application as part of on-going fire PRAs by the development team and by an owner’s group 

team that is independent of the developers. The objectives of the testing were to ensure that: a) 

the method is robust and applies to all types of plants and the range of post-fire operator actions 

expected to be needed in a fire PRA, b) there is sufficient and clear guidance for the users to 

render consistent application, and c) the guidance produces reasonable best-estimate values for 

human error probabilities. 

While the specific scope of the testing depends on the volunteer plants and the status of their fire 

PRA, the testing was intended to exercise the following portions of the fire HRA methodology 

guidelines: 

1. Identification and definition of HFEs primarily through review of this guidance against work 

done as part of the fire PRA. 

2. Quantitative Screening and Scoping HRA Quantification for a selected set of HFEs. The set 

was selected to address technical issues and capture performance shaping factors (PSFs) to 

the extent possible. 

The results of the testing and the peer review have been documented in Appendix F of this 

document, including the insights gained. 

1.3 Scope 

This document describes the process and technical bases for the performance of the human 

reliability analysis as part of a fire PRA. This document provides a complete reference for fire 

HRA as part of a PRA modeling the plant response to fire initiating events, and specifically 

addresses quantification (for which there was limited guidance in NUREG/CR-6850). It is 

intended to be a stand alone reference which supplements and extends the guidance in 

NUREG/CR-6850 [1] Task 12 by providing additional guidance for the development of scoping 

and detailed human error probabilities for a fire HRA. 

The purpose of fire HRA is to identify, characterize, and quantify events representing human 

failures used in the development and quantification of a fire PRA model. Fire HRA includes 

modifications to existing HFEs from the internal events (non-fire) PRA to incorporate fire 

impacts and scenarios, as well as the analysis of new fire HFEs to be included in the FPRA 

model. The scope of the fire HRA focuses on post-initiating event (dynamic) human failure 

events, and these are grouped into the following categories: 
Introduction 

1-5 

• Existing Internal Events HFEs – actions from the internal events PRA that are used 

• Fire Response HFEs – including Main Control Room Abandonment HFEs (which are 

considered as a special sub-set of the fire response HFEs) 

• HFEs corresponding to undesired response to spurious actuation or spurious instrumentation 

Pre-Initiating Event (Latent) HFEs. Latent human failure events are not addressed in this 

document. All existing pre-initiators in the Level 1, Internal Events PRA model are independent 

of the initiator and, hence, independent of a fire initiator as well. The existing pre-initiators do 

not need to be re-analyzed, but should be retained in the FPRA model as their impacts remain 

relevant to the conditional core damage probability (CCDP) and conditional large early release 

probability (CLERP). NUREG/CR-6850 [1] states that: 

“...the scope of this procedure does not include pre-initiator human failure events 

specifically related to fire systems, barriers, or programs. Undetected pre-initiator human 

failures such as improperly restoring fire suppression equipment after test, compromising 

a fire barrier, or incorrectly storing a transient combustible can all affect the fire risk. 

Tasks 6, 8, and 11 make use of industry-wide data that contains contributions from such 

human failures...” 

Thus, pre-initiator HFEs in fire suppression systems are already included in the empirical data 

of NUREG/CR-6850. If suppression system fault trees are modeled explicitly, then latent HFEs 

would be added using standard HRA modeling techniques. It should be noted that NUREG1792, Good Practices in HRA, [4] documents that it is a good practice to review historical data 

for fire dampers. The multi-compartment analysis portion of the fire PRA may consider 

mis-positioned fire dampers, but there is no difference from the standard HRA methods for 

identification, qualitative and quantitative assessment and thus latent HFEs are not addressed 

in this report. 

Fire Detection HFEs. Manual fire detection is not included in the HRA scope of this report. 

Manual fire detection is credited as a guaranteed success in continuously occupied areas; 

and in other areas, the frequency of the roving fire watch is considered to determine detection 

probability. 

Fire Suppression HFEs. NUREG/CR-6850 [1] uses a statistical evaluation of historical events to 

assign reliability estimates for the fire suppression systems. Suppression is modeled by a set of 

curves showing probability of non-suppression as function of time available for suppression; 

there are curves for various types of fires and locations within a NPP. Since the fire suppression 

probability is addressed implicitly with data, it is not necessary for the HRA to explicitly model 

the fire brigade response as part of the human reliability analysis task. The NUREG/CR-6850 

non-suppression curves are based on historical data for automatically actuated suppression 

systems. Human failure events modeling manual actuation of suppression systems would be 

accomplished following the guidance of this report. 
Introduction 

1-6 

Performance Shaping Factors. Many, if not all, of the fire impact on the human reliability 

analysis comes through the influence on performance shaping factors such as cues, procedures, 

and timing. Additionally, the impact of interactions among the fire brigade and the operational 

crew may be considered in PSFs such as increased workload or staffing, and are within the scope 

of the fire HRA methods in this report. 

1.4 Intended Audience and Prerequisite Expertise 

This document is aimed primarily at human reliability analysts involved in Nuclear Power Plants 

(NPP) fire PRAs. It is intended to serve the needs of a fire PRA team by providing a structured 

framework for conducting and documenting a fire HRA. This document pays particular attention 

to task interfaces and interactions between HRA and other disciplines in a fire PRA conducted 

following the approach outlined in NUREG/CR-6850. 

HRA involves qualitative and quantitative analysis of plant-specific, fire safe shutdown operator 

actions. Hence, the analysis needs the participation of personnel knowledgeable of plant 

practices relating to operations, staffing, training, emergency preparedness, general emergency 

operating procedures, and fire-specific operating procedures as well as those familiar with the 

plant specific fire PRA modeling. Depending on the level of detail in the fire PRA (often related 

to the specific NUREG/CR-6850 task being supported) the multi-disciplinary team will benefit 

by including deterministic fire modeling experts to describe the fire ignition and progression 

modeling, and electrical expertise to describe the fire impact on electrical circuits including open 

circuits and/or hot shorts. The HRA expert should assist the PRA analyst to identify and 

appropriately incorporate human actions in the plant fire safe shutdown response model. 

1.5 Report Structure 

This report is structured in the following sections and associated Appendices. 

Section 1 delineates the objectives and scope of this report, as well as providing the background 

information on the project tasks conducted in developing the fire HRA methodology and 

guidelines. 

Section 2 provides an overview of the guidance provided in the report. It is intended to show to 

the user various steps in conducting fire HRA and how these steps may fit into a fire PRA. 

Section 3 describes the guidance for identifying actions and defining human error events that are 

to be considered, and guidance on how to model in a fire PRA. This is a revision of the guidance 

provided in NUREG/CR-6850, Volume 2, Section 12.5.1 [1]. 

Section 4 describes the qualitative attributes contributing to quantification of HFEs including 

performance shaping factors. This is a revision of the guidance provided in NUREG/CR-6850, 

Volume 2, Section 12.5.5 [1]. 
Introduction 

1-7 

Section 5 describes the post-fire HRA quantification. Three approaches to quantification are 

offered. 1) screening, 2) scoping, and 3) detailed HRA quantification. Screening human error 

probabilities are assigned based on a revision of the guidance provided in NUREG/CR-6850, 

Volume 2, Sections 12.5.2 through 12.5.4 [1]. Scoping is a more refined quantification than 

Screening HRA (Section 4 of this report) but less refined than a detailed fire HRA. Detailed 

HRA is the application of either the EPRI HRA approach or ATHEANA. 

Section 6 describes the process for identifying defining and quantifying recovery actions. The 

types of recovery actions considered in Section 6 are those that were not added to the fault trees 

and event trees as part of the planned plant response. Instead, they are actions that are added at 

the sequence or cutset level to re-align the affected system, or to provide an alternate system, 

such that success of these actions would have prevented core damage and/or large early release. 

Section 7 describes the process for how to assess dependencies. 

Section 8 describes the guidance for conducting the uncertainty evaluation. 

Section 9 describes an overview for what to include in the documentation. 

Appendix A offers an examination of fire HRA analyses based on this guidance against the 

requirements of the fire PRA Standard [3]. 

Appendix B provides a limited review of recent operating experience in the U.S. nuclear power 

industry geared towards gaining insights on operator behavior during historical fire events. 

Appendices C and D provide guidance for detailed quantification of HFEs using EPRI HRA 

Cause-Based Decision Tree (CBDT) and Human Cognitive Reliability/Operator Reliability 

Experiments (HCR/ORE) methods, and the ATHEANA method, respectively. 

Appendix E contains the definition of terms used in this report. 

Appendix F contains a summary of the testing, including scope and insights. 

Appendix G contains guidance on how to identify and define HFEs for fire-related electrical bus 

clearing and restoration procedures. 

Appendix H provides the justification for the scoping human error probabilities. 

1.6 References 

1. EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities. September 2005. 

NUREG/CR-6850/EPRI 1011989. 

2. Verification and Validation of Selected Fire Models for Nuclear Power Plant Applications. 

NRC and Electric Power Research Institute, May 2007. NUREG-1824 & EPRI 1011999. 
Introduction 

1-8 

3. BSR/ANS 58.23, “FPRA Methodology Standard”, December 2006 (Note statement in 

Foreword about standards). This draft standard is no longer available. The latest version is 

Part 4 of ASME/ANS RA-Sa-2009, available from American Society of Mechanical 

Engineers. 

4. NUREG 1792, “Good Practices for Implementing Human Reliability Analysis”, April 2005. 

5. NUREG 1842, “Evaluation of Human Reliability Analysis Methods Against Good 

Practices”, August 2006. 

6. An Approach to the Analysis of Operator Actions in Probabilistic Risk Assessment. 

EPRI-TR-100259, Electric Power Research Institute, 1992. EPRI-TR-100259. 

7. ASME RA-S-2000, “Standard for PRA for Nuclear Power Plant Applications”, Rev 14A, 

May 11, 2001 supplemented by ASME RA-Sa-2003, “Addenda to Standard For Probabilistic 

Risk Assessment For Nuclear Power Plant Applications”, December 5, 2003, supplemented 

by ASME RA-Sb-2005, “Addenda to Standard For Probabilistic Risk Assessment For 

Nuclear Power Plant Applications”, December 2005, all by American Society of Mechanical 

Engineers. 
2-1 

2

FIRE HRA FRAMEWORK 

2.1 Introduction 

The NFPA 805 transition initiative has encouraged the development of guidance for performing 

human reliability analysis (HRA) for fire probabilistic risk assessment (FPRA). This project 

builds upon what is documented in NUREG/CR-6850, Volume 2, Section 12 [1] and addresses 

the development of human reliability analyses satisfying both the ASME PRA Standard [2] and 

current requirements of the fire PRA Standard [3]. For this report, a more in-depth, realistic 

treatment has been developed to explicitly account for key fire-induced influencing factors that 

impact the human actions needed to prevent core damage or large early releases. 

2.2 Fire HRA Process 

To model a fire HRA, NUREG/CR-6850 [1] recommends the process listed below and shown in 

Figure 2-1. This conceptual approach is based upon the SHARP1 framework for HRA [4], the 

approach used in ATHEANA [5], and the approach outlined in the ASME PRA Standard, [2] 

on which the Good Practices for Implementing Human Reliability Analysis [6] are based. 

The following comprises the fire HRA process. Figure 2-1 shows the relationship to other HRA 

methods and tasks. The subsequent text summarizes the changes in this document from the 

original NUREG/CR-6850 HRA development. 

1. Identify and define HFEs 

• Internal events HFEs 

• Fire response HFEs 

• HFEs corresponding to undesired operator responses to spurious actuation or spurious 

instrumentation 

• Main control room abandonment HFEs 

• Initial assessment of the feasibility of the HFE 

2. Qualitative evaluation 

• Develop narrative describing the initial conditions and the context for the HFE 

• Assess performance shaping factors 

• Operator interviews 

• Experience review 
Fire HRA Framework 

2-2 

3. Quantitative evaluation of the human error probability (HEP) using one of the following: 

• Screening approach 

• Scoping approach to quantification 

• Detailed approach to quantification 

4. Recovery 

• Identify and define 

• Quantify 

5. Dependency evaluation 

• Identify combinations of multiple operator actions 

• Evaluate dependencies 

• Incorporate dependency evaluation into the fire PRA model 

6. Uncertainty analysis 

7. Documentation 

Identification and Definition. The identification and definition process is largely unchanged from 

NUREG/CR-6850. 

Qualitative Evaluation. For fire HRA, a qualitative analysis step (Section 4) has been added as 

a stand-alone step. In many methods, this step is implicitly considered in the identification and 

definition step. This step has proven to be important in the recent benchmarking exercise of 

HRA predictions with empirical data, and thus is described explicitly. 

Quantitative Evaluation. For fire HRA, this report provides three levels of quantification: 

screening, scoping and detailed HRA. Although the levels are presented sequentially, it is not 

required that an analyst progress through them sequentially or use all the methods. If the analyst 

finds the screening and scoping methods to be too conservative or limiting, then he or she is 

encouraged to use one of the more detailed HRA methods. 

The screening methodology (Section 5) assigns quantitative screening values to the HFEs 

modeled in the fire PRA by addressing the unique conditions created by fires. In those 

instances where a less conservative analysis is required (i.e., conservative screening values are 

unacceptable), the next stage presented is a scoping analysis. The scoping analysis (Section 5) 

is a simplified HRA quantification approach developed specifically for this report that offers 

additional guidance beyond the screening analysis. Although it has similarities to a screening 

approach, the scoping quantification process requires a more detailed analysis of the fire PRA 

scenarios and the associated fire context, and a good understanding of the many performance 

shaping factors (PSFs) likely to influence the behavior of the operators in the fire scenario. 

It is likely that some actions will not be able to meet the criteria for the scoping HRA method, 

due to any number of reasons. For such cases, a detailed HRA approach is required. 

Recovery, Dependency and Uncertainty. These are aspects of the fire HRA that were not 

addressed in NUREG/CR-6850. 
2-3 

Figure 2-1 Fire HRA process 
Fire HRA Framework 

2-4 

2.3 Relationship to Other Fire PRA Tasks 

Fire HRA is an iterative process and is developed in conjunction with a fire PRA. It is a series of 

successive quantifications starting at the screening level and becoming more and more detailed. 

As the fire PRA evolves, the fire HRA will also evolve. As such, the inputs to the fire HRA 

potentially come from several fire PRA tasks listed in NUREG/CR-6850 [1]. Similarly, the fire 

HRA output feeds several NUREG/CR-6850 fire PRA tasks, including various levels of fire 

PRA quantification (for example, NUREG/CR-6850 Tasks 7, 8, and 11). Figure 2-2 shows 

in total how the fire HRA task (NUREG/CR-6850 Task 12) is connected with the other 

NUREG/CR-6850 fire PRA tasks. The solid lines are as depicted in NUREG/CR-6850 [1], and 

these lines represent either the end results or the inputs to the fire HRA (Task 12). The dotted 

lines have been added for completeness and the information is not necessarily considered as an 

input or end result per NUREG/CR- 6850 [1]. For example, the timing information necessary 

for the HEP quantification will come from an intermediate step of Task 8 but is not explicitly 

identified as an output of Task 8. NUREG/CR-6850 [1] provides the following list of how the 

fire HRA is linked to other NUREG/CR-6850 fire PRA tasks. 

• NUREG/CR-6850 Task 2, Fire PRA Component Selection. This task identifies fire-scenario 

mitigating equipment and diagnostic indications of particular relevance to human actions 

modeled in the fire PRA. Task 12 identifies the human actions needed in the model. Tasks 2 

and 12 are iterative since identified human actions may imply additional equipment and 

diagnostic indications, which need additional human actions. Note that the equipment and 

indications will involve (1) those needed for potential success of actions required by EOPs, 

fire procedures, and (2) those whose failure (including spurious events) during a fire can 

influence operators to isolate or to reposition critical equipment into a less desirable position. 

• NUREG/CR-6850 Task 5, Fire-Induced Risk Model, will provide a list of human actions 

already included as basic events in the portions of the Internal Events PRA that are modeled 

in the fire PRA. These actions will be reviewed and revised (if needed) in the Task 12 fire 

HRA. New human failure events identified in Task 12 (such as in a review of fire 

procedures) will be added to the fire PRA model as part of NUREG/CR-6850 Task 5. 

• NUREG/CR-6850 Task 7, Quantitative Screening. The fire HRA in NUREG/CR-6850 Task 

12 provides screening human error probabilities (HEPs) used in performing the quantitative 

screening or first quantification conducted in NUREG/CR-6850 Task 7. The Task 7 

quantification results will provide feedback to Task 12 based on the accident sequences or 

cutsets and accompanying CCDPs. The feedback will identify fire scenarios and fire HFEs 

needing a more detailed best estimate analysis to obtain more realistic CDFs and/or LERFs. 

• Knowledge from supporting tasks such as NUREG/CR-6850 Task 3 (Fire PRA Cable 

Selection), Task 9 (Detailed Circuit Failure Analysis), and Task 10 (Circuit Failure Mode 

Likelihood Analysis) will prove useful to the fire HRA. In these tasks, the associated cable 

and circuit analyses help determine the potential for equipment failures, as well as spurious 

operations and indications that the operators may face during a fire event. This information 

will establish which screening HEPs are selected as well as the best-estimate quantification 

of the more important HEPs. As part of the iterative nature of PRA, in some cases, it will be 

desirable to perform some of the more detailed tasks (i.e., Tasks 9 and 10) as input to Task 

12 so as to establish the best screening HEPs to carry out Task 7 most efficiently. 
Fire HRA Framework 

2-5 

• Knowledge from NUREG/CR-6850 Task 8, Scoping Fire Modeling, and NUREG/CR-6850 

Task 11, Detailed Fire Modeling, provides details on the fire modeling of various areas 

and has proven to be useful in defining scenario-specific factors affecting HRA. These 

factors impact the quantification of screening HEPs, as well as scoping and best-estimate 

quantification of the more important HEPs. For example, the potential for adverse 

environments and timing information relative to equipment damage comes from these two 

tasks. As part of the iterative nature of PRA, in some cases, it will be desirable to perform 

portions of NUREG/CR-6850 Tasks 8 or 11 as input to Task 12 so as to establish the best 

screening HEPs to carry out Task 7 more efficiently. 

• Ultimately, the final products of NUREG/CR-6850 Task 12, including the HFEs to be 

modeled, some screening HEPs, and scoping and best-estimate quantification of certain 

HEPs, are inputs into the final risk quantification performed under NUREG/CR-6850 

Task 14, Fire Risk Quantification.” 
Fire HRA Framework 

2-6 

Figure 2-2 

Mapping of fire HRA task 12 to NUREG/CR-6850 [1] PRA tasks1

 

1

 Note: Task 7c and 7d added to figure based on discussion in NUREG/CR-6850. 

TASK 7b: 

Quantitative Screening -II 

TASK 11: Detailed 

Fire Modeling 

A. Single 

B. MuliCompartment 

TASK 15: 

Uncertainty & Sensitivity 

Analysis 

TASK 16: 

Fire PRA Documentation 

TASK 1: 

Plant Boundary & 

Partitioning 

TASK 3: 

Fire PRA Cable 

Selection 

TASK 6: 

Fire Ignition Frequencies 

TASK 7a: 

Quantitative Screening -I 

TASK 8: 

Scoping Fire Modeling 

TASK 9: 

Detailed Circuit Failure Analysis 

TASK 10: 

Circuit Failure Mode 

and & Likelihood 

TASK 14: 

Fire Risk Quantification 

TASK 12: 

Fire HRA 

Screening 

TASK 12: 

Fire HRA 

Scoping, Detailed 

HRA and 

Recovery 

TASK 13 

Seismic-Fire Interactions 

TASK 5: 

Fire-Induced Risk 

Model 

TASK 2: 

Fire PRA 

Component 

Selection 

Task 7c 

Quantitative Screening III

(Optional)

Task 7d 

Quantitative Screening IV

(Optional)

Note: The solid lines 

are shown in NUREG6850 and represent 

either the end results 

or the inputs to Task 

12. The dotted lines 

have been added for 

completeness to show 

intermediate steps 
Fire HRA Framework 

2-7 

2.4 General Assumptions 

The work performed under these guidelines assumes the following: 

1. The FPRA and fire HRA are only concerned with fires that cause an initiating event, 

which leads to a reactor trip or a requirement for a reactor trip or manual shutdown. Such 

fires are considered obvious to detect. Smaller fires may not be obvious to detect, but their 

consequences would be much less significant and, if no reactor trip occurs, they are not 

relevant to the fire HRA. This assumption is consistent with the following assumptions in 

NUREG/CR-6850 [1]: 

• The crew is aware of the fire location within a short time (i.e., within the first ~10 

minutes of a significant indication of non-normal condition by fire alarms, multiple 

equipment alarms, and automatic trip). 

• The crew is aware of the need for plant trip (if it is not automatic) 

• The crew is aware of the need to implement a fire brigade 

• The crew is aware of the potential for unusual plant behavior as a result of the fire. 

Most plants can be operated from the control room with two or three operators as the 

minimum, but a crew may consist of four or five licensed operators. Thus assigning one 

to the fire brigade does not diminish the control room capability below what is required. 

2. All of the required fire protection safe shutdown actions, either from the “Appendix R 

program” or from NFPA-805 safe shutdown analysis, are proceduralized in the plant fire 

response procedures. It is not within the scope of this document to identify new “Appendix 

R” or NFPA-805 safe shutdown actions required to satisfy the plant’s fire protection program 

requirements. This document has addressed identification of operator actions required for 

fire PRA and these actions may or may not be added to the Appendix R/NFPA-805 safe 

shutdown list. In general, a fire anywhere in the plant introduces new accident contextual 

factors and potential dependencies among the human actions beyond those typically treated 

in the internal events PRA. These new factors and dependencies will mildly or significantly 

increase the potential for unsafe actions during an accident sequence and will be addressed in 

the procedure. They include, for instance, potential adverse environments (e.g., heat, smoke), 

possible accessibility and operability issues, use of fire procedures, potential spurious events 

associated with both diagnostic and mitigating equipment, and increased demands on staffing 

and their workload, among others. 

3. As stated above, it is assumed that the crew is aware of the fire location within a short period 

of time (~10 minutes). Once the crew is aware of the location, the fire brigade will work 

quickly to extinguish the fire. For HFEs where there are several hours available after reactor 

trip to perform the action, it is assumed that the action is time independent of the fire, and fire 

impacts will have very little if any effect on the operator performance. 

4. The objective of the Main Control Room crew is to manage the active power control, 

injection, and heat removal systems to achieve safe shutdown with no damage to the core 

given the fire. 
Fire HRA Framework 

2-8 

2.5 Technical Bases 

The fire HRA Methodology has been developed within the framework of, and uses to the extent 

practicable, existing HRA methods that are currently in widespread use. It is not the intent of this 

project to develop a new or unique detailed HRA methodology to address fire issues involving 

PRA, but rather to extend existing methods to address the fire conditions when the screening 

and scoping approaches are not adequate. While there are many HRA methods available, this 

project focused on two cognitive/execution methods to perform detailed HRA for fire context. 

Neither is it the objective of this project to research performance shaping factors (PSFs) and 

screening human error probabilities beyond what is documented in Volume 2, Section 12 of 

NUREG/CR-6850 [1]. These PSFs are similar to and consistent with the ones derived by the 

NRC (defined as manual actions feasibility criteria) in NUREG-1852 [7]. Lessons learned 

from this process can then be applied to other HRA methods on an as-needed basis. 

• EPRI HRA Methodology – CBDT [7] and THERP [9]: Recent industry efforts have 

focused on a standardized approach using the EPRI Cause-Based Decision Tree method 

(CBDT) [8, 10, and 11] for the cognitive aspect of HRA including detection, diagnosis, and 

decision-making. CBDT [8] is complemented by the EPRI HCR/ORE [10] for modeling 

cognition of time-sensitive actions. THERP [9] is used to model the execution/manipulation 

aspect of the HRA. This collective set of CBDT, HCR/ORE, and THERP is referred to as the 

EPRI HRA approach in this report. 

• ATHEANA [5]: The USNRC’s ATHEANA method appears to be suitable for a fire HRA 

because it offers a structured process for identifying critical aspects of successes/failures 

associated with abnormal operations. Also, ATHEANA is not limited to a specific set of 

performance shaping factors (PSFs) or plant conditions, allowing fire-specific PSFs and 

contexts to be easily accommodated. 

In addition to the above two methods, the authors have developed a scoping HRA approach to be 

used as a simplified quantification approach. This scoping approach was developed by drawing 

upon the principles and concepts embedded in the ATHEANA and EPRI HRA methods, plus 

other related HRA information (e.g., concepts of “feasibility” and “time margin” that were 

introduced in NUREG-1852 [7]). 

2.6 References 

1. EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities. September 2005. 

NUREG/CR-6850/EPRI 1011989. 

2. ASME PRA-Sb-2009, “Standard for PRA for Nuclear Power Plant Applications”, February 

2009 (Note statement in Foreword about standards). Available from American Society of 

Mechanical Engineers. 

3. BSR/ANS 58.23, “FPRA Methodology Standard”, December 2006 (Note statement in 

Foreword about standards). This draft standard is no longer available. The latest version is 

Part 4 of ASME/ANS RA-Sa-2009, available from American Society of Mechanical 

Engineers. 

4. Systematic Human Action Reliability Procedure (SHARP) Enhancement Project. December 

1992. EPRI TR-101711. 

5. NUREG-1880, “ATHEANA User’s Guide”, June 2007. 
Fire HRA Framework 

2-9 

6. NUREG 1792, “Good Practices for Implementing Human Reliability Analysis”, April 2005. 

7. NUREG-1852, “Demonstrating the Feasibility and Reliability of Operator Manual Actions 

in Response to Fire”, October 2007. 

8. An Approach to the Analysis of Operator Actions in Probabilistic Risk Assessment. Electric 

Power Research Institute, 1992. EPRI TR-100259. 

9. NUREG/CR-1278, “Handbook of Human Reliability Analysis with Emphasis on Nuclear 

Power Plant Applications”, (THERP) Swain, A.D. and Guttman, H. E., August 1983. 

10. Operator Reliability Experiments Using Nuclear Power Plant Simulators. Electric Power 

Research Institute, July 1990. EPRI NP-6937. 

11. Software Users Manual, The Human Reliability Calculator Version 4.0, EPRI, Palo Alto, 

CA, and Scientech, Tukwila, WA. January 2008. Product ID. 1015358. 

3-1 

3

IDENTIFICATION AND DEFINITION 

3.1 Introduction 

The objectives of the identification and definition task are to (1) identify operator actions and 

associated instrumentation that are necessary for successful mitigation of fire scenarios, and (2) 

to define the human failure events (HFEs) at the appropriate level of detail necessary to perform 

NUREG/CR-6850 [1] tasks up to initial risk model development (in Task 5). A detailed 

definition is needed for the qualitative HRA in Task 12. 

It is intended that the identification and definition task be performed early in the FPRA 

development, because the list of associated instrumentation required for operator actions will 

need to be added to the component selection list in NUREG/CR-6850 [1] Task 2, and the 

identification of actions can be helpful for risk modeling in Task 5. As the initial risk model is 

developed, the FPRA analysts will need to develop which operator actions can or can not be 

credited. 

As in the internal events HRA, operator actions are primarily identified by accident sequence and 

procedure review. Identification of post-initiators for fire HRA is primarily concerned with three 

types of procedures; emergency operating procedures (EOPs), annunciator/alarm response 

procedures (ARPs), and fire procedures. 

EOPs are those procedures which are required in response to a reactor trip or safety injection. 

In the United States, EOPs are standardized procedures (by vendor, such as Westinghouse, 

General Electric and Combustion Engineering) on which the operators are thoroughly trained. 

Most internal event HRA actions are identified by review of EOPs and associated event trees. 

ARPs are those procedures to which the operators are directed in response to an annunciator. 

Fire procedures are procedures (beyond the normal EOPs/AOPs) that the operators will use in 

response to a fire. Currently, in the United States, there is no standardized fire procedure or 

format among plants. Fire procedures have historically been developed to meet 10CFR50 

Appendix R1

 requirements, but many utilities are transitioning their fire protection program to 

one based on the National Fire Protection Associations risk-informed, performance-based 

program called NFPA-805. A plant may have one fire procedure or many fire procedures 

depending on their Appendix R/NFPA-805 program. The level of detail given in the procedures 

is known to vary widely among plants. Some plants have a specific set of instructions for actions 

that are required to be performed for a specific fire location, others provide a list of instruments 

that could be affected by the fire on an area-by-area basis, others are intended for use primarily 

by the fire brigade, and sometimes control room actions and fire brigade actions are co-mingled. 

 

1

 Within the context of Fire PRA Chapter 10 Appendix R of the Code of Federal Register is commonly referred to as 

Appendix R and this short hand many be used through out this report. 
Identification and Definition 

3-2 

The naming of fire procedures can also vary among plants: common names include fire 

procedures, pre-fire plans, fire strategies, serious station fire procedure, main control room 

abandonment procedures, site emergency response procedure (which include a section for fire). 

NUREG/CR-6850 [1] refers to all these procedures as fire emergency procedures (FEPs). 

Throughout this document, the term fire procedure will be used to reference to any type of 

procedure (beyond the normal EOPs/AOPs) that the operators will use in response to a fire. 

For fire HRA there are 3 types of post-initiator operator actions to consider: 

• Internal events operator actions. 

• Fire response operator actions – main control room abandonment actions are considered 

as a special sub-set of the fire response operator actions. 

• Undesired operator responses to spurious actuation or spurious instrumentation. 

The identification of fire response actions includes the following actions that may be required in 

the FPRA model: 

• Fire response actions to mitigate the expected fire damage, by providing mitigation using 

equipment taken credit for in Task 2 of the FPRA. 

• Pre-emptive fire response actions to prevent fire damage to equipment (protect equipment) 

needed in the FPRA. 

• Fire response actions recovering PRA sequences or cutsets, typically consisting of multiple 

equipment failures and/or failed operator action(s). 

• Fire response actions to mitigate spurious indications and actuations. 

3.2 Internal Events Operator Actions 

Internal events operator actions are actions that are required in response to a reactor trip and/or 

safety injection, typically directed by the emergency operating procedures (EOPs), alarm 

response procedures (ARPs), abnormal operating procedures (AOPs) and/ or normal operating 

procedures (NOPs). 

Internal events operator actions are identified by considering the fire-induced initiating events 

and their related fault and event trees from the internal events PRA. Since these operator actions 

had already been identified, their HFEs defined, and their human error probabilities (HEPs) 

quantified as part of the internal events HRA, it is not necessary to repeat the internal events 

HRA identification process. All that is required for the FPRA identification process is to 

determine which of these HFEs could occur in fire scenarios. This is accomplished by (1) 

identifying the fire-induced initiating events from NUREG/CR-6850 [1] Task 2; and (2) 

identifying the HFEs in the logic structures associated with these fire-induced initiating events. 

For example, turbine trip is a common fire-induced initiating event, and the internal events PRA 

often models the response to turbine trip within a “general transient” event tree. All the HFEs 

that are associated with the turbine trip portion of the general transient event tree or related fault 

trees could therefore occur in fire scenarios. An example of such an HFE is “Operator fails to 

start auxiliary feedwater” – the implied operator action is therefore “start auxiliary feedwater.” 
Identification and Definition 

3-3 

Existing internal events HFEs that are not associated with any fire induced initiating events 

can be screened from further consideration in the fire HRA. For example, steam generator tube 

rupture (SGTR) is not typically a fire induced initiating event in a PWR, therefore fire impact on 

SGTR HFEs need not be considered in the fire PRA. 

For fire HRA, there are potentially two sub-types of internal events operator actions, (1) those 

that are explicitly modeled as basic events in the internal events PRA and (2) those that are 

proceduralized in the EOPs but are not modeled as basic events or are developed into detailed 

HEPs (instead they are typically set to conservative screening values in the internal events PRA). 

The second type of action is identified by the same process as for actions already included in the 

internal events PRA. The only difference is once the qualitative analysis stage is reached, the 

HRA analyst will not have a base analysis from which to work. To ensure the identification task 

is complete, the following steps are all required, but not necessarily in the following order. The 

point at which each of the steps is completed will depend on the development of the fire PRA. 

The following steps are a summary of the discussion presented above. 

Step 1) Identify all operator actions in internal events PRA. This identification should be 

straightforward and in most cases is a data extraction from the internal events PRA based on 

basic event name. At this stage, the pre and post initiators are separated. All existing preinitiators in the Level 1, internal events PRA model are independent of the initiator and hence 

independent of a fire initiator as well. The existing pre-initiators do not need to be re-analyzed, 

but should be retained as-is in the FPRA model since their impacts remain relevant to the 

CCDP and CLERP. 

Step 2) Screen from consideration internal events HFEs that are not associated with fireinduced initiating events. These initiating events are identified in Task 2 of NUREG/CR-6580 

[1]. Examples of initiators not typically included in fire PRA are large LOCA and ATWS 

(for BWRs and PWRs), and SGTR (for PWRs). There may be cases were a single HFE analysis 

is used for several initiators and the limiting case initiator is not associated with the fire PRA. 

In these cases, the HFE should not be screened from consideration but should be re-evaluated 

from first principles to correctly model the fire impacts. For example, the timing of an HFE 

maybe based on the limiting case for large LOCAs and then the same analysis is applied to 

small and medium LOCAs. In this case the HFE should be retained for the fire PRA for the 

small LOCA and the timing will need to be re-evaluated in the qualitative analysis. 

Step 3) Review fire related fault trees and event trees. ASME requirement HR-E1 [2] requires 

that “when identifying the key human response actions REVIEW: (a) the plant-specific 

emergency operating procedures, and other relevant procedures (e.g., AOPs, annunciator 

response procedures) in the context of the accident scenarios (b) system operation such that an 

understanding of how the system(s) functions and the human interfaces with the system is 

obtained”. For this identification step, it is important that the internal events HRA meets ASME 

category II and a review of plant procedures had already been completed for the internal events 

model. This fire HRA guideline has been written assuming the internal events PRA model is up 

to date and meets Capability Category II of the PRA Standard. However, it is necessary to 

review the fire fault trees and events trees to ensure that internal events actions are still modeled 

appropriately. This review will identify any actions that were not previously modeled in the 

internal events PRA but will be needed for the fire PRA. These actions are proceduralized 

actions in the EOP and/or AOP/ARP/NOPs that were not considered important for the internal 
Identification and Definition 

3-4 

events model due to a low probability of associated component failure. An example of this type 

of action is manual back-up of automatic actuation, such as “operator fails to start a pump after 

automatic actuation failed”. Such actions are not always modeled in the internal events PRA 

because random hardware failures have relatively low failure probabilities for internal events, 

but in a post-fire situation the hardware could be failed by the fire, or its reliability severely 

degraded, such that manual operator actions are needed and must be added to the PRA model. 

This step is typically not performed by an HRA analyst in isolation; it requires communication 

between the PRA fire modeling analyst and the HRA analyst. It is an iterative step which will 

be re-visited as the fire PRA model develops. 

Step 4) Define each internal events HFE 

The definition of existing internal events HFEs must be revised for fire impact. All the 

assumptions and inputs that are used in the internal events HFE analysis must be systematically 

considered for fire impact including: 

• Fire impact on instrumentation and indications credited for detection and diagnosis. 

• Fire impact on timing of cues, response, execution, and time available. 

• Fire impact on success criteria. 

• Fire impact on manpower resources, which affect recovery. 

• Fire impact on local actions, e.g., accessibility, atmosphere, lighting. 

Further discussion on how and what to consider in the definition of the HFE is presented 

in Section 4. The identification and definition is an iterative process and is added here for 

completeness for the reader. 

3.3 Fire Response Operator Action Categorization 

Fire response operator actions are new post-initiator operator actions required in response to a 

fire. They are typically directed by the fire procedure(s). They are sometimes called fire manual 

actions and are referred to elsewhere in this document simply as “new” MCR or ex-control room 

actions (i.e., they are fire specific and were not included as internal events HFEs.) The following 

sections outline the different types of fire response actions based on function in the fire PRA. 

3.3.1 Fire Response Actions to Mitigate the Expected Consequences of Fire 

Damaged Equipment Needed in the FPRA 

To identify the fire response actions that might mitigate the effects of equipment damaged by 

fire, each fire area is first reviewed to identify equipment that is potentially damaged by a fire in 

that compartment/area. This identification is typically accomplished during the performance of 

the NUREG/CR-6850 [1] fire modeling tasks during the review of the fire procedure(s). Note 

this information may change as the modeling progresses, for example from a complete loss of 

instrumentation in the first quantification of NUREG/CR-6850 Task 7 [1] to a partial loss of 
Identification and Definition 

3-5 

instrumentation in a more detailed quantification of the same area in NUREG/CR-6850 Task 11 

[1]. Given that fire damage to equipment is identified, the fire procedure(s) applicable to each 

scenario is reviewed to identify any fire response actions that can be credited for mitigation. 

Examples of fire response human failure events (HFEs) are listed below. Note that each of these 

HFEs may require several sub-task failures to be modeled or some of these HFEs may be later 

consolidated into one HFE. Such subdivision or consolidation would depend on the level at 

which the HFE is required in the logic model e.g. function, system, train or component level 

would require different levels of resolution. 

• Operators fail to open a level control valve using a local handwheel, after the fire causes 

remote control to be unavailable. 

• Operators fail to manually operate a charging pump at the breaker, given that the pumps 

cannot be controlled from the main control room because fire has damaged control circuits. 

• Operators fail to close a flow control valve by isolating the air supply. 

• Operators fail to locally operate a residual heat removal pump when motor the control circuit 

is failed by the fire. 

• Operators fail to restore steam generator level by locally controlling auxiliary feedwater 

after fire damages control room indicators. 

• Operators fail to isolate pressure operated relief valve (PORV) after it spuriously opens 

during the fire and cannot be closed from the control room. 

The fire HRA should not take credit for any fire response actions that are not proceduralized 

except as described in Section 6. 

3.3.2 Pre-Emptive Fire Response Actions to Prevent Fire Damage to Equipment 

(Protect Equipment) Needed in the FPRA 

Most pre-emptive fire response HFEs involve failures to de-energize power supplies or disable 

control systems in order to prevent spurious actuations. Some examples are shown below. 

• Operators disable a solid state protection system. 

• Operators de-energize a motor control center. 

• Operators de-energize pressurizer heaters. 

These actions are explicitly stated in the fire procedures; however, they may or may not identify 

why the actions are to be performed. At some plants, the fire procedures direct the operators to 

place the plant in a Self Induced Station Blackout (SISBO) as a pre-emptive measure in order to 

mitigate any spurious actuations. Detailed guidance for SISBO plants is described in Appendix 

G. These pre-emptive actions can be identified and HFEs defined and modeled before screening 

(see Section 5), or after initial quantification, and as needed, from the initial fire PRA results. 
Identification and Definition 

3-6 

3.3.3 Fire Response Actions Recovering PRA Sequences or Cutsets 

For scenarios in which the internal events operator actions are assumed failed because of fire 

impacts to the instrumentation or equipment, the HRA analyst may need/wish to credit an 

additional action. This action could be one proceduralized in the fire procedures. An example of 

this is an internal events HFE for an operator failing to start a pump. In the internal events model, 

this HFE is a simple control room action but, in the fire scenario, the fire fails the control room 

switch and the HEP evaluates to 1.0. For the fire PRA, the HRA analyst may wish to credit a 

local action to start the pump. To identify these types of actions, the fire impact on the existing 

internal events actions needs to be known (and is typically provided through the fire PRA 

quantification) and the potential success path to be applied needs to be known. The latter is 

often identified as a result of operator interviews. Given that the existing internal events actions 

applicable to the FPRA have been identified, the fire impact on them due to fire damage to 

instrumentation is identified during the fire modeling tasks specified in NUREG/CR-6850 [1]. 

Other impacts such as timing delays also need to be addressed (see Section 4). As noted above, 

the fire impact is first quantified in the fire modeling tasks of Task 7, and later refined in 

Task 11. 

3.3.4 Main Control Room Abandonment Actions 

MCR abandonment actions are a special case, or a subset, of fire response actions. The same 

identification process applies as for fire response actions, but the procedure review would be 

limited to the fire procedures that apply to MCR abandonment and establishment of local 

control. Local control may be at a one or more local control panels, breakers, or pieces of 

equipment. In addition to the local fire response actions, the cognitive decision for MCR 

abandonment needs to be addressed. Generally there are two criteria for MCR abandonment, 

either due to uninhabitability or inability to control the plant. The criteria used in the fire PRA 

model for MCR abandonment or use of alternative shutdown needs to be defined. The decision 

to abandon the MCR is an area of uncertainty since there may not always be clear decision 

criteria for abandonment. When habitability is not an issue, the crew may not completely 

abandon the MCR even if their ability to control the plant is hindered, for example due to 

fire effects on control cables. 

In the initial stages of the FPRA development, the decision for abandonment will be determined 

by the fire PRA analyst as a simple “yes” (MCR abandonment is required) or “no” (MCR 

abandonment is not required). If the fire PRA determines that the operators will abandon the 

control room then it is the HRA analyst’s task to identify the operator actions required for 

success (based on review of the MCR abandonment procedure) once the decision to abandon has 

been made. If the fire PRA determines that the conditions exist such that the operators will not 

perform the abandonment procedure to completeness and some operating staff will remain in the 

control room, the FPRA analyst will need to define the operator actions required for success on a 

scenario specific basis. 
Identification and Definition 

3-7 

3.3.5 Manual Actuation of Fixed Fire Suppression Systems 

Manual actuation of fixed fire suppression systems are included in the HRA scope of this 

report. NUREG/CR-6850 [1] uses a statistical evaluation of historical events to assign reliability 

estimates for the fire suppression systems. Suppression is modeled by using non-suppression 

probability curves. Since the fire suppression probability is addressed with data, it is not 

necessary for the HRA to model the fire brigade response. 

However, manual actuation of automatic fire suppression systems from the control room during 

an event is within the scope of the HRA since it is not accounted for in the non-suppression 

probability curves. These actions are identified in reviewing the fire procedures. Typically, if 

suppression is required from the control room, the action is proceduralized in the fire procedures 

on a fire area-by-area basis. In some cases these actions are proceduralized in the fire brigade 

response procedures. 

3.4 Fire Response Operator Action Identification and Definition 

The fire response operator actions are identified by a systematic review of the fire procedure(s) 

to identify the fire response actions required in the FPRA. In order to understand what fire 

response actions are required in the FPRA, it is necessary to first understand the fire scenarios, 

which requires modeling of the fire impacts on equipment and instrumentation in the FPRA. 

However, if the FPRA modeling has not advanced to this stage yet, all procedural fire response 

actions could be identified, and some can be excluded from further consideration if it is later 

determined that they are not required in the FPRA. An iterative approach using three steps is 

followed in order to identify fire response actions. 

Step 1) Develop fire scenarios first to understand the impact of fire on equipment and 

instrumentation, and then identify specific fire response actions required for mitigation.

For this approach, ideally, the fire FPRA has developed past NUREG 6850 Task 5 risk model 

development. The HRA analyst and fire PRA analyst will work together to review the fire 

scenarios in conjunction with both the fire procedures, EOPs, fault trees and event trees. 

To identify the operator actions in this approach, the fire PRA analyst will need to create 

timeline for the fire sequence of events in sufficient level of detail such that the HRA analyst can 

map the expected operator action as directed in the fire procedures to the specific fire sequence. 

This many also require operator interviews to confirm the expected plant response for each fire 

scenario. 

Step 2) Identify all procedural fire response actions, and then apply only those that are 

required for mitigation once the fire impacts on equipment and instrumentation becomes 

known. In this approach the HRA analyst can identify the fire response actions without 

significant input from the fire PRA analyst. The fire procedure review will simply document all 

possible actions listed in the fire procedures. As part of this approach the HRA analyst would 

map the identified fire response actions to internal events actions if applicable. An example of 

this approach is shown below: 
Identification and Definition 

3-8 

Fire 

Response 

Basic Event 

Identifier 

Related Basic Event 

Identifier in PRA Equipment Fire Response Basic Event Description 

ACP-OPSISO-1F1A None 4160V 

 Bus 1F 

Operators fail to isolate 

4160V Bus 1F from Bus 1A 

ACP-OPSISO-1FDG1 EAC-OPS-FO-DG1 – 

Operators fail to operator 

Diesel Generator 1 (DG 1) 

DG1 Operators fail to align DG1 to 

4160V Bus 1F by isolating 

and operating DG1 and 

Breaker EG1 per Section 10 

of Procedure 5.4.30.1 

CS-OPS-OCMO15 LCS-OPS-FO-MO15 – 

Operators fail to align 

Condensate Storage Tank 

(CST) to pump suction 

from the control room 

CS-MO-12A Operators fail to open 

CS-MO-15 using contactor or 

handwheel per section 11 of 

procedure 5.4.30.1 

HPCI-OPSOC-CD RHR-OPS-FO-RHRA – 

Operators fail to cool down 

using High Pressure 

Coolant Injection (HPCI) for 

Small LOCA 

HPCI/Residual 

Heat Removal 

(RHR) 

Operators fail to cool down 

using HPCI and establish 

RHR per section 9 of 

procedure 5.4.30.1 

FZ50-OPSSUPRESS None Fire suppression 

system FZ AA-55 

Operators fail to active 

suppression system for 

AA-55 from control room 

AFW-OPSXTIE-FIRE AFW-OPS-XTIE – 

Operators fail to cross tie 

Auxiliary Feedwater (AFW) 

per AOPs 

AFW FM-124 Operators fail to cross-tie 

AFW per the Main Control 

Room abandonment 

procedure 

This approach is resource intensive for the HRA analyst but does provide clear documentation 

of the procedure review in order to meet ASME standard requirements HR-E1 and HR-E2. This 

approach also provides the fire PRA analyst with all possible actions that can be credited and the 

fire PRA analyst can implement these actions on an as needed bases. 

Step 3) An iterative approach combining the above two approaches. Since the fire HRA 

task is typically not performed independently of the fire PRA, a hybrid approach to the two 

approaches described above may be performed. The hybrid approach would be plant and 

model specific. For example, as the risk model is being developed, the HRA analyst could 

review the fire procedures to identify MCR abandonment actions with the assumption that MCR 

abandonment is required. After the fire PRA has developed the MCR abandonment scenarios, 

the HRA analyst can define the actions for the specific fire sequence. If the fire modeling has 

progressed to a stage where specific locations are determined to be risk significant, the HRA 

analyst could take these areas and only review sections of the fire procedures specific to the risk 

significant areas. 
Identification and Definition 

3-9 

The human failures of fire response actions are defined to represent the impact of the human 

failures at the function, system, train or component level as appropriate. The definition should 

include: 

• The specific high level tasks required to achieve the goal of the response. 

• Accident sequence specific procedural guidance (fire response procedures). 

• The availability of cues and other indications for detection and evaluation errors. 

• Accident sequence specific timing of cues, and time window for successful completion. 

Further discussion on how and what to consider in the detailed definition of the HFE is presented 

in Section 4.2. The identification and definition is an iterative process and is included here for 

completeness for the reader. 

3.5 HFEs Corresponding to Undesired Operator Responses to Spurious 

Actuation 

For fire HRA, an undesired action is defined as a well intentioned operator action that is 

inappropriate for a specific context and that unintentionally aggravates the scenario. Undesired 

responses primarily consist of shutting down or changing the state of mitigating equipment in a 

manner that increases the need for safe shutdown structures, systems, or components. The key 

criterion in identifying undesired operator actions is that it leads to a worsened plant state; for 

example, turning a transient initiator into a consequential LOCA. If an operator responds to a 

spurious indication and the action is judged to not impact the CCDP or CLERP, then it does 

not need to be considered further, except as a dependency on other actions. The dependency 

evaluation needs to include the potential for prevention of other actions. 

In fire events, spurious indications occur when electrical cables routed through a zone where 

the fire is postulated are shorted, grounded, or opened as the cable insulation is burned. These 

instrument wires feed alarms and control indications that act as cues for operator actions. 

Thus, an undesired action can be triggered through a false cue that tells the operator to take an 

action that is potentially detrimental to safe shutdown. For example, an action is classified as 

undesirable, if the operators conclude from false cues that the safety injection (SI) termination 

criteria are met and shut down SI when it is inappropriate to do so. 

The undesired operator actions are to be identified within the context of the accident progression. 

When the EOPs are implemented, the operators follow them and remain in the EOP network 

until the plant has reached a safe, stable state when normal procedures can be implemented 

again. During the initial EOP response, the operators are trained to respond only to indications, 

annunciators or alarms that are referenced in the EOPs or that are very pertinent to the scenario. 

In practice, once the accident diagnosis is complete, required equipment status is verified, and 

the plant is stabilized (during? to? cooldown and depressurization), the operators would resume 

normal protocol for monitoring of the control room and start attending to annunciators or alarms 

again. In a fire scenario, the operators would also implement the fire procedures either in parallel 

to the EOPs, or the EOPs may be suspended while the fire procedure(s) are performed - 

depending on plant-specific procedural guidance and training. 
Identification and Definition 

3-10 

To reasonably bound the number of modeled, undesired operator actions due to spurious 

indications, it is recommended that human performance-based criteria be developed to be applied 

consistently in the identification process. Such criteria should be based on the plant specific 

factors that govern operator cognitive response to indications such as: 

1. Cue parameter(s) 

2. Cue (procedural) hierarchy 

3. Cue verification 

4. Degree of redundancy for a given parameter 

Each of the above factors is briefly discussed below: 

Cue parameters 

The cue for an operator cognitive response may consist of a single parameter or multiple 

parameters. For example, low lubrication oil pressure for a pump is a single parameter that 

would actuate an alarm which would require the operator to trip the pump to protect the bearings. 

As an example of multiple parameters, the cue for implementing the functional restoration 

procedure for loss of secondary cooling on a PWR is based on multiple parameters namely low 

steam generator feed flow and low steam generator narrow range level. 

For operators to be misled by a single parameter cue, a spurious indication(s) on the single 

parameter would be sufficient, while for a multiple parameter cue, multiple spurious indications 

on different parameters would be required. It would generally be true that multiple spurious 

indications on different parameters are less likely to mislead the operators than a spurious 

indication on a single parameter but the relative likelihood would depend on the fire impact on 

instrumentation in a specific scenario. 

Cue (procedural) hierarchy 

Following a reactor trip or safety injection, operator response is governed by procedure. The 

operators enter the emergency operating procedures (EOPs). During the initial EOP response, the 

crew basically focuses on plant parameters and alarms that are called out in the EOPs – other 

annunciator and alarms may be ignored until the plant is stabilized, unless the cue is very 

pertinent to the scenario. In the EOPs, certain cues are required to be monitored continuously; 

they may be known as continuous action statements, floating steps, and/or foldout page 

instruction(s), depending on the vendor. The operators also may have some cue-specific 

indication preferences based on training, procedures, ease-of-use, and reliability. When a 

continuously monitored cue occurs, the operators may be required to suspend what they are 

doing and perform the instruction(s) associated with this cue. Cues may be further prioritized e.g. 

Westinghouse EOPs cues are prioritized by (1) safety function and (2) severity of challenge to 

safety function - in the critical safety function status trees (CSFSTs) that are monitored from a 

certain point in the EOPs. Although there may be plant-specific deviations, operators generally 

prioritize the cues as follows: 

a) Cues that are continuously monitored. 

b) Cues that are called out in the EOPs as checks, but are not continuously monitored. 
Identification and Definition 

3-11 

c) Cues that are not called out in the EOPs, but that may be very pertinent to the scenario. 

d) Cues that are not called out in the EOPs and that are not pertinent to the scenario. 

Operators are more likely to be misled by a spurious indication(s) on a high priority cue than a 

low priority cue. 

Cue verification 

Certain cues may require an immediate response, while other cues may require verification prior 

to action. For example, a typical annunciator response procedure (ARP) may require the 

operators to verify the validity of the cue by comparison with the other indications, or by local 

inspection. 

Operators are more likely to be misled by a spurious indication(s) of a cue that requires an 

immediate response than a cue that requires to be verified first. 

Degree of redundancy for a given parameter 

Most plant parameters have redundant instrumentation channels and indications. For example, 

each steam generator level may have three or four redundant instrumentation channels. The 

operators expect all the redundant channels to provide the same indication of the parameter. 

Should one of the redundant channels deviate significantly from the other channels, the operators 

would suspect instrumentation failure. The operators would enter the abnormal operating 

procedure for instrumentation failure, which would require the suspect instrumentation channel 

to be placed in the tripped position. However, if additional indications deviate, it becomes 

progressively more difficult to tell which are correct and which are not. 

Operators are not likely to be misled by a spurious indication on one of several redundant 

instrumentation channels, but they may be misled by multiple spurious indications on redundant 

channels. 

3.5.1 Examples of Operator Actions that Result in Undesired Response 

Examples of operator actions listed in the EOPS that could result in undesired responses are 

shown in Table 3-1. In the first example, the operators are required to check safety injection (SI) 

status and to actuate SI if required in E-0 step 4. If SI is not required in the scenario but the 

operators see a false high containment pressure, they will actuate SI. The instrumentation 

associated with containment pressure is shown in the MCR Instrumentation column: there are 

four redundant pressure indications (PI) and a diverse pressure recorder (PR) device. In the 

second example, the operators are required to stop the low head safety injection (LHSI) pumps if 

RCS pressure is higher than 275 PSIG in E-0 step 25. This step is also a “continuous action step” 

(denoted by gray highlight) which means that once the operators reach step 25, they will start 

monitoring the RCS pressure to stop the LHSI pumps if required. 
Identification and Definition 

3-12 

Table 3-1 

Examples of operator actions in EOPs that could result in undesired responses 

Procedure Parameter Spurious 

Indication 

MCR 

Instrumentation 

Undesired 

Action 

Consequence if 

Operators Respond 

to Spurious 

Indication 

E-0 Step 4 

RNO 

Containment 

(CNMT) 

pressure 

> 5 PSIG PI LM100A 

PI LM100B 

PI LM100C 

PI LM100D 

PR 1LM 100A 

Actuate SI Fill pressurizer, 

challenge PORVs, 

consequential LOCA 

E-0 

step 25 

Reactor Coolant 

System (RCS) 

pressure 

> 275 PSIG PI RCS 402 

PI RCS 403 

Stop LHSI 

pumps 

Loss of core cooling 

For undesired operator actions, continuous action steps are more important because they are 

monitored and remain in effect until the procedure is exited – in contrast to normal steps that are 

only performed when the operators reach the step. 

Examples of operator actions based on spurious annunciators that could result in undesired 

responses are listed in Table 3-2. 

Table 3-2 

Examples of operator actions based on spurious annunciators that could result in 

undesired responses 

Spurious Annunciator Undesired Action Consequence 

ESW PUMP MOTOR INSTANT TRIP Place the affected 

pump’s control switch in 

LOCKOUT. 

One train of service water stopped 

reducing ESW prob. of success in 

CCDP calculation. Can be restarted. 

CCW PUMP MOTOR INSTANT 

TRIP 

Place the affected 

pump’s control switch in 

LOCKOUT. 

Stopping one CCW pump increases 

operating temperature on many 

components, but can be restarted. 

EAST RHR PUMP SUCTION 

VALVES NOT FULL OPEN 

Immediately open 

1-IMO-310, East RHR 

Pump Suction, or 

1-ICM-305. 

Depending on scenario (size of LOCA 

or not) could lead to cavitation of the 

pump. Loss of pump in Recirc. mode 

RHR PUMPS MOTOR INSTANT 

TRIP 

Place pump control 

switch in LOCK-OUT. 

Delay start of RHR if not on or halts 

RHR if on. Impacts CCDP. Can be 

manually started. 
Identification and Definition 

3-13 

3.5.2 Process for Identifying and Defining HFEs that Result in Undesired Operator 

Response 

To ensure the identification task is complete, the following steps are all required but not 

necessarily in the order presented. The point at which each step is completed will depend 

on the development of the fire PRA. The steps below are a summary of the above discussion. 

Step 1) Review EOPs for undesired operator response actions 

The EOPs are to be systematically reviewed to identify all the steps where an undesired operator 

action can result. The EOPs to review are those that the operators are expected to perform for all 

the fire induced initiating event scenarios in the fire PRA model. Each step in the procedure that 

contains some decision logic with reference to a plant parameter is to be considered for the 

potential to cause an undesired operator action should the indication associated with the 

parameter be spurious. The instrumentation associated with the plant parameter could be 

identified in the EOPs, the EOP background documentation, instrumentation and control 

diagrams and/or control room panel layout drawings or pictures. 

Prior to the EOP procedure review, the HRA analyst may benefit from doing preliminary 

operator interviews in order to more fully understand how the crew anticipates responding to 

spurious indications and actuations. At most U.S nuclear power plants, crews are trained to rely 

on multiple and diverse indications before taking actions. The following assumptions can be 

made to reasonably bound the number of undesired operator actions in accordance with 

Capability Category II of the fire PRA standard. 

• Actions that require multiple spurious indications on different parameters can be screened 

from consideration. 

• Actions that require multiple spurious indications on redundant channels can be screened 

from consideration. 

• Actions that have a proceduralized verification step can be screened from consideration, if 

the verification will be effective given the fire scenario. 

Step 2) Review ARPs for undesired operator response actions 

The annunciator response procedures (ARPs) are to be systematically reviewed to identify 

potential undesired operator actions that can result from an annunciator or alarm. The 

identification process would be analogous to that for the EOPs described above. The ARPs to 

review would be any ARP which involved equipment or systems modeled in the fire PRA. 

Although operators may not respond to annunciators or alarms that are not referenced in the 

EOPs during the initial implementation thereof, the annunciators or alarms will remain “in 

alarm” and will eventually be responded to. Prior to the ARP review, the HRA analyst may need 

to do preliminary operator interviews to understand how the crew anticipates responding to 

spurious indication. The same assumptions applied to the EOP review for screening of undesired 

operator actions can also be applied to the ARP review. 

Step 3) Define HFEs 

The undesired operator response actions should be defined to represent the impact of the human 

failures at the function, system, train or component level as appropriate. The definition should 

include: 
Identification and Definition 

3-14 

• The specific high level tasks required to achieve the goal of the response. 

• Accident sequence specific procedural guidance (fire response procedures). 

• The availability of cues and other indications for detection and evaluation errors. 

• Accident sequence specific timing of cues, and time window for successful completion. 

Additionally, the undesired end state should be included in the definition. 

Further discussion on how and what to consider in the definition of the HFE is presented in 

Section 4.2. The identification and definition is an iterative process and is included here for 

completeness for the reader. 

3.6 Initial Assessment of Feasibility 

Once the operator action has been identified and the HFE defined, the HRA analyst needs to 

initially determine if the HFE is feasible. If it is not feasible the HEP should be set to 1.0. In this 

stage of the HRA analysis, the goal of the preliminary feasibility assessment is to identify those 

actions that should not be credited, ultimately reducing the total number of HFEs requiring 

further analysis. After the preliminary results have been incorporated into the model, additional 

resources can be used to re-asses actions that were previously considered not feasible. There will 

always be cases in which, with enough information, the HRA analyst could make an argument 

that an action is feasible even though the initial information suggests that the action will be 

extremely difficult or vice versa. To initially determine the feasibility the following information 

should be addressed qualitatively and early in the HRA task to avoid unnecessary analysis: 

• What are the critical operator tasks required for success? Based on the procedure review 

during the identification step, the HRA analyst should know how the operators are going to 

diagnose the need for the action (for example, the action is proceduralized in the fire 

procedures or EOPs, or there are several control room alarms) and what types of tasks are 

involved in its execution (e.g., if the operator has to turn two local valves 600 times or has to 

start a pump from the control room). The identification of the critical tasks required for 

success may not include sufficient information to qualitatively determine feasibility, but this 

identification, in combination with the following additional items, should be sufficient to 

initially verify feasibility. 

• Is the location where the action is accomplished accessible? If any of the critical tasks are 

required in the same location as the fire, or it is known that the operators will not be able to 

reach the location(s) due to the fire, then the HEP should be set to 1.0. 

• Sufficient time to complete the action. The analyst should ensure there is sufficient time 

available to complete the action. If there is not, then the HEP should be set to 1.0. This item 

involves determining both the total time required to accomplish the action and the time 

available. The total time required for the action consists of the amount of time required for 

diagnosis and the amount of time required for execution (including transit time). The total 

time required must not exceed the total time available to complete the action. The total time 

available can be an estimated based on thermal-hydraulic calculations or by engineering 

judgment early in the overall NUREG/CR-6850 quantification tasks. 
Identification and Definition 

3-15 

• Is there enough staff available to complete the action? If there are not enough crew 

members available to complete the action (the number of people required for each task 

exceeds the crew available), then the HEP should be set to 1.0.

• Has the fire impacted equipment such that required critical tasks can not be 

performed? This item includes the instrumentation and/or alarms used as the cue(s) for the 

operator response, or if the component that is to be manually started/stopped/re-aligned is 

damaged by the fire. If the fire has damaged the equipment such that it will not function even 

if the operator takes the appropriate action, then the HEP should be set to 1.0. For example, 

if the auxiliary feedwater pump is affected by fire then the operator will not be able to restore 

the pump locally. Any one of the above criteria could provide sufficient information to 

determine if the action is not feasible. For example, the action requires the operators to 

locally disconnect two breakers in the same room where the fire is occurring. However, more 

often, if all of these items are considered collectively it becomes obvious that this HFE is not 

feasible. 

In the identification and definition stage, the entire narrative and detailed information about each 

PSF may not yet be known, but consideration of the above should allow the HRA analyst to 

make a preliminary qualitative assessment about feasibility. The feasibility step is not unique in 

the identification and definition stage, but this process is iterative - as more information is known 

about the HFE, the feasibility could be re-assessed (see Sections 4 and 5). 

3.7 HRA/PRA Modeling 

Once human failure events (HFEs) have been identified and defined, they can be incorporated 

into the PRA model. Task 5 step 1.3 of NUREG/CR 6850 [1] provides the following guidance on 

incorporating HFEs into the fire PRA model. During the early phases of the model development 

process, the model configuration setting function of the quantification tool can be used to 

temporarily assign a value of 1.0 or TRUE for surrogate events in the model. Surrogate events 

are typically existing human failure events in the Internal Events logic model. New fire-specific 

human failure events may have to be added to the logic models based on actions specified in 

 the fire procedures. During the final stages of the model development process, unscreened 

fire-induced human failure events will be explicitly incorporated into the logic models. The 

 fire-induced human failure basic events will be conditional on the appropriate fires.

Refinements to these HFEs are likely to occur as other HRA tasks are performed, especially 

qualitative analysis (e.g., review of relevant procedures) and quantitative analysis tasks. In 

deciding which actions to credit initially, the analyst may choose to perform some sensitivity 

analyses to determine if such actions need to be credited in the fire PRA by using the current 

internal events PRA (or during the development of the fire PRA model) or by setting the HEPs to 

a value provided by the screening, scoping or detailed assessment methods. It is recommended 

that all actions treated in the internal events PRA and those necessary to achieve safe shutdown 

in fire procedures be included in the fire PRA. 
Identification and Definition 

3-16 

HRA analysts should use existing guidance on the interface between the HRA and PRA tasks, 

including how HFEs are modeled and placed into PRA logic models. For example, in Section 

5.2.3.1 of NUREG-1792 [3], it is recommended that HFEs “...be placed in proximity ...to the 

component, train, system, and function affected by the human failure event.” Also, in Section 

3.9.2 of NUREG-1624 [4], it is recommended that the need for altering the PRA logic model in 

order to accommodate HFEs, especially errors of commission (such as undesired responses to 

spurious indications) may be needed, especially if the HFEs only occur in very specific contexts. 

3.8 References 

1. EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities. September 2005. 

NUREG/CR-6850/EPRI 1011989. 

2. ASME RA-Sb-2005, “Standard for PRA for Nuclear Power Plant Applications”, December 

2005, (Note statement in Foreword about standards). Available from American Society of 

Mechanical Engineers. 

3. NUREG 1792, “Good Practices for Implementing Human Reliability Analysis (HRA)”, 

Sandia National Laboratories, 2005. 

4. Verification and Validation of Selected Fire Models for Nuclear Power Plant Applications.

May 2007. NUREG-1824 & EPRI 1011999. 

5. NUREG-1852, “Demonstrating the Feasibility and Reliability of Operator Manual Actions 

in Response to Fire”, October 2007. 
4-1 

4

QUALITATIVE ANALYSIS 

4.1 Introduction 

All HRA methods require a qualitative analysis prior to quantification. In the SHARP1 process, 

[1] this analysis is embedded in the identification and definition step and, in ATHEANA, [2] it is 

considered explicitly. For fire HRA, the qualitative analysis involves defining the HFE narrative 

in the context of the fire PRA and developing an understanding of Performance Shaping Factors 

(PSF). Qualitative analysis is needed as input to the quantification. This report addresses two 

approaches to non-screening quantification, either a scoping approach, or a detailed analysis. 

Both quantification approaches need qualitative analysis, but the level of detail required for a 

given HFE differs depending on whether a scoping or a detailed approach to quantification is 

used. This section includes an overview of the issues that are to be considered in performing a 

fire HRA. It is based upon guidance in the ASME PRA standard [3], SHARP1 [1], ATHEANA 

[2] and NUREG 1792 [4]. It is important that this section be reviewed prior to performing the 

fire HRA, whether using the scoping or a detailed approach. The information in this section will 

provide a useful understanding of the issues associated with the fire context and will support the 

specific qualitative analysis required for quantification. Specific guidance for addressing these 

fire context issues during quantification are provided in the relevant sections, but the information 

in this section establishes a knowledge base that is important for thoughtful application of the 

quantification approaches. 

4.2 HFE Narrative 

1. Accident sequence (preceding functional failures and successes) 

2. Timing information 

3. Accident-specific procedural guidance 

4. Availability of cues and other indications for detection and evaluation of errors 

5. Preceding operator errors or successes in sequence 

6. Operator action success criteria 

7. Physical environment 

For existing internal events HRAs, much of their definitions will remain unchanged for the fire 

HRA; however, these definitions should be verified to ensure that all PSFs are accounted for 

appropriately in the context of fire. Additionally, the scoping approach to quantification and the 

EPRI method both assume that the internal events HRA meets Capability Category II. This 

assumption should also be verified before additional analysis is performed. For new actions 

identified by the fire HRA, each HFE must be defined to this level of detail regardless if the 
Qualitative Analysis 

4-2 

action is risk significant or non-risk significant in order to meet ASME standard requirements 

HR-F2. [3] 

4.2.1 Accident Sequence Preceding Function Failures and Success 

For fire PRA, the initiating event is a fire that causes a reactor trip. The reactor trip can either be 

caused by the fire itself or by fire-induced equipment failures that lead to initiators such as 

LOOP, or LOCA from stuck open PORV, which will also lead to an automatic or manual trip the 

reactor. 

Following the reactor trip, functional failures and successes are identified to understand how all 

the PSFs could impact operator performance. This step also identifies the operator action in the 

context of the fire PRA. For existing EOP actions, the functional failures and successes will 

typically follow those in the internal events PRA but need to be verified. The PRA analyst is not 

always aware of the specific HRA details and they could unintentionally change the sequences 

of events on which the internal events actions were based upon. 

Identification of the accident sequence will also identify any potential dependencies among 

HFEs. 

4.2.2 Timing Information 

In the “Identify and Define” step described in Section 3, the timing information was identified 

such that a qualitative statement could be made about the feasibility of the action. Specifically, 

the method simply asks, “Is there enough time to complete the action?” For quantification, the 

following detailed timing information needs to be defined: 

• the total time available – period from initiating event (usually reactor trip ) until an 

undesired end state 

• the time at which the cue for the action occurs relative to the initiating event 

• the time it takes the operators to formulate a response (detect, diagnose, decide), and 

• The time to execute the response, including time required to travel to a local area, if 

necessary. This information needs to be defined in the context of the fire (see Section 4.3.2). 

The total time available and the time at which the cue occurs are typically obtained from 

thermal hydraulic analyses such as FSAR, MAAP calculations, or vendor specific studies. 

The time it takes for operators to formulate and execute a response can be obtained from: 
Qualitative Analysis 

4-3 

– Plant specific demonstrations per the guidelines presented in Sections 4.3.2 and 5.2.2 

– Plant specific simulator data 

– Plant specific operator interview 

– Job performance measures (JPMs; for actions outside control room) 

– Estimation 

Usually, combinations of the above approaches will need to be used to obtain as realistic 

estimates as possible. 

For existing EOP actions, the timing information may be similar to the internal events PRA 

but may need to be adjusted to account for fire impacts such as: 

• Delays in implementing EOP procedures due to first implementing Fire procedures 

• Increases in manipulation time due to additional work load 

• Increase in cognitive response due to misleading or unclear indications 

• Increases in manipulation time due to additional travel time for local actions. 

4.2.3 Accident Specific Procedural Guidance 

For each HFE, the procedural guidance needs to be identified. This guidance includes not only 

identifying the procedures but also identifying how the operators will arrive at the specific 

procedure step. For fire PRA, there may be procedural guidance in both the Fire procedures 

and the EOPs. If the procedural guidance is unavailable, then the HFE can still be developed 

into an HEP by using the requirements of the ASME PRA Standard high level and supporting 

requirements of HR-H. This section invokes additional requirements and justification in order 

to be a credible story for success of this action. 

4.2.4 Availability of Cues and Other Indications for Detection and Evaluation 

Errors 

The cues should be defined at a functional level as well as the specific components required. 

The definition includes how the instrumentation is impacted by fire. Secondary cues that could 

impact recovery are also to be identified. In fire scenarios, it should be confirmed if the cues and 

indications that are credited for the relevant internal events operator actions are still valid. Note 

the fire impact may directly affect the cues and instrumentation. The deterministic safe shutdown 

analysis typically provides for at least one safe shutdown path. For fire scenarios where all 

redundant trains are failed, then the HEP is initially set to 1.0. 

4.2.5 Preceding Operator Errors or Successes in Sequence 

Preceding operator errors or success are defined in order to understand the workload, and 

potential stress levels. They also aid understanding of the procedural paths followed by the 

operators. This definition is done by review of the event trees and fault trees and may require 

interaction with the FPRA analyst. For fire response actions, the HRA analyst will need to work 

with FPRA analyst to ensure that the fire response actions are incorporated appropriately. 
Qualitative Analysis 

4-4 

4.2.6 Operator Action Success Criteria 

The specific operator actions required for success needs to be defined. This includes identifying, 

the sub-tasks, the locations of each sub-task, who (STA, local operator, control room operator) 

will perform each sub-task and any potential recoveries. 

4.2.7 Physical Environment 

The fire could have significant impact on the physical environment in which the operator actions 

are being performed. The fire location must be identified and any changes to the operators’ work 

environment must be considered. For example, the fire location may require the operators to take 

a detour when performing local actions, or the actions may require that the operators wear SCBA 

gear. 

4.2.8 Fire PRA Context 

Each of the above categories can be defined in various levels of detail depending on what is 

required in the fire PRA task. For example, in Task 7a of NUREG/CR-6850, [5] each fire area 

is quantified for complete room burn-up. At this stage of the fire PRA development, screening 

values such as those provided in NUREG/CR-6850 [5] would be applicable since the purpose of 

Task 7a is to screen out fire compartments based on quantitative screening criteria. Additionally, 

the fire response scenarios may not be fully defined such that a complete detailed HRA analysis 

cannot be performed. For example, the detailed timing information will come from Task 8 which 

may or may not be completed yet. Finally, as the fire PRA model is developed, the specific 

sequences of events may change. 

When a room is completely burned up, any instrumentation located in the fire area being 

quantified is assumed failed (unless it is known to be protected) and thus any HFE requiring this 

instrumentation should be assumed failed. Additionally if the HFE requires a local action be 

performed in the fire location the HEP should be set to 1.0. 

Starting in task 8 up through the early quantification of Task 11 of NUREG/CR-6850, [5] for 

potentially risk-significant compartments, a scoping approach is used for quantification. A 

scoping analysis for HRA quantification is considered more detailed than NUREG/CR-6850 

screening but less detailed than a complete HRA. At this stage of the FPRA development, many 

HFEs have not been screened out and performing a detailed analysis could be very resource 

intensive since, as the fire PRA is further refined, more HFEs will be screened out. 

HFEs required for final quantification in Task 12 of NUREG/CR-6850 [5] must be defined in the 

greatest level of detail since these HFE are potentially risk significant to the fire PRA. Cues and 

indications must be clearly identified and their fire impacts clearly understood. The timing 

information must be plant specific and verified by simulator or plant walk-downs, the preceding 

operator successes and failures must be identified and any potential recoveries identified. 
Qualitative Analysis 

4-5 

4.3 Performance Shaping Factors (PSF) 

Performance shaping factors (PSFs) are interdependent and their impact on the human error 

probability is complicated. However, for practical analysis, the PSFs are often treated 

independently and are discussed as such below. The purpose of this section is to describe which 

PSFs need to be addressed for fire HRA. This discussion is intended to provide understanding 

and support (an important knowledge base) for the specific treatment of PSFs included in the 

scoping and detailed HRA methods. This section provides an overview of what to consider for 

fire HRA. In many cases, the same guidance for internal event events can also be applied to fire 

and is reproduced here for clarification. The implementation of these PSFs is discussed within 

the appropriate section for quantification. (Scoping is addressed in section 5.2 and the section 

C-7 for the EPRI approach) The following is a listing of the PSFs to consider for fire HRA: 

• Cues and Indications 

• Timing 

• Procedures and Training 

• Complexity 

• Workload, Pressure, and Stress 

• Human Machine Interface 

• Environment 

• Special Equipment 

• Special Fitness Needs 

• Crew Communications, Staffing and Dynamics 

This list is a combination of PSFs listed in NUREG/CR-6850, NUREG-1792, NUREG-1852, 

and the PRA Standards [3-6]. 

4.3.1 Cues and Indications 

Cues and indications are necessary because all required operator actions are predicated on them. 

Without cues or indications, the operators have no prompts that some action is required, and 

hence no operator action can be credited. 

In fire scenarios, it must be confirmed that the cues and indications, which are credited for the 

relevant internal events operator actions, are still valid. For example, an operator action credited 

in response to certain indications in the internal events PRA may not be credible anymore if 

either (1) the indications are impacted by the fire, or (2) the associated instrumentation cable 

routing is unknown. To still be able to credit such actions, it must be shown that there are either 

(1) alternative (redundant or diverse) indications that are not impacted by the same fire, or (2) 

that the minimum required instrumentation is sufficiently protected and procedurally identified 

as such. [7] lists the minimum instrumentation required to be protected, which includes: 
Qualitative Analysis 

4-6 

• diagnostic instrumentation for shutdown systems, 

• level indication for all tanks used, 

• pressurizer (PWR) or reactor water (BWR) level and pressure, 

• reactor coolant hot-leg temperatures, or core exit thermocouples, and cold-leg temperatures 

(PWR), 

• steam generator pressure and level (wide range, PWR), 

• source range flux monitor (PWR), 

• suppression pool level and temperature (BWR), and 

• emergency or isolation condenser level (BWR). 

For fire HRA, it can be assumed for the instrumentation listed above that there will always 

be a minimum set of instruments available. However, protection of one train of instrumentation 

does not necessarily mean that the operators will know which train to use. The system by which 

the operators identify the protected trains should be verified during operator walkthrough or 

talk-throughs. 

NUREG-1792 [4] notes that, in the internal events HRA, it is often assumed that the cues and 

indications are adequate because of the redundancy and diversity in a typical control room. 

However, in scenarios where redundancy and/or diversity could be impacted, such as loss of 

DC or fire, this assumption must be verified. 

NUREG-1852 [6] notes that, in addition to the SSCs needed to directly perform the desired 

function, instrumentation and cues needed to provide diagnostic indications (either EOOs or 

EOCs) relevant to the desired operator manual actions. These indications, to the extent required 

by the nature of the operator manual action, may be needed to (1) enable the operators to 

determine which manual actions are appropriate for the fire scenario, (2) direct the personnel 

performing the manual actions, and (3) provide feedback to the operators, if not already directly 

observable, to verify that the manual actions have had their expected results and the manipulated 

equipment will remain in the desired state. 

Spurious indications are of special concern in fire scenarios, because they can cause confusion 

or even prompt the operators to take an inappropriate action. Indications that are not verified for 

validity could prompt the operators to perform an inappropriate action if a spurious indication 

appears to be valid within the context of the scenario. Spurious indications that are clearly out 

of the scenario context would likely be identified as invalid by operators, given an awareness of 

potential erratic instrumentation behavior as a result of the fire. For example, spurious high 

temperature readings from core exit thermocouples in a PWR would be identified as invalid if 

(1) there had not been a trend of increasing temperature, (2) hot and cold leg temperatures are 

constant, and (3) subcooling margin indications are constant. 
Qualitative Analysis 

4-7 

Identification of the invalid indications will add to the time required to perform necessary actions 

and, at worst, cause the operators to not take appropriate actions or perform procedure-directed 

actions under the wrong circumstances or at the wrong time. For example, if the operator follows 

procedure in response to a spurious high-temperature alarm and shuts down an otherwise 

operable pump because of the spurious indication. Consideration must be given to the spurious 

events and their effects that could happen with each postulated fire and how they might affect 

subsequent operator performance relative to the HFEs being analyzed. 

Analysts sometimes justify not modeling potential EOOs or EOCs on the basis that operators 

would be able to identify invalid indications based on the context (as noted above). Such 

arguments must be well documented and confirmed by appropriate plant staff (e.g., operators 

and trainers). 

For MCR abandonment actions, it is likely that the crew will have limited familiarity with the 

ex-CR panels and how cues for actions are presented. Furthermore, the human-machine interface 

of these panels may not be as good as in the MCR. These issues must be considered in evaluating 

the adequacy of relevant cues for post-MCR abandonment actions. In addition, in cases of MCR 

abandonment or use of alternate shutdown approaches, the general effects of crews no longer 

having access to all the information in the MCR needs to be evaluated. 

4.3.2 Timing 

Timing is one of the more important PSFs and needs to be considered up front to determine the 

feasibility of a postulated operator action. An operator action is considered feasible if the time 

available exceeds the time required. In Section 3, an assessment of its feasibility was used as an 

initial basis for deciding whether to even model an action. In Section 5, demonstrating the 

feasibilities of the actions being modeled is a key aspect of the scoping quantification approach. 

While the more detailed HRA methods discussed in Appendices C and D may not explicitly 

address feasibility, the timing issues discussed in this section are also relevant to those 

approaches. 

In determining feasibility the time available is typically derived from thermal-hydraulic studies 

and is the period from the initiating event (fire induced reactor trip) until an undesired or 

irreversible plant damage state is reached, e.g., core damage. NUREG-1852 [6] suggests that 

time available should consider unique fire-specific uncertainties such as (1) nature of the fire 

(fast or slow), (2) fire detector response times, and (3) air flows that can impact fire growth. 

However, because fire detection and suppression in NUREG/CR-6850 [5] is based on empirical 

non-suppression data curves, these factors are implicitly accounted for and need not be 

considered explicitly in the fire HRA. 

The time required considers three aspects: 

1. the time at which the cue occurs relative to the initiating event 

2. the time it takes the operators to formulate a response (detect, diagnose, decide) and 

3. the time to execute the response including time required to travel to a local area, if necessary. 
Qualitative Analysis 

4-8 

The time it takes to formulate and execute a response is not easily measurable. It is not as simple 

as watching an operator perform an action in ideal conditions with a stop watch to determine the 

time required to perform the act. Only when the sequence context is considered holistically with 

the interfacing PSFs can more meaningful “times” be estimated. Thus, to demonstrate the 

feasibility of HFEs modeled in the fire PRA, the actions should be walked through and timed 

under as realistic circumstances as possible.1

 For example, if personnel would need to wear 

SCBAs to perform an action in a fire scenario, then they should wear the gear when an estimate 

of the time to diagnose and complete the action is obtained. For fire scenarios, even simple MCR 

actions may need to be simulated to some extent in order to get realistic estimates of required 

times. However, it is clearly not possible to simulate all potential conditions during a fire that 

could affect the time to diagnose and perform an action, so some judgments about the time 

required given the expected conditions will have to be estimated. For use in the HRA scoping 

quantification approach described in Section 5, a time margin (the difference between the 

available and required time) is used to account for the uncertainties associated with fire 

conditions that could impact the time required to complete an action. Time margins and 

demonstrating feasibility consistent with the guidance from NUREG-1852 [6] are discussed 

in more detail in Sections 5.2.2 and 5.2.3. 

NUREG-1792 [4] and NUREG/CR-6850 [5] point out that timing can be influenced by many 

other PSFs. In particular, the time to perform an action is a function of (at least) the following 

factors that could be impacted by fire. 

• Crew 

• Cues 

• Human Machine Interface 

• Complexity of action involved 

• Special Tools or Clothing 

• Diversions and other concurrent requirements 

• Procedures 

• Environmental conditions 

1

 The PRA standard ASME/ANS RA-Sa – 2009 item HR-G5 discusses basing the “required time to complete actions 

on action time measurements in either walkthroughs or talkthroughs of the procedures or simulator observations” 

to meet Capability Categories II and III. Just prior to the issuance of this draft, a point was made by the PWR 

owner’s group regarding the extent of credit that can be taken for talkthroughs due to issues involved in scheduling 

walkthroughs or simulator exercises with operator crews. Since the scoping approach was developed based on the 

assumption that walkthroughs would be performed, a further analysis will need to be conducted by the Guidelines 

team to re-evaluate how the use of talkthroughs would impact the use of the scoping approach HEPs. This will be 

initiated concurrent with the public review and comment period. 
Qualitative Analysis 

4-9 

NUREG/CR-6850 [5] provides the following examples of how the overall estimates of the time 

available and time needed to complete the desired action can be influenced by other PSFs during 

a fire: 

• A spurious closure of a valve used in the suction path of many injection paths may need 

quick detection and response by the crew. 

• Use of less familiar or otherwise different procedure steps and sequencing could change the 

anticipated timing of actions in response to a fire. 

• Interfacing with the fire brigade may delay performing some actions. 

• The desired actions may be more complex and/or lead to increased workload relative to the 

internal events response (e.g., disable an equipment item before repositioning it, as opposed 

to simply repositioning it during an internal event). 

• Accessibility issues, harsher environments, and/or the need for other special tools may 

impact the overall timeline of how quickly actions normally addressed in response to internal 

events can be performed under fire conditions. 

• Potential fire growth and suppression could alter equipment failure considerations from those 

considered for internal events. 

For MCR abandonment actions or alternative shutdown approaches, enough time must be 

allowed for the operators to perform the required actions to achieve and maintain hot shutdown 

from an alternate shutdown location(s) or panel(s). Included in this required time is an allowance 

to reach the required destination, diagnose the problem, and execute the required solution. 

Uncertainties in other factors that could affect completion of the actions within the time available 

(such as the environmental conditions discussed below and elsewhere in this document) must be 

considered in determining the HEPs. 

Demonstrating Feasibility and the Use of Time Margins 

As discussed above, demonstrating feasibility involves showing that a given action or set of 

actions can be diagnosed and executed within the available time. To support HRA quantification, 

particularly the scoping quantification approach described in Section 6, it is important that 

estimated action times are based on a demonstration of the action or set of actions that is as 

realistic as possible. Time-authenticated demonstrations of the actions, involving actual 

execution of the actions to the extent possible, are an important requirement of the approach. 

In performing a demonstration, the times for both diagnosis and execution, once the relevant 

cues for the action occur, need to be determined. There are a number of activities that may 

influence the time to respond, such as: 

• MCR staff obtaining the correct fire plan and procedures once the fire location is confirmed 

• MCR staff informing the plant staff of the fire and calling for fire brigade assembly and 

actions 

• MCR staff alerting and/or communicating with local staff responsible for completing various 

actions 

• MCR staff providing any specific instructions to the responsible local staff for the actions 
Qualitative Analysis 

4-10 

• having the local staff collect any procedures, check out communications equipment and 

obtain any special tools or personnel protective equipment necessary to perform the actions 

• performing the actions wearing SCBAs or personnel protective clothing 

• traveling to the necessary locations 

• implementing the desired actions. It should be noted that some actions may have to be 

coordinated or done sequentially [i.e., cannot start until prior actions are completed and the 

MCR staff or others are informed, who also may be dealing with the fire brigade and 

handling multiple procedures (EOPs and Fire procedures)] 

• informing the MCR staff and others as necessary that the actions have been successfully 

completed and the desired effect has been achieved. 

Given the range of factors that can influence the time to complete an action, to the extent 

possible, the conditions under which the diagnosis and execution will have to occur should be 

included in the demonstration to determine feasibility. However, there are a number of other 

situations or factors in the fire context that may be very difficult to recreate. Examples include: 

• The operators may need to recover from/respond to difficulties such as problems with 

instruments or other equipment (e.g., locked doors, a stiff handwheel, or an erratic 

communication device). Such difficulties can and sometimes do happen and represent 

an uncertainty in how long it will take to perform an action. 

• Environmental and other effects might exist that are not easily simulated in the 

demonstration, such as: 

– radiation. For example, the fire could reasonably damage equipment in a way that 

radiation exposure could be an issue in the location in which the action needs to be taken, 

causing the need to don personnel protection clothing (which takes extra time), but which 

may not be included in the demonstration. 

– smoke and toxic gas effects. These are not likely to be simulated in a demonstration, but 

in a real fire where the manual action needs to be taken in a separate room near the fire 

location, there may be smoke and gas effects that could slow the implementation time for 

the action although wearing SCBAs could be simulated. 

– increased noise levels from the fire fighting activities, operation of suppression 

equipment, or personnel shouting instructions 

– water on the floor possibly delaying the actions 

– obstruction from charged fire hoses 

– heat stress which requires special equipment and precautions or too many people getting 

in each others’ way. 

• All these effects may not be simulated in a demonstration, but should be considered as 

possible, perhaps even likely, when determining the time that it may take to perform the 

manual action in a real situation. 
Qualitative Analysis 

4-11 

• The demonstration might be limited in its ability to account for (or envelop) all possible fire 

locations where the actions are needed and for all the different travel paths and distances to 

where the actions are to be performed. A similar limitation is that the location or activities of 

needed plant personnel when the fire starts could delay their participation in executing the 

operator manual actions (e.g., they may typically be in a location that is on the opposite side 

of the plant for a postulated fire location and/or may need to restore certain equipment before 

being able to participate, such as routinely doing maintenance). [The intent is not to address 

temporary/infrequent situations but to account for those that are typical and may impact the 

timing of the action]. 

• It may not be possible to execute relevant actions during the demonstration because of 

normal plant status and/or safety considerations while at power (e.g., operators cannot 

actually operate the valve using the handwheel, but can only “talk-through” doing so). 

In addition, there are a number of factors involving typical and expected variability among 

individuals and crews that could lead to variations in operator performance (i.e., human-centered 

factors), such as the following examples: 

• physical size and strength differences that may be important for performing the actions 

• cognitive differences (e.g., memory ability, analytic skills) 

• different emotional responses to the fire/smoke 

• different responses to wearing SCBAs to accomplish a task (i.e., some people may be more 

uncomfortable than others with a mask over their faces, thus affecting action times) 

• differences in individual sensitivities to “real-time” pressure 

It should be noted that, given the likely experience and training of plant personnel performing 

the actions, it need not be assumed that the above characteristics would lead to major delays in 

completing the actions. However, their potential effects should be considered in the specific 

fire-related context of the actions being performed, to confirm this assumption. 

The point above is that, although good demonstrations are important for demonstrating 

feasibility, there are many factors in fire scenarios that could affect the time required to perform 

the actions that may not be explicitly addressed. Thus, although a reasonable demonstration can 

provide confidence that the action is feasible under the assumed conditions, it is necessary to 

show that there is some time margin available in order to have confidence that factors not 

observed during simulation would not usually prevent the action from being completed. When 

using the HRA scoping quantification approach in Section 5, in addition to meeting certain 

criteria with respect to particular PSFs, analysts will be asked whether the action being 

quantified has been demonstrated to be feasible and whether there is a time margin available to 

account for unexpected influences on action completion times, such as those described above. 

Different HEPs will be assigned based on the size of the time margin (e.g., 50% or 100%) and on 

other factors addressed in the scoping analysis flow charts. Thus, analysts will need as realistic 

estimates of the time margins as possible, or at least acceptable conservative estimates of the 

time margins. Guidance for demonstrating the feasibility of the relevant actions is provided in 

Section 5, based on the guidance in NUREG-1852 [6] for demonstrating the feasibility of 

operator manual actions. 
Qualitative Analysis 

4-12 

4.3.3 Procedures and Training 

As stated in NUREG-1852 [6] there are three roles of plant procedures, which can aid successful 

operator performance during a fire: 

1. The procedures can assist the operators in correctly diagnosing the type of plant event that 

the fire may trigger (usually in conjunction with indications), thereby permitting the 

operators to select the appropriate operator manual actions. 

2. The procedures direct the operators to the appropriate preventive and mitigative manual 

actions. 

3. The procedures attempt to minimize the potential confusion that can arise from fire-induced 

conflicting signals, including spurious actuations, thereby minimizing the likelihood of 

personnel error during the required operator manual actions. 

As stated in NUREG/CR-6850, [5] depending on the fire, the operators may need to use other 

procedures or controls than EOPs typically used in response to internal events. Implementing 

unfamiliar or multiple procedures simultaneously could lead to confusion. In some cases, 

especially for some ex-CR actions, procedures might not exist or be readily retrievable, or 

ambiguous in some situations. The analyst must check the adequacy and availability of these 

other procedures that would be needed to address the fires modeled in the fire PRA. Obviously, 

the amount of training the crews receive on implementing the procedures and the degree of 

realism will be a critical factor. 

For fire HRA, talk-throughs with operations and training staff can be very helpful in uncovering 

difficulties in using the relevant procedures. In contrast to EOPs, the fire response procedures are 

not always standardized and their use is sometimes at the discretion of the shift supervisor. 

Understanding when and how the procedures are implemented will drive other PSFs such as 

timing, cues and indications, workload, stress, and complexity. 

Should any fire response actions be required that are not proceduralized, the fire HRA should 

not take credit for them as a first approximation. Non-proceduralized recovery actions are to 

be credited on an as-needed basis. As the FPRA is further developed, there may be a desire to 

credit non-proceduralized actions. These cases could be considered, provided that following 

requirements Supporting Requirement HR-H2 of the ASME Standard [3] are met: 

CREDIT operator recovery actions only if, on a plant-specific basis, the following occur: 

(a) a procedure is available and operator training has included the action as part of crew’s 

training, or justification for the omission for one or both is provided 

(b) “cues” (e.g., alarms) that alert the operator to the recovery action provided procedure, 

training, skill-of-the-craft exist 

(c) attention is given to the relevant performance shaping factors provided in HR-G3 

(d) there is sufficient manpower to perform the action 

For fire HRA, item (b) is especially important. It must be known that the cue will be unaffected 

by the fire. Additionally, it must also be known that: 
Qualitative Analysis 

4-13 

• There is enough time for the operators to diagnosis and perform the tasks 

• There are enough crew members available, in many instances some of the operators will be 

assigned to the fire bridge and unable to assist. The location of the fire will not prevent the 

operators from performing the tasks. 

Like procedures, training for both control room and local actions is an important factor when 

assessing operator performance. As stated in NUREG- 1852, [6] training supports three functions 

for operator performance during a fire: 

1. Training establishes familiarity with the Fire procedures and equipment needed to perform 

the desired actions, as well as, potential conditions in an actual event, 

2. Training provides the level of knowledge and understanding necessary for the personnel 

performing the operator manual actions to be well prepared to handle departures from the 

expected sequence of events, and 

3. Training gives the opportunity to personnel to practice their response without exposure to 

adverse conditions, thereby enhancing confidence that they can reliably perform their duties 

in an actual fire event. 

For internal events HRA, typically operators can be considered “trained at some minimum 

level” to perform their desired tasks. But for fire HRA, the crew’s familiarity and level of 

training (e.g., types of scenarios, frequency of training or classroom discussions and/or 

simulations) for addressing the range of possible fire complications and potential actions to be 

performed may be less than for internal events. "Less familiarity" needs to be accounted for in 

assessing the impact of training for fire actions and in determining their HEPs. Training on fire 

PRA scenarios can often offset the effects of other negative PSFs such as poor procedures, 

limited time available, cues and indications, and complexity. 

An especially important concern is the decision of “if and when” to leave the MCR. The 

procedural guidance, training received, and the explicitness and clarity of the criteria for 

abandoning the MCR must be considered. Guidance for addressing these issues relative to the 

scoping approach is provided in Section 5.2.9. This concern is an area of uncertainty since there 

are typically no clear decision criteria for abandonment; it may be at the discretion of the shift 

supervisor. The decision to leave the MCR and the timeliness in which this decision is made can 

have serious ramifications. Problems leading to a higher likelihood of failure to reach safe 

shutdown can arise if the crew delays too long in leaving or if they leave too quickly. Decisions 

about how to model the decision to leave the MCR will depend on the impact of early or late 

abandonment. Discussions with those responsible for making the decision to abandon the MCR 

under various conditions and information on how they are trained and experiences they have had 

related to abandoning the MCR will be critical to determining appropriate HEPs. 

4.3.4 Complexity 

As stated in NUREG-1792, [4] the PSF complexity attempts to measure the overall complexity 

involved for the situation at hand and for the action itself (e.g., many steps have to be performed 

by the same operator in rapid succession vs. one simple skill-of-the-craft action). Many of the 

other PSFs bear on the overall complexity, such as the need to decipher numerous indications 
Qualitative Analysis 

4-14 

and alarms, the presence of many complicated steps in a procedure, or poor human-machine 

interface. Nonetheless, this factor also captures “measures,” such as the ambiguity associated 

with assessing the situation or in executing the task, the degree of mental effort or knowledge 

involved, whether it is a multivariable or single-variable task, whether special sequencing or 

coordination is required in order for the action to be successful (especially if it involves multiple 

persons in different locations), whether the activity may require very sensitive and careful 

manipulations by the operator. The more these “measures” describe an overall complex situation, 

this PSF should be identified as a negative influence. To the extent these “measures” suggest a 

simple, straightforward, unambiguous process (or one that the crew or individual is very familiar 

with and skilled at performing), this factor should be found to be nominal or even ideal (i.e., 

positive influence). 

For local and MCR abandonment actions, the crew may be required to visit various locations and 

as the number of location increase the complexity of the situation is increased. Adding to this 

complexity is the extent to which multiple actions must be coordinated. The number and 

complexity of the actions and the availability of needed communication devices should be 

accounted for. 

4.3.5 Workload, Pressure, and Stress 

Although workload, pressure, and stress are often associated with complexity, the emphasis here 

is on the amount of work that a crew or individual has to accomplish in the available time (e.g., 

task load), along with their overall sense of being pressured and/or threatened in some way with 

respect to what they are trying to accomplish (see Swain and Guttmann [8] for a more detailed 

definition and discussion of stress and workload). To the extent that crews or individuals expect 

to be under high workload, time pressure, and stress, it is generally thought to have a negative 

impact on performance (particularly if the task being performed is considered complex). 

However, the impact of these factors should be carefully considered in the context of the 

scenario and of the other PSFs thought to be relevant. For example, in internal events HRA, if 

the scenario is familiar, its procedures and training are very good, and if the crews usually 

implement their procedures within the available time, then analysts might decide that relatively 

high expected levels of workload and stress will not have a significant impact on performance. 

However, for fire HRA, if the scenario is unfamiliar, the procedures and training for the fire 

scenario are only considered adequate, and the time available to complete the action has been 

shortened due to fire, the analyst may decide that stress will have a significant impact on 

performance. 

For local and MCR abandonment actions, there is the potential for high time pressure to reach 

the necessary locations and perform the appropriate actions. An important consideration in the 

performance of these actions is the extent to which multiple actions need to be coordinated or 

sequentially performed and, as discussed above, the available time as perceived by the operators. 

The hazards associated with performing the actions will also be relevant. 
Qualitative Analysis 

4-15 

For HRA methods that categorize stress into different levels such as low, moderate, and high, a 

new highest level of stress may want to be considered for fire HRA. This higher stress level 

recognizes the potential for larger combinations of negative PSFs that could occur during a fire 

and increase the stress above what is considered high stress for internal events HRA. 

4.3.6 Human Machine Interface 

Human Machine Interfaces (HMI) impact operator performance differently depending on the 

location of the action. In general, NUREG-6850, NUREG-1852, and NUREG-1792 [4-6] all 

agree that, for control room actions, the human machine interface (HMI) will have minimal or 

positive effect on the human performance. This minimal effect recognizes that problematic HMIs 

have either been taken care of by control room design reviews and improvements or they are 

easily worked around by the operating crew due to the daily familiarity of the control room 

boards and layout. However, any known very poor HMI should be considered as a negative 

influence for an applicable action even in the control room. For control room actions for fire 

HRA, the human machine interfaces will remain similar to internal events with the exception 

of potential impacts on instrumentation. 

For local actions, the HMIs can have potentially large impacts on operator performance during a 

fire. Local actions may involve more varied (and not particularly “human-factored”) layouts and 

require operators to take actions in much less familiar surroundings and situations. Thus, any 

problematic HMIs can be an important negative factor on operator success. For instance, if 

access to a valve requires the operator to climb over pipes and to turn the valve with a tool while 

in an awkward position, or in-field labeling of equipment is in poor condition and could lengthen 

the time to find the equipment, then such “less ideal” HMIs could be a negative performanceshaping factor. In contrast, if a review reveals no such problematic interfaces for the act(s) of 

interest, this influence can be considered adequate, or even positive if the interface helps ensure 

the appropriate response in some way. 

Local actions that require the use of equipment that has been damaged such that manipulation 

could be difficult or unlikely to succeed should not be credited in the PRA. For example, the fire 

modeling and electrical evaluation defines a scenario as a hot short on a control cable that causes 

a valve to close and drive beyond its seat, possibly making it impossible to open manually. 

For control room abandonment or alternative shutdown actions, the adequacy of the remote 

shutdown and local panels needs to be verified. These scenarios are typically not modeled in the 

internal events PRA and the shutdown panel and related interfaces are plant specific and design 

reviews and improvements have not always been completed. Additionally, the operators are not 

as familiar with the panel layout as they are in for control room scenarios. 

HMI PSFs need to be considered in combination with other PFSs. NUREG-1852 [6] does not 

explicitly discuss the HMI, but it does reference NUREG-0711, “Human Factors Engineering 

Program Review Model,” [9] in the context of environmental conditions and communications 

in so far as that the HMI should support operator actions under a full range of environmental 

conditions and the level of communication needed to perform the task. It notes that “when 

developing functional requirements for monitoring and control capabilities that may be 

provided either in the control room or locally in the plant, the following...should be considered: 

...communication, coordination...workload [and] feedback.” Examples cited include 

“loudspeaker coverage...page stations...personnel page devices suitable for high-noise or remote 
Qualitative Analysis 

4-16 

areas [and] communication capability...for personnel wearing protective clothing [such as] voice 

communication with masks....” All of these factors can bear on the likely success of operator 

actions and need to be evaluated in assessing the time to respond in performing demonstrations 

for feasibility. 

4.3.7 Environment 

If the fire does not directly impact the control room, the environmental conditions inside the 

control room are not usually relevant to success of operator actions since they rarely change 

control room habitability. However, if the fire directly affects the MCR either by smoke, the 

introduction of toxic gases, or fire damage and requires the control room to be abandoned, 

environmental conditions need to be considered as negative impacts to the crew’s success. 

For local actions, environmental conditions could be an important influence on the operator 

performance. Radiation, lighting, temperature, humidity, noise level, smoke, toxic gas, even 

weather for outside activities (e.g., having to go on a potential snow-covered roof to reach the 

atmospheric dump valve isolation valve) can be varied and far less than ideal. Fires can introduce 

additional environmental considerations not normally experienced in the response to internal 

events. These considerations include heat, smoke, the use of water or other fire-suppression 

agents or chemicals, toxic gases, and different radiation exposure or contamination levels. Any 

or all of these considerations may adversely impact the operator actions in the locations where 

the actions are to be taken and along access routes. 

During a fire, there is the potential that the crews ideal travel path to the action location will 

be blocked by the fire and will lead to a delay or inability to reach the action location. Where 

alternate routes are possible, the demands associated with identifying such routes and any extra 

time associated with using the alternate routes should be factored into the analysis. Pursuant to 

NUREG/CR-6850, [5] if the action is required to be performed in the same location as the fire, 

the action should not be credited in the fire PRA. 

4.3.8 Special Equipment 

Due to varying environmental conditions during a fire, the crew may require the use of special 

equipment. These items, identified in NUREG-1852 [6] as portable equipment can include: keys, 

ladders, hoses, flash lights, clothing to enter high radiation areas, and fire special protective 

clothing and breathing gear. The accessibility of these tools needs to be checked to ensure that 

they can be located and would be accessible during a fire. Furthermore, the level of familiarity 

and training on these special tools needs to be assessed. Equipment tends to be more important 

for success of local fire actions than control room actions. 

Abandoning the MCR might also call upon the need to don protective gear or self contained 

breathing apparatus (SCBA). The hindrance of the special clothing on the operators’ actions 

needs to be accounted for. 
Qualitative Analysis 

4-17 

4.3.9 Special Fitness Needs 

According to NUREG/CR-6850, [5] the fire and its effects could cause the need to consider 

actions not previously considered under internal events, or changes to how previously considered 

actions are performed, checks should be made to ensure unique fitness needs are not introduced. 

Unique fitness needs could include: 

• Having to climb up or over equipment to reach a device because the fire has caused the 

ideal travel path to be blocked. 

• Needing to move and connect hoses, using an especially heavy or awkward tool. 

• Physical demands of using respirators. Wearing a respirator could impact communication 

as well. 

4.3.10 Crew Communications, Staffing, and Dynamics 

Crew Dynamics 

Crew/team dynamics and crew characteristics are essential to understanding 1) how and where 

the early responses to an event occur, and 2) the overall strategy for dealing with the event as 

it develops. In particular, the way the procedures are written and what is (or is not) emphasized 

in training can affect overall crew performance. The overall strategy may be related to an 

organizational or administrative influence which can cause systematic and nearly homogeneous 

biases and attitudes in most or all the crews. A review of team dynamics typically includes the 

following, as described in NUREG-1792 [4]. 

• Are independent actions encouraged or discouraged among crew members? Allowing 

independent actions may shorten response time but could cause inappropriate actions going 

unnoticed until much later in the scenario. 

• Are there common biases or “informal rules?” For example, is there a reluctance to do certain 

acts, is there an overall philosophy to protect equipment or run it to destruction if necessary, 

or are there informal rules regarding the way procedural steps are interpreted. 

• Are periodic status checks performed (or not) by most crews so that everyone has a chance to 

“get on the same page” and allow for checking on what has been performed to ensure that the 

desired activities have taken place? In general, are there good communication strategies used 

to help ensure that everyone stays informed? 

• Is the overall approach of most crews to aggressively respond to the event, including taking 

allowed shortcuts through the procedural steps (which will shorten response times), or are 

typical responses slow and methodical (“we trust the procedures” type of attitude), thereby 

slowing down response times but making it less likely to make mistakes. In general, deciding 

whether the crew characteristics have a positive or negative effect will be contingent on the 

scenario being examined. For example, a particular bias may be very positive for some 

scenarios, but not for others. 

For fire HRA, the typical internal events crew dynamics may change as a result of responding to 

a fire and need to be re-considered. For instance, the fire may create new or unique fire-related 

responsibilities that have to be handled by a crew member. The use of plant status discussions by 

the crew may be delayed or performed less frequently, allowing less opportunity to recover from 
Qualitative Analysis 

4-18 

previous mistakes. Such differences may be best determined by talk-through with operations 

staff, as well as observing simulated responses of fire scenarios. The main goal of such an 

analysis is to determine whether there are any particular crew characteristics or team dynamics 

that could impact a given accident scenario and human action being addressed. Certain 

characteristics may be fine for most scenarios, but could cause problems in others. 

Crew Availability 

Fire can introduce additional demands for staffing resources beyond what is typically assumed 

for handling internal events. These demands can take the form of needing to use and coordinate 

with more personnel to perform certain local (ex-CR) actions, as well as with the fire brigade 

and/or local fire department personnel. According to NUREG-1792, [4] for control room actions, 

the availability of staff is generally not an important consideration for internal event PRA since 

plants are supposed to maintain an assigned minimum crew with the appropriate qualified staff 

available in or very near the control room. One of the key assumptions in NUREG/CR-6850 [5] 

is that even if one or more MCR persons are used to assist in ex-control room activities such as 

aiding the fire brigade, the minimum allowable number of plant operators remains available. 

For other ex-control room local actions, crew availability of staff can be an important 

consideration particularly dependent on (1) the number and locations of the necessary actions, 

(2) the overall complexity of the actions that must be taken, and (3) the time available to take 

the actions and the time required to perform the actions. 

For MCR abandonment actions or alternate shutdown actions, the crew will be dispersed 

to various alternative shutdown panels and controls and this dispersal requires additional 

coordination among all crew members. It must be assured that there are adequate control room 

members necessary to fulfill the needs of proper shutdown actions from alternative and remote 

shutdown panels. 

Communication 

For both internal events and fire HRA control room actions, communication among crew 

members should be verified. Typically there will be an established strategy for communicating 

within the control room that ensures that directives are not easily misunderstood. Do crew 

members avoid the use of double negatives? It is expected that communication will not be a 

problem; however, any potential communication problems (such as having to talk with special 

air packs and masks on in the control room in a minor fire) should be accounted for if they exist. 

For local actions, communication may be much more important because of the possibility of less 

than ideal environment or situation. It should be understood how equipment faults caused by the 

fire could affect the ability for operators to communicate as necessary to perform the desired 

act(s). For instance, having to set up the equipment and talk over significant background noise 

and possibly having to repeat oneself many times should be a consideration, even if only 

as a possible “time sink” for the time to perform the act. For fire conditions, the necessary 

communication devices to carry out the desired actions may or may not be available. For 
Qualitative Analysis 

4-19 

example, the plant loudspeaker coverage may be disabled due to the fire. In addition, the 

operators’ level of familiarity and training to use any special communication devices needs to be 

assessed. There is also the potential for the crew to need respirators and communicating through 

these devices can be difficult. 

Following MCR abandonment, the location of remote and alternate shutdown panels and the 

required related actions may be in a variety of places, the ability to communicate between 

different places should be considered and adjusted for. Furthermore, if it is required that SCBA 

be worn, this apparatus might interfere with clarity in communications between the team. The 

ability for operators to communicate with each other during the initiation and execution of the 

tasks and after their completion is critical. 

Communication can be directly related to other PSFs such as environmental conditions, timing, 

complexity, and crew discussions about faulty indications. 

4.4 Review of Relevant Experiences 

In order for the fire HRA analyst to gain a better understanding of the plant response following 

an event, he should consider reviewing relevant experiences. The analyst should look at both 

plant-specific events as well as industry-wide incidents to populate theses reviews. Typically, the 

experience review is focused on events of a particular type with an emphasis on the associated 

human performance. In this way, the analyst can truly evaluate the effect of such incidents and 

gain insight into the context in which accidents can occur. Although these reviews are helpful at 

the beginning of an HRA analysis, it is particularly relevant to a detailed HRA analysis in which 

more specifics are necessary. 

The search for relevant historical experiences will usually focus on a specific type or class of 

events (e.g., a particular type of initiating event such as a fire or small LOCA). When gathering 

industry-wide experiences, the analyst may want to look to the NRC Information Notices, or 

similar types of information, as these notices will sometimes include summaries of example 

events along with a discussion of the problems and surrounding context illustrated by these 

events. 

Conducting a historical review of experiences exposes the analyst to a variety of plant conditions 

and plant progressions (including timing issues) that should be considered in the HRA analysis. 

Furthermore, the review may reveal potential influences on operator performances (e.g., plant 

conditions and associated gaps in performance shaping factors such as procedures or training) 

and challenging conditions or situations the operators might encounter. Operator performance 

during unusual plant conditions may reveal deficiencies in the human-centered factors that lead 

the operators to make errors in responding to the situation. The study of these situations aids the 

analyst in identifying the context of the incident, especially the plant conditions, the significant 

PSFs, and the dependencies that set up the operators for failure. Finally, plant-specific 

sensitivities or tendencies may have been influenced by a previous event, and may need to be 

accounted for in the fire HRA dependency analysis. These occurrences may have been affected 

by plant policies and/or the informal rules that operators follow and would thus impact the 

human error probability. (A historical review of plant-specific and industry-wide events, 

incidents, and accidents will aid the analyst in detailing the relevant contextual cues surrounding 
Qualitative Analysis 

4-20 

human performance. For instance, the significant PSFs driving the performance in particular 

events can be identified. To this end, and as a further benefit to reviewing previous events, the 

discussion among the PRA team members and operations staff is often more productive if the 

specifics of a historical event can be used as an illustrative example.

4.5 Review of Plant Operations 

Prior to detailed quantification, the HRA analyst should confirm with plant operational personnel 

the general organizational factors affecting fire HFEs such as crew staffing, procedural and 

communications protocols. Discussion with operators can often reveal that there are “informal 

rules” among operators about which even the training staff maybe unaware. 

Understanding how and when the fire procedures are implemented can drive the HEP results. 

Operator interviews have shown that the use of the fire procedures can vary widely among plants 

and sometimes the use of the procedures is at the discretion of the shift supervisor. At some 

plants, the fire procedures are implemented in parallel to the EOPs and, at other plants, they are 

implemented after completion of the EOPs, and, at still other plants, they are combined with 

EOPs. When and how the procedures are implemented will affect PSFs such as timing, and crew 

availability and workload. Other informal rules can include departing from the EOP procedures 

when the diagnosis is clear to the operators or anticipating alarms and acting before the 

minimum time necessary. 

Additionally, it should be confirmed how the crew will interact with the fire brigade. The crew’s 

tasks during a fire may be varied and these additional tasks would lead to an increased workload. 

This activity confirms that a minimum set of operators and staff is available to complete the 

actions. 

After each HFE has been quantified, additional operator interviews should be performed. In 

these operator interviews, plant-specific data is collected through plant walk-downs and operator 

talk-throughs. The purpose of these interviews is to “tune” the fire PRA model to the accident 

scenario in question. The HRA analyst must know what is in the fire PRA model, what is in the 

procedures, and what the operator is actually doing (or concerned with) - for the fire HRA model 

to be most representative. 

4.6 References 

1. Systematic Human Action Reliability Procedure (SHARP) Enhancement Project. SHARP 1 

Methodology Report. December 1992. EPRI TR-101711. 

2. NUREG-1880, “ATHEANA User’s Guide”, June 2007. 

3. ASME RA-Sb-2005, “Standard for PRA for Nuclear Power Plant Applications”, December 

2005, (Note statement in Foreword about standards). Available from American Society of 

Mechanical Engineers. 

4. NUREG 1792, “Good Practices for Implementing Human Reliability Analysis (HRA)”, 

Sandia National Laboratories, 2005. 
Qualitative Analysis 

4-21 

5. EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities. September 2005. 

NUREG/CR-6850/EPRI 1011989. 

6. NUREG-1852, “Demonstrating the Feasibility and Reliability of Operator Manual Actions in 

Response to Fire”, October 2007. 

7. Section IX of Attachment I to IN 84-09, “Lessons Learned from NRC Inspection of Fire 

Protection Safe Shutdown Systems (10 CFR 50, Appendix R)”, dated March 7, 1984. 

8. NUREG/CR-1278, “Handbook of Human Reliability Analysis with Emphasis on Nuclear 

Power Plant Applications,” (THERP) Swain, A.D. and Guttman, H. E., August 1983. 

9. NUREG-0711, Rev. 2, “Human Factors Engineering Program Review Model”, 

February 2004. 

5-1 

5

QUANTIFICATION 

This report describes three possible approaches for quantifying the HFEs identified in the fire 

PRA models. These methods offer a stepped approach progressing from a simpler screening 

method to a more detailed method. Although the stages are presented sequentially, it is not 

intended that an analyst progress through them sequentially or use all the methods. For each 

HFE requiring quantification, the analyst has the following options for quantification. 

1. Screening HRA similar to that presented in NUREG/CR-6850 [1] 

2. A new scoping fire HRA quantification method that is introduced in this report 

3. Two detailed HRA quantification approaches modified for application in fire PRAs. 

The first methodology described (see Section 5.1) is a screening analysis. The screening 

methodology assigns quantitative screening values to the HFEs modeled in the fire PRA by 

addressing the unique conditions created by fires. To determine appropriate HEPs, a given HFE 

must be matched to a set of criteria. The HEPs assigned in this manner are conservative and may 

not be acceptable as a final HEP for a given HFE (i.e., a more realistic HEP is needed). In 

addition, since the screening approach assigns a screening value of 1.0 for main control room 

(MCR) abandonment or alternative shutdown actions, a possible next step, conservative, 

approach (similar to an approach presented in NUREG/CR-6850 [1]) is provided at the end of 

the screening section. This approach allows assignment of a single overall failure probability 

value (e.g., 0.1) to represent the failure of reaching safe shutdown using alternate means 

(including MCR abandonment) if certain minimal criteria are met. 

In those instances where a less conservative analysis is required, the next stage presented is 

a scoping analysis. The scoping fire HRA approach is a simplified quantification approach 

developed specifically for this report that addresses fire-specific aspects of operator performance. 

The scoping analysis outlined in Section 5.2 uses decision-tree logic, as well as descriptive text, 

to guide the analyst to the appropriate HEP value. 

Although it has similarities to a screening approach, the scoping quantification process requires 

a more detailed analysis of the fire PRA scenarios and the associated fire context, and a good 

understanding of several factors likely to influence the behavior of the operators in the fire 

scenario. Given such an analysis, it is expected that the flowcharts provided can be used to 

perform quantification for many of the HFEs being modeled. However, it is expected that some 

actions will not be able to meet some of the criteria for any of a number of reasons (and result 

in an HEP of 1.0). Furthermore, the HEPs developed using this method may be conservative 

compared to that which could be developed using one of the two detailed HRA approaches 

also described in this report. 
Quantification 

5-2 

For those cases in which the scoping approach cannot be used or a more detailed and possibly 

less conservative analysis is desired, analysts have the option of performing a detailed analysis 

using: 

1. EPRI detailed HRA methodology [2] approach presented in Appendix C of this report, or 

2. ATHEANA HRA method (NUREG-1880) [3] presented in Appendix D 

Section 5.3 below provides additional discussion regarding detailed fire HRA. Another 

alternative would be for the analyst to decide not to take credit for the action and assign an 

HEP of 1.0. 

5.1 Screening HRA Quantification 

Section 12 of NUREG/CR-6850 [1] provides guidance for assigning initial screening HEPs as 

an aid in simplifying and refining the fire PRA model to focus analysis resources on those fire 

scenarios and associated equipment failures and operator actions most significant in the overall 

fire risk. This process helps rank the fire sequences. The ranking can be used to determine which 

sequences might be further analyzed to demonstrate low risk by analysis of cable separation or 

by detailed human reliability evaluations. 

The screening methodology presented below stems from NUREG/CR-6850 [1]. Based on recent 

plant specific applications of the methodology, it was determined that the screening criteria for 

Sets 1 and 2 did not adequately distinguish between short and long term actions. Long term 

actions are those that are not required during the early stage (e.g., first hour) of a fire event 

and are not expected to be performed until at least one hour after the fire initiation and trip 

of the plant. Thus, short term actions are those required within the first hour of a trip. By not 

distinguishing between short and long term actions, the NUREG/CR-6850 [1] application of the 

screening criteria produced overly conservative HEPs for the longer term actions. Thus, the 

screening criteria for Sets 1 and 2 described below have been modified to reflect the likely 

differences in the HEPs for long term actions, but otherwise they are identical to the criteria 

presented in NUREG/CR-6850 [1]. 

As discussed in NUREG/CR-6850 [1], the screening methodology described below is a method 

for assigning quantitative screening values to the HFEs modeled in the fire PRA when 

performing Task 7, Quantitative Screening, and subsequent model refinement activities. 

However, because of the unique conditions created by fires, some level of analysis will be 

needed to determine which screening “set” (see below) is applicable. If the needed screening 

analysis seems too demanding, analysts always have the option to initially assign screening 

failure probabilities of 1.0 to all HFEs. 

The method supports assignment of screening values by addressing the conditions that can 

influence crew performance during fires, ensuring that the time available to perform the 

necessary action is appropriately considered (given the other on going activities in the accident 

sequence), and ensuring that potential dependencies among HFEs modeled in a given accident 

sequence are addressed. Note that the criteria are best applied on a fire scenario (or groups of 

similar scenarios) basis, in order to decide which criteria set applies for which fire(s). For a 
Quantification 

5-3 

particular HFE(s), if an appropriate set of criteria (discussed below) cannot be identified or met, 

no screening value should be used (i.e., assign a 1.0 failure probability initially and/or do a more 

detailed analysis depending on whether the HFE becomes important after initial model 

quantification). 

5.1.1 Method for Assigning Screening Values to HFEs (Sets 1, 2, 3, and 4) 

In the first set of criteria described below (Set 1), the goal is to determine whether the fire 

conditions are such that the HFEs modeled in the Internal Events PRA can simply be assigned 

the Internal Events PRA values modified for general fire effects during screening. Hence, 

Set 1 criteria apply only to existing HFEs in the Internal Events PRA. If the criteria can be met, 

analysts still need to ensure that potential dependencies across HFEs in the models are accounted 

for per the ASME Standard [4]. That is, that the fire effects and the addition of any new firerelated HFEs to the model do not significantly alter the dependencies among the internal events 

HFEs and their associated HEPs. Set 2 addresses a special case for HFEs modeled in related 

scenarios in the Internal Events PRA, but that did not meet the Set 1 criteria. Set 3 addresses (1) 

new HFEs added to the fire PRA to account for fire-specific effects, and (2) prior Internal Events 

PRA HFEs that had to be significantly altered or modified during identification and definition 

step (see Section 3) to reflect fire effects in the fire PRA. Set 4 addresses actions involved with 

MCR abandonment and the abandonment decision. Each of the four sets of screening criteria and 

HEP screening values is presented in turn below. 

5.1.1.1 Screening Values Under Set 1 

Given that the criteria for Set 1 exist, the Internal Events PRA probability values for the 

applicable HFE(s), multiplied by a factor of 10 to account for effects not covered in the Internal 

Events HEP evaluation (such as fire brigade interaction, increased workload and/or distraction 

issues, and other unexpected fire effects), can be used as screening values for initial evaluations 

of the fire PRA model in Task 7 and beyond. 

However, if the actions can be determined to be long term actions in the sense that they would 

not need to occur until the fire was almost assuredly extinguished, spurious events would no 

longer be occurring, and they meet all of the other criteria for Set 1, then the HEPs from the 

internal events PRA can be used. It must be clear that the fire effects would no longer be 

dynamic and changing, that any equipment damage will be largely assessed and understood, 

and that environmental effects will be stabilized and not significantly affect the ability of the 

operators to perform the action. 

The criteria for Set 1 are as follows: 

Set 1 Criteria 

1. The fire can cause an automatic plant trip, or a forced and proceduralized manual trip, 

and could not cause significant damage to functional safe shutdown equipment or related 

instrumentation beyond that considered in the Internal Events PRA for which the HFE 

value(s) apply. This condition demonstrates that from the safe shutdown perspective, the 

challenge of the particular fire is not significantly worse (functionally or as to effects on 

equipment) than already considered in the Internal Events PRA for the applicable 

HFE(s). 
Quantification 

5-4 

2. Based on input from the cable/circuit analysis, no spurious behavior of instrumentation 

(e.g., false or lost indications) or spurious equipment actuations can occur in this fire 

beyond those with the following general characteristics. (1) The spurious events are not 

associated with safety-related equipment and instrumentation relevant to the critical 

safety functions, and hence will be only minor distractions, not immediate challenges to 

safe shutdown. (2) The operators can discern the events to be clearly attributable to the 

fire. (3) The events do not need immediate responses or corrective actions from the crew 

(e.g., to prevent damage to critical safety function equipment or damage to the core) 

while attempting to achieve safe shutdown. 

3. One train/division of safe shutdown, related equipment and instrumentation is completely 

free of any spurious events or failures directly associated with the fire, allowing the crew 

to maintain the critical functions such as heat removal and RCS integrity; and reach safe 

shutdown using the emergency operating procedures. 

4. Those members of the MCR crew most directly responsible for achieving and 

maintaining safe shutdown (i.e., the board operators responsible for controlling and 

monitoring plant status and the crew supervisor responsible for reading the procedures 

and directing crew actions) will not have significant additional responsibilities. That is, 

they will be able to remain in the EOPs (as when responding to an internal event) or, 

if they are to follow FEPs, those FEPs closely resemble the EOP actions (so that the 

Internal Events PRA HFEs can still be deemed relevant for their definition and 

quantification). One way to demonstrate this, for instance, would be if someone else is 

responsible for dealing with the fire-specific response procedures and the actions 

associated with those procedures do not significantly disrupt the above MCR members’ 

responsibilities and actions related to reaching safe shutdown. The fire-specific actions 

also should not divert personnel normally needed to assist the MCR crew in reaching 

safe shutdown. 

5. There is no significant environmental impact or threat to the MCR crew (e.g., no 

significant smoke, potential toxic gases, loss of lighting if not already part of the Internal 

Events PRA HFE, such as for station blackout). 

6. There is no reason to suspect that the time available to diagnose and implement the 

action(s) being addressed would be significantly different than in the Internal Events 

PRA-related scenario(s) for which the HFE(s) apply. 

7. A dependency assessment of the applicable HFEs in the Internal Events PRA has been 

performed per the ASME Standard [4] to ensure that the dependencies are accounted for 

in the fire PRA. Potential dependencies created either by the fire effects or the associated 

introduction of new HFEs into the model need to also be addressed. If new HFEs related 

to the fire have been added to the model, these new actions should be shown to not 

create new dependencies among the HFEs in the accident sequence and that any likely 

strong dependencies have been accounted for during the screening, so that accident 

sequences/cut sets are not artificially removed because of multiplying many supposedly 

independent HEPs together. 
Quantification 

5-5 

8. If any of the HFEs being modeled are local (i.e., ex-control room) manual actions that 

were originally modeled in relevant accident sequences in the Internal Events PRA, it 

should be shown that achieving the local actions will not be significantly affected by the 

presence of fire from an environment and accessibility perspective (e.g., no significant 

interference from smoke or toxic gases either in traveling to the location of the action or 

in executing that action; no loss of lighting; no new high radiation threat; and others). It 

should also be demonstrated that the staff assumed to conduct the action will still be 

available, i.e., they will not be conducting other fire-related responses such as isolating 

electrical equipment or supporting the fire brigade, for example. Furthermore, other 

conditions assumed in evaluating the corresponding Internal Events PRA local action 

(i.e., need for special tools, communication capability, adequacy of procedures and 

training) should not be significantly different under fire conditions. (Note: If SCBAs 

are needed to carry out the local action, these Set 1 criteria are not met for that action). 

If all of the conditions for Set 1 are met, the Internal Events PRA HEPs for the applicable 

HFE(s), multiplied by a factor of 10 to account for the effects of potential fire brigade interaction 

and other minor increased workload and/or distraction issues, can be used as screening values for 

initial evaluations of the fire PRA model in Task 7 and beyond. In addition, if the HFEs can be 

determined to be long term actions as described above, then the original HEPs from the internal 

events analysis can be used. 

5.1.1.2 Screening Values Under Set 2 

This set addresses a special case where the Set 1 criteria related to spurious events are not met, 

but a reasonable screening value can still be applied. The Set 2 criteria still apply only to HFEs 

that were previously modeled in the Internal Events PRA. If the Set 2 criteria are met, screening 

values of 0.1 or 10 times the Internal Events PRA values, whichever is greater can be used1

. 

However, if the HFEs are long term actions as described above and they meet all of the other 

criteria for Set 2, then screening values of 0.1 or 10 times the Internal Events PRA values, 

whichever is smaller can be used. Potential dependencies across events in a scenario still need to 

be examined (as discussed under Set 1) and the total joint probability of the HFEs in the scenario 

should be reasonable, as outlined by the ASME Standard [4]. 

Set 2 Criteria 

If all of the Set 1 conditions are met except that significant spurious electrical effects are likely to 

be occurring in one safety-related train/division (and one train/division only) of equipment 

and/or instrumentation important to the critical safety functions, and hence may need some 

corrective responses on the part of the crew, the HFEs from similar scenarios modeled in the 

Internal Events PRA may be assigned a Set 2 screening value as long as appropriate 

dependencies are considered. The point of this Set 2 condition is that in Set 1, the spurious 

effects are not in safety-related, critical function-related equipment, and do not need any 

 

1

 The Set 2 screening adjustments are intended to conservatively bound the general fire effects on level one actions 

modeled in the internal events PRA. Examples of such effects are described in Appendix B. Set 2 adjustments do 

not address operator actions added to the PRA model to address additional fire scenario concerns. 
Quantification 

5-6 

immediate response from the crew. In Set 2, the crew might have to attend and respond to the 

spurious activity in the affected train/division to make sure it does not affect their ability to reach 

safe shutdown (e.g., causing a diversion of all injection). However, the crew would likely detect 

the spurious activity quickly and not be confused by it. They would still have at least one 

train/division of safe shutdown equipment unaffected, and they would still be likely to conduct 

the safe shutdown actions as indicated by the procedures without significant delays. 

For the long term HFEs, the above conditions would essentially have occurred in the past and 

things will have stabilized. As with Set 1, it must be clear that the fire effects would no longer be 

dynamic and changing, that any equipment damage will be largely assessed and understood, and 

that environmental effects will be stabilized and not significantly affect the ability of the 

operators to perform the action. 

5.1.1.3 Screening Values Under Set 3 

These criteria address (1) new HFEs added to the fire PRA or (2) prior Internal Events PRA 

HFEs needing to be significantly altered or modified in Step 1 of this procedure because of fire 

conditions. In such cases, existing Internal Events PRA HEPs either do not exist, or are not 

appropriate as a basis for the fire PRA. 

Set 3 Criteria 

1. If the action being considered is either a MCR or local (i.e., ex-control room) manual 

action and it is to be performed within approximately 1 hour of the fire’s initiation, set 

the HEP to 1.0 for screening. The 1-hour limit is both a reasonable limit for early 

response actions that will most likely be (or need to be) completed, as well as a time 

beyond which most plants can have additional personnel and any technical support group 

available at the plant site. 

2. If the action is not necessary within the first hour, the fire can be assumed to be out and 

thus not continuing to cause delayed spurious activity and other late-scenario 

complicating disturbances, and that there is plenty of time available to diagnose and 

execute the action, set the HEP to 0.1 for screening or 10 times the internal events HEP. 

The analyst still needs to ensure that potential dependencies across HFEs in the models 

and the joint probabilities of multiple HFEs are accounted for per the ASME Standard 

[4]. That is, that the fire effects and the inclusion of the new actions in the model do not 

create significant new dependencies among the HFEs (new and old) in the model. If 

unaccounted-for dependencies are likely to exist, a 1.0 screening value should be used, or 

dependencies accounted for in some other way as part of the quantification. 

5.1.1.4 Screening Values Under Set 4 

This criterion addresses HFEs associated with the decision to abandon the MCR and all 

subsequent actions in reaching safe shutdown. Because of (1) the unique nature of the decision to 

abandon the MCR, (2) the wide variability on how and where plants implement safe shutdown 

when the MCR is abandoned, and (3) the low likelihood that such actions could be screened 

anyway, unless the applicable fire initiating frequencies are extremely low, a global screening 

value of 1.0 should be assigned for this entire set of actions. This acknowledges that more 
Quantification 

5-7 

detailed analysis will likely be needed for these types of scenarios, and thus screening is not 

appropriate for these cases. An initial possible alternative (similar to an approach initially 

presented in NUREG/CR-6850 [1]) that allows assignment of a single overall failure probability 

value (e.g.,0.1) to represent the failure of reaching safe shutdown using alternate means 

(including MCR abandonment) is described in section 5.1.1.6 below. This approach allows 

an initial conservative value to be assigned if certain criteria are met and this value may be 

adequate for some plants. 

Set 4 Criterion 

All HFEs involved in MCR abandonment and reaching safe shutdown from outside the MCR, 

including HFEs representing the decision to abandon the MCR, should be assigned screening 

values of 1.0. More detailed analysis is needed either before the screening runs 

of the fire model or afterward (see section 5.1.16 below for a possible initial step). 

5.1.2 Examples and Basis for Quantitative Screening Values 

It is acknowledged that the above set of screening values do not have a direct empirical 

basis. The values selected are based mainly on experience with the range of screening values 

traditionally used and accepted in HRA (e.g., in the HRAs performed for the NRC Individual 

Plant Examination Program); experience in quantifying HEPs for events in NPP HRAs; 

experience in applying a range of HRA methods and the values associated with those methods; 

and experience in performing HRA in fire PRAs. The screening approach intentionally applies 

values that may be conservative for some cases to avoid being overly optimistic. However, this is 

necessary to avoid being overly optimistic for potentially important and/or complex scenarios 

and associated HFEs. Table 5-1 summarizes the approach to screening using example values 

for the HEP from the internal events analysis and the assigned fire screening values. 
Quantification 

5-8 

Table 5-1 

Example HEP adjustments and values using fire zone screening criteria 

 1 2 3 4 

Criteria Original HEP 

Examples 

HEP 

considering 

Fire Effects 

X10 

HEP 

Considering 

Fire Effects = 

0.1 

HEP Value to 

Apply 

Set 1 (Existing Level 1 

HFEs) example HEP 

adjustments 

0.001 0.01 NA 0.01 

Short term example 0.3 [1]1 NA 1 

Long Term example 0.0001 0.001 [0.1]2 [0.001 or 

0.0001]3

Set 2 (Spurious 

modification to existing 

HFEs) example HEP 

adjustments 

0.001 0.01 0.1 0.1 

Short term example 0.3 1 [0.1]4 1 

Long term example 0.0001 0.001 0.1 0.001 

Set 3 (New or significantly 

modified HFEs) example 

HEP adjustments 

NA 1 0.1 

Use both HEPs 

in sensitivity 

analysis 

Short term example 0.3 1 0.1 1 

Long term example 0.0001 0.001 0.1 0.001 

Set 4 (MCR abandonment 

HFEs) example HEP 

adjustments 

NA 1 [1]5

 [1]6

Notes 

1 The value of an HEP never exceeds a probability of 1.0. 

2 For long term events the lower value is recommended - most fires are out by this time and event conditions become static. 

3 The original value can be applied for long term events if the fire is out and event conditions are static after the 1st hour. 

4 The HEP screening value should never be lower than the original HEP because fires add complexity to the event. 

5 Overall success of transfer to remote location is 0.1 in several IPEEs. (See section 5.1.3). 

6 Recovery HEPs are 1.0. Detailed analysis needed for HEPs below 1.0. 

5.1.3 Single Overall Failure Probability Approach for MCR Abandonment or 

Alternative Shutdown 

NUREG/CR-6850 [1] suggests that the use of a single overall failure probability value to 

represent the failure of reaching safe shutdown using alternate means can be used if the 

probability value is evaluated conservatively and a proper basis is provided. It notes that this 

approach was used in several IPEEE submittals and that in many cases, 0.1 was used as a point 

value estimate for the probability. This approach is not recommended by this guideline unless a 

detailed analysis and timeline is done that shows that more than adequate time is available to 
Quantification 

5-9 

conduct all of the actions required to abandon the MCR, set up the alternate shutdown means, 

and accomplish each of the actions required to reach safe shutdown. In addition, the time 

required for the plant conditions to reach a state where the crew would decide to abandon the 

MCR must also be considered. In other words, the time it would take for the MCR to become 

uninhabitable (see Section 11.5.2 of NUREG/CR-6850 [1]) or the time it would take to reach a 

state where the plant could no longer be completely controlled from the MCR due to fire effects 

NUREG/CR-6776 [5], would have to be factored in to the analysis (including likely crew 

hesitancy to abandon the MCR). Substantial extra time (i.e., a time margin of at least 100% for 

the set of actions required) should be available before a screening value such as 0.1 should be 

used and the basis for meeting the criteria discussed above should be carefully documented. 

It should be noted that from a CDF perspective, this approach will probably not be as preferable 

as using the scoping or detailed HRA strategies. Explicitly modeling HFEs for critical human 

actions associated with achieving safe shutdown using alternative means should usually lead 

to a lower CDF. As long as the actions are feasible (there is adequate time to perform all of 

the actions), there is a time margin available to account for unexpected fire effects, there are 

procedures available, the crews are trained on the procedures, and other PSFs do not overly limit 

their likelihood of success, then the combined HEPs for the relevant HFEs using these strategies 

should generally be significantly less than 0.1. 

5.2 Scoping Fire HRA Quantification 

The scoping fire HRA quantification approach allows assignment of HEPs to new HFEs 

identified specifically for the fire PRA (i.e., outside the Internal Events PRA) and to HFEs 

which are carried over from the internal events analysis that survive quantitative screening 

(i.e., they are important enough that a less conservative, more realistic HEP is needed).2

 

There are minimum criteria that must be satisfied for the scoping fire HRA approach to be used. 

If the criteria covered within this scoping procedure are not met, the analyst must use a more 

detailed HRA evaluation method. Section 5.2.1 presents these criteria. 

In addition to meeting the minimum criteria, the scoping fire HRA quantification approach 

requires that the actions associated with the HFE be demonstrated as being feasible within the 

time allotted. Section 5.2.2 describes how to perform a feasibility demonstration and its 

elements. In addition, Section 5.2.3 covers how to determine the time margin available 

and Section 5.2.4 discusses PSFs relevant in the scoping fire HRA approach. 

Once the minimum criteria have been met and the feasibility has been demonstrated, then 

analysts can use the steps for assigning HEPs to new or existing HFEs detailed in the flowcharts 

presented in Figures 5-2 through 5-6 and discussed in associated sections. A search scheme 

(Section 5.2.6 and Figure 5-2) is provided first to direct the analyst to the correct scoping 

quantification guidance for the HFE being considered. The flowcharts provide a means of 

obtaining HEPs (assumed to be mean values) for four categories of actions that are associated 

with the following HFEs: 

 

2

 The scoping fire HRA approach is used to quantify the probability of failure of the action or actions (which may 

include multiple subtasks) that are represented within a single HFE. 
Quantification 

5-10 

1. New and existing MCR actions (Section 5.2.7 and Figure 5-3), 

2. New and existing ex-control room actions (Section 5.2.8 and Figure 5-4), 

3. Actions associated with abandoning the MCR or using alternate shutdown means due to 

MCR habitability issues or due to difficulties in controlling the plant exclusively from the 

MCR because of the effects of the fire (Section 5.2.9 and Figure 5-5), and 

4. Cases where the fire may affect critical instrumentation, thereby creating the potential for 

errors of commission (EOCs) or errors of omission (EOOs) due to incorrect indications 

(Section 5.2.10 and Figure 5-6). The flowcharts for spurious indications will support 

addressing spurious instrument effects as described in ANS Fire PRA standard 

(HLR-ES-C1 and C2 [6]). 

Sections for each of the four categories of actions provide information and discussion on the 

factors that are expected to be important for this category of HFE and how to use the relevant 

flowchart. 

5.2.1 Determine Minimum Criteria 

In order to use the scoping approach to quantify the modeled HFEs, the feasibility of the action 

must be demonstrated (discussed in Section 5.2.2) and the following minimum criteria relative to 

several PSFs need to be met. It should be noted that meeting these criteria establishes only the 

minimum criteria and does not preclude additional consideration of these PSFs later on in 

performing the scoping analysis. 

1. Procedures – There should be plant procedures (e.g., fire-specific procedures, emergency 

operating procedures, alarm response procedures, abnormal operating procedures and/or 

normal operating procedures) covering each operator action being modeled. The procedures 

should support both diagnosis and execution of the action, unless the execution of the action 

can be demonstrated as skill-of-the craft. Skill-of-the-craft actions are those that one can 

assume trained staff would be able to readily perform without written procedures (e.g., 

simple tasks such as turning a switch or opening a manual valve as opposed to a series of 

sequential actions or set of actions that need to be coordinated). 

2. For HFEs modeled to recover EOOs or EOCs caused by spurious instrumentation, although 

procedures will usually support recovery of such actions, in some cases operators may be 

able to rely on the scenario context and additional cues (in conjunction with the existing 

procedures) to recover those errors. In these cases, specific procedural guidance directing the 

recovery per se may not always be available, but arguments can be made that the existing 

procedures, in conjunction with operator training and available cues will be adequate to 

support recovery of the errors. If analysts rely on such arguments, they should be well 

documented and confirmed by appropriate plant staff (e.g., operators and trainers). 

3. Training – Operators should have received training on the procedures being used and on the 

actions being performed. The training should establish familiarity with the procedures, the 

equipment needed to perform the desired actions, and how to successfully execute the action. 

The training should be performed per the plant’s normal training practices and, if 

appropriate, include special considerations given the desired actions will need to be carried 
Quantification 

5-11 

out during a fire (e.g., wearing SCBAs while performing the action). When subtasks must be 

coordinated among more than one person to complete the action, the training should also 

cover how to conduct the coordination and communication aspects of the action. 

4. Availability and Accessibility of Equipment – It should be shown that all equipment and 

tools needed to perform the modeled human actions during a fire will be readily available 

and accessible. The time needed to access this equipment during fire scenarios will be 

included in estimating response execution times (discussed further below). 

5.2.2 Demonstrate the Feasibility of the Operator Actions 

With the minimum criteria met, a key analysis to support the scoping fire HRA approach is the 

demonstration of the feasibility of the actions modeled in the HFE. All of the scoping flowcharts 

used to quantify HFEs included in the models assume that the actions have been demonstrated to 

be feasible. As discussed in Section 4, demonstrating feasibility involves showing that a given 

action or set of actions for a particular HFE can be diagnosed and performed within the time 

available. That is, an operator action is considered feasible if the time available exceeds the time 

required. The time available is typically derived from thermal-hydraulic studies and is defined as 

the time from the initiating event (fire induced reactor trip) until an undesired or irreversible 

plant damage state is reached, e.g., core damage. The time required for operator performance 

should consider three aspects: 

1. The time at which the cue occurs relative to the initiating event, 

2. The time it takes the operators to formulate a response (detect, diagnose, decide), and 

3. The time to execute the response including time required to travel to a local area, if 

necessary. 

To support the scoping quantification approach, it is important that the action times are estimated 

based on an actual demonstration of the action or set of actions that is as realistic as possible. 

That is, the actions (including diagnosis) should be walked through and timed while simulating 

the fire scenario and including the requirements of the action to the extent possible.3

 However, it 

is acknowledged that it will not always be possible to conduct all of the subtasks and simulate all 

of the conditions that might occur during a fire that could affect the time to diagnose and perform 

an action. Even for MCR actions, it will be difficult to simulate the effects of a fire (either inside 

or outside the MCR) and how they might affect the crews’ ability to respond to an accident 

scenario. Thus, some estimates about aspects of the time required given the expected conditions 

will have to be based on judgment. If the demands of the task and the time to complete the 

actions must be based on the judgments of plant personnel, then a process should be used to help 

ensure that the estimates are reasonable (e.g., get multiple independent judgments). As long as a 

 

3

 The PRA standard ASME/ANS RA-Sa – 2009 item HR-G5 discusses basing the “required time to complete actions 

on action time measurements in either walkthroughs or talkthroughs of the procedures or simulator observations” 

to meet Capability Categories II and III. Just prior to the issuance of this draft, a point was made by the PWR 

owner’s group regarding the extent of credit that can be taken for talkthroughs due to issues involved in scheduling 

walkthroughs or simulator exercises with operator crews. Since the scoping approach was developed based on the 

assumption that walkthroughs would be performed, a further analysis will need to be conducted by the Guidelines 

team to re-evaluate how the use of talkthroughs would impact the use of the scoping approach HEPs. This will be 

initiated concurrent with the public review and comment period. 
Quantification 

5-12 

reasonable effort is made in conducting a realistic demonstration and knowledgeable plant staff 

are used to provide estimates where needed, time margins (discussed below) will be used to 

provide a way to account for potential shortcomings in the ability to adequately simulate the 

actual plant conditions during the demonstration. 

Ideally, in order to get as realistic estimate of the time required to perform the actions as 

possible, several crews would be used in conducting the demonstrations. However, since this 

may not always be possible, at least one randomly selected, established crew should participate 

in the demonstration. Since data from one crew may not be representative of all crew response 

times, time margins are used to account for potential variability in crew response times in 

determining HEPs using the scoping flowcharts. The larger the time margin, the more likely the 

variability in crew performance will be enveloped and the lower the HEPs that can be assigned. 

Conservative HEPs are also assigned to help bound the uncertainties. 

In addition, while it is easiest to conceptually imagine each action being individually 

demonstrated for different fire scenarios, it is acknowledged that some actions and the fire 

scenario contexts may have characteristics that are very similar (e.g., the actions themselves 

are similar, timing related to when the actions have to be performed and how long it would 

take to implement the actions are similar, locations for the actions are not vastly different as to 

significantly affect travel time to the locations, similar environments exist for the locations 

for the actions). In such cases, with justification, a demonstration of an action for a given 

scenario could be argued to bound or otherwise represent other similar actions in similar 

circumstances. Hence, one demonstration may be sufficient to credit other similar actions under 

similar situations. Furthermore, if a demonstration of feasibility was completed at an earlier date 

(e.g., to meet criteria in NUREG-1852 [7]), and the conditions have not significantly changed, 

the feasibility of the actions do not need to be demonstrated again. 

How to Perform a Demonstration 

This section provides information on what should be considered and how to ensure that 

the demonstration is appropriate (it is based on related guidance in NUREG-1852 [7]). The 

first step in performing a demonstration is to ensure that the minimum criteria discussed above 

in section 5.2.1 have been met. After that, the main goal is to include in the demonstration 

all aspects that could influence the outcome of the actions, if it is reasonable to do so. Things 

to consider for inclusion are discussed below. 

Before proceeding, it should be noted that, to the extent reasonable, the entire fire-induced 

accident scenario should be simulated for the demonstration, including all the expected cues 

and MCR activities. More details on the nature of the simulation are given below. While it is 

desirable that any demonstration simulates the fire conditions to the extent reasonable, under all 

circumstances, the demonstration is to be done considering the ability to replicate expected fire 

conditions safely for personnel, and without jeopardizing the safe operation of the plant. All 

actions associated with detecting and diagnosing the presence of the fire and diagnosing the need 

for and executing the relevant actions should be timed during the demonstration. Obviously, this 

information will be important in determining whether there will be enough time available to 

perform the actions. 
Quantification 

5-13 

Environment – The environmental conditions expected to be present in the areas which operators 

will have to access to complete the actions, as well as in the locations of the actions, should be 

simulated to the extent reasonable (noting the safety considerations cited above). For example, 

the following conditions could be simulated in all relevant areas, including areas through which 

the operators may have to travel: 

• The lighting levels expected to be present during the actual fire to the extent feasible and 

safe. 

• If the environmental conditions are assumed to involve the use of SCBAs at any time in the 

scenario, then the donning and wearing of these during those periods. 

• If protective clothing will be needed at any time, then the donning and wearing of these 

during those periods. 

• If SCBAs may be needed, then any communications anticipated during those periods when 

the SCBAs are worn (personnel who use SCBAs must receive training and be qualified in 

their use). 

Equipment Functionality and Accessibility – Accessibility to the relevant systems and equipment 

is necessary to enable the personnel to perform the operator actions. To the extent possible, the 

personnel participating in the demonstration should carry out the actions (including accessing the 

equipment) if the actions can be done without affecting the safety of the plant (e.g., manually 

open a valve with the handwheel). As noted earlier, if the demands of the task and the time to 

complete the actions must be based on the judgments of plant personnel, then a process should 

be used to help ensure that the estimates are reasonable (e.g., get multiple independent 

judgments). A preferred approach is to obtain estimates of the time to execute specific actions 

when safety is not a concern (e.g., during shutdown or when the system is out of service for 

some reason). 

In addition, if the plant history indicates that certain equipment tends to have persistent types 

of problems (e.g., a tendency for valve hand wheels to be stiff), then those conditions should be 

assumed for the demonstration and not “pre-conditioned” solely for the demonstration. 

Available Indications and Main Control Room Response – In conducting the demonstration, 

the actual effects of the fire conditions should be simulated, to the extent possible, in the plant 

training simulator and the operators should diagnose the need for the relevant actions based on 

the expected pattern of indications (including cues expected to be affected by the fire). In 

addition, the presence of the cues needed to detect the fire should be simulated and the crew 

should have to respond accordingly. The MCR response to the scenario should be the same as 

during an actual fire. The MCR crew should enter the relevant procedures based on the expected 

indications and take the necessary steps to respond to the fire and reach hot shutdown. The 

parameters indicating the need for the operator actions in response to the fire (fire procedure 

responses) should also be simulated, and the crew should have to summon the staff necessary for 

the actions, retrieve the relevant procedures, provide the necessary guidance, and interact with 

the individuals as necessary while they complete the actions for the demonstration. In addition, 

the personnel executing the actions should have to check relevant indications of successful 

completion of the actions and verify completion. These indications should be accurately 

simulated to the extent possible. 
Quantification 

5-14 

All aspects of the scenario associated with diagnosis and the execution of the actions should be 

timed. This will provide information relevant to determining the time to diagnose the need for 

the actions and the time needed to implement the actions. If any aspects of the scenario cannot be 

simulated, their potential impact on the time should be estimated. 

Communications – The communications necessary to complete the operator actions should be 

part of the demonstration. This should include communications necessary from the detection of 

the fire through completion of the actions. Examples of conditions that should be included in 

the demonstration include the following: 

• If it cannot always be assumed that the personnel expected to perform the actions will be in 

the control room at the time they will be needed, then consideration for where the personnel 

might be with respect to being able to communicate with the control room should be included 

in the demonstration. If personnel might be in areas where someone would have to be sent to 

get them, then this activity should be simulated. 

• If personnel must be able to communicate with each other and with the control room, then 

those communications and the devices that will have to be used should be part of the 

demonstration. 

Portable Equipment – Any portable equipment that will be needed to conduct the actions during 

a real fire should also be accessed and used to the extent reasonable during the demonstration. 

Portable equipment includes unique or special tools, such as keys to open locked areas 

or manipulate locked controls, flashlights, ladders to reach high places, torque devices to turn 

valve handwheels, and electrical breaker rackout tools. Such equipment should be located where 

it would be expected to be located during a real fire. The equipment should not be gathered 

together and made easily accessible just for purposes of the demonstration (i.e., no “preconditioning”). 

Personnel Protection Equipment – Similar to the portable equipment noted above, any personnel 

protection equipment such as protective clothing, gloves, and SCBAs should be located, 

accessed, and donned as during an actual fire. 

Procedures and Training – Activities associated with the use of procedures should be addressed 

in the demonstration, including the following: 

• detection of the entry conditions for the procedures 

• retrieval of the procedures 

• the potential need for multiple copies 

• usability of the procedures under the expected condition (e.g., lighting levels, a place to put 

them during their execution if they must be closely followed). 

In addition, while the selection of a crew for the demonstration should be random, it should be 

ensured that there has been no pre-conditioning such as limiting the selection to only those crews 

most recently trained. 
Quantification 

5-15 

Staffing – Staff who will have duties associated with successful completion of the actions 

(including diagnosis and execution of the actions) should participate. Staffing issues such as the 

following should be considered in the demonstration: 

• If personnel will have to be summoned from outside the MCR, how long it will take them to 

get to the control room should be assessed as part of the demonstration considering the likely 

starting locations for the personnel based on where these persons are typically located. Plant 

staff should consider the potential for the personnel to be in remote locations from which it is 

difficult to egress and that the personnel may have to complete some actions before they can 

leave an area if this is the typical situation for some staff members. It would then be preferred 

that these considerations be included in the demonstration. 

• If the actions will involve multiple staff in certain sequences, then these activities, 

their coordination, and their associated communication aspects should be included. 

• If the MCR crew is likely to be directing and coordinating multiple teams involved 

in executing manual actions, these activities should be simulated. Furthermore, 

if the individuals in the MCR coordinating these activities will have other significant 

responsibilities, those responsibilities should also be simulated. 

Other Aspects Important to the Demonstration – There are several other important issues or 

aspects that plant staff should consider in conducting an appropriate demonstration: 

• If the fire or other factors could affect where personnel have to travel (e.g., what routes they 

have to take) and where they have to enter and exit various rooms, then this should be 

considered in the modeling for the demonstration and determining the travel time. 

• If the conditions that could be generated by the fire have the potential to vary significantly, 

this should be accounted for when deciding how to model the scenario(s) for purposes of the 

demonstration. 

• If smoke could significantly affect visibility, the action should generally not be credited. 

In general, plant staff should strive to make the demonstrations as realistic as possible and make 

conservative assumptions as necessary. If this is done and the above information is followed, 

then the resulting timing information obtained from demonstrations should provide a good basis 

for determining the feasibility of the actions. Once an action has been demonstrated to be 

feasible (i.e. it has been shown that the time required to perform the action is less than the time 

available), additional factors are evaluated in order to estimate the HEP for the action using the 

scoping flowcharts. These include estimating the available time margin for the action and 

addressing other key factors that could influence the likelihood of success under fire conditions. 

5.2.3 Calculation of Time Margin 

As discussed in section 4.3.2 and immediately above in section, 5.2.2, it is clear that in spite of 

plant staff’s best efforts, there may be conditions that are very difficult, if not impossible, to 

simulate. This is one of the reasons it is necessary to show that additional time is available 

beyond that required based on the demonstration (i.e., to provide a way to account for potential 

shortcomings in the ability to adequately simulate the actual plant conditions during the 

demonstration). That is, a tradeoff exists between the extent to which the demonstration is 

realistic, and the uncertainties to be addressed as part of justifying there is adequate time to 
Quantification 

5-16 

perform the action. For instance, more realistic demonstrations translate into less uncertainty 

with regard to justifying there is adequate time. Similarly, the more crews that can participate in 

the simulations, the less uncertainty associated with crew response times. 

One technique used to address the potential shortcomings in plants’ ability to realistically 

simulate plant conditions during fires and the potential variability in crew response times is to 

require particular time margins (the difference between the total available time and the time 

required, essentially the extra time available) to obtain certain HEPs. In addition, different time 

margins may be required if the presence of certain conditions (e.g., short vs. long time frame 

events or simple vs. complex actions) suggest the potential for greater sensitivities to the effects 

of the fire or greater variability in crew response times. Thus, a key factor in applying the 

scoping quantification approach is the time margin available for a particular action. 

Figure 5-1 presents a timeline illustrating the components involved in calculating time margin. 

tavail

tw

tc td tm Time Margin

Initiating

Event

to

Cue

received

Crew

diagnosis 

complete

Action

complete

Action no 

longer 

beneficial

Figure 5-1 

Timeline Illustrating total time available, time required, and the resulting time margin 

In this diagram, tavail is the total time available from the initiating event until the action is no 

longer beneficial. The time window, or tw, is the amount of time available to perform the action 

including diagnosis and execution. The other variables are as follows: to is the time of the 

initiating event, tc is the time from the initiating event until the cue(s) is received, td is the time 

to diagnose the problem and formulate the response, and tm is the manipulation time, or time 

required to execute the action. 

Time margin can be calculated as: 

( )

( ) TM

t tt

t t

w dm

d m

= − +

+

*100%

Time margins should be calculated for all actions or sets of actions (underlying a given HFE) 

being modeled and quantified using the scoping approach, and in some cases at least, the explicit 

development of a timeline or a timeline analysis can be useful. Recall that some actions 
Quantification 

5-17 

underlying an HFE may require multiple subtasks to be performed in parallel or they may 

involve a mix of both serial and parallel actions, and some tasks may overlap. In these cases, 

determination of the time margin may not always be as straightforward as illustrated above, since 

the time for the tasks taken together, including where they overlap, needs to be considered in 

determining the time margin available, For example, an action may involve several subtasks that 

if performed serially would take 30 minutes to complete. However, if two people are involved, 

and two of the subtasks can be performed in parallel, then the execution time may only require 

20 minutes (or at least less than 30 minutes). In this case, less extra time would be needed to 

obtain a 100% time margin. Although the application is somewhat different, Appendix A of 

NUREG-1852 [7] provides guidelines and examples for using timelines to demonstrate sufficient 

time to perform a range of combinations of serial and parallel subtasks.

5.2.4 Assess Key Conditions and PSFs 

In applying the scoping flowcharts, in addition to addressing the timing issues discussed above, 

there are decisions that must be made regarding particular conditions and PSFs that could affect 

performance of the actions. Some of the decisions are required in all of the flowcharts and others 

are specific to particular flowcharts. General guidance for making these decisions is provided in 

this section, but in some cases there are details associated with particular conditions and PSFs 

that are specific to particular flowcharts. These details are discussed in the sections providing 

guidance for the specific flowcharts. 

It should be noted that some of the decisions that need to be made will not be made exclusively 

by the HRA analysts. For example, explicit criteria were developed in NUREG/CR-6850 [1] for 

determining when smoke, toxic gases, and heat levels would be high enough to require MCR 

abandonment (i.e., due to habitability issues). Similarly, questions are asked in all of the 

flowcharts regarding smoke levels for areas in which operators will be performing actions in or 

through which areas they will have to pass on the way to perform actions. This information is 

used to determine whether SCBAs will be needed or whether there may be dense enough smoke 

to cause visibility problems and prevent the action from being taken. These determinations will 

be part of the fire modeling tasks (Task 8, Scoping Fire Modeling, and Task 11, Detailed Fire 

Modeling) and the information will have to be supplied to the HRA analysts based (probably) 

on conservative estimates of the likely smoke, toxic gases, and heat levels in those areas and 

whether they could be high enough to require SCBAs or severely affect visibility. HRA analysts 

should participate in this process to help ensure that relatively conservative estimates of the fire 

effects are made. 

Assessments important to scoping flowcharts 

Do the procedures match the scenario? – An important question asked in several of the 

flowcharts-, concerns the diagnosis of a given action. In particular, it is asked if the cues being 

received (that are directly relevant to the action being modeled) match the procedural guidance. 

In other words, is it expected that the cues and their timing will be correct and consistent with the 

procedures? Another way to ask the question is whether the procedures should be relatively easy 

to follow given the pattern of indications. If the cues and their timing are expected to be correct 

given the accident conditions and are consistent with the procedures, then the diagnosis for the 

need for the action can be considered relatively simple and straightforward. However, if the cues 
Quantification 

5-18 

for an action are not expected to match the procedures well, it should be assumed that the 

diagnosis will be difficult and the HEP for the action should either be set to 1.0 or a detailed 

analysis performed. This question is not asked in the scoping flowcharts when it is known that 

one or more key indicator(s) specific to an action will likely be affected by fire (i.e., in the cases 

where the fire could lead to effects on specific instrumentation and EOOs or EOCs are possible 

[SPI flowchart, Figure 5-6]). In these cases, the procedures (related to determining the needed 

action) are not likely to match the pattern of cues. 

Response execution complexity – The complexity of the actions involved in executing the 

response after the diagnosis is made is addressed in all of the specific scoping flowcharts. 

Execution complexity is only quantified at two levels, either high or low. In deciding on the level 

of execution complexity, a number of aspects are evaluated (note that the guidelines below apply 

to both MCR and local actions): 

• Single step actions – If an action requiring only a single step (e.g., simply starting a pump as 

opposed to aligning for feed and bleed) can be performed by a single crew member and the 

action is supported by clear procedures (trained personnel should be able to follow them 

straightforwardly) or the action can be considered skill-of-the-craft,, then generally low 

complexity can be assumed. 

• Multiple step actions – If the HFE requires multiple steps to be completed for success, then 

complexity may increase. If the execution of the multiple steps can be performed by single 

crew members working independently of what other personnel (if any) involved in the action 

are doing and the execution of the steps is supported by either clear procedures (and trained 

personnel should be able to follow them straightforwardly) or the actions can be considered 

skill-of-the-craft, then low complexity can generally be assumed. Yet, if there are any 

concerns that procedures needed to support the actions may be ambiguous, that any of the 

steps may be difficult to complete correctly, or that difficult judgments may be required 

(even if only for some personnel), then high complexity should be assumed. 

• Multiple crew members performing coordinated steps – If multiple crew members are 

required to complete an action and the steps require coordination and communication 

between team members to successfully complete the action, then high complexity should be 

assumed. This will be true when the steps must be performed in a particular sequence and 

when the steps involve a combination of sequential and parallel steps. Generally, high 

complexity should be assumed for any actions requiring coordination and communication 

among crew members. Exceptions would be well trained, EOP-based actions in the MCR 

that are part of the expected response to an initiating event, but even these actions should be 

examined carefully for potential ambiguity and difficulty. 

• Multiple location steps – During the execution of an action, multiple locations may need to 

be visited either by different members of the staff or by one staff member. The necessity of 

visiting multiple locations (e.g., different electrical cabinets or different rooms, not just 

different panels in the MCR) increases the complexity, particularly if coordination and 

communication between the staff members is required. Generally, if multiple locations 

must be visited to complete the action, then high complexity should be assumed. 
Quantification 

5-19 

• Multiple functions – Multiple functions may need to be performed in the execution of an 

action (e.g., both electrical alignment and mechanical) that will increase the execution 

complexity of the action. When multiple functions must be performed, the complexity should 

be assumed to be high. 

• Accessibility of location or tools – Factors such as excessive heat, absence of adequate 

lighting, or the presence of the fire brigade in the area may make it more difficult for the 

operator to reach the location of the actions or to access tools necessary in performing the 

action. To the extent the action would become more difficult to complete because of such 

conditions, high complexity should be assumed. 

As discussed in Section 4 (qualitative analysis), other factors can contribute to complexity. For 

example, time pressure or stress can make even simple actions seem more difficult. Thus, while 

the guidance above can be used in most cases to determine whether complexity is high or low, if 

additional information is known about the conditions under which an action will be performed 

(based on a qualitative analysis) and those conditions may add to the complexity, then they 

should be considered in assessing complexity level, generally leading to low complexity actions 

being assessed as high. 

It should be noted that several of the factors that could add to complexity are already included in 

the scoping flowcharts. In addition, the demonstration of feasibility will show that the action is 

not so complex that it cannot be performed in the time available and the time margin is intended 

to account for other factors that may not have been explicitly included in the demonstration or 

covered in the scoping flowcharts. 

Timing of cues for the action relative to expected fire suppression time – An assumption of the 

scoping flowcharts is that actions that have to be performed during an ongoing fire (whether the 

action is inside or outside the MCR) will be more susceptible to both the direct and indirect 

effects of the fire. Thus, two of the flowcharts (in MCR actions and Ex-control room actions, 

Figures 5-3 and 5-4) explicitly ask whether the cue or cues for an action will occur while the 

fire is ongoing. Based on the information in NUREG/CR-6850 [1], for application of the scoping 

flowcharts, it is assumed that most fires (exceptions noted below) will be extinguished or 

contained within 604

 minutes of the start of the fire. Thus, upon entering the two flowcharts 

noted above, the time from the beginning of the fire to the presentation of the cue for an action 

needs to be determined. For the purposes of the scoping analysis, the start of the fire is 

considered to be concurrent with the initiating event. Although this is rarely the case in actuality, 

estimating the times to be such allows a conservative estimate as to the effect of the fire on the 

diagnosis and execution of the action. 

Depending on when the cues occur, analysts will take different paths through the flowcharts. If 

the cue is expected to be received more than 60 minutes after the fire has started or the plant has 

tripped, it can usually be assumed that the fire has been suppressed or contained. An important 

exception to this rule are more challenging fires such as fires of turbine generators, outdoor 

transformers, high energy arching faults, and flammable gas fires. For modeling of actions 

during these events, the analyst should always assume the cue occurs before the fire has been 

suppressed, regardless of when the cues occur relative to the start of the fire. Similarly, for cues 

 

4

 Some have argued that fire suppression time (e.g., non-suppression time in NUREG/CR-6850[7]) should be 

assumed to be 70-75 minutes rather than 60 minutes in order to include time to detect the fire. Pending NRC and 

industry resolution of FAQ-50 (which addresses this issue) fire suppression time is assumed to be 60 minutes from 

the start of the fire. 
Quantification 

5-20 

received within the first 60 minutes of the start of the fire, the fire is considered to not yet be 

under control. HFEs quantified in these situations will be assigned a slightly higher HEP to 

account for direct and indirect effects of an ongoing fire. 

Action time window – The time window for an action is defined as the amount of time from the 

occurrence of the cues for action until the action is no longer beneficial. For actions that have a 

short time window, additional consideration is given to the time margin and determining 

feasibility. For the scoping flowcharts, it is assumed that short time window actions (<= 30 

minutes, approximately) will be more susceptible to diversions and distractions caused by the 

occurrence of the fire in the plant. Thus, short time window actions are given different treatment 

in the scoping flow charts than longer time frame actions (> than 30 minutes, approximately). 

This different treatment is applied whether the cue for the action occurs during on-going fire 

suppression efforts or afterward. If the action time window is equal to or less than 30 minutes, 

the analyst is directed one way in the flowchart and another direction if the action time window 

is greater than 30 minutes, resulting in the need for somewhat greater time margins for short time 

frame actions. As noted above, the reasoning is that actions with shorter time windows will be 

more sensitive to even minor diversions and distractions associated with the occurrence of the 

fire and will, therefore, need somewhat larger time margins to absorb these effects and still 

complete the action. 

Levels of smoke and other hazardous elements in action areas – All of the specific scoping 

flowcharts address the levels of smoke and other hazardous elements (hereafter referred to as 

smoke levels) present in the areas of the actions or in areas personnel must travel through to 

reach those areas. This information is used to make yes/no decisions with respect to whether 

SCBAs will be needed or whether there may be dense enough smoke to cause visibility 

problems and prevent the action from being accomplished. As discussed briefly above, these 

determinations will be part of the fire modeling tasks (Task 8, Scoping Fire Modeling, and Task 

11, Detailed Fire Modeling) and the information will have to be supplied to the HRA analysts 

based (probably) on conservative estimates of the likely smoke levels in those areas and whether 

they could be high enough to require SCBAs or severely affect visibility. Plant criteria for 

donning SCBAs may also be taken in to account. Note that smoke removal systems that can be 

assumed to be functioning can be taken in to account in estimating smoke levels. If analysts are 

not sure about the potential effects of likely smoke conditions on the ability of crews to respond, 

conservative assessments can be made. For example, if some smoke effects are likely given the 

location of the fire, but it is not known whether SCBAs will be needed, it would be conservative 

to assume that they would be needed. 

Branches for quantification in the scoping flowcharts are based on the following levels of smoke 

within the action areas: 

• No smoke or hazardous elements are present. 

• Smoke or hazardous elements are present, but at a low enough level as to not require the use 

of any breathing apparatus (e.g., SCBA). 

• Smoke or hazardous elements are at high enough level such that breathing gear (e.g., SCBA) 

is required. 

• Smoke levels are high enough to affect visibility and prevent execution of the action. (Note 

that actions directly in the vicinity of the fire cannot be credited). 
Quantification 

5-21 

The guidelines for addressing smoke effects that could lead to MCR abandonment due to 

habitability issues are addressed separately in the section on the search scheme for selecting the 

appropriate flowcharts for the action (Section 5.2.6.1) and in the section on MCR abandonment 

flowchart (Section 5.2.9). 

Accessibility – In the scoping flowcharts for ex-control room actions (Figure 5-4) and MCR 

abandonment or alternative shutdown actions (Figure 5-5), analysts need to determine whether 

the action location will be accessible when the fire is still assumed to be ongoing. This question 

is concerned with certain areas being blocked or otherwise inaccessible due to the presence of 

the fire and on-going attempts to suppress the fire. Analysts must determine whether the action 

needs to be performed in the vicinity of the fire or if the presence of the fire and actions 

associated with suppressing it could prevent operators from being able to reach the action. 

If either of these is true, the action cannot be credited. 

5.2.5 Basis for Scoping Fire HRA Quantification HEPs 

The scoping quantification guidance offered here is intended to be a simplified and conservative 

HRA approach. The guidance is simplified in the sense that recommended HEP values are 

associated with a minimal number of influencing factors (e.g., performance shaping factors 

or plant conditions), resulting in less effort being required of the HRA analyst. Similarly, the 

guidance is conservative in the sense that recommended HEPs are expected to be higher in value 

than that which could be derived if a more detailed and time-consuming HRA analysis was 

performed. 

Like the screening HEPs assigned in Section 5.1, it is acknowledged that the HEP values used in 

the scoping analysis do not have a direct empirical basis. The values selected are based mainly 

on experience with the range of values traditionally used and accepted in HRA (e.g., in the 

HRAs performed for the NRC Individual Plant Examination Program and the NRC Individual 

Plant Examination of External Events Program), experience in quantifying HEPs for events in 

NPP HRAs, experience in applying a range of HRA methods and the values associated with 

those methods, and experience in performing HRA in fire PRAs. The values were selected with 

the goal of being somewhat conservative, while crediting the demonstrations of feasibility, 

reasonable time margins, and other PSFs. A discussion on the basis of the HEPs quantified 

through the use of the scoping fire HRA method as well as the further justification behind the 

requirements of demonstrating feasibility and a certain time margin are given in Appendix H. 

Within a flowchart, the HEPs are based on the following characteristics: 

• Timing of the cue for an action relative to the start of the fire 

• Length of action time window 

• Level of diagnosis complexity 

• Level of execution complexity 

• Level of smoke at area of action or in areas to be passed through 

• Accessibility of action site 
Quantification 

5-22 

5.2.6 Guidance for Using the Search Scheme (Figure 5-2) 

In the identification and definition section (Section 3), HFEs were identified and categorized as: 

1) internal events operator actions (existing operator actions from internal events PRA model), 

2) fire response operator actions (operator actions explicitly called out in the fire procedures) and 

3) undesired operator actions (due to spurious instrumentation). This particular classification 

helps to understand how the HFE was identified, but for the purposes of scoping fire HRA 

quantification, the HFE needs to first be further classified. 

In the scoping fire HRA quantification approach, HFEs are treated based on conditions within 

the MCR, the location of the actions associated with the HFE (MCR or ex-control room), and the 

condition of relevant instrumentation. The search scheme (Figure 5-2) uses pertinent questions in 

determining which action is being quantified and directing the analyst to one of the following 

flowcharts: in MCR action, ex-CR or local action, MCR abandonment or alternative shutdown, 

or recovery of error due to spurious instrumentation. 

In some instances, the HFE may be quantified within the Search Scheme. For instance, the first 

question in the Search Scheme flowchart (Figure 5-2, Decision 1 [D1]) asks if the feasibility of 

the action being quantified has been demonstrated. Specifically, this demonstration addresses 

whether there is time to diagnose and perform the action under the expected conditions (e.g., as 

an in control room action or as an action taken after MCR abandonment). If the action has not 

been demonstrated as being feasible per the guidance in Section 5.2.2, an HEP of 1.0 can be 

assigned immediately. 

Two other cases exist in the search scheme for which the action is assumed to fail and an HEP of 

1.0 may be assigned. First, prior to entering the decision diamond determining whether the action 

is an in-MCR or ex-control room action (D6), the question is asked (D5) whether the procedures 

match the scenario (i.e., do the cues received by the control room staff to support diagnosis 

match the procedural guidance? See Section 5.2.4 for guidance on this decision). If the cues do 

not match the procedures (D5), it is assumed that diagnosis may be difficult and the action is 

assumed to fail (i.e., HEP = 1.0). In the second case, for the execution of ex-CR actions, it is 

assumed that either procedures are present for directing the steps of the action, or the execution 

is skill-of-the-craft (D7). Again, if these procedures or skills do not exist, the action is assumed 

to fail (HEP = 1.0). 

Notice that the HEPs assigned in the Search Scheme flowchart are identified with labels (e.g., 

SS1). These labels are provided for all HEPs assigned through the use of the flowcharts. The 

labels are provided primarily to help later in tracing how a particular HEP was decided upon 

in the analysis. The specific acronym associated with each HEP is determined based on the 

flowchart used. Specifically, the labels represent which flowchart was used is assignment of 

the HEP: 

• SS = Search Scheme 

• INCR = In MCR 

• EXCR = Ex-MCR 

• CRAB = MCR Abandonment (this label also is used for HEPs quantified during alternative 

shutdown actions) 

• SPI = Spurious Instrumentation 
Quantification 

5-23 

Figure 5-2 

Scoping HRA analysis search scheme 
Quantification 

5-24 

Although there are some HFEs that may be quantified with the use of the Search Scheme 

alone, most HFEs will be directed to the other flowcharts for quantification. A series of 

questions is asked in the Search Scheme to determine which of the flowcharts is appropriate 

for quantification. After determining that the action being modeled is feasible (D1), the next 

decision (D2) determines whether the analyst will be directed to the flowchart quantifying MCR 

abandonment or alternative shutdown (Figure 5-5; CRAB) based on the control room being 

uninhabitable or operators having difficulty controlling the plant (i.e., unable to trip the reactor, 

provide decay heat removal (DHR), or operate systems necessary to mitigate the initiating event) 

from within the MCR. 

Discussion and guidance on interpretation of the questions asked in the Search Scheme 

(Figure 5-2) and the transitions to other flowcharts are presented in subsections immediately 

below. Following these discussions, separate sections provide guidance on using the other 

flowcharts, and the resulting scoping fire HFE quantification: 

• Section 5.2.7 – HFEs comprised of actions that take place in the main control room (INCR) 

• Section 5.2.8 – HFEs comprised of actions that are diagnosed in the MCR but take place 

outside the main control room (EXCR) 

• Section 5.2.9 – HFEs associated with actions related to abandoning the main control room or 

using alternate means for shutdown (CRAB) 

• Section 5.2.10 – HFEs resulting from responses to spurious indications (SPI) 

5.2.6.1 MCR Abandonment/Alternative Shutdown (D2 and D3) 

There are two critical factors that influence operators in deciding whether to abandon the main 

control room: 

1. Is the main control room habitable? (Figure 5-2, Decision 2 [D2]) 

2. Can the plant be controlled from the main control room? (Figure 5-2, Decision 3 [D3]) 

For fires that either directly cause an uninhabitable environment in the MCR or otherwise make 

plant monitoring and control extremely difficult from the MCR (unable to control key safe 

shutdown equipment), the crew may need to leave the MCR and achieve safe shutdown wholly 

or in part from ex-CR locations. Section 11.5.2 of NUREG/CR-6850 [1] provides criteria for 

determining when the MCR would need to be abandoned due to habitability issues (D2). To 

establish timing of this event, it is suggested that at least one of the following criteria from 

NUREG/CR-6850 [1] be satisfied: 

• The heat flux at 6' above the floor exceeds 1 kW/m2

 (relative short exposure). This can be 

considered as the minimum heat flux for pain to skin. Approximating radiation from the 

smoke layer as q,' = σ –Tsl 4, a smoke layer of around 95°C (200°F) could generate such heat 

flux. 

• The smoke layer descends below 6' from the floor, and optical density of the smoke is less 

than 3.0 m-1. With such optical density, a light-reflecting object would not be seen if it is 

more than 0.4 m away. A light-emitting object will not be seen if it is more than 1 m away. 

• A fire inside the main control board damaging internal targets 2.13 m (7') apart. 
Quantification 

5-25 

If any of the criteria are met, then subsequent actions will need to be quantified as MCR 

abandonment actions and analysts will follow the Search Scheme flowchart to the MCR 

Abandonment/Alternative shutdown (CRAB) flowchart for each action (Figure 5-5). This 

would include an action to switch control to a remote shutdown panel (RSP) if appropriate. 

For cases where the MCR is habitable (D2) but plant monitoring or control becomes difficult due 

to critical instrumentation and controls for critical equipment being affected by the fire, the crew 

has a decision to make (i.e., “D3” in Figure 5-2). The two possibilities are: 

• To abandon the MCR, or 

• They may decide to stay in the MCR (i.e., direct the crew response from the MCR to the 

extent possible), but collect information or take actions outside the MCR as necessary to 

reach safe shutdown (referred to as alternate shutdown, which may be standard practice for 

some plants). 

However, when habitability is not an issue, it is reasonable to expect that the MCR would not 

be completely abandoned.5

 So, the HRA analysis should focus on how the crew would need to 

respond to the scenario given the specific fire effects. In particular, for a given fire and its 

expected effects on equipment, analysts will need to determine whether the crews would need to 

switch control to a RSP or whether it would be possible to control the plant using an alternate 

shutdown approach based on the fire response procedures. This determination should be based 

on interviews with plant operators and trainers and an examination of the plant fire procedures. 

It is assumed that the crew would try to take whatever actions are necessary to reach safe 

shutdown, whether they involve using a RSP, taking actions outside the MCR as necessary based 

on the fire procedures, or even some combination of both, depending on plant practice and 

available equipment. 

If the effects of the fire could be significant enough that switching to a RSP (if available) would 

probably be required (e.g., large fire in the cable spreading room), analysts will need to estimate 

when switchover is likely to occur relative to the start of the initiating event. At that point, the 

analyst can quantify the HFE including the switchover action and all subsequent actions using 

the CRAB flowchart. The timing for the actions will have to take into account the time to 

perform the switchover and the timing of the critical cues at the RSP. If it is determined that the 

operating crew could reach safe shutdown using ex-control actions, as necessary, without 

switching over to the RSP (use an alternative shutdown approach), then the HFE for these 

actions would also be quantified using the CRAB flowchart, but the time to accomplish the 

switchover would not be included, nor would the impact of the switchover on what the operators 

would do. 

A scenario involving MCR abandonment or the need to use alternative shutdown introduces a 

level of complexity that can not be adequately addressed by quantifying these actions as usual 

local (i.e., ex-CR) actions. It is likely that many factors may introduce more serious challenges to 

operator success under these conditions, e.g.: 

 

5

 Analysts may want to determine if there are exceptions to this expectation or if there are plant-specific reasons why 

such an assumption would not be valid. 
Quantification 

5-26 

• Less available instrumentation and controls, 

• The need for organized involvement of many operators in various locations in the plant, 

• The need for communications among personnel at distributed locations, 

• Less familiar procedures, 

• Less frequent training, 

• More time needed to reach the necessary locations, 

• More time needed to perform activities that in other situations could easily be done in the 

MCR. 

In general, if it is known that habitability and control of the plant from the MCR would not be 

affected to the extent that MCR abandonment or alternative shutdown means would be required, 

then analysts will progress in the search scheme to the next question asking about indicators for 

the specific actions being affected by the fire (D4). 

5.2.6.2 Actions Caused by Spurious Instruments (D4) 

Per the fire PRA standard [6], analysts will need to determine whether there are particular actions 

(either EOCs or EOOs ) that could be caused by the effects of single spurious instruments or by 

combinations of spurious instruments if the contribution to risk would be high (see ANS Fire 

Standard HLR-ES-C1 and C2 for more detail [6]). 

Therefore, if the primary cues or instruments used for the action currently being quantified are 

modeled as being affected by the fire, the analyst is directed (D4) to the flowchart quantifying 

the recovery of EOCs or EOOs committed due to spurious instrumentation (Figure 5-6; SPI). 

If the cues or instruments are fed by “protected” cables, they can generally be assumed to not be 

affected by the fire. Some instruments and cues associated with safety systems, and in particular, 

those associated with achieving and maintaining safe shutdown conditions are considered 

“protected” in accordance with 10 CFR Part 50 Appendix R, or as unaffected in a NFPA-805 

project. 

For the purpose of scoping quantification, an instrument is considered “protected” if: 

1. It’s cables are not routed through the fire area in question, or 

2. If the cables are wrapped with a fire barrier which is sufficient for the postulated HFE and 

the given fire scenario. 

However, even if the equipment and cables are protected per Appendix R criteria, it will need to 

be verified that the likely nature and location of the fire in a given area would not damage the 

cables (e.g., due to direct flame impingement, explosive fires). If the reliability and validity of 

the cues cannot be ascertained, spurious indications are possible within the MCR, and the analyst 

should treat the cues as potential spurious indications and use the SPI flowchart (Figure 5-6) for 

recovery of errors caused by these spurious indicators. 
Quantification 

5-27 

5.2.6.3 In MCR and Ex-Control Room Actions 

If the action being quantified deals neither with MCR abandonment or alternative shutdown, 

nor with the response to spurious instruments caused by the fire, the final two choices for 

quantification are based on the location of the action. 

The PRA models will include both existing HFEs from the internal events models and new HFEs 

based on the presence of the fire, the initiating event, and the plant-specific fire procedures. 

These HFEs will represent both MCR actions and ex-control room actions, with the diagnosis for 

the action taking place in the MCR. They will include the traditional human actions modeled in 

PRA, but may also include fire response actions such as the “fire manual actions” implemented 

in procedures to meet deterministic requirements (e.g., see NUREG-1852 [7]). 

A preliminary question (Figure 5-2, Decision 5 [D5]) in the quantification of these in MCR 

and ex-control room actions asks if the procedures match the scenario (see section 5.2.4 for 

guidance). The intention of this question is to assess the difficulty in diagnosing the problem. If 

the specific cues for the action do not match the procedures, it is assumed that diagnosis will be 

difficult and that the action will fail (HEP = 1.0). If the execution of the action occurs within the 

MCR, the analyst is directed (D6) to Figure 5-3, INCR flowchart. Otherwise, quantification is 

based on the action being executed locally (i.e., outside the MCR). 

Prior to transferring to the flowchart for quantifying ex-CR actions (Figure 5-4, EXCR), one 

final question regarding the guidance given directing the action is asked (D7). The question 

addresses: 

1. Are procedures available to support executing the action outside the MCR? 

2. Can the action (and related subtasks) be assumed to be skill-of-the-craft, thus not requiring 

step by step procedures? 

Skill-of-the-craft actions are those that one can assume trained staff would to be able to readily 

perform without written procedures (e.g., simple tasks such as turning a switch or opening a 

manual valve as opposed to a series of sequential actions or set of actions that need to be 

coordinated). If neither of these options is true, the action is assumed to fail (HEP = 1.0). If one 

of the options can be assumed, the analyst is directed to Figure 5-4 to quantify the ex-CR action. 
Quantification 

5-28 

D19.

Is there smoke or 

other hazardous 

elements in the 

MCR?

D20.

Is SCBA 

required?

Yes

D12.

Is the action time 

window greater than 

30 minutes?

D9.

Is the action time 

window greater than 

30 minutes?

D8.

Has 60 minutes 

elapsed since start 

of the fire?

Yes

No

Yes

(> 30 mins)

D16.

Is there smoke or 

other hazardous 

elements in the 

MCR?

D17.

Is SCBA 

required?

Yes

No

No

No

No

Yes

Yes

D11.

Is the 

execution 

complexity 

high?

Yes

D10.

Is the 

execution 

complexity 

high?

Yes

HEP 

Lookup Table 

A

No No

D18.

Is the 

execution 

complexity 

high?

No

D13.

Is the 

execution 

complexity 

high?

Yes

No

No

HEP 

Lookup Table 

M

No 

(< or = 30 mins)

HEP 

Lookup Table 

J

HEP 

Lookup Table 

L

HEP 

Lookup Table 

K

HEP 

Lookup Table 

C

HEP 

Lookup Table 

B

HEP 

Lookup Table 

D

HEP 

Lookup Table 

H

HEP 

Lookup Table 

I

Yes

(> 30 mins)

No

(< or = 30 mins)

INCR

D21.

Is there smoke or 

other hazardous 

elements in the 

MCR?

Yes

Yes

HEP 

Lookup Table 

N

D22.

Is SCBA 

required?

No

HEP 

Lookup Table 

O

Yes

D14.

Is there smoke or 

other hazardous 

elements in the 

MCR?

D15.

Is SCBA 

required?

Yes

HEP 

Lookup Table 

E

No

HEP 

Lookup Table 

F

No

HEP 

Lookup Table 

G

Yes

HEP = 1.0

(INCR1)

Figure 5-3 

INCR - scoping HRA analysis for in MCR actions 
Quantification 

5-29 

Figure 5-4 

EXCR - scoping HRA analysis for EX-CR actions 
Quantification 

5-30 

CRAB

D43.

Is one of the following 

conditions met: 1) there are 

procedures for executing the 

action or 2) it is skill-of-thecraft?

HEP = 1.0

(CRAB3) Yes No HEP = 1.0(CRAB4) No

Yes

D41.

Are all the 

necessary cues for 

required actions 

protected?

HEP = 1.0

(CRAB1) No

D44.

Are both 

conditions met: 1) the 

area is accessible and 2) 

there is no fire in the 

vicinity of the 

action? 

Yes

D50.

Is SCBA 

required?

Yes

No

No

Yes

D48.

Is the 

execution 

complexity 

high?

No

No

HEP 

Lookup Table 

AH

HEP 

Lookup Table 

AE

HEP = 1.0

(CRAB7)

HEP 

Lookup Table 

AF

No

(< or = 30 mins)

Yes

Yes

HEP = 1.0

(CRAB8)

D49.

Is there smoke or 

other hazardous 

elements in the 

vicinity?

D52.

Is there smoke or 

other hazardous 

elements in the 

vicinity?

D42.

For the given 

action, do the 

procedures match 

the scenario?

HEP = 1.0

(CRAB2) No

Yes

D51.

Dense smoke (or 

other effect) 

largely impairing 

visibility?

HEP 

Lookup Table 

AG

No Yes

Yes

(> 30 mins)

D46.

Is the 

execution 

complexity 

high?

D47.

Is there smoke or 

other hazardous 

elements in the 

vicinity?

No

HEP = 1.0

(CRAB5)

Yes

HEP 

Lookup Table 

AD

HEP = 1.0

(CRAB6)

No Yes

D45.

Is the action time 

window greater than 

30 minutes?

Figure 5-5 

CRAB - scoping HRA analysis for MCR abandonment or alternative shutdown actions 
Quantification 

5-31 

5.2.7 Guidance for Using the INCR Flowchart for in MCR Actions (Figure 5-3) 

The flowchart presented in Figure 5-3 (INCR) walks through the steps of assigning scoping 

HEPs to HFEs within the MCR. This flowchart is intended to be used for: 

• New HFEs identified outside the Internal Events PRA, or 

• Existing HFEs from the internal events analysis that survive quantitative screening. 

The flowchart covers both diagnosis and execution of the action in the MCR. Following the 

guidance provided in Section 5.2.1, analysts will generally need the following information to 

apply the flowchart: 

• The general expectations for when the cue for an action would occur relative to the start of 

the fire (e.g., within 60 minutes of the start of the fire or after). If the cue for an action occurs 

within 60 minutes of the start of the fire as opposed to after 60 minutes, different paths are 

taken through the flowchart (D8). Note that for more challenging fires such as fires of turbine 

generators, outdoor transformers, high energy arching faults, and flammable gas fires, the 

analyst should always assume the cue occurs before the fire has been suppressed, regardless 

of when the cue occurs relative to the start of the fire. 

• A determination of the available time window from when the cue for the action occurs until 

the response is no longer beneficial. If the time window for an action is approximately <= 30 

minutes as opposed to > 30 minutes, different paths are taken through the flowchart (D9 and 

D12). 

• The level of execution complexity expected; high or low indicates different paths (D10, D11, 

D13, and D18). 

• The expected level of smoke and other hazardous element effects in the MCR (D14, D16, 

D19, and D21). The presence of smoke leads to a different path. Note that smoke removal 

systems that can be assumed to be functioning can be taken into account in estimating smoke 

levels in the MCR. 

• A determination of whether SCBAs will be needed (D15, D17, D20, and D22). 

• An estimate of the time margin for use in the look up tables. 

If analysts are not sure about the potential effects of likely smoke conditions on the ability of 

crews to respond, conservative assessments can be made. For example, if some smoke effects are 

likely given the location of the fire, but it is not known whether SCBAs will be needed, it would 

be conservative to assume that they would be needed. 

Based on the answers to each of the questions within the flowchart, the action is either assumed 

to fail (i.e., HEP = 1.0), or the analyst will be directed to find the HEP value in the lookup tables. 

The lookup tables for the INCR flowchart are located in Table 5-2. Within the lookup table, the 

HEP assigned for each action is based on the time margin available. 
Quantification 

5-32 

Table 5-2 

In MCR actions HEP lookup tables 

HEP Lookup Table Time Margin HEP HEP Label 

> 200% 0.005 INCR2 

100 – 199% 0.025 INCR3 

50 – 99% 0.125 INCR4 A 

< 50% 1.0 INCR5 

> 200% 0.025 INCR6 

100 – 199% 0.125 INCR7 

50 – 99% 0.625 INCR8 B 

< 50% 1.0 INCR9 

> 100% 0.001 INCR10 

C 50 – 99% 0.005 INCR11 

< 50% 1.0 INCR12 

> 200% 0.005 INCR13 

100 – 199% 0.025 INCR14 

50 – 99% 0.125 INCR15 D 

< 50% 1.0 INCR16 

> 200% 0.05 INCR17 

E 100 – 199% 0.25 INCR18 

< 100% 1.0 INCR19 

> 200% 0.1 INCR20 

F 100 – 199% 0.5 INCR21 

< 100% 1.0 INCR22 

> 200% 0.2 INCR23 G < 200% 1.0 INCR24 

> 200% 0.25 INCR25 H < 200% 1.0 INCR26 

> 200% 0.5 INCR27 I < 200% 1.0 INCR28 

> 100% 0.01 INCR29 

J 50 – 99% 0.05 INCR30 

< 50% 1.0 INCR31 

> 100% 0.02 INCR32 

K 50 – 99% 0.1 INCR33 

< 50% 1.0 INCR34 

> 100% 0.04 INCR35 

L 50 – 99% 0.2 INCR36 

< 50% 1.0 INCR37 

> 200% 0.05 INCR38 

M 100 – 199% 0.25 INCR39 

< 100% 1.0 INCR40 

> 200% 0.1 INCR41 

N 100 – 199% 0.5 INCR42 

< 100% 1.0 INCR43 

O > 200% 0.2 INCR44 

< 200% 1.0 INCR45 
Quantification 

5-33 

The termination point of the branch of the flowchart will direct the analyst to the correct row 

in the HEP lookup table column within Table 5-2. The second column lists the time margins 

available for selection by the analyst based on the calculation of the time margin for the action. 

The next column provides the HEP value. Finally, the last column gives the label to use for 

identifying how the HEP was assigned. 

5.2.8 Guidance for Using the EXCR Flowchart for ex-CR Actions (Figure 5-4) 

The flowchart presented in Figure 5-4 (EXCR) walks through the steps of assigning scoping 

HEPs to HFEs that are diagnosed within the MCR, but that must be executed locally (i.e., outside 

the MCR). As with the MCR action flowchart (Figure 5-3, INCR), this flowchart is intended to 

be used for: 

• New HFEs identified outside the Internal Events PRA, or 

• Existing HFEs from the internal events analysis that survive quantitative screening. 

Similarly, the flowchart covers both diagnosis and execution of the action, with the main 

difference being that the actions are executed outside the MCR. 

Although the HEPs may be different due to the actions having to be performed outside the MCR, 

there are only a few differences between the questions asked in the MCR action flowchart 

(Figure 5-3) and those asked for actions that must be executed outside the MCR (Figure 5-4). 

The additional pieces of information that will be needed include (following the guidance in 

5.2.7): 

• A determination of whether the area for the ex-control room action is accessible (D27). If no, 

credit for the action cannot be taken. 

• A determination of whether the action must take place in the direct vicinity of the fire (D27). 

If yes, credit for the action cannot be taken. 

• An estimate of the effects of expected level of smoke and other hazardous elements in the 

areas where the action must take place (D30, D31, D35, and D38). 

Other than answering these questions, analysts will step through the flowcharts for ex-control 

actions (Figure 5-4; EXCR) just as was done for MCR actions in Flowchart Figure 5.3 (INCR). 

Lookup tables for the ex-CR flowchart are located in Table 5-3 (see guidance in section 5.2.7 for 

use of the look up tables). 
Quantification 

5-34 

Table 5-3 

Ex-CR actions HEP lookup tables 

HEP Lookup Table Time Margin HEP HEP Label 

> 200% 0.01 EXCR6 

100 – 199% 0.05 EXCR7 

50 – 99% 0.25 EXCR8 P 

< 50% 1.0 EXCR9 

> 200% 0.05 EXCR10 

100 – 199% 0.25 EXCR11 

50 – 99% 0.5 EXCR12 Q 

< 50% 1.0 EXCR13 

> 100% 0.002 EXCR14 

R 50 – 99% 0.01 EXCR15 

< 50% 1.0 EXCR16 

> 200% 0.01 EXCR17 

100 – 199% 0.05 EXCR18 

50 – 99% 0.25 EXCR19 S 

< 50% 1.0 EXCR20 

> 200% 0.5 EXCR21 T 

< 200% 1.0 EXCR22 

> 200% 0.1 EXCR23 

U 100 – 199% 0.5 EXCR24 

< 100% 1.0 EXCR25 

> 200% 0.2 EXCR26 V < 200% 1.0 EXCR287 

> 200% 0.4 EXCR28 W 

< 200% 1.0 EXCR29 

> 100% 0.02 EXCR30 

X 50 – 99% 0.1 EXCR31 

< 50% 1.0 EXCR32 

> 100% 0.04 EXCR33 

Y 50 – 99% 0.2 EXCR34 

< 50% 1.0 EXCR35 

> 100% 0.08 EXCR36 

Z 50 – 99% 0.4 EXCR37 

< 50% 1.0 EXCR38 

> 200% 0.1 EXCR39 

AA 100 – 199% 0.5 EXCR40 

< 100% 1.0 EXCR41 

> 200% 0.2 EXCR42 AB 

< 200% 1.0 EXCR43 

> 200% 0.4 EXCR44 AC 

< 200% 1.0 EXCR45 
Quantification 

5-35 

5.2.9 Guidance for Using the CRAB Flowchart for Main Control Room 

Abandonment and/or Shutdown Using Alternate Means Actions (Figure 5-5) 

The flowchart presented in Figure 5-5 (CRAB) provides analysts with a means of obtaining 

HEPs for the actions associated with MCR abandonment and/or use of alternate shutdown 

means. Certain information will be needed to conduct the scoping quantitative analysis, 

including (following the guidance in section following the guidance in section 5.2.6.1). 

• The identification of the necessary cues for the diagnosis of the needed actions and whether 

the instruments supporting the necessary cues have been verified to be protected from the fire 

effects (D41). 

• The availability of procedures to support the diagnosis of the action, including a 

determination of whether the procedures related to diagnosing the action will generally match 

the expected pattern of cues for a given scenario (D42). 

• The availability of procedures to support the execution of the action or documentation that 

the action can be considered is skill-of-the-craft (D43). 

• A determination of whether the area for the ex-control room action is accessible (D44). If no, 

credit for the action cannot be taken. 

• A determination of whether the action must take place in the direct vicinity of the fire (D44)? 

If yes, credit for the action cannot be taken. 

• A determination of the available time window from when the cue for the action occurs until 

the response is no longer beneficial. If the time window for an action is approximately <= 30 

minutes as opposed to > 30 minutes, different paths are taken through the flowchart (D45). 

• The level of execution complexity expected; high or low indicates different paths (D46 and 

D48). 

• An estimate of the effects of expected level of smoke and other hazardous elements in the 

areas where the action must take place (D47 and D49 - D52), for example, will SCBAs need 

to be worn? 

With this information, analysts will be able to step through the decision flowchart for 

abandoning the MCR or using alternate shutdown and, in most cases, obtain HEPs useable 

for MCR abandonment HFEs in the fire PRA. 

Upon entering this flowchart, the first questions ask if the necessary cues for the action have 

been verified protected from the effects of the fire (D41) and whether the scenario matches the 

procedures (D42). If the answer to either is “no”, the action is assumed to fail (HEP = 1.0). If the 

answer to both is “yes”, then it is asked whether there are either: 

1. Procedures available to support executing the action outside the MCR, or 

2. The action (and related subtasks) can be assumed to be skill-of-the-craft, thus not requiring 

step by step procedures (D43). 
Quantification 

5-36 

If neither of these options is true, the action is assumed to fail (HEP = 1.0). If one of the options 

can be assumed, the analyst continues in the flowchart and addresses the area in which the 

action(s) will be taken as well as the path to the target location (D44). If neither the area nor the 

path to the area are accessible, the action is assumed to fail (HEP = 1.0). If the area and path are 

accessible, quantification continues similar to those steps taken in ex-CR and in MCR actions in 

which the action time window is measured, the execution complexity assessed, and the need for 

SCBA is determined. 

The lookup tables for the MCR abandonment or use of alternative shutdown flowchart are 

located in Table 5-4. In determining the time margin to use in the quantification of the actions, 

the analyst must take into account timing issues important to MCR abandonment or alternative 

shutdown conditions (e.g., time required to perform a switchover to a RSP or additional time to 

perform formerly in-MCR actions outside the MCR). 

Table 5-4 

MCR abandonment or alternative shutdown actions HEP lookup tables 

HEP Lookup Table Time Margin HEP HEP Label 

> 200% 0.5 CRAB9 

AD 

< 200% 1.0 CRAB10 

> 100% 0.1 CRAB11 

AE 50 – 99% 0.5 CRAB12 

< 50% 1.0 CRAB13 

> 100% 0.2 CRAB14 

AF 

< 100% 1.0 CRAB15 

> 100% 0.4 CRAB16 

AG 

< 100% 1.0 CRAB17 

> 200% 0.5 CRAB18 

AH 

< 200% 1.0 CRAB19 

Of particular importance is consideration of the time required for the conditions to reach a state 

where the crew would need to abandon the MCR. In other words, the time it would take for the 

MCR to become uninhabitable (see criteria from Section 11.5.2 of NUREG/CR-6850 [1]) or the 

time it would take to reach a state where the plant could no longer be controlled (or completely 

controlled) from the MCR due to fire effects (see NUREG/CR-6776 [5] for information relevant 

to determining such timing). These times will have to be factored in to the analysis. These times 

may also affect assumptions about which operator actions would be performed in the control 

room prior to abandonment or taking alternative actions and which automatic system actuations 

would have occurred. In general, it can be assumed that there would be adequate time for most 

“immediate emergency operator actions” to be accomplished before the crew has to abandon the 

MCR or begin to take shutdown related actions outside the MCR. 
Quantification 

5-37 

Even if the crews do not fully abandon the control room, but use alternative shutdown means 

(e.g., atypically perform some actions locally), additional timing issues must be considered. 

An estimate of the time required before the fire could significantly affect plant control from the 

MCR (see NUREG/CR-6776 [5]) can be used as the estimate of when the crew would need to 

switch plant control to alternate means. This time may be inaccurate in that some crews may 

anticipate the need to switch to alternative shutdown or abandon the MCR and do it earlier and 

others may be reluctant and stay longer. However, which assumption is made will have to be 

based on the plant-specific analysis and consideration of PSFs (see Section 4). In quantifying 

human actions that will need to occur after the decision to use alternate shutdown has been made, 

the time required to set up or switchover to a RSP or use alternate shutdown means will have to 

be taken in to account. This time would need to be subtracted from the time available to perform 

the remaining actions.6

Two other issues also arise. If there is reason to believe that the crews would abandon early, 

then the potential difficulties associated with performing the remaining actions outside the MCR 

would have to be taken in to account in their quantification. Similarly, if there is reason to 

believe the crews would abandon sometime after the point at which control would be lost or the 

MCR would be assumed to be uninhabitable, then (as noted above) this time would have to be 

subtracted from the available time. Furthermore, credit could not be taken for completing any 

critical actions in the MCR after the time estimated for when control relevant to those actions 

could be lost. 

5.2.10 Guidance for Using the SPI Flowchart for EOC or EOO Due to Spurious 

Instrumentation (Figure 5-6) 

The flowchart presented in Figure 5-6 (SPI) addresses the assignment of HEPs for the failure 

to recover an EOC or EOO committed due to response to spurious instrumentation (due to fire 

effects). Upon entry into the flowchart, it is assumed that the EOC or EOO has been committed 

(a HFE has been modeled to address the potential error) and the flowchart then assesses the 

probability that this error would remain uncorrected (i.e., operator recovery of the EOO or 

EOC fails). 

In order to quantify the recovery of EOCs or EOOs due to spurious instrumentation with the 

scoping fire HRA approach (i.e., go beyond the 1.0 HEP value set with the screening approach), 

the HRA analyst must know the cable routing for the spurious instrumentation in question. 

If the instrumentation (e.g., RPV level, SG level) is required for a fire manual action, then the 

cable routing may be known prior to fire PRA analysis. In many cases, the fire procedures 

specifically tell the operator which trains of instrumentation (identified as protected or available 

by the fire protection program) are available given the location of the fire. 

 

6

 Note that in practice, precise estimates of when the crews would decide to abandon the MCR or begin to use 

alternate shutdown are not believed to be critical for the scoping analysis. Analysts are encouraged to perform 

plant-specific analyses and strive to make reasonable estimates of the timing of events based on the guidance in 

this document, but trying to precisely anticipate when operating crews will decide to abandon the MCR etc. in 

these conditions may not always be realistic. It is assumed that operating crews will respond to the conditions they 

are facing and take necessary steps to reach safe shutdown. The use of time margins and the general conservatism 

of the scoping approach are assumed to adequately account for potential impreciseness in estimating the related 

timing. 
Quantification 

5-38 

However, there are HFEs required for fire PRA which are not required for the deterministic safe 

shut down analysis (either Appendix R or NFPA-805). For example, the operator action for 

switching over to recirculation; in this case, the cable tracing for RWST level indicators will 

need to be obtained in order to credit this action. If the cables for RWST level indication are 

routed through the fire area in question, then EOOs and EOCs due to spurious indicators need to 

be considered. If the cables are not routed through this room, then EOOs and EOCs do not need 

to be considered. If the instrumentation is not required for a deterministic safe shutdown action 

then it can be assumed that it is not protected by a fire barrier wrap. 

Some instruments and cues associated with safety systems, in particular, those associated with 

achieving and maintaining safe shutdown conditions are considered “protected” in accordance 

with 10 CFR Part 50 Appendix R or NFPA-805. However, even if the equipment and cables are 

protected per the deterministic safe shutdown analysis criteria, it will need to be verified that the 

likely nature and location of the fire in a given area would not damage the cables (e.g., due to 

direct flame impingement, explosive fires). If a cue can be verified to be protected such that a 

spurious indicator would not result, there is no need to model the EOC or EOO. 

Furthermore, some plants offer a list of equipment and indications that, based on the specific fire 

location(s), can be regarded as "suspect." For the purposes of this scoping fire HRA guidance, if 

a plant has such a list that is to be used in fire scenarios, then it can be assumed that the operating 

crew is "suspicious" of a listed spurious indication (or a spurious equipment actuation) if it 

appears during the appropriate fire scenario. Therefore, the analyst does not need to model the 

response to spurious indicators for those situations in which the instrument in question is listed 

as being suspect due to the location of the fire. If, however, the HRA analyst feels that due to 

other circumstance that might cause the operator to ignore this warning and might, therefore, 

commit the error anyway (e.g., time pressure, real or inferred, keeping the operator from 

verifying the “suspect” instrument), the analyst may still model the action as if an EOC or 

EOO has occurred. 
5-39 

Figure 5-6 SPI - scoping HRA analysis for EOC or EOO due to spurious instrumentation 
Quantification 

5-40 

Following the assumption that the operator would commit an EOC or an EOO due to a spurious 

indicator, Figure 5-6 quantifies the probability of recovering this error. The initial question asked 

upon entry into Figure 5-6 inquires if there is information available to help the operators 

recognize the need to recover the error (D53). Recovery of the error may be through: 

• Reversal of the action or the use of an alternative system, for the committal of an EOC, or 

• Performance of the necessary action, if an EOO had been committed. 

The signs directing the operator to the need to recover may be through procedural guidance or 

through subsequent (especially, different) cues or the contextual information informing the 

operator that an error has been made (e.g., if operators have turned off a needed pump to protect 

it due to a spurious alarm, it is reasonable to expect that they would recognize the need to replace 

the function given the context). If procedural guidance is not available, the contextual 

information or subsequent cues must be of a great enough strength (compelling) to enlighten the 

operator that the situation must be remedied (e.g., a compelling alarm). Especially if the operator 

was following procedural guidance when responding to the spurious indicator, it will be his or 

her predilection to believe the action was necessary and to not question further. Therefore, the 

cues (either existing diverse cues or subsequent cues) must raise a suspicion in the operator to 

more carefully consider the situation and turn to recovery actions. If the guidance or cues do not 

exist such that the operator would be made aware of the need to remedy the situation, either by 

recognizing that an error has been made or recognizing the need for the function or action, the 

recovery action is assumed to fail (i.e., HEP = 1.0). 

After it is decided that recognition for recovery is present, the means for recovery should be 

evaluated. Although the operator may recognize that the error needs to be corrected or that 

the function needs to be started, restored or recovered, it may not be possible. Therefore, the 

availability and feasibility of the recovery action should be ensured before progressing further 

(D54). 

Given the recovery action can be done, the next decision point is the location of the action (D55). 

If the action is performed within the MCR, the analyst is pointed one direction in the flowchart, 

and is pointed the other direction if it is a local action. At this point, the quantification proceeds 

similarly to what was done in the quantification of in MCR actions (Figure 5-3) and ex-CR 

actions (Figure 5-4). For in MCR actions, a series of questions is asked to determine the action 

time window, level of execution complexity, the level of smoke, heat, or other toxins, and the 

need to wear breathing gear (e.g., SCBA). For more discussion on how each of these is 

considered refer to section 5.2.4. 

For ex-CR actions, the first issue is to ensure that the area in which the action takes place as well 

as the travel path to the area are accessible (D65). If this is not the case, the action is assumed to 

fail (HEP = 1.0). Assuming the area and travel path are accessible, the analyst must work 

through a series of question similar to those asked for in MCR actions. Specifically, the analyst 

needs to determine the length of time in the action window, the level of execution complexity, 

the level of smoke, heat, or other toxin at the site of the action, and the need to wear breathing 

apparatus (e.g., SCBA). 
Quantification 

5-41 

Depending on the response to each of the questions posed in the flowchart, the action will either 

be assigned an HEP of 1.0 immediately, or the analyst will be directed to an HEP lookup table. 

The lookup tables for the SPI Flowchart are located in Table 5-5. Once in the HEP lookup table, 

the analyst is directed to the appropriate HEP based on the time margin associated with the 

action. 

Table 5-5 

EOC or EOO due to spurious instrumentation HEP lookup tables 

HEP Lookup Table Time Margin HEP HEP Label 

> 200% 0.25 SPI11 AI < 200% 1.0 SPI12 

> 200% 0.5 SPI13 AJ < 200% 1.0 SPI14 

> 100% 0.05 SPI15 

AK 50 – 99% 0.25 SPI16 

< 50% 1.0 SPI17 

> 100% 0.1 SPI18 

AL 50 – 99% 0.5 SPI19 

< 50% 1.0 SPI20 

> 100% 0.2 SPI21 AM < 100% 1.0 SPI22 

> 200% 0.25 SPI23 AN < 200% 1.0 SPI24 

> 200% 0.5 SPI25 AO < 200% 1.0 SPI26 

> 100% 0.1 SPI27 

AP 50 – 99% 0.5 SPI28 

< 50% 1.0 SPI29 

> 100% 0.2 SPI30 AQ < 100% 1.0 SPI31 

> 100% 0.4 SPI32 AR < 100% 1.0 SPI33 

> 200% 0.5 SPI34 AS < 200% 1.0 SPI35 

> 200% 0.5 SPI36 AT < 200% 1.0 SPI37 

5.3 Detailed HRA Quantification 

As discussed above, it is expected that some actions will not be able to meet some of the criteria 

in the scoping fire HRA approach for any of a number of reasons (and result in an HEP of 1.0). 

Furthermore, the HEPs developed using this approach may be fairly conservative compared to 

that which could be developed using one of the two detailed HRA approaches described in this 

report. 

For those cases in which the scoping method cannot be used, or a more detailed and possibly less 

conservative analysis is desired, analysts have the option of performing a detailed analysis using 

either: 

• The EPRI HRA approach [2] presented in Appendix C of this report, or 

• The ATHEANA HRA method (NUREG-1880) [3] presented in Appendix D. 
Quantification 

5-42 

With appropriate consideration of the fire context as described in Section 4 of this report 

(Qualitative Analysis) and specific consideration of PSFs as determined by the methods, the 

two detailed HRA methodologies presented can be used to address fire-specific issues and PSF 

impacts. 

Additional guidance on method selection (given the fire context) is desirable but not available at 

this time. At present time the method selected for detailed quantification will be based on 

considerations such as plant-specific scenario information, fire context/impact, and general 

suitability (for non-fire conditions). NUREG/CR-1842 [8] provides general insights on the 

strengths and weaknesses of HRA methods for non-fire conditions. 

5.4 Special Cases where Little or No Credit should be Allowed 

In Section 12.5.5.3 of NUREG/CR-6850 [1], several cases were discussed where it was 

recommended that little or no credit be taken for human actions. These cases were identified 

prior to the efforts described in this document to develop more detailed HRA quantification 

processes. Although the conditions addressed in these special cases should still be carefully 

analyzed, a detailed HRA analysis may identify situations where it could be appropriate to take 

some credit for such actions. The discussions of PSFs presented in this report generally address 

the issues associated with these cases, but since they were explicitly called out in NUREG/CR6850 [1], they are revisited here to avoid confusion. Each of the special cases from NUREG/CR6850 [1] is presented below, followed in italics by relevant caveats. 

• Tasks needing significant activity and/or communication among individuals while wearing 

SCBAs. It is believed that communication under such conditions is very difficult, and until 

proven otherwise, where the levels of smoke, heat, or toxic gases are high enough to 

necessitate the use of SCBAs, the likelihood of success is assumed to be extremely low. 

Additionally, performing numerous and strenuous actions wearing SCBAs should also be 

given little credit for success and at least account for delays in carrying out the actions given 

the likely visibility and other similar difficulties. 

Caveat: It is the case that some SCBAs include devices that would allow for 

communication among personnel. In addition, if adequate time is available, personnel 

could communicate outside the area where the SCBAs are required and then return to the 

relevant areas to perform the important actions. Where such situations exist, a careful 

analysis may be able to justify crediting such actions. Performing numerous and strenuous 

actions while wearing SCBAs should still be credited very rarely and only when a thorough 

analysis is performed and justification is provided. For any of the above situations, a 

realistic demonstration that the actions can be performed under similar conditions would 

provide good justification. 
Quantification 

5-43 

• The fire could cause significant numbers of spurious equipment activations (and/or stops) 

and affect the reliability of multiple instruments. Actions that are based on such instruments 

and equipment should be assumed to fail, unless alternate sources of reliable information can 

be documented and a basis for using the alternate sources can be strongly supported. The 

additional time, complexity, availability of procedures, and other relevant PSFs contributing 

to identifying and using the alternate sources of information should be considered in 

determining the likelihood of success. 

Caveat: This caution still generally applies, but the issue and treatment of spurious effects 

are treated in detail in other sections of this report and that guidance should be followed. 

• Actions to be performed in fire areas or actions needing operators or other personnel to travel 

through fire areas should not be credited. Where alternate routes are possible, the demands 

associated with identifying such routes and any extra time associated with using the alternate 

routes should be factored into the analysis. 

Caveat: None 

• Actions needing the use of equipment that could have been damaged such that even manual 

manipulation may be very difficult or unlikely to succeed (e.g., a hot short on a control cable 

has caused a valve to close and drive beyond its seat, possibly making it impossible to open, 

even manually) should not be credited. 

Caveat: None 

• Actions to be performed without the basic needs of procedure direction, training, special 

tools (if necessary), or sufficient time should not be credited. 

Caveat: None 

5.5 References 

1. EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities. September 2005. 

NUREG/CR-6850/EPRI 1011989. 

2. Software Users Manual, “The Human Reliability Calculator Version 4.0, EPRI, Palo Alto, 

CA, and Scientech , Tukwila, WA. Product ID. 1015358”, January 2008. 

3. NUREG-1880, “ATHEANA User’s Guide”, June 2007. 

4. ASME RA-S-2000, “Standard for PRA for Nuclear Power Plant Applications”, Rev 14A, 

May 11, 2001 supplemented by ASME RA-Sa-2003, “Addenda to Standard For Probabilistic 

Risk Assessment For Nuclear Power Plant Applications”, December 5, 2003, supplemented 

by ASME RA-Sb-2005, “Addenda to Standard For Probabilistic Risk Assessment For 

Nuclear Power Plant Applications”, December 2005, all by American Society of Mechanical 

Engineers. 

5. NUREG/CR-6776, “Cable Insulation Resistance Measurements Made During Cable 

Fire Tests”, June 2002. 
Quantification 

5-44 

6. BSR/ANS 58.23 “FPRA Methodology Standard”, December 2006 (Note). 

Note: These Fire HRA Guidelines were originally written to the December 2006 draft 

version of the Fire PRA Methodology standard which ultimately became ANSI/ANS-58. 23-

2007 in November 2007. Some sections also cite ASME PRA-S-2000, “Standard for PRA 

for Nuclear Power Plant Applications”, and its addenda ASME RA-Sa-2003 and ASME RASb-2005, as they relate to internal events PRA issues that apply to Fire PRA/HRA. It was 

decided to issue this version of the Fire HRA Guidelines for public review and comment 

rather than delay it further to resolve any inconsistencies between the draft and final versions 

of the ANS standard, or to review and incorporate information from the recently published 

ASME/ANS RA-S-2008, “Level 1 and Large Early Release Frequency (LERF) PRA 

Standard”, which applies to at-power internal events, internal fire events, and external events 

for operating reactors. The necessary reviews and revisions to reflect the latest standards will 

be addressed prior to issuing the final Fire HRA Guidelines. 

7. NUREG-1852, “Demonstrating the Feasibility and Reliability of Operator Manual Actions in 

Response to Fire”, October 2007. 

8. NUREG 1842, “Evaluation of Human Reliability Analysis Methods Against Good 

Practices”, August 2006. 
6-1 

6

RECOVERY 

6.1 Introduction 

New recovery actions are needed for development and evaluation of realistic fire PRA models 

at different stages of development (e.g., 7b and/or Task 11 of NUREG/CR-6850 [1]). For fire 

HRA, recovery actions are modeled in the PRA the same way as in the internal events HRA. The 

ASME PRA standard [3] permits the modeling of recovery actions that have cues, procedures, 

and are feasible. The main difference for a fire HRA is to consider the impact of the fire on the 

ability to perform recovery actions associated with specific fire scenarios. 

The objective of this section is to provide guidance on how recovery actions can be modeled 

in the post-initiator fire HRA and provide requirements that should be met before applying 

recovery actions with an HEP less than 1.0. 

There are two types of recovery actions of concern for fire HRAs that are discussed in this 

section. These are: 

• Type 1 – Recovery from a human error, which is treated in the evaluation of the basic HEP 

Typical recovery activities that are considered in the HEP include peer checking, unexpected 

instrument responses in response to an action, and new alarms. These apply in both the 

internal event and fire HFE evaluations. 

• Type 2 – Recovery of initially unavailable functions, systems, or components needed to 

achieve successful decay heat removal and limit power input from the core, which are treated 

by developing a new HEP and evaluating dependencies with other HFEs in the sequence. 

This is consistent with the standard PRA concept of recovering cutsets, and those cutsets may 

contain either equipment or human elements. Recovery in this sense means that a new human 

action is added to the sequence to mitigate the problem. 

Another recovery action (Type 3) that is considered in the PRA involves modeling the fire 

brigade and their actions to extinguish the fire. According to NUREG/CR-6850 [1], this type 

of recovery action is treated in the fire modeling task via statistical models derived from fire 

suppression event data. Because the impact is on the fire itself, it is not addressed as an HRA 

modeling issue. Instead a fire scenario with suppression considered is defined to include its 

impact on the electrical instruments, controls and power cables to define the input conditions 

for the HRA models that impact the Core Damage Frequency PRA model. 

The approach for recovery in Screening is to assume that recoveries of Type 1 are included in the 

HEP assessment and if Type 2 assessments are needed, they should be performed within the 

rules of the Scoping analysis or evaluated as part of a detailed assessment. 
Recovery 

6-2 

The recovery approach for Scoping implicitly addresses Type 1 recovery in the HEP assignment 

as outlined by the scoping trees and Type 2 with new defined actions that are allowed by 

requirements for the scoping trees. 

The scoping approach does not address complex recoveries associated with MCR evacuation, 

dealing with spurious multiple actuations, spurious multiple instrument cues, or remove and 

restore power on buses and circuits. These recoveries require a detailed analysis. 

6.2 Identify and Define 

After the initial fire PRA model quantification, recovery actions may be identified to restore or 

reconfigure a function, system or component initially unavailable in that scenario to reduce its 

likelihood by the probability of a successful recovery. The need for recovery actions can follow 

from PRA model iterations with a screening, scoping or part of a detailed analysis. The 

identification of the recovery actions not only includes the definition, but also includes a 

preliminary feasibility assessment consistent with that discussed in Section 3. 

The need for the recovery is determined by the dominance of the sequence or cutset and the 

feasibility is determined by the nature of the recovery action postulated. The analyst must first 

determine which sequences or cutsets should be considered for inclusion of recovery actions. 

The selection of the number of contributors is a balance between the contribution of the specific 

sequence to core damage frequencies and the analytical effort needed to identify and quantify the 

recovery action. For fire PRA, to ensure all potential recoveries are modeled, in addition to 

cutset review, there should also be review of the procedures and talk-throughs with operators or 

training personnel to include potential recovery actions that have not been previously identified. 

In terms of feasibility, Type 1 recovery activities that are considered in the HEP itself include 

an evaluation of the likelihood and efficacy of peer checking of other operator actions, and 

response vs. complacency regarding new alarms. Feasible Type 2 recovery actions require a cue 

(instruments or procedure), a procedure for actions, and sufficient time, tools and staff to carry 

out the recovery action. It is assumed that repair of equipment is not allowed in recovery actions, 

but realignments, manual starts and breaker operations are allowed. These Type 2 recoveries can 

be modeled in fault trees, event trees, or as cutset events. 

6.2.1 Recovery Action Requirements 

The identification of a recovery action must meet specific requirements. From NUREG-1792 [2] 

the following requirements need to be considered when incorporating a recovery action into the 

PRA model: 

• whether the cues will be clear and provided in time to indicate the need for a recovery 

action(s), and the failure that needs to be recovered 

• the recovery is not a repair action (e.g., the replacement of a motor on a valve so that it can 

be operated) 

• whether sufficient time is available for the recovery action(s) to be diagnosed and 

implemented to avoid the undesired outcome 
Recovery 

6-3 

• whether sufficient crew resources exist to perform the recovery (recoveries) 

• whether there is procedure guidance to perform the recovery (recoveries) 

• whether the crew has trained on the recovery action(s) including the quality and frequency 

of the training 

• whether the equipment needed to perform the recovery (recoveries) is accessible and in a 

non-threatening environment (e.g., extreme radiation or smoke) 

• whether the equipment needed to perform the recovery (recoveries) is available in the 

context of other failures and the initiator for the sequence/cut set 

6.2.2 Limits on use of Recovery Actions 

In accordance with ASME standard requirement HR-H2 [3] recovery actions should only 

be modeled as a frequency reduction for a fire scenario if: 

• A procedure is available and operator training has included the action as part of crew’s 

training, or justification for the omission for one or both is provided. 

• “Cues” (e.g., alarms) that alert the operator to the recovery action provided procedure, 

training, or skill of the craft exists. 

• Attention is given to the relevant performance shaping factors provided in HR-G3. 

• There is sufficient manpower to perform the action. 

Additionally, NUREG/CR-6580 [1] states that the following actions should not be recognized 

in the fire PRA. 

• Recovery actions that require significant activity and or communication among individuals 

while wearing SCBAs. It is believed that communication under such conditions is very 

difficult, and until proven otherwise, where the levels of smoke, heat, or toxic gases are high 

enough to necessitate the use of SCBAs, the likelihood of success is assumed to be extremely 

low. Additionally, performing numerous and strenuous actions wearing SCBAs should also 

be given little credit for success and at least account for delays in carrying out the actions 

given the likely visibility and other similar difficulties. 

• Recovery actions that would require the operators or other personnel to travel through fire 

areas should not be credited. Where alternate routes are possible, the demands associated 

with identifying such routes and any extra time associated with using the alternate routes 

should be factored into the analysis. 

• For internal events HRA recoveries of systems or components previously assumed failed are 

typically not credited. Similarly, for fire PRA recovery actions that involve restoring systems 

or equipment damaged by the fire should not be credited. 

• Recovery actions that are not proceduralized or for which there is insufficient time should not 

be credited. 

NUREG-1852 [4] states that recoveries should only be recognized for scenarios in which there 

is a time margin available for the action to account for potential unexpected fire effects. 
Recovery 

6-4 

6.2.3 Recovery Action Feasibility Factors 

After the recovery actions have been identified a check addressing the feasibility must be 

performed. SHARP1 [5] requires the following conditions be met in order for the action to be 

considered feasible: 

• The MCR crew must be able to diagnose the need for recovery. 

• The time to accomplish the task must be adequate considering the total time available. 

• The required equipment is available to the crew and the crew can gain access to the 

equipment. 

• There must be enough available staff to perform the action. 

For fire HRA the following conditions, based on PSF considerations, must be addressed in order 

to assess the feasibility of the recovery action: 

• Cues and Indications – The MCR crew must be able to diagnose the need for the recovery 

action. The instrumentations and indications needed for diagnoses must not be affected by 

the fire. 

• Timing – The time to accomplish the task must be adequate considering the total time 

available for the new recovery action after the initial system alignment was found to be 

ineffective in preventing challenges that could lead to core damage. The time must address 

the timing impacts due to fire (see PSF section on timing). Since most recovery actions occur 

in combinations with other HFEs, a time line is needed that accounts for early success or 

failures in other actions and that demonstrates adequate time available for the recovery 

action. 

• Procedures and Training – Based on the recommendation in the ASME Standard [3], 

only proceduralized actions can be credited for recoveries. Recovery actions may be 

proceduralized in specialized procedures which the operators may not receive extensive 

training for the specific case being analyzed. Identifying the specialized procedures may 

require discussions with operations personnel. For example, cross-tying the RWST in the 

event of drain down due to multiple spurious operators may not be specifically addressed in 

the fire procedures, but there may be a procedure addressing RWST cross-tying in the event 

of an external event and the training on this event could be extensive. 

• Human-Machine Interface – Similar to internal events recovery actions the fire HRA can 

not include repair of a system or component. For fire HRA, repair of components or systems 

damaged due to fire should not be included as successful in the fire PRA. For local actions 

the diagnosis and planning for the recovery action is performed in the MCR and there is no 

additional diagnosis required in executing the procedure at the local station (e.g., open a 

valve, close a breaker, or regulate flow). 

• Environment – Actions that are “heroic” (e.g., operators must enter an extreme highradiation environment in order to perform) should not be included in the analysis. For fire 

HRA, heroic actions would include working in or traveling through a location where the fire 

or heavy smoke is present. 
Recovery 

6-5 

• Special Equipment – If the recovery action requires special equipment such as hoses, 

ladders, or other off-site tools, then additional time for locating these items should be 

accounted for in the recovery action. In addition, there must be ample time available 

for the crew to locate and setup the special equipment. 

• Specific Fitness – If the recovery action requires that the crew wear SCBAs or fire 

protection gear, the actions should not be included in the fire PRA. Additionally, no credit 

should be given for recovery actions in which not all able bodied operators could perform. 

• Availability of staff – There must be enough crew available to complete the recovery action. 

In addressing the availability of the crew, other competing actions should be identified and 

the recovery action can only be credited if there is ample crew for all competing tasks as well 

as the recovery. 

• Communications – Recovery actions that require significant activity and or communication 

among individuals while wearing SCBAs should not be credited. Communications under 

such conditions is very difficult, and until proven otherwise, where the levels of smoke, heat, 

or toxic gases are high enough to necessitate the use of SCBAs, the likelihood of success is 

assumed to be extremely low. 

In addition to the specific PSFs mentioned above, all other PSFs outlined in Section 5 need to 

be considered in the recovery analysis in the same manner as the initial HFE. 

6.3 Quantification 

The quantification should follow the same approach as outlined in Section 5. However, because 

of the potential complex nature of recovery actions in many cases, demonstrating the feasibility 

of the actions per the guidance above and ensuring an adequate time margin are especially 

important. In many cases, a detailed HRA may be required using either the ATHEANA or EPRI 

method within the constraints discussed above. 

Type 1 recovery from a human error is modeled as part of the HFE quantification by adjusting 

the HEP within the time constraints of the event that is modeled. These recovery actions may be 

identified and quantified as part of the initial HFE definition or in the quantification stage 

because of the close connection with other HFEs. 

Another option for quantification of recovery actions is to apply plant specific data. The data 

must be applicable for the plant/sequence context or modified accordingly. For example, a plant 

may use available experience data for the probability of failing to align a firewater system for 

injection, but the experience data is based on designs for which all the actions can be taken from 

the main control room whereas for this plant, the actions have to be performed locally (NUREG1792 [2]). Therefore, the time margin for performance of the action would have to be increased, 

and consideration would have to be given to performance shaping factors that would relate to 

fire-related effects at the local control site (e.g., environmental conditions, wearing of special 

gear, and accessibility) as discussed in Appendix H. 

For quantification, the ASME PRA standard [3] requires that dependencies between recovery 

actions and any other HFEs in the sequence, scenario or cutset be addressed. To account for 

these dependencies, follow the guidance in Section 8. 
Recovery 

6-6 

6.4 References 

1. EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities. September 2005. 

NUREG/CR-6850/EPRI 1011989. 

2. NUREG-1792, “Good Practices for Implementing Human Reliability Analysis (HRA)”, 

Sandia National Laboratories, 2005. 

3. ASME RA-S-2000, “Standard for PRA for Nuclear Power Plant Applications”, Rev 14A, 

May 11, 2001 supplemented by ASME RA-Sa-2003, “Addenda to Standard For Probabilistic 

Risk Assessment For Nuclear Power Plant Applications”, December 5, 2003, supplemented 

by ASME RA-Sb-2005, “Addenda to Standard For Probabilistic Risk Assessment For 

Nuclear Power Plant Applications”, December 2005, all by American Society of Mechanical 

Engineers. 

4. NUREG-1852, “Demonstrating the Feasibility and Reliability of Operator Manual Actions in 

Response to Fire”, October 2007. 

5. Systematic Human Action Reliability Procedure (SHARP) Enhancement Project. SHARP 1 

Methodology Report. December 1992. EPRI TR-101711. 
7-1 

7

DEPENDENCY ANALYSIS 

The analysis of dependent HFEs is important, because risk metrics such as core damage 

frequency can be significantly underestimated in cutsets or sequences containing multiple 

Human error probabilities (HEPs). The ASME standard [1] requires that multiple human actions 

in the same accident sequence or cutset be identified, an assessment of the degree of dependency 

is performed, and a joint human error probability be calculated. For fire PRA, a preliminary 

dependency analysis is preformed in combination with NUREG/CR-6850 [2] Detailed Fire 

Modeling Task 11 and is finalized as part of Task 14, Fire Risk Quantification. 

This section is concerned with identification of dependencies among HFES at the cutset level 

that have been up until this point been quantified as independent HFEs. The identification and 

qualitative analysis steps may also identify relationships (often referred to as dependencies) 

among PSFs. The relationships among multiple PSFs within a single HFE are addressed scoping 

or detailed HRA quantification. 

7.1 Qualitative Dependency Analysis 

Through a review of cutsets and sequences, the combination of multiple sets of HFEs are 

identified for potential dependencies. Once the cutsets or sequences are identified they should 

be reviewed as follows: 

• The review should ensure that sequences or combinations of operator actions do not exist 

where the joint human error probability is less than a lower limit such as 1E-5. 

• The review should ensure no accident sequences with multiple human actions were 

prematurely truncated. 

• Dependencies that have been previously accounted for the in the internal events HRA, 

need to be re-evaluated for fire HRA. There may be cases where the assumptions about 

dependencies may no longer be credible in the fire PRA. For example, if the Fire procedures 

are implemented in parallel to the EOP, new dependencies may be created due to performing 

multiple actions in the same time period, possibly with the same staffing levels. Additionally, 

changes in timing due to fire impacts could affect workload and stress levels, for example. 

• An assessment of the feasibility of multiple HFEs performed within the same sequence 

should be performed. For fire PRA, there is the potential for several fire response actions 

to be performed within the same sequence. If feasibility has been demonstrated for the 

HFE as an independent action, which could be the case if the HFE is a fire manual action, 

there is the potential to not have enough crew available to perform all HFEs in the 

sequence. Additionally, there may be enough time perform each HFE independently 

but in combination, there is not enough time available. 
Dependency Analysis 

7-2 

For HRA, it is important to not only identify failure HFEs in the sequence, as would be the case 

in a review of the cutsets, it is also important to review successful operator actions that occur 

in the same sequence. The success paths would be identified by review of the event trees, and 

should be noted in the HFE definition, in accordance with ASME criteria HR-F2 requirement 

B [1]. 

Where it is found that combinations of operator actions HEPs are unduly multiplied in the 

cutsets, the appropriate level of dependency among the HEPs is to be assessed. In accordance 

with the ASME Standard [1], influences of success or failure on parallel and subsequent human 

actions and system performance should include: 

1. The time required to complete all actions in relation the time available to perform the actions. 

2. Factors that could lead to dependence (e.g., common instrumentation, common procedures, 

inappropriate understanding or mindset as reflected by failure of a preceding HFE, and 

increased stress)Availability of resources (e.g., crew members, other plant personnel to 

support performance of ex-control room actions). 

Once the combination of HFEs is identified a level of dependency is assigned. One approach 

to assigning a level of dependency is shown below and taken from the EPRI detailed HRA 

methodology [3]. This decision tree is based on discussion presented in THERP. Both internal 

events HRA and fire HRA evaluate the same elements in the dependency analysis. 
Dependency Analysis 

7-3 

Same Crew – If the time between the cues for the required actions exceeds the length of a shift 

(typically 12 hours), the actions are to be performed by different crew. In this case, the “No” 

branch on the “Same Crew” decision node in Figure D-1 is selected. The different crew can be 

considered independent as the shift change will involve a complete re-evaluation of the plant 

status, so ZD can be assigned for low stress [1] situations (S18). For elevated stress such as a 

fire, LD is assigned. If the time between the cues is less than the length of a shift, the probability 

of a shift change during the time window needs to be considered. For a typical HFE time window 

of 1 hour and a shift length of 12 hours, the probability of no shift change is 1-1/12 = 0.92, so 

HFEs by different crew are typically only credited in scenarios where the HFE time window is 

longer than the length of a shift. 

Common Cognitive – If the HFEs have a common cognitive element i.e. performed by the 

same crew and driven by the same cue or procedural step, the “Yes” branch on the “Common 

Cognitive” decision node is selected as a first approximation, as these HFEs would be regarded 

as completely dependent. The analyst should determine if the common cognitive element had 

been modeled as a separate basic event. If the common cognitive element is modeled as a 

separate basic event, the “No” branch can be selected. 

Same Time – If the cues for two HFEs occur at the same time, the “Yes” branch on the 

“Same Time” decision node is selected. The required actions for these HFEs are to be performed 

simultaneously. If the cue for subsequent action occurs before the preceding action can be 

completed as illustrated below, the “Yes” branch on the “Same Time” decision node in 

Figure D-1 is also selected, as the required actions would have to be performed either 

simultaneously, or the crew may select to do either one or the other based on some 

prioritization. These HFEs are termed “Simultaneous” HFEs: 

Adequate Resources – For simultaneous HFEs, the next consideration is whether there are 

sufficient resources to support the required actions. This determination can be done by 

comparing the required tasks with the number of crew (workload). If the resources are 

inadequate, the “No” branch on the “Adequate Resources” branch is selected, which implies 

complete dependence. If it can be shown that there are adequate resources to support both HFEs 

and that the scenario is feasible, the “Yes” branch on the “Adequate Resources” branch is 

selected. Next location and stress are considered. For the same location, the “Yes” branch 

on the “Same Location” decision node is selected. For high or moderate stress scenarios, assign 

complete dependence; for low stress, assign high dependence. For different locations, the “No” 

branch on the “Same Location” decision node is selected. (Location refers to the room or general 

area where the crew members are located. For example, the control room is a location – location 

is not differentiated down to individual panels in the control room). For high or moderate stress 

scenarios, assign moderate dependence; for low stress, assign low dependence. 

Same Location – If the execution for the HFEs occur in the same location then the dependency 

level is either high or complete, if the actions are performed in different locations then the 

dependency level is either moderate or low. 

Timing – The timing decision branch considered the time between the cues. The more time 

between the cues the lower the dependency level. 
Dependency Analysis 

7-4 

Stress – Stress is a culmination of all other performance shaping factors. These may include 

preceding functional failures and successes, preceding operator errors or successes, availability 

of cues and appropriate procedures, workload, environment (heat, humidity, lighting, 

atmosphere, and radiation), requirement and availability of tools or parts, accessibility of 

locations. In general, stress is considered high for loss of support system scenarios or when 

the operators need to progress to functional restoration or emergency contingency action 

procedures – the closer they get to exhausting procedural options, the higher the stress. 

With the proper level of dependency identified, the dependent HEPs can be re-assessed by 

applying the appropriate dependency formulas in Table 10-17 and shown below in Table 8-1 

in THERP [3] or, if ATHEANA [5] is being used to quantify the actions, appropriately 

documented expert judgment can be used (as described in NUREG-1880 [4]). The effects of 

the revised, dependent HEPs are typically incorporated by applying correction factors to PRA 

such as revising probabilities to be conditional events or using rule-based recovery probabilities. 

Once the dependency evaluation has been conducted, then the incorporation of the human 

interaction into the PRA model may require revision. However, some HRA methods, such 

as ATHEANA, use a different approach to address dependencies. For example, ATHEANA 

explicitly models both the initial HFE and the non-recovery event together, on a cutset-by-cutset 

basis. 

Table 7-1 

THERP Dependency Equations 

Dependence Level Equation Approximate Value 

for Small HEP 

Zero (ZD) HEP HEP 

Low (LD) (1+19 X HEP)/20 0.05 

Medium (MD) (1+ 6 X HEP)/7 0.14 

High (HD) (1 + HEP)/2 0.5 

Complete (CD) 1.0 1.0 

7.2 Screening and Scoping HEPs 

A review of the cutsets for dependencies will show some combinations in which there are both 

screening and scoping HEPs. The screening HEPs by definition, are considered conservative and 

adjusting these HEPs even more may either increase the HEP to 1.0 or make them overly and 

unrealistically conservative. The screening HEPs will not usually need to be further adjusted to 

account for dependencies as long as the combination of HFEs is shown to be feasible. (There is 

enough time to complete all the actions and enough crew members are available to complete all 

the actions.) Scoping HEPs can be treated using the same approach as described in the section 

above, but the criteria for the scoping HEPs must still be met. That is, if credit for the action is 

taken, the adjustments in the HEPs should still reflect that the actions are feasible and there is 

an adequate time margin given the dependent effects. 
Dependency Analysis 

7-5 

7.3 References 

1. ASME RA-S-2000, “Standard for PRA for Nuclear Power Plant Applications”, Rev 14A, 

May 11, 2001 supplemented by ASME RA-Sa-2003, “Addenda to Standard For Probabilistic 

Risk Assessment For Nuclear Power Plant Applications”, December 5, 2003, supplemented 

by ASME RA-Sb-2005, “Addenda to Standard For Probabilistic Risk Assessment For 

Nuclear Power Plant Applications”, December 2005, all by American Society of Mechanical 

Engineers. 

2. EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities. September 2005. 

NUREG/CR-6850/EPRI 1011989. 

3. Software Users Manual, The Human Reliability Calculator Version 4.0. EPRI, Palo Alto, 

CA, and Scientech, Tukwila, WA: January 2008. Product ID. 1015358. 

4. NUREG/CR-1278, “Handbook of Human Reliability Analysis with Emphasis on Nuclear 

Power Plant Applications”, (THERP) Swain, A.D. and Guttman, H. E., August 1983. 

5. NUREG-1624, Rev 1, Technical Basis and Implementation Guidelines for A Technique for 

Human Event Analysis (ATHEANA)”, May 2000. 

8-1 

8

UNCERTAINTY ANALYSIS 

8.1 Background 

Uncertainty in the context of PRA and HRA is defined as the representation of the confidence 

in the state of knowledge about the parameter values and models used in constructing the PRA 

(ANSI/ANS-58.21-2007 [1] and ASME RA-2002/RA-Sb-2005 [2]). For fire HRA, uncertainties 

are addressed in the same manner as for internal events HRA. The ASME standard [1] 

requirement HR-G9 specifies that the HRA characterize the uncertainty in the estimates 

of the HEPs consistent with the quantification approach, and provide mean values for use 

in quantification. 

The consideration and assessment of uncertainty in any analytical context is typically performed 

to assist the decision-making process that the analytical PRA models support. In fire modeling 

and HRA in particular, by identifying the areas of uncertainty and focusing on those aspects of 

uncertainty that can be reduced, the associated decision-making processes can be improved. 

Based on a review of many applications, the common characteristics and distinctions of 

uncertainty are: 

• Uncertainty versus randomness 

• Aleatory versus epistemic 

• Parametric, modeling and completeness 

• Sensitivity analysis versus uncertainty analysis 

8.1.1 Uncertainty Versus Randomness 

Although most PRA applications do not distinguish between these two, the term randomness 

refers to the inherent variability of an outcome that is limited by imperfect knowledge regarding 

the modeled phenomena and the models and parameters used in the modeling. 

8.1.2 Aleatory Versus Epistemic 

Aleatory uncertainty is attributed to inherent randomness, natural variation, or chance outcomes 

in the physical world; in principle, this uncertainty is irreducible because it is assumed to be a 

property of nature. Aleatory uncertainty is sometimes called random or stochastic variability. 

Virtually all PRAs of current generation plants identify some potentially risk important operator 

actions. The baseline uncertainty assessment includes variability based on factors such as: safety 
Uncertainty Analysis 

8-2 

culture, organizational performance, communication and interface among groups, and operating 

crew factors such as normal differences in crew variability, personalities, and time of day 

(circadian rhythms). All of these are assumed to be independent of the fire event context. 

Thus, evaluation of the aleatory uncertainty provides a parameter for estimating the uncertainty 

bounds around the mean HEP. This parameter represents the irreducible uncertainty based 

on the elements of personnel human behavior that are outside the event-driven context of a fire 

scenario. 

Epistemic uncertainty is attributed to the lack of knowledge about events and processes; in 

principle, this uncertainty is reducible because it is a function of information. Epistemic 

uncertainty is sometimes called, subjective or internal uncertainty, and divides into two major 

sub-categories: model uncertainty and parameter uncertainty. When combined with the aleatory 

uncertainty, the epistemic uncertainty parameters provide a basis for quantitatively estimating the 

uncertainty bounds for a specific HEP. The combined uncertainty parameters represent both the 

irreducible and event driven issues associated with the fire scenario. When combined with the 

aleatory uncertainty, the epistemic uncertainty parameters provide a basis for quantitatively 

estimating the uncertainty bounds for a specific HEP. The combined uncertainty parameters 

represent both the irreducible and event driven issues associated with the fire scenario. This 

uncertainty contribution comes from the knowledge of the analyst integrating the information 

about the fire context and determining the likelihood of an operator error that can lead to core 

damage. As information about the fire context and effects, and the operators expected actions 

according to the procedures increases for the HRA analyst the epistemic uncertainty decreases. 

8.1.3 Parametric, Modeling and Completeness 

PRA applications have used uncertainty in parameters, modeling and completeness to represent 

the lack of knowledge or primarily the epistemic uncertainty associated with specific 

applications. 

8.1.3.1 Parameter Uncertainty 

Parameters address uncertainties associated with failure rate data, HEP estimates, applicability of 

data, statistical variation, model processing simplifications and truncations. 

The error factor (EF) is used to describe the statistical variation of uncertainty in the measure of 

the HEP. It is defined as the ratio of the HEP0.95 to HEP0.50 values of a distribution of HEPs. 

The mean of a lognormal distribution can be estimated using the median and the EF using this 

equation: median * exp{0.5[(ln EF)/1.645]2

}. 
Uncertainty Analysis 

8-3 

In chapter 7 of NUREG/CR- 1278 [3] Swain uses data collected by Wechsler to measure the 

ratio of the upper and lower bounds of typical repeated tasks by people with aptitude and training 

on the task, as shown in Table 8-1. The ratio of the upper and lower bound extremes, in these 

data measures, range from 1.76 to 2.83 (e.g., the time0.95 to time0.50. values). Thus, when 

converting the end point range to an EF for a lognormal distribution, the EF ranges from 1.33 to 

1.68 in the tasks where data were collected (Table 7-1 in NUREG/CR-1278 [3]). Using these 

data to address normal human variability (aleatory) for typical tasks in less repetitive conditions 

in a nuclear plant and assuming that the rate of actions measured has the same distribution as the 

human error rate (lognormal), Swain assigned an EF of 3.0 as the generic HEP uncertainty. This 

encompasses all the sources of uncertainty in a task defined in the PRA to be evaluated (aleatory 

plus epistemic). If the event context increased the stress, or the HEP was much less than .001, 

then Swain recommended an EF of 10.0 on the HEP. Thus, it can be considered that aleatory 

variability accounts for less than 2 of the error factor and epistemic the remainder of 3, 5, or 10. 

Table 8-1 

Summary of measurements used to evaluate HEP uncertainty in NUREG/CR-1278 [3] Task unit of measure Subjects Comments Mean Upper extreme Lower Extreme Ratio upper to lower extreme EF upper to middle (lognormal) Ratio Mean to median 

Calculated 

median 

(lognormal) 

Filament 

mounting 

(elec. 

Bulbs) 

Ave. per 

hour 

100 104.9 132 75 1.76 1.33 1.01 103.36 

Card 

punching 

Ave # Cards 

per hour 

113 day shift 232.2 340 160 2.13 1.46 1.03 226.19 

Assemble 

radio Tubes 

# tubes per 

hour 

65 99.5 132 61 2.16 1.47 1.03 96.80 

Checking 

posting and 

listing 

Percent of 

average 

34 females 102.1 150 65 2.31 1.52 1.03 98.85 

Card 

punching 

Ave # Cards 

per hour 

121 night shift 198.5 275 115 2.39 1.55 1.04 191.65 

Check 

grocery 

store orders 

Time in 

seconds 

46 365 575 225 2.56 1.60 1.04 350.45 

Machine 

sewing 

Units per hr. 

5 day ave 

101 females 72.4 112 43 2.60 1.61 1.04 69.40 

Manipulate 

lathe 

Avg. output 

per day 

120 71.8 134 51 2.63 1.62 1.04 68.77 

Typing Words per 

minute 

616 53.4 85 30 2.83 1.68 1.05 50.79 

Assumptions 

People tested had aptitude for the task and were trained. 

The highest score is rarely 5 times the lowest score and usually not more than three. 

The log normal distribution was a better fit to the data than a normal distribution. 

No reason to think the log normal is not appropriate for HEPs as well as timing data. 

Mean/median = exp {0.5[(ln EF)/1.645]2

} 
Uncertainty Analysis 

8-4 

8.1.3.2 Modeling Uncertainty 

Modeling addresses the adequacy of detail in logic modeling, logic correctness and recognition 

of dependencies in the model inputs. 

One way that modeling uncertainty is addressed in the HRA Guidelines methodology is through 

the questions in the scoping analysis process which strive to reduce areas of uncertainty that are 

not addressed in the screening process. For example, the scoping question “Given when the cues 

occur, is the action still feasible?” requires a demonstrated feasibility of the action via job 

performance measures considering the time required to do the task and time allowed by the 

system. 

Each subsequent question reduces modeling uncertainty as more information is obtained. For 

example, with inputs from electrical evaluations, a "Yes" answer to “All necessary & sufficient 

cues & controls for required actions are not impacted by fire?” reduces uncertainty assumed in 

the screening assessment. Thus, changes can be made from an unknown No to a sure Yes as 

information on the location of train power and instrument cables is obtained. This reduces key 

modeling uncertainty about the cue for required actions involving cooling train circuitry. The 

subsequent level of information obtained by verifying the location of circuits that cannot be 

impacted by the fire addresses the elimination of potential spurious actions and indications 

(See Appendix B examples). 

Likewise answering the following scoping questions about managing the fire event reduce 

uncertainty. 

• Within the main control room (MCR), do the procedures match the scenario? 

• Is the action to be performed in the MCR or locally? 

Areas that contribute to increased uncertainty should be addressed in the detailed analysis. For 

example, events that involve MCR abandonment actions are typically plant specific and may not 

have clear decision criteria for abandonment. When habitability is not an issue, crew may not 

completely abandon MCR even if their ability to control parts of the plant are hindered due to 

fire effects on control cables, in performing demonstrations of time-authenticated actions, 

involving diagnosis and execution, times need to be estimated and there are a number of 

activities that may influence time to respond and contribute to task timing uncertainty. 

Situations or factors in the fire context that may be very difficult to recreate in simulations 

and job performance measures include: 

• MCR staff obtaining correct fire plan and procedures once fire location is confirmed 

• MCR staff knowing that special instructions to responsible local staff need to be provided 

• Local staff collecting procedures, checking out communications equipment and obtain any 

special tools or personnel protective equipment necessary to perform actions at a local 

control station 

• Traveling to necessary locations through smoke 

• MCR staff alerting and/or communicating with local staff implement coordinated or 

sequential actions in multiple locations 
Uncertainty Analysis 

8-5 

• Dealing with difficulties such as problems with instruments or other equipment (e.g., locked 

doors, a stiff hand wheel, or an erratic communication device). The PRA hardware models 

typically address these issues, unless no manual actions are modeled. 

8.1.3.3 Completeness uncertainty 

Reg. Guide 1.174 [4] states that “Completeness is not in itself an uncertainty, but a reflection 

of scope limitations. The result is, however, an uncertainty about where the true risk lies. The 

problem with completeness uncertainty is that, because it reflects an unanalyzed contribution, it 

is difficult (if not impossible) to estimate its magnitude. Some contributions are unanalyzed not 

because methods are not available, but because they have not been refined to the level of the 

analysis of internal events. Examples are the analysis of some external events and the low-power 

and shutdown modes of operation. There are issues, however, for which methods of analysis 

have not been developed, and they have to be accepted as potential limitations of the technology. 

Thus, for example, the impact on actual plant risk from unanalyzed issues such as the influences 

of organizational performance cannot now be explicitly assessed.” Completeness is addressed 

through the review process to either expand upon the original analysis or to provide justification 

for scope constraints.. The risk-informed process described in RG 1.174 includes defense-indepth, safety margins, and performance monitoring to provide protection against the unknown 

elements in the models. 

For the assessment of human reliability during a fire sequence, the analyst should consider 

these issues when assigning both the median value of the HEP (which is independent of the 

uncertainty distribution) and the uncertainty parameters. 

8.1.4 Sensitivity Analysis Versus Uncertainty Analysis 

Sensitivity methods can be used to evaluate the risk importance of fire related actions instead 

of assigning uncertainty distributions. While these terms are sometimes used interchangeably, 

uncertainty analysis refers to applications which propagate the uncertainty of the individual 

parameter probability distributions through the model to produce an output in the form of a 

probability distribution based on the distribution of the inputs (e.g., Monte Carlo sampling). 

Uncertainty analysis can encompass the evaluation of sensitivity cases. Sensitivity analysis 

includes setting one parameter to a failure value of 1.0 and determining the impact on the result. 

Most PRA modeling codes provide the capability to perform special types of sensitivity analysis 

on all the components to produce a risk importance ranking. Two popular methods are 

Fussell-Vesely and risk achievement worth. 

For the determination of human error distributions, the analyst can assign a distribution as 

discussed below. Either manually setting the value of an HEP to 1.0 or application of the risk 

importance measures can be used to evaluate the risk importance of the human errors modeled in 

the fire PRA. If the risk contribution is above a threshold (RG 1.174), then actions need to be 

considered for reducing the risk impact. 
Uncertainty Analysis 

8-6 

8.2 Fire HRA Applications of Uncertainty 

For fire HRA, three approaches were presented for human failure event quantification: screening, 

scoping and detailed HRA. Methods for characterizing the uncertainty associated with the human 

error probability are also recommended. For screening, scoping and detailed (EPRI and 

ATHEANA) HRA methods, the following guidance can be applied. 

8.2.1 Screening 

In keeping with the simplicity of the screening approach, the assignment of uncertainty is 

also simplified for screening. The screening HEP values are in the range of 10-3 to 1. Swain 

NUREG/CR-1278 [3] recommends a range of error factors of 3 to 10, with a lower range in 

the .001 to .01 range. 

In the case of developing uncertainty values for screening HEPs when the clarity of the fire 

induced scenario is broadly defined, there is not enough evidence to reduce the uncertainty. 

Therefore, as shown in Table 8-2 for screening HEP values, an EF of 5 applies. The HEP 

value can be used as a mean value in the PRA model. 

Table 8-2 

Uncertainty assignment for screening values 

Criteria [1] HEP Value to Apply [2, 4] Uncertainty Assignment 

Set 1 example 0.01 5 

Short term example 1 NA [4] 

Long Term example 0.001 5 

Set 2 example 0.1 5 [4] 

Short term example 1 NA [4] 

Long term example 0.001 5 

Set 3 example Use both HEPs in sensitivity analysis NA [4] 

Short term example 1 NA [4] 

Long term example 0.001 5 

Set 4 example If important to risk use scoping or detailed 

analysis NA [4] 

Table Notes 

1 See Table 8-2 for description of criteria and example cases. 

2 For simplicity with PRA assume HEP value is mean of log normal distribution with estimated normal variation 

 error factor of 3 and fire effects of 2 for a total of 5. 

3 The HEP screening value should never be lower than the original HEP because fires add complexity to the event. 

4 The value of an HEP never exceeds a probability of 1.0. 

8.2.2 Scoping 

The scoping approach provides much more information about the fire event scenario and the 

issues that are included and not included. Thus, the uncertainty assigned to the HEP obtained 

during the scoping process should be lower than that assigned during the screening process. The 

scoping HEP values are in the range of 10-3 to 1. Reference (NUREG/CR-1278) recommends a 
Uncertainty Analysis 

8-7 

range of error factors of 3 to 10 over a HEP range of 0.0001 to 0.1. For the detailed analysis of 

issues outside the scoping analysis, the assigned uncertainty can be larger than the uncertainty 

related to the scoping analysis, because the detailed analysis addresses issues that are not 

considered in the screening and scoping analyses, such as self-induced station blackout (SISBO) 

or similar fault clearance strategies and MCR abandonment. 

Uncertainty values for scoping HEPs depend on the clarity of the fire induced scenario 

definition. Two improvements for reducing uncertainty over the screening process are the ability 

to precisely answer questions and the separation of specific scenarios for detailed analysis. 

Therefore, as shown in Table 8-3 for scoping HEP values, when the answers to the questions in 

the scoping trees are clear, EFs of 1, 3, apply. If the questions are not clearly answered with 

knowledge of cable routing, the uncertainty estimate for EFs becomes 1, 5 and over the range of 

HEP values. The scoping HEP values can be considered as median values to be adjusted by the 

EF to become mean values so they match with the other mean values in the PRA model. If 

propagation of uncertainty is to be used as a method for tracking overall uncertainty and treating 

risk important human actions, the scoping HEPs in the trees should be treated as medians. If 

point estimates are used with sensitivity assessments for overall evaluations of the uncertainty 

impact there is little error introduced by using the scoping HEPs as either a mean or median. 

Table 8-3 

Uncertainty categories for scoping analysis 

Scoping HEP [1] (median) Scoping [2] (EF) Scoping [3] (EF) 

Estimated HEP > 0.001 3 5 

Estimated HEP > 0.1 1 1 

Table notes: 

1 If propagation of uncertainty modeling is used in the PRA model, the HEP in the scoping tables should be treated 

 as median values, and be adjusted to means based on the uncertainty value. 

2 High certainties in answers to scoping questions. 

3 Some uncertainty in answers to scoping questions, but bounding by the screening process. 

8.2.3 Detailed HRA 

Any initial fire scenario model can be modeled in more detail. One method for re-modeling is 

to separate the drivers of uncertainty into explicit models and then reevaluate the uncertainty in 

each supporting model. If the uncertainties are considered to be too high leading to HEP values 

of 1.0 in risk important sequences in the initial PRA model, the NUREG/CR-6850 process 

focuses on epistemic uncertainties that are represented by unknowns such as cable routing 

relative to the fire location, and the effects of cable shorting and grounding on controls and 

instruments associated with fire growth models. 

In practice with any detailed approach, areas of uncertainty that are included in the HEP 

distribution can be separated into specific models to more accurately address a specific issue 

such as seasonal temperature changes or day night shift dependences using separate models 

within the PRA logic structure to quantify the impact of the specific condition. For example, if 

the presence of ice changes a preferred alignment or the way operators react, a special model can 

include possible deviations due to the ice condition directly on the core damage frequency rather 
Uncertainty Analysis 

8-8 

than as part of the uncertainty in the HRA model. The typical aleatory uncertainty such as crewto-crew variations remain as uncertainty inputs to distributions for both the ice condition HEP 

and the non ice condition. 

By providing this increase in knowledge to the PRA and HRA from other fire modeling tasks the 

fire effects on the hardware are clearly defined. The uncertainty in the fire scenario and context 

associated with potential human actions is reduced. In this case the impact of the failure mode 

variations and variations within scenario become clearly defined for the crews allowing HRA 

models to better address the specific fire scenario. Actions needed to control the plant from a 

safety perspective are much better defined in the procedures (e.g., sub-scenarios or extremes 

represented within a PRA scenario definition), and the rationale for defining unsafe actions is 

more clearly understood. This increased understanding of the fire context and plant response 

should permit reduction on the uncertainty in known aspects and increase it in others. 

8.2.3.1 EPRI Model 

The EPRI approach used to address uncertainty is based on THERP Table 20-20 (also listed in 

Table 7-2) and guidance in THERP Chapter 7 [3]. THERP’s assessment of uncertainty assumes 

a lognormal distribution. The following is taken directly from THERP Chapter 7: 

“Although we would like to have data clearly showing the distributions of human 

performance for various NPP tasks, there is ample evidence that the outcomes of HRAs are 

relatively insensitive to assumptions about such distributions. One example is described in 

Appendix A8 t o the draft Handbook (Swain and Guttmann, 1980). 

Another example is illustrated by an experimental study in which Mills and Hatfield (1974) 

collected distribution data on task completion times for several realistic tasks. One significant 

finding was that errors resulting from assuming an incorrect form of the PDF of task times 

were small and of little practical significance. The distributions, all unimodal, were best 

described by various Weibull functions, but the authors state, “From a practical point of 

view, the error produced by assuming normality may not be large enough to warrant using a 

better - fitting PDF.” During the preparation of WASH-1400, a sensitivity analysis was 

performed by Dr. W. E. Vessely using a Monte Carlo procedure to see if the assumption of 

different probability density functions for the human error estimates would materially affect 

the predicted availability of various safety-related subsystems. It was found that the predicted 

availability did not differ materially when different distributions were assumed. 

We can conclude that the assumption of normal, lognormal, or other similar distributions 

usually will make no material difference in the results of HRA analyses for NPP operations. 

In some cases, this insensitivity may result from a well-designed system that has so many 

recovery factors that the effect of any one human error on the system is not substantial. If 

very different distributions such as a bimodal type, an exponential, or an extreme value were 

used, it is possible that different results could be obtained. For computational convenience, 

one might wish to assume the same distribution for probabilities of human failure as the one 

used for probabilities of equipment failure, as was used in WASH-1400. A sensitivity 

analysis will reveal whether any significant differences will be obtained with different 

assumptions.” 
Uncertainty Analysis 

8-9 

Since the publication of THERP, the EPRI HCR/ORE [5] studies were performed. The data for 

time to a corrective action that was collected could be fit to a number of distributions where the 

mean and the median can differ (in the normal distribution, the mean and median are the same). 

For mathematical convenience a lognormal distribution was selected to represent the time-based 

probability of success distribution, although the Weibull distribution provides equally good fits. 

The THERP approach to uncertainty is to assign an error factor solely based on the final HEP. 

Since the approach is not based on the initiators, it can be applied to all initiators including fire. 

The EPRI approach for fire is to apply the same error factors as for internal events, and the 

factors are shown in Table 8-4. 

Table 8-4 

EPRI uncertainty categories for EPRI detailed analysis 

HEP Reference Error Factor 

Estimated HEP < 0.001 THERP Table 20-20 10 

Estimated HEP > 0.001 THERP Table 20-20 5 

Estimated HEP > 0.1 Mathematical convenience 1 

8.2.3.2 ATHEANA 

Guidance on addressing uncertainty, and other issues associated with eliciting probabilities is 

given in the ATHEANA User’s Guide (NUREG-1880). 

The approach begins with detailed qualitative discussions to ensure all the available information 

(evidence) is brought to the table, shared, and agreed upon to the extent possible. It is a 

facilitated process to control bias and ensure all participants participate in a meaningful way. All 

qualitative and quantitative evidence is presented, justified, and discussed. All participants must 

contribute their own ideas, evidence, and preliminary estimates. The final distribution is selected 

to give credence to alternative qualitative and quantitative evidence that the experts believe 

would reflect a reasonable consensus of the technical community. The mean HEP and other 

statistics can be calculated from the consensus distribution. 

The elicitation process includes a detailed identification of the key factors contributing to 

aleatory and epistemic uncertainty. Ideally, the process generates probability distributions that 

include epistemic uncertainty to address lack of knowledge and aleatory to address stochastic 

variability. Then the distributions can be combined mathematically, accounting for the likelihood 

of the event occurring under both epistemic (e.g., lack of knowledge about the fire impacts) and 

aleatory conditions (e.g., circadian rhythms, season variation effects and other factors that are 

addressed as being independent of the fire). In practice, these assessments of uncertainty are 

sometimes integrated by consensus of the experts in a single step. The HEP in a fire scenario 

may be made up of combinations of distributions of multiple unsafe actions that have been 

evaluated separately. The individual distributions can be combined mathematically into 

a single distribution, from which a statistical representation can be calculated. 
Uncertainty Analysis 

8-10 

8.3 Additional Guidance for Uncertainty 

The in addition to the references discussed in this section the following list of references are 

applicable to internal HRA and can be referenced for fire HRA if additional guidance is desired. 

1. EPRI 1009652, “Guideline for Treatment of Uncertainty in Risk-Informed Applications”, 

December 2005. 

2. NRC Inspection Report No. EA-03-016 - Arkansas Nuclear 1 - 50-313/01-06; 368/01-06 

Entergy Operations, Inc. Enclosure 2, April 7, 2004. 

3. NUREG-1855, “Guidance On Treatment of Uncertainties Associated with PRAs in Risk 

Informed Decision Making”, (DRAFT), November 2007. 

8.4 References 

1. BSR/ANS 58.23, “FPRA Methodology Standard”, December 2006 (Note) 

• Note: These Fire HRA Guidelines were originally written to the December 2006 draft 

version of the Fire PRA Methodology standard which ultimately became ANSI/ANS58.23-2007 in November 2007. Some sections also cite ASME PRA-S-2000, “Standard 

for PRA for Nuclear Power Plant Applications”, and its addenda ASME RA-Sa-2003 and 

ASME RA-Sb-2005, as they relate to internal events PRA issues that apply to Fire 

PRA/HRA. It was decided to issue this version of the Fire HRA Guidelines for public 

review and comment rather than delay it further to resolve any inconsistencies between 

the draft and final versions of the ANS standard, or to review and incorporate information 

from the recently published ASME/ANS RA-S-2008, “Level 1 and Large Early Release 

Frequency (LERF) PRA Standard”, which applies to at-power internal events, internal 

fire events, and external events for operating reactors. The necessary reviews and 

revisions to reflect the latest standards will be addressed prior to issuing the final 

Fire HRA Guidelines. 

2. ASME RA-S-2000, “Standard for PRA for Nuclear Power Plant Applications”, Rev 14A, 

May 11, 2001 supplemented by ASME RA-Sa-2003, “Addenda to Standard For Probabilistic 

Risk Assessment For Nuclear Power Plant Applications”, December 5, 2003, supplemented 

by ASME RA-Sb-2005, “Addenda to Standard For Probabilistic Risk Assessment For 

Nuclear Power Plant Applications”, December 2005, all by American Society of Mechanical 

Engineers. 

3. NUREG/CR-1278, “Handbook of Human Reliability Analysis with Emphasis on Nuclear 

Power Plant Applications”, (THERP) Swain, A.D. and Guttman, H. E., August 1983. 

4. Regulatory Guide 1.174, “An Approach For Using Probabilistic Risk Assessment in RiskInformed Decisions on Plant-Specific Changes to the Licensing Basis”, U.S. Nuclear 

Regulatory Commission, Revision 1 November 2002. 

5. Operator Reliability Experiments Using Nuclear Power Plant Simulators. Electric Power 

Research Institute, July 1990. EPRI NP-6937. 

6. Software Users Manual, The Human Reliability Calculator Version 4.0. EPRI, Palo Alto, 

CA, and Scientech, Tukwila, WA: January 2008. Product ID. 1015358. 

7. NUREG-1880, “ATHEANA User’s Guide”, Final Report, U.S. NRC, Washington, DC, June 

2007. 
9-1 

9

DOCUMENTATION 

In accordance with NUREG/CR-6850 [1] the output of this entire task is a calculation package. 

In connection with the ASME Standard [2], this package should contain: 

• all human actions and associated HFEs considered in the fire analysis, 

• the description of the HFE and especially its context in the fire scenarios, 

• the quantification method (screening or best-estimate), including the method/tools that were 

used, 

• the basis for the derivation of the HEP with particular attention as to the evaluation of (1) 

dependency considerations and (2) the PSFs and related fire effects, the assigned HEP 

uncertainty values and their bases, 

• an assessment of the assumption’s sensitivity in the HRA modeling and quantification to the 

PRA risk measures, 

• The method and treatment of dependencies for post-initiator actions, 

• Table of pre- and post-initiator human actions evaluated by the model, system, initiating 

event, and function, 

• HEPs for recovery actions and their dependences with other actions. 

9.1 References 

1. EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities. September 2005. 

NUREG/CR-6850/EPRI 1011989. 

2. ASME RA-S-2000, “Standard for PRA for Nuclear Power Plant Applications”, Rev 14A, 

May 11, 2001 supplemented by ASME RA-Sa-2003, “Addenda to Standard For Probabilistic 

Risk Assessment For Nuclear Power Plant Applications”, December 5, 2003, supplemented 

by ASME RA-Sb-2005, “Addenda to Standard For Probabilistic Risk Assessment For 

Nuclear Power Plant Applications”, December 2005, all by American Society of Mechanical 

Engineers. 

A-1 

A

FIRE PRA STANDARD AND THE FIRE HRA GUIDANCE 

A.1 Objective 

This appendix discusses the relationship between the fire HRA guidance in this document, used 

to support the development of a fire PRA following NUREG/CR-6850 guidance [1], and that 

provided in Fire PRA Methodology Standard [2]. The intent of examining the relationship 

between these documents is twofold. 

• First, to ensure that relevant technical issues are considered in the development of this 

guidance, e.g., number of spurious instrument operations that may prevent or delay a 

desirable action (error of omission, EOO) or cause an inappropriate action (error of 

commission, EOC), and 

• Second, to examine how the fire HRA guidance provided herein maps into various capability 

categories of the standard to ensure that the guidance can meet the capability category 

desired by the user. 

A.2 Fire PRA Standard Requirements Relevant to Fire HRA 

A.2.1 Identification of Actions and Definition of HFEs 

HRA-A1 and HRA-A2 set the requirements for identification of important human actions carried 

over from the Internal Events PRA (EOP actions) and those called out in the fire procedures, 

respectively. 

HRA-B1, HRA-B2 and HRA-B3 set the requirements for defining human failure events that are 

carried over from the Internal Events PRA (EOP actions), those called out in the plant fire 

response procedures (FRP actions), and undesired operator action (EOC), respectively. 

The undesired operator response actions (often called errors of commission, EOC) are typically 

identified and defined, for the sake of efficiency, starting with the malfunctioning instruments 

and/or alarms that may trigger such actions. Therefore, identification/definition of EOCs relies 

on instruments and/or alarms (including the number of instrument and/or alarm spurious 

operations) selected in supporting requirements ES-C1 and ES-C2. 

An important caveat regarding the depth of investigation required for multiple spurious 

operations is set forth in Discussion 2 under ES-C2, namely: “Consideration of just one fireinduced spurious indication relevant to each operator action being addressed for Capability 
Fire PRA Standard and the Fire HRA Guidance 

A-2 

Categories I and II is indicative of balancing (a) the current state of the art and the resources 

required to consider almost innumerable combinations of two or more spurious indications 

against (b) the desire to capture in the fire PRA the associated risk caused by such spurious 

indications.” Discussion 3 notes that “Capability Category III includes consideration of other 

instrumentation not needed to directly affect the modeled actions (e.g., other “nuisance” alarms 

or indications) but that may still cause undesired operator effects that are relevant to the Fire 

PRA.” 

A.2.2 Estimating Screening/Scoping/Detailed HEPs 

HRA-C1 and HRA-D1 require that all HFEs and recovery actions identified/defined be 

quantified, unless a basis is provided for not doing so. 

The graded application of this requirement is implied per the gradations in the internal events 

(non-fire) PRA standard [3] high-level requirement HLR-HR-G, as shown in Table A-1, and 

associated supporting requirements with the caveat that the PSFs of the ASME standard are 

complemented with the fire-specific PSFs discussed in this report. 

Table A-1 

Internal events PRA standard requirements HR-G3, HR-G4, and HR-G5 1

Capability Category I Capability Category II Capability Category III 

HR-G3 USE an approach that takes the 

following into account: 

(a) the complexity of the response 

(b) the time available and time 

required to complete the response 

(c) some measure of scenarioinduced stress 

The ASEP Approach is an 

acceptable approach.

When estimating HEPs EVALUATE the impact of the following plantspecific and scenario-specific performance shaping factors: 

(a) quality [type (classroom or simulator) and frequency] of the 

operator training or experience 

(b) quality of the written procedures and administrative controls 

(c) availability of instrumentation needed to take corrective actions 

(d) degree of clarity of cues/indications 

(e) human-machine interface 

(f) time available and time required to complete the response 

(g) complexity of the required response 

(h) environment (e.g., lighting, heat, radiation) under which the 

operator is working 

(i) accessibility of the equipment requiring manipulation 

(j) necessity, adequacy, and availability of special tools, parts, 

clothing, etc.

HR-G4 BASE the time available to complete 

actions on applicable generic 

studies (e.g., thermal/ hydraulic 

analysis for similar plants). 

SPECIFY the point in time at which 

operators are expected to receive 

relevant indications. 

BASE the time available to complete 

actions on appropriate realistic 

generic thermal/hydraulic analyses, 

or simulation from similar plants 

(e.g., plant of similar design and 

operation). SPECIFY the point in time 

at which operators are expected to 

receive relevant indications. 

BASE the time available to 

complete actions on plant-specific 

thermal/hydraulic analysis, or 

simulations. SPECIFY the point in 

time at which operators are 

expected to receive relevant 

indications. 

HR-G5 When needed, ESTIMATE the time 

required to complete actions. The 

approach described in ASEP is an 

acceptable approach.

When needed, BASE the required 

time to complete actions for 

significant HFEs on action time 

measurements in either 

walkthroughs or talk-throughs of 

the procedures or simulator 

observations.

When needed, BASE the required 

time to complete actions on action 

time measurements in either 

walkthroughs or talk-throughs of 

the procedures or simulator 

observations.

 

1 While the performance shaping factors (PSFs) listed in this table have slightly different wording, they cover the same 

attributes of the fire PSFs listed in NUREG/CR-6850 and this document. 
Fire PRA Standard and the Fire HRA Guidance 

A-3 

A.3 Review of the EPRI/NRC-RES Fire HRA Guidance against the Relevant 

Requirements of the Fire PRA Standard 

This section describes a comparison of a fire human reliability analyses carried out based on 

the guidance provided in this document against the requirements set forth in the Fire PRA 

Methodology Standard pertaining to HRA [2]. It is not the intent of this section to be an 

assessment of this guidance, rather to offer a roadmap for the users of this guide to perform 

an assessment of their own analyses against the requirements of the Fire PRA Standard. 

A.4 References 

1. NUREG/CR-6850/EPRI 1011989, “EPRI/NRC-RES Fire PRA Methodology for Nuclear 

Power Facilities,” September 2005. 

2. BSR/ANS 58.23, “FPRA Methodology Standard” December 2006 (Note). 

Note: These Fire HRA Guidelines were originally written to the December 2006 draft 

version of the Fire PRA Methodology standard which ultimately became ANSI/ANS-58.23-

2007 in November 2007. Some sections also cite ASME PRA-S-2000, “Standard for PRA 

for Nuclear Power Plant Applications”, and its addenda ASME RA-Sa-2003 and ASME RASb-2005, as they relate to internal events PRA issues that apply to Fire PRA/HRA. It was 

decided to issue this version of the Fire HRA Guidelines for public review and comment 

rather than delay it further to resolve any inconsistencies between the draft and final versions 

of the ANS standard, or to review and incorporate information from the recently published 

ASME/ANS RA-S-2008, “Level 1 and Large Early Release Frequency (LERF) PRA 

Standard”, which applies to at-power internal events, internal fire events, and external events 

for operating reactors. The necessary reviews and revisions to reflect the latest standards will 

be addressed prior to issuing the final Fire HRA Guidelines. 

3. ASME RA-S-2000, “Standard for PRA for Nuclear Power Plant Applications”, Rev 14A, 

May 11, 2001 supplemented by ASME RA-Sa-2003, “Addenda to Standard For Probabilistic 

Risk Assessment For Nuclear Power Plant Applications”, December 5, 2003, supplemented 

by ASME RA-Sb-2005, “Addenda to Standard For Probabilistic Risk Assessment For 

Nuclear Power Plant Applications”, December 2005, all by American Society of Mechanical 

Engineers. 
Fire PRA Standard and the Fire HRA Guidance 

A-4 

Table A-2 

ANS 58.23-2007 standard requirements vs. HRA steps identified in this document 

Step in this 

Method Index No. CC-I CC-II CC-III 

HRA-A1 For each fire scenario, for each safe shutdown action carried over from 

the Internal Events PRA, DETERMINE whether or not each action 

remains relevant and valid in the context of the Fire PRA consistent with 

the scope of selected equipment per the ES element and plant response 

model per the PRM element of this standard, and in accordance with 

HLR-HR-E and its Supporting Requirements (SRs) in Section 2 with the 

following clarifications: 

• Where SR HR-E1 mentions “in the context of the accident 

scenarios,” specific attention is to be given to the fact that these are 

fire scenarios 

and 

DEVELOP a defined basis to support the claim of nonapplicability of any 

of the requirements under HLR-HR-E in Section 2. 

Identification 

HRA-A2 For each fire scenario, IDENTIFY any new fire-specific safe shutdown 

actions called out in the plant fire response procedures (e.g., deenergizing equipment per a fire procedure for a specific fire location) 

consistent with the scope of selected equipment from the ES and PRM 

elements of this standard, and in accordance with HLR-HR-E and its 

SRs in Section 2 with the following clarifications: 

• Where SR HR-E1 discusses procedures, this is to be extended to 

procedures for responding to fires; 

• Where SR HR-E1 mentions “in the context of the accident 

scenarios,” specific attention is to be given to the fact that these are 

fire scenarios; 

• Another source for SR HR-E1 is likely to be the current Fire Safe 

Shutdown/Appendix R analysis, 

and 

DEVELOP a defined basis to support the claim of nonapplicability of 

any of the requirements under HLR-HR-E in Section 2. 

HRA-B1 INCLUDE and MODIFY, if necessary, human failure events (HFEs) 

corresponding to the actions identified per SRs HRA-A1 in the Fire PRA 

plant response model consistent with Secs. 4.6 and 4.9, and in 

accordance with HLR-HR-F and its SRs in ASME-RA-2002/RA-Sb-2005. 

HRA-B2 INCLUDE new fire-related safe shutdown HFEs corresponding to the 

actions identified per SR HRA-A2 in the Fire PRA plant response model 

consistent with Secs. 4.6 and 4.9, and in accordance with HLR-HR-F 

and its SRs in ASME-RA-2002/RA-Sb-2005. 

Definition 

HRA-B3 INCLUDE HFEs for cases where fire-induced instrumentation failures or 

spurious indication could cause an undesired operator action, consistent 

with HLR-ES-C of this standard and in accordance with HLR-HR-F and 

its SRs in ASME-RA-2002/RA-Sb-2005. 

 All DEVELOP a defined basis to support the claim of nonapplicability of any 

of the requirements under HLR-HR-F in ASME-RA-2002/RA-Sb-2005. 
Fire PRA Standard and the Fire HRA Guidance 

A-5 

Table A-2 

ANS 58.23-2007 standard requirements vs. HRA steps identified in this document 

(continued) 

Step in this 

Method Index No. CC-I CC-II CC-III 

Screening Fire 

HRA 

Scoping Fire 

HRA 

Detailed Fire 

HRA 

HRA-C1 For each selected fire scenario, QUANTIFY the HEPs for all HFEs and 

ACCOUNT FOR relevant fire-related effects for both 

screening/conservative values as well as detailed assessments, in 

accordance with HLR-HR-G and its SRs in ASME-RA-2002/RA-Sb-2005 

with the following clarification: 

• Attention is to be given to how the fire situation alters any previous 

assessments in nonfire analyses as to the influencing factors and 

the timing considerations covered in SRs HR-G3, HR-G4, and HRG5 in ASME-RA-20020RA-Sb-2005, and 

DEVELOP a defined basis to support the claim of nonapplicability of any 

of the requirements under HLR-HR-G in ASME-RA-2002/RA-Sb-2005. 

[NOTE: SEE TABLE A1 above for HR-G3, -G4 and G5 requirements]

Discussion 1: The graded application of this requirement is implied per 

the gradations in ASME-RA-2002/RA-Sb-2005 @2# for the SRs under 

HLR-HR-G. 

Discussion 2: The Fire PRA context introduces new aspects to those 

performance shaping factors (PSFs) already identified in the ASME 

requirements (e.g., the effects of the environmental conditions would 

need to consider relevant fire environments), or might introduce new 

PSFs (e.g., the fact that one operator is generally assigned as member 

of the fire brigade or the added burden associated with post-fire operator 

actions). The intent of SR HRA-C1 is to ensure treatment of such 

factors. 

Recovery HRA-D1 INCLUDE recovery actions and ACCOUNT FOR relevant fire-related 

effects in accordance with HLR-HR-H and its SRs in ASME-RA2002/RA-Sb-2005 with the following clarification: 

• Attention is to be given to how the fire situation alters any previous 

recovery action assessments in nonfire analyses 

and 

DEVELOP a defined basis to support the claim of nonapplicability of any 

of the requirements under HLR-HR-H in ASME-RA-20020RA-Sb-2005. 

Dependency Not specifically addressed 

Uncertainty HLR-UNC-A The Fire PRA shall identify key sources of CDF and LERF uncertainties, 

including key assumptions and modeling approximations. These 

uncertainties shall be characterized such that their impacts on the 

results are understood. 

[NOTE: No specific discussion regarding HRA-related uncertainty for 

HFEs] 

Documentation HRA-E1 DOCUMENT the Fire PRA HRA including 

• those fire-related influences that affect the methods, processes, or 

assumptions used as well as the identification and quantification of 

the HFEs/HEPs in accordance with HLR HR-I and its SRs in ASMERA-2002/RA-Sb-2005, and DEVELOP a defined basis to support the 

claim of nonapplicability of any of the requirements under HLR-HR-I 

in ASME-RA-2002/RA-Sb-2005, and 

• any defined bases to support the claim of nonapplicability of any of 

the referenced requirements in ASME-RA-20020RA-Sb-2005 

beyond that already covered by the clarifications in this section. 

B-1 

B

FIRE EVENT REVIEW 

B.1 Objective 

This appendix documents a review of the significant fire events in the U.S. and internationally - 

a source of information in the development of this guide. Specifically, this review was intended 

to: 

• Serve as a check for the fire performance shaping factors defined in this document (also, in 

NUREG/CR-6850 and NUREG 1852, Demonstrating the Feasibility and Reliability of 

Operator Manual Actions in Response to Fire) and how they may manifest themselves in 

response of crew to actual events, 

• Gain insights into how different crews respond to different actual fire scenarios (variability) 

and how these lessons may influence development of a fire HRA method, both qualitatively 

(e.g., as part of the basis for qualitative screening rule-sets or assumptions) and quantitatively 

(e.g., as part of the basis for the screening values). 

B.2 Fire Events Review 

Tables B-1 through B-3 provide summaries of the review of three fire events. These summaries 

are developed, for the most part, based on the information documented following a fire event, 

e.g., as part of a root-cause analysis. The interpretations do not reflect any changes that may have 

occurred since then. Such changes may include changes in operator training, possibly as the 

result of this or other events. 

The information on each event is organized in the following way: 

• First, the information relevant to each fire performance shaping factor is extracted from the 

fire event description from the analysis. This is intended to help characterize how operator 

response to an actual fire can be associated with these PSFs and whether there are additional 

issues to be covered. 

• Second, an assessment/discussion is provided regarding if and how the information could 

impact various steps of the fire HRA. 

B.3 Summary of Fire Events Review Findings and Implications 

The following key issues were identified as important for consideration in the fire HRA methods 

based on an evaluation of the findings and implications from the fire events review. These issues 

appear to have been addressed through the timing, staffing and indication portions of the EPRI 

HRA quantification methodology presented in Appendix C, as well as the consideration of 

fire-specific performance shaping factors in the scoping analysis as outlined in Appendix H, 

section H.3 and in the detailed analysis as indicated in Appendix C, section C.2. 
Fire Event Review 

B-2 

• Actual fire events can occur in different and unexpected ways due to fire induced spurious 

equipment operations or inaccurate instrument readings that act as a cue to unsafe operator 

actions. The unpredictability of the fire adds to stress, workload and issues that need attention 

by the crew (for example more alarms than expected and/or a potential loss of annunciators). 

Simulator exercises, based on a pre-defined fire scenario and component failure conditions 

for the fire zone, model only one possible set of control room conditions. One scenario 

selected for simulation is not necessarily the most risk significant. Differences between 

training scenarios and actual events can also add stress to the crew which can be reflected 

in the uncertainty of a HFE. 

• Detailed HRA response modeling needs to look at timing of cues, time windows and 

manipulation time. 

• Smoke in the control room and crew knowledge that the fire was continuing to burn for 

some time both added to the stress level of the crew and may have contributed to the overall 

workload/burden of the crew. 

• Fire could be made worse (in spite of good intentions) by some operator actions (e.g., restore 

lube oil to hot bearings) or inactions (delay of water on the fire) because of lack of 

knowledge or training. 

• Incorporation of experience from previous events into procedures and training should be 

credited in the basic HEPs. 

• The HRA process guidance should address both possibilities of leaving the MCR when 

it is not really necessary, as well as leaving when perhaps it is too late. 

• Staffing levels of MCR personnel and those out in the plant performing local actions, as well 

as the impact of fire fighting staff at a barely adequate level, should be considered in the 

detailed HRA if a significant number of local manual actions are needed to achieve safe 

shutdown during a fire. 

• HRA model credit can be given for an ex-control room task when the task walk down is 

performed and demonstrates timing is reasonable, there is space for air packs, and the path 

is not through the fire zone. Consideration should also be given to number and adequacy 

of system(s) of communication between the MCR and remote staff, since important 

communications to achieve safe shutdown during a fire are required for any ex-control room 

actions. If three diverse communications (including radio or wireless) are available, then no 

penalty is needed. 

• The use of SCBAs can be key in maintaining the plants in a safe shutdown condition. 

These tools should be available to the plant operators for electrical fires. 
B-3 

Table B-1 Summary of the fire event 1 review 

PSFs Findings Pertinent to Event Imp

Applicability and Suitability of Training/Experience 

Ineffective training stated as a contributing factor regarding interpretation of EOP by the TSC and the monitoring of all relevant indications by the crew so as to fully understand the plant status (see Operator Action Tendencies and Informal Rules, below). The fact that the simulator could not simulate a cooldown from low power condition contributed to the overall lack of familiarity by the crew as to what to expect. Crew exacerbated the cooldown when they opened the auxiliary SG feed nozzles but failed to close the main feedwater SG nozzles (perhaps a training issue). 

In sthat a fir

Suitability of Relevant Procedures and Administrative Controls 

Procedural guidance was not sufficiently explicit for specifying the start point of the temperature decrease as well as what was meant by being in a plant state with emergency injection; this led to the misunderstanding by 

the TSC that the ES criteria could only be satisfied with 3 pumps running 

and that operation in the TSOR region was not necessary (when actually, 

the ES criteria had been met and operation in the TSOR region was necessary). Lack of procedural guidance regarding the closing of main feedwater SG 

nozzles when using the auxiliary nozzles to the SGs in order to attain 

natural circulation. Hence, the crew was doing this based on memory. 

In sthat a fir
Fire Event Review 

B-4 

Table B-1 Summary of the fire event 1 review (continued) 

PSFs Findings Pertinent to Event Imp

Operator Action Tendencies and Informal Rules 

Appears there was a tendency of crew members to focus on some indications to the detriment of monitoring the entire situation (see 1st observation under Team/Crew Dynamics and Crew Characteristics) TSC decided not to perform the required operation in the TSOR region once the reactor overcooling had occurred. This is stated as being due to improper interpretation of the EOP guidance for when such operation is required. Lack of more explicit guidance in the procedure, and apparently, a proper focus in training contributed to the misinterpretation. Some personnel in the TSC also were under the erroneous assumption that “HPI in the ES mode” meant that all three HPI pumps were on and injecting through both headers. 

In sthat a fir

Availability and Clarity of Instrumentation (Cues to Take Actions and Confirm Expected Plant Response) 

Nothing to indicate that there were failed or inadequate instrumentation. No 

Time Available and Time Required to Complete the Act, Including the Impact of Concurrent and Competing Activities 

Nothing to indicate that the crew was rushed or otherwise sensitive to a time constraint. 

No 

Complexity of the Required Diagnosis and Response, the Need for Special Sequencing, and the Familiarity of the Situation 

Crew was not familiar with expectations regarding a possible cooldown 

when at a low power condition due to the simulator not being capable of simulating such an event (this is in spite of classroom discussions that did cover the relevant issues). 

No 
B-5 

Table B-1 Summary of the fire event 1 review (continued) 

PSFs Findings Pertinent to Event Imp

Workload, Time Pressure, and Stress 

Operator burden was high (as stated in the documentation of the event) due to numerous factors including smoke in the control room, higher stress knowing that the fire fighting activities were not being successful, and dealing with numerous equipment failures both independent of the fire as well as due to fire-induced failure of the ICS because of erroneous signals. 

Smcrew conboth crew the crewstreof a accIn therroalthvs. confailu

Team/Crew Dynamics and Crew Characteristics [Degree of Independence Among Individuals, Operator Attitudes/Biases/Rules, Use of Status Checks, Approach for Implementing Procedures (e.g., Aggressive Crew vs. Slow/Methodical Crew)] 

Entire crew became focused on RCS pressure rise and incore thermocouples to ensure adequate core cooling, but did not also monitor cold leg temperatures and technical specification cooldown rates as they are supposed to do. Therefore they were not aware that the vessel was being subjected to an overcooling transient. Reasons given for these errors stated as ineffective training and operator burden. Management deficiency, deficient supervision also contributed from the standpoint of not requiring operation in the TSOR region (which should have been done) and inappropriately having the operations coordinator direct the staff to use auxiliary spray in violation of a technical specification limit (which apparently was discussed but not appropriately followed through when the coordinator did not realize that pressurizer temperature was elevated). 

Opea cowerundand 
Fire Event Review 

B-6 

Table B-1 Summary of the fire event 1 review (continued) 

PSFs Findings Pertinent to Event Imp

Available Staffing/Resources No indication with regard to staffing issues relative to safe shutdown 

though fire-fighting staffing was deemed barely adequate. 

No evesomconlocaach

Ergonomic Quality of the Human-System Interface (HSI) 

Nothing indicates this was a problem. No 

Environment in Which the Action Needs To Be Performed 

There was smoke in the control room. Env

espbe amet

Accessibility and Operability of the Equipment To Be Manipulated 

Nothing indicates this was a problem. No 

Need for Special Tools (Keys, Ladders, Hoses, Clothing Such as To Enter a Radiation Area) 

Nothing indicates this was a problem. No 

Communications (Strategy and Coordination) and Whether One Can Be Easily Heard 

Nothing indicates this was a problem relative to safe shutdown although local communications among the fire brigade were difficult due to high noise level from ejector relief valves lifting and the fact that hands-free 

communication was not available while in SCBAs. 

No evedoebe cof cach(incenv

Special Fitness Needs Nothing indicates this was a problem. No 
B-7 

Table B-2 Summary of the fire event 2 review 

PSFs Findings Pertinent to Event Imp

Applicability and Suitability of Training/Experience 

Training addresses key fire issues at this plant, e.g. in Attachment 1 of their Abnormal Operating Instructions (AOI), which provides warnings about equipment that could be affected and lessons learned. Operators 

perform a bi-annual walk through of shutdown tasks outside the MCR in the plant. They walk to every action and time those that have time requirements in the AOI. Generally the operators don't do simulator drills 

on the fire AOI and controlling the plant from outside the MCR. . The simulator training cycle is every 4 years for the fire AOI because fire specifics are not thought to be difficult; other AOIs train on a 2 year cycle. 

The philosophy of training is to focus on effect rather than cause. Operators receive 200 hours/year of training. They are trained to respond 

to a safety system with functional response procedures. Trainers are not sure if being in a fire would cause operators to mistrust instruments/alarms. The focus is on using multiple indications for decision-making. The safety of the fire fighters was a primary concern in reluctance to use water, along with a secondary concern about what else might fail. It was finally decided that water would be used on the fire. Later learned that all the hose nozzles on site are 10,000 volt capable nozzles. [Unknown technical feature related to training.] Training changes were implemented as a result of the fire. Operators need additional fire training, especially for first responders and in managing fires. The training needs to address issues outside the procedures and ability to adapt to the needs of the situation. 

The trainsimfire wayissucrew expThe the couthe theror kof ctherwor(e.gbeawatof k
Fire Event Review 

B-8 

Table B-2 Summary of the fire event 2 review (continued) 

PSFs Findings Pertinent to Event Imp

Suitability of Relevant Procedures and Administrative Controls 

During a fire the AOI is assigned to a licensed crew member who is the primary communicator with the fire brigade. The remaining crew continues using the EOPs, which is typical of all AOI’s. The operating crew was in the fire AOI and the reactor trip procedure at the same time. There were so many AOIs going on that coordination and setting priorities was somewhat difficult. The plant fire procedure AOI should include consideration of potential complications in fire events. 

Whopeboth probHEPaddthe incoin sThe alloresptime acccan and in a respsevthe 
B-9 

Table B-2 Summary of the fire event 2 review (continued) 

PSFs Findings Pertinent to Event Imp

Operator Action Tendencies and Informal Rules 

Shutting the MSIVs was common practice for a trip and is now in the procedures. Details for restoring annunciators have been added to the alarm response procedures that are similar to what the operators actually did during the fire. Control Room Supervisor (CRS) - Within about 5-10 minutes, the MCR crew had indications that the main turbine bearing temperatures were over 700o F. Initially they were going to attempt to get lube oil back but an available engineer said that the flash point of lube oil is 400 degrees, so it was decided that they would not proceed to recover lube oil. It was also realized that they had 800 lb. of hydrogen stored above the turbine, so they vented it to 10 lb. In consideration of MCR evacuation some rules of thumb are Fires make a lot of smoke and you hear about people dying from smoke inhalation. Therefore, therefore some operators have a low smoke threshold for MCR habitability. The Shift Manager has the ultimate say in MCR evacuation. In response to this fire, for safety, MCR operators must now ensure that a breaker room is clear of personnel before switching 4 KV power supplies. 

Before the breaker explosion and fire, switching operations were not recognized as hazardous. By comparison, the long term practice is not to stand next to a pump that is being started. 

PlanusinundincoThe allothey procshofor a
Fire Event Review 

B-10 

Table B-2 Summary of the fire event 2 review (continued) 

PSFs Findings Pertinent to Event Imp

Availability and Clarity of Instrumentation (Cues to Take Actions and Confirm Expected Plant Response) 

Following the reactor trip, it was immediately clear that severe electrical power problems existed in the non-nuclear secondary side of the plant. As a by-product of this, it was very quiet in the MCR, with no alarms to silence. It was clear to the RO (crew), very quickly, that the secondary side of the plant was largely affected. Within minutes of the trip, the loss of annunciators had taken out all switchyard indications. However, the SRO was comfortable with the primary system status instrumentation and had the STA doing 15 minute safety function checks. Additional complexities developed as a result of draining water from secondary system pump seals and the resulting flooding. With both the primary system and steam generator feed status OK, he focused on getting annunciator alarms back, going upstairs from the main control room (MCR) to get the annunciator panels back in the same room with the supply source. He tried to re-power the bus, but it tripped again. Next he stripped the bus and successfully re-powered it. At around the time he started to restore loads, the MCR learned about the fire. Someone who had just left the switchgear room and saw the fire start, reported it. So he decided to just energize the most important loads until the fire could be investigated. There was uncertainty in how the control room was notified of the fire. Most likely notification was a manual report from the field, because the fire alarm is often unreliable due to steam detections or bypassing the fire computer frequently for maintenance. 

The amoalarindishoopefor mdiscHowfailubefoperfeveThe use supscrenot shuthouprimgenjeopissuThefor pprocfrom relecha
B-11 

Table B-2 Summary of the fire event 2 review (continued) 

PSFs Findings Pertinent to Event Imp

Time Available and Time Required to Complete the Act, Including the Impact of Concurrent and Competing Activities 

This was a unique situation, usually there are numerous alarms coming in after a trip which can be much more distracting than the fire. In his nuclear safety area, conditions (pressure, temperature...) were stable and charging was started within the first 2 minutes. The crew thought that there could have been someone in the breaker room at the time of the fire. This would have accounted for the crew knowing what was going on so quickly (e.g., the crew knew about the fire within 2-3 minutes of the start of the event). They did about 3 briefs in the first hour. There were so many alarms going on that coordination and setting priorities was somewhat difficult. The shift manager needed these briefs to pull all the information together. The first brief occurred when the MCR crew transitioned out of the trip response EOP. He asked for a brief from the Unit 2 CRS. The STA, SE and Unit 2 CRS worked closely on addressing alarms and the STA kept the SM well informed. It was fortunate that so many people were available. Without them there would have been delays in managing the fire. It was not too significant for the nuclear safety aspects of this particular event. Once the Control Room Supervisor (CRS) knew about the fire in the switchgear room, he was concerned about spurious actuations. Power level in the reactor was very low. CRS was 80% sure that AFW was manually started. The MSIVs were manually closed very soon, since circulating water was unavailable. 

Opethe the discopeFor impof thstafeve
Fire Event Review 

B-12 

Table B-2 Summary of the fire event 2 review (continued) 

PSFs Findings Pertinent to Event Imp

Complexity of the Required Diagnosis and Response, the Need for Special Sequencing, and the Familiarity of the Situation 

During a normal plant startup the task was shifting from RAT to Unit 3 generator (UAT) at about 30% power, when the first signs of the problems 

to come were a variety of alarms and loss of all non-1E 4 KV power. The cubicles contained only non-1E power (e.g., like losing the switchyard) that could cause loss of feedwater. The RO reported to the CRS that there 

was no secondary power and after the reactor trip they ought to trip MSIVs and go onto atmospheric dump. As soon as the UAT breaker closed unexpected alarms appeared in the MCR - first a few and then many more. The compressors are sensitive to grid fluctuations and generate alarms and that happened. The RO used 4 main circ pumps instruments as a check on off-site power and noted that non-safety electrical power was unavailable. 1E power was available. Additionally, there was zero (0) speed indication on the RCPs, but indication lights indicated that they were running; thus the RO was aware of confusion on some plant indications. The RO closed the MSIVs almost immediately because it was obvious they were quickly losing the 

secondary side of the plant. After learning of the fire, the CRS gave the fire AOI to a RO and the other unit CRS immediately. The fire AOI is not very easy to use, because they do not train on it as often. It also seems to be written for the best case fire, i.e., a fire with no other significant challenges. If something else occurs (e.g., a primary or secondary leak), dealing with the situation could be more of a challenge. 

DiffeveincropeThe use scre
B-13 

Table B-2 Summary of the fire event 2 review (continued) 

PSFs Findings Pertinent to Event Imp

Workload, Time Pressure, and Stress 

The site had never gone through a real loss of offsite power (LOOP). This event produced many more alarms than in the simulator. The procedures didn't work so well for this LOOP like event, since we had never had one. For example, with no seal water, all secondary pumps leaked enough water to cause flooding. Later, the CST overflowed by gravity drain. During the fire, the staff in the MCR was calm; especially since the primary system and steam generator feed status were OK. From a safe shutdown point of view, everything went fine. As it was learned that they had also lost the main turbine lube oil pumps 

and there had likely been turbine damage (i.e., a very depressing situation for the staff), the operator’s main action tasks dealt with venting hydrogen from the main generator and possibly restoring the lube oil. They did not restore lube oil, however, because the turbine engineer warned that the bearings were too hot and if they restored the lube oil, it might likely start another fire. 

CretaskgoinThe incrto sHEP 
Fire Event Review 

B-14 

Table B-2 Summary of the fire event 2 review (continued) 

PSFs Findings Pertinent to Event Imp

Team/Crew Dynamics and Crew Characteristics [Degree of Independence Among Individuals, Operator Attitudes/Biases/Rules, Use of Status Checks, Approach for Implementing Procedures (e.g., Aggressive Crew vs. Slow/Methodical Crew)] 

After the fire was announced, an RO went through the turbine hall and approached the switchgear room. He observed that the switchgear room 

door was open, dense black smoke inside, and felt a strong vibration 

(from turbine slowing down). He met the Fire Department staff just outside 

the area. He checked the room ventilation status and found out the fans were powered by the same area so they probably would not be available. The CRS could have declared a fire or an annunciator event; he declared the fire because that's where the most help was needed. He knew that the 

primary system and steam generator feed status were OK so the focus 

needed to be on the fire. Standard procedures do not rely on annunciators/alarms at all; rather the instruments are used. Communications in the MCR are handled by CRS. 

Even in the case of instrument problems, MCR operators are continually trained to rely on multiple indications for decision making, whether there is a fire or not. Trainers have always given operators multiple failures (the operators used to complain about the unreality of these unconnected failures). After the fire the operators became much more tolerant about training with apparently unconnected failures, recognizing what had happened during a real fire. 

The real “We get didnwe with pumcauoveThe screthrosetsmodcueman
B-15 

Table B-2 Summary of the fire event 2 review (continued) 

PSFs Findings Pertinent to Event Imp

Available Staffing/Resources Only 3 operators are needed to carry out the reactor trip EOP, so one RO 

was an extra man for the AOI procedure. The reactor was shutdown and they soon had secondary cooling via AFW. They soon lost all annunciators (the small alarm tiles) but not the instruments. Some indicator lights went off, some went green. The crew wanted to restore the annunciators. All breakers at the plant use DC control power and the bus they lost killed some control power. The RCPs were still running; they have three power sources (UAT, RAT, and the other unit’s RAT). The primary responsibility of the Operations Fire Technical Advisor 

(OFTA) is advising the fire department on what equipment and materials are important in the room where the fire is located from an 

operational/safety point of view. The OFTA needs an integrated plant understanding. There is no formal qualification for OFTA; qualification comes with Control Operator qualifications. The OFTA and Fire Department captains and personnel met for the first time during the event. The position is more an "Emergency Tech Advisor" who deals with other emergencies, as well as fire. An RO was assigned to support fire crew during this event. 

BeinEOdiffithe time the taskresosevfuncprocnecperfto bconThe screthousmalittle opebeeothefewsafejeopbarrarea
Fire Event Review 

B-16 

Table B-2 Summary of the fire event 2 review (continued) 

PSFs Findings Pertinent to Event Imp

Ergonomic Quality of the Human-System Interface (HSI) 

Manual notification of fire. A few minutes into the event, a guy came running in and said there is a fire, probably a chem. tech. With that announcement, the Shift Manager (SM) started to think about the EPIPs. [Note: SM takes on the EPIPs (emergency coordination and offsite notifications) but does not take over plant procedures.] A couple of minutes after the Trip, they lost annunciators and all noise. Therefore, the MCR crew did not trust indications; so all indications were double checked. The primary system status remained OK during the entire event, with all safety-related buses and equipment always available. During the event the Fire Department asked RO to inspect the room. He was nervous because he had no breathing protection. The SCBAs were not at the location and the Fire Department uses Scott air packs. They don't train the operators on their equipment. The smoke had decreased, so he entered the room and then reported on his observations. 

The redufillemetsmoScractu
B-17 

Table B-2 Summary of the fire event 2 review (continued) 

PSFs Findings Pertinent to Event Imp

Environment in Which the Action Needs To Be Performed 

It was too dark in the locker area to find a flashlight. When he got to the room it was dark – only emergency battery-powered lights were on: they were OK but not good lighting. Once his eyes adjusted to the light, he could read the labels. While the lighting loss affected his response a little, 

he said that overall it was not a major deterrent. With regard to the RO’s willingness to abandon the MCR, he indicated he is very willing to leave. He thought that if there was enough smoke to need an air pack, he would prefer to leave instead. This RO’s view was that SCBA gear is really provided for earthquake with chemical release. 

With regard to MCR habitability in other circumstances, the SRO indicated his preferences would be to evacuate if there are flames. If there is just smoke, they would don SCBAs, keep a few persons in the MCR, and simultaneously start manning remote shutdown. If there is only control problems, man both areas (MCR and remote) but the tendency would be to not leave the MCR. With regard to the specific issue of MCR abandonment, it seems clear that the threshold for when it is necessary to do so differs from person to person and is not a clearly defined decision. 

At osaid the extirepowas connew and say not in thAssactiimpexaThe addthe necperhseehanbe uremeveconMCoka
Fire Event Review 

B-18 

Table B-2 Summary of the fire event 2 review (continued) 

PSFs Findings Pertinent to Event Imp

Accessibility and Operability of the Equipment To Be Manipulated 

They don't actually use keys to get to/through radiation areas. Keys are under Security controls so operations does not test them. If there were to be a problem with the keys, they can get another set of keys. SCBA gear is provided for earthquake with chemical release, and can be used for fire. An OFTA kit was prepared for the future that includes an audio recorder, communications gear, note pads and other materials. This is now available. However, it includes a copy of the fire AOI, which in the operator's judgment may not be particularly useful for the OFTA. The Fire Department carries the fire preplans, which have much more useful onscene information. 

The impshuthe wouthe can the exisprocof wThe scothe train

Need for Special Tools (Keys, Ladders, Hoses, Clothing Such as To Enter a Radiation Area) 

Control room operators don't actually use keys to get to/through radiation areas. Keys are under Security controls so operations does not test them. 

If there were to be a problem with the keys, they can get another set of keys. An OFTA kit was prepared for future that includes an audio recorder, communications gear, note pads and other materials. This is now available. 

The the sceThe impshuthe wouthe can the exisprocwho 
B-19 

Table B-2 Summary of the fire event 2 review (continued) 

PSFs Findings Pertinent to Event Imp

Communications (Strategy and Coordination) and Whether One Can Be Easily Heard 

Operators do periodic briefs during an event: what's happened, current status, and what we're going to do next. They don't routinely describe how they expect the plant to respond. A few minutes into the event, a guy came running in and said there is a fire - probably a chem. tech. CRS could have declared a fire or an annunciator event. He declared a fire because that's where help was needed With regard to how often to talk to the MCR staff, CRS said that that is a judgment call as to how important it is that the MCR staff be made aware of conditions at the scene of the fire. 

Thinwas into werwatfire spraFireWhy The not enethat thus firefUncknoaddThe addothemigworinte

Special Fitness Needs All crew passed normal health screening for license. Som

imp
Fire Event Review 

B-20 

Table B-3 Summary of the fire event 3 (1975) review8

PSFs Findings Pertinent to Event Imp

Applicability and Suitability of Training/Experience 

The cable spreading room event was new in concept for the team. Little 

experience on the effects relative to use of EOPs and application of fire fighting techniques. No simulator training available at the time of the event. Lack of knowledge on effects of water on cables needed to put the fire out. The basic training on plant systems provided operations with knowledge and ability to use systems such as the control rod drive cooling system to support injection to the core and maintain core cooling. Did not evaluate precursor fires started by using open flame to test room seal effectiveness. 

Lacof fisystacti DewhecoutrainsucIncoprevand the 

Suitability of Relevant Procedures and Administrative Controls 

Process for testing seal with an open flame was informal and not in procedures. Procedural guidance was not sufficiently explicit for dealing with fire fighting methods, dealing with confusing instruments, anticipating impact of fire on plant safety systems, and spurious actions caused hot shorts as 

cable insulation failed. The structure for organizing technical support was absent. Lack of procedural guidance on using systems such as the CRD cooling 

system. Hence, the crew was taking actions based on system knowledge and problem solving. 

Initicovthe The bouthat knoConplanto reHEP innothe 
B-21 

Table B-3 Summary of the fire event 3 (1975) review (continued) 

PSFs Findings Pertinent to Event Imp

Operator Action Tendencies and Informal Rules 

The operators did not manually trip the units during the first 30 minutes of the fire. The MCR crews were under the erroneous assumption that use of water 

on cable fires was a hazard to fire fighters. Use of special fire equipment for this application was unknown to the control room operators. This led to reluctance to declare a fire and apply water to put fire out as a management decision. The operators were not prepared for dealing with confusing instruments and spurious actions caused by the fire. The tendency was to believe instruments until proven illogical. Operators stayed in control room using air pack and temporary air hose 

set up to clear atmosphere. 

The careeacto eprotThe for tto caftestreaddThe shoenvinsttrainusinrese
Fire Event Review 

B-22 

Table B-3 Summary of the fire event 3 (1975) review (continued) 

PSFs Findings Pertinent to Event Imp

Availability and Clarity of Instrumentation (Cues to Take Actions and Confirm Expected Plant Response) 

"Control board indicating lights were randomly glowing brightly, dimming, and going out; numerous alarms occurring; and smoke coming from beneath panel 9-3, which is the control panel for the emergency core cooling system (ECCS). The operator shut down equipment that he determined was not needed, only to have them restart again." Misleading indications that some safety systems were operating; later found not operable. Later review indicates this could be due to hot shorts. The fire caused multiple confusing instrument readings; at least two spurious actions occurred leading to a confusing idea of plant system configuration. Operators reported that an additional control room fire might have occurred due to electrical overload triggered by the degraded cables in the CSR. Operators put it out with a CO2 hand held extinguisher. Some key sensors became unavailable (e.g., suppression pool temperature). 

Sincfor cmetconcheThe the knoconand tray The anaburdsecbusand 
B-23 

Table B-3 Summary of the fire event 3 (1975) review (continued) 

PSFs Findings Pertinent to Event Imp

Time Available and Time Required to Complete the Act, Including the Impact of Concurrent and Competing Activities 

The fire was manually detected when it occurred and was reported to control room about 15 minutes later. The fire continued after this period adding to concurrent activities. The crew was rushed to find sources of water to keep the core covered while pumps that were initially tripped as a result of the fire were recovered. 

Lacthe assDelredusystand DetHEP adduseAutaddwin

Complexity of the Required Diagnosis and Response, the Need for Special Sequencing, and the Familiarity of the Situation 

Crew was not familiar with plant behavior under the fire event conditions. This event was complicated by misleading indications, some spurious actions and continued fire progression for over five hours impacting both operating units. Although control circuits for many of the systems which could be used for Unit 1 were ultimately disabled by the fire, the station operating personnel were able to institute alternative measures by which the primary system could be depressurized and adequate cooling water supplied to the 

reactor vessel. Unit 1 was shut down manually and cooled using remote manual relief valve operation and condensate booster pump, and control rod drive system pumps. Unit 2 was shut down and cooled for the first hour by the RCIC. After depressurization, Unit 2 was placed in the RHR shutdown cooling mode with makeup water available from the condensate booster pump and control rod drive system pump. 

The abilfires deteand AppWithand locaappbetwactiHRA innoundproc
Fire Event Review 

B-24 

Table B-3 Summary of the fire event 3 (1975) review (continued) 

PSFs Findings Pertinent to Event Imp

Workload, Time Pressure, and Stress 

Operator burden was high due to numerous factors including means for removing smoke from the control room, higher stress knowing that the fire fighting activities were not being successful, and dealing with numerous equipment failures both independent of the fire as well as due to fireinduced failure of the ICS because of erroneous signals. 

Smcrew conboth crew the crewstreof a accIn therroalthotheconis n

Team/Crew Dynamics and Crew Characteristics [Degree of Independence Among Individuals, Operator Attitudes/Biases/Rules, Use of Status Checks, Approach for Implementing Procedures (e.g., Aggressive Crew vs. Slow/Methodical Crew)] 

Operators required several attempts to manually operate key valves to align the condensate booster pump on unit 2 because the time required for the manual action exceeded the supply of air in the SCBAs which required recharging. Use of the CARDOX system in the cable spreading room increased the pressure, driving smoke into the control room. Effectiveness of CO2 was limited in stopping the fire. 

Opeconwerundand to cassloss diffidrivgrou
B-25 

Table B-3 Summary of the fire event 3 (1975) review (continued) 

PSFs Findings Pertinent to Event Imp

Available Staffing/Resources People were available because of 2 units, and construction staff. No 

indication that lack of staff had an impact on safe shutdown though firefighting staffing was slow. 

The conThe exteunlepres

Ergonomic Quality of the Human-System Interface (HSI) 

Lack of an automated fire indication panel by fire zone delayed indication of the fire to the control room – these are standard features in control rooms today. 

Use accfor t

Environment in Which the Action Needs To Be Performed 

There was smoke in the control room from both secondary electrical fire and pressurization of the cable spreading room with CO2. 

Smoke in the area of key valves hampered operation to maintain safe shutdown. 

Envespbe amet

Accessibility and Operability of the Equipment To Be Manipulated 

The location of some manual valve operating stations was remote and difficult to reach with SCBAs. Because of the difficulties and lack of practice, the operators accomplished the task in a longer time than it would take under non-fire conditions. 

HRA an etask demtherpath 

Need for Special Tools (Keys, Ladders, Hoses, Clothing Such as To Enter a Radiation Area) 

SCBAs were needed and the ability to recharge was needed. Additional SCBAs would have been useful. 

The maishushoope
Fire Event Review 

B-26 

Table B-3 Summary of the fire event 3 (1975) review (continued) 

PSFs Findings Pertinent to Event Imp

Communications (Strategy and Coordination) and Whether One Can Be Easily Heard 

The overall strategy in both units for safe shutdown was the same, but used different equipment and actions. Following trip use high pressure systems if available, then depressurize manually to the suppression pool, and inject with low pressure systems. Heat removal accomplished through turbine driven systems to avoid the need for electrical driven pumps. Communications were hampered by problems with the phone lines because of complications with the construction phone lines. In plant communications via phone lines were lost. 

Sincachare actirequonly betwavacomwirepen

Special Fitness Needs This event required operations in smoke filled areas and work with heavy 

SCBAs. 

Operequlice
C-1 

C

DETAILED QUANTIFICATION OF POST-FIRE HUMAN 

FAILURE EVENTS USING EPRI FIRE HRA METHODS 

C.1 Objective 

This purpose of this attachment is to present a detailed methodology for quantification of fire 

HEPs using the EPRI HRA methods as implemented in the EPRI HRA Calculator [1]. This 

attachment is structured to follow the EPRI HRA Calculator® 1 using the HCR/ORE and 

CBDTM [2]/THERP [3] methods for quantification. If the analyst is not using the EPRI HRA 

Calculator software, then sufficient guidance is provided so that an analyst could quantify the 

HEP by hand. The EPRI HRA methodologies are based on EPRI’s SHARP and SHARP1 HRA 

framework [4]. The approach in this appendix is to step HRA analysts through the HRA tasks 

needed to develop, quantify and document human failure events (HFEs). 

The EPRI HRA methodology embodies several of the HRA quantification methods currently 

used in the US industry. It use allows the user to select among the following quantification 

methods: THERP, ASEP, HCR/ORE, CBDTM, SPAR-H for post-initiator (latent) 

quantification. These methods are primarily applied to level 1 internal events and LERF HRA. 

The methods are mostly task-based and decompose operator errors into two categories; cognitive 

(detection, diagnosis, and decision-making), failure and execution (manipulation or 

implementation) failure. These HRA methods provide sufficient resolution to meet the needs of 

the internal events PRA model. The advantage of using existing methods for fire HRA is that 

they evaluate fundamental aspects and factors affecting human performance, and thus applying 

these methods to fire scenarios should yield a good first-order approximation of operator failure, 

and would further 

be consistent with the modeling for non-fire scenarios at many nuclear power plants. 

C.2 EPRI Performance Shaping Factors 

NUREG/CR-6850 [5] suggests that the following PSFs (from NUREG-1792 [6]) be considered 

in quantification but does not describe how to model these effects. 

• Available staffing resources 

• Applicability and suitability of training/experiences 

• Suitability of relevant procedures 

 

1

 HRA Calculator is s registered trademark of EPRI. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-2 

• Availability and clarity of instrumentation 

• Time available 

• Environment in which act needs to be performed 

• Accessibility and operability of equipment to be manipulated 

• Need for special tools 

• Communications 

• Team/crew dynamics 

• Special fitness needs 

The ASME PRA Standard [7] requires that the PSFs listed in Table C-1 be considered for 

post-initiators. These PSFs include most of the PSFs suggested by NUREG/CR-6850 but 

“communications” and “team/crew dynamics” are not explicitly stated in ASME PRA Standard 

“Special fitness needs” from NUREG/CR-6850 can be considered under “Environment (e.g., 

lighting, heat, radiation) under which the operator is working” in the ASME PRA Standard. 

Table C-1 

ASME PRA standard performance shaping factors 

SR Performance Shaping Factors 

HR-F2 Accident sequence specific timing of cues, and time window for successful completion 

 Accident sequence specific procedural guidance 

 The availability of cues and other indications for detection and evaluation errors 

 The specific high level tasks (e.g., train level) required to achieve the goal of the response 

HR-G3 Quality [type (classroom or simulator) and frequency] of the operator training or experience 

 Quality of the written procedures and administrative controls 

 Degree of clarity of the cues/indications 

 Human-machine interface 

 Time available and time required to complete the response 

 Complexity of the required response 

 Environment (e.g., lighting, heat, radiation) under which the operator is working 

 Accessibility of the equipment requiring manipulation 

 Necessity, adequacy, and availability of special tools, parts, clothing, etc. 

HR-G7 The time required to complete all actions in relation to the time available to perform the 

actions 

 Factors that could lead to dependence (e.g., common instrumentation, common 

procedures, increased stress, etc. 

 Availability of resources (e.g., personnel) 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-3 

The general PSFs incorporated in the EPRI HRA methodology are shown in Table C-2. The 

EPRI HRA methodology was specifically designed to meet the requirements of the ASME PRA 

Standard and therefore the PSFs in the EPRI HRA methodology reflect those of the ASME PRA 

Standard. 

Table C-2 

EPRI HRA methodology performance shaping factors 

Category Performance Shaping Factors 

Cue/s Initial 

 Subsequent 

Procedures Cognitive 

 Execution 

 Other 

Complexity of Response Cognitive 

 Execution 

Training Classroom 

 Simulator 

 JPM 

Timing Delay time (when cue occurs with respect to origin) 

 System time window (time to reach undesired outcome) 

 Manipulation time (to perform required action) 

 Median response time (to detect, diagnose, decide) 

Accessibility Main control room 

 Locally for manual actions 

Environmental Lighting 

 Heat/humidity 

 Radiation 

 Atmosphere 

Special Requirements Tools 

 Parts 

 Clothing 

Stress Plant response as expected 

 Workload 

 Environmental PSFs (above) 

Dependency Analysis Shift Change 

 Common Cognitive 

 Timing between cues 

 Time required to complete actions 

 Available resources 

 Stress 

 Same or different locations 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-4 

The PSFs that are considered in the CBDTM implemented in the EPRI HRA methodology are 

listed in Table C-3. 

Table C-3 

CBDTM[5] performance shaping factors 

Type Designator Decision Tree Performance Shaping Factors 

pc a: Data not available Indication Available in Control Room 

Indication Accurate 

Warning or Alternate in Procedure 

Training on Indication 

pc b: Data not attended to Low vs. High Workload 

Check vs. Monitor 

Front vs. Back Panel 

Alarmed vs. Not Alarmed 

pc c: Data misread or 

miscommunicated 

Indicators Easy to Locate 

Good/Bad Indicator 

Formal Communications 

Failures in the 

Operator–Information 

Interface 

pc

 d: Information 

misleading 

All Cues as Stated 

Warning of Differences 

Specific Training 

General Training 

pc e: Relevant step in 

procedure missed 

Single vs. Multiple Procedures 

Graphically Distinct 

Placekeeping Aids 

pc f: Misinterpret 

instruction 

Standard Unambiguous Wording 

All Required Information 

Training on Step 

pc g: Error in interpreting 

logic 

“NOT” Statement 

“AND” or “OR” Statement 

Both “AND” & “OR” 

Practiced Scenario 

Failures in the 

Operator-Procedure 

Interface 

pc

 h: Deliberate violation Belief in Adequacy of Instruction 

Adverse Consequence if Comply 

Reasonable Alternatives 

Policy of “Verbatim” Compliance 

The PSFs from NUREG-1792 [8], the ASME PRA Standard and the CBDTM/THERP as 

embodied in the EPRI HRA methodology are summarized in Table C-4. 
Detailed Quantification of Post-Fire Human Failure Events Usin

C-5 

Table C-4 Performance shaping factors mapping 

NUREG-1792 ASME PRA Standard CBDTM

Timing Delay time (wrespect to origin) 

Accident sequence specific timing of cues, and time window for successful completion (SR HR-F2) Timing System time 

reach undesired out

Timing System time reach undesired outTiming Manipulation required action) Timing: Median respdiagnose, decide) 

Time available and time required to complete the action, including the impact of concurrent and competing activities 

Time available and time required to complete the response (SR HR-G3) 

Timing: Time availab

Availability and clarity of instrumentation Cue/s: Initial (cues to take actions as well as confirm expected plant response) 

The availability of cues and other indications for detection and evaluation errors (SR HR-F2) Cue/s: Subsequent 

Data not available: IControl Room Data not available: IData not attended toData not attended toPanel Data not attended toAlarmed Data misread or misIndicators Easy to LData misread or misGood/Bad Indicator 

Ergonomic quality of human-system interface (HSI) 

Degree of clarity of the cues/indications (SR HR-G3) Human-machine interface (SR HR-G3) 

Information misleadStated 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-6 

Table C-4 Performance shaping factors mapping (continued) 

NUREG-1792 ASME PRA Standard CBDTM

Procedures: CognitiProcedures: Execut

Accident sequence specific procedural guidance (SR HR-F2) 

Procedures: Other 

Data not available: Win Procedure Information misleadDifferences Relevant step in proSingle vs. Multiple Relevant step in proGraphically Distinct Relevant step in proPlacekeeping Aids Misinterpret instructUnambiguous WordMisinterpret instructInformation Error in interpreting Statement Error in interpreting Statement Error in interpreting “OR” Deliberate violation: Instruction Deliberate violation: Consequence if ComDeliberate violation: Alternatives 

Quality of the written procedures and administrative controls (SR HR-G3) 

Deliberate violation: Compliance 

Suitability of relevant procedures and administrative controls 

The specific high level tasks (e.g., train level) required to achieve the goal of the response (SR HR-F2) 

THERP[6] execution EOC for each step 
Detailed Quantification of Post-Fire Human Failure Events Usin

C-7 

Table C-4 Performance shaping factors mapping (continued) 

NUREG-1792 ASME PRA Standard CBDTM

Training Classroom Training Simulator Training JPM Data not available: TInformation misleadInformation misleadMisinterpret instruct

Applicability and suitability of training and experience 

Quality [type (classroom or simulator) and frequency] of the operator training or experience (SR HR-G3) 

Error in interpreting Scenario 

Complexity of the required response Complexity of Respo(SR HR-G3) Complexity of RespoThe specific high level tasks (e.g., train level) required to achieve the goal of the response (SR HR-F2) 

THERP[6] execution EOC for each step 

Dependency Analyscues Dependency AnalysChange Dependency AnalysCognitive Dependency Analyscomplete actions Dependency Analys

Complexity of required diagnosis and response. In addition to the usual aspects of complexity, special sequencing, organization, and coordination can also be contributors to complexity. 

Factors that could lead to dependence (e.g., common instrumentation, common procedures, increased stress, etc.) (SR HR-G7) 

Dependency Analyslocations 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-8 

Table C-4 Performance shaping factors mapping (continued) 

NUREG-1792 ASME PRA Standard CBDTM

Stress: Plant responStress: Workload Stress: Environment

Workload, time pressure, stress All listed under SR-HR-F2 + SR-HR-G3 

Data not attended toWorkload 

Environmental: LighEnvironmental: HeaEnvironmental: Rad

Environment in which the action needs to be performed 

Environment (e.g., lighting, heat, radiation) under which the operator is working (SR HR-G3) 

Environmental: Atmo

THERP[6] execution EOC for each step Special RequiremenSpecial Requiremen

Special fitness needs (For special situations expected to involve the use of heavy or awkward tools/equipment, carrying hoses, climbing, etc) 

The specific high level tasks (e.g., train level) required to achieve the goal of the response (SR HR-F2) 

Special Requiremen

Accessibility and operability of equipment to Accessibility: Main cbe manipulated 

Accessibility of the equipment requiring manipulation (SR HR-G3) Accessibility: Locally 

Special RequiremenSpecial Requiremen

The need for special tools (keys, ladders, hoses, clothing such as to enter a radiation area) 

Necessity, adequacy, and availability of special tools, parts, clothing, etc. (SR HR-G3) 

Special Requiremen
Detailed Quantification of Post-Fire Human Failure Events Usin

C-9 

Table C-4 Performance shaping factors mapping (continued) 

NUREG-1792 ASME PRA Standard CBDTM

Availability of resources (e.g., personnel) (SR HR-G7) 

Dependency Analysresources 

Available staffing and resources 

There is sufficient manpower to perform the action (HR-SR-H2) 

Communications (strategy and coordination) as well as whether one can be easily heard 

 Data misread or mis

Formal Communicat

Team/crew dynamics and crew characteristics [degree of independence among individuals, operator attitudes/biases/rules, use of status checks, approach for implementing procedures, (e.g., aggressive vs. slow and methodical)] 

ACCOUNT for any dependency between the HFE for recovery and any other HFEs in the sequence, scenario, or cutset to which the recovery is applied. (HR-SR-H3) 

Recovery by self revERF 

Data not available: IControl Room Data not available: I

Consideration of “realistic” accident sequence diversions and deviations (e.g., extraneous alarms, failed instruments, outside discussions, sequence evolution not exactly like that trained on). Information mislead

Stated 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-10 

C.3 Post Initiator EPRI HFE Analysis Framework 

The EPRI approach for quantification of post-initiators HFEs (regardless of the initiators 

(fire, internal events, or flood all use the same framework)) is to classify the HFE as two parts 1) 

detection, diagnosis, and decision phase and 2) an action phase. In the first phase there are three 

possible outcomes, a mistake (P1), a non-response (P2) and a correct response. In the second 

phase, there are two possible outcomes, a slip (P3) and a correct action. This representation is 

diagramed in Figure C-1 for the purpose of quantification. 

Failure 

Success 

 P3 

 P2 

 P1 

Detection/Diagnosis 

Decision 

Execution

Failure to 

process 

information in 

timely manner 

Cognitive 

processing 

procedural 

mistakes 

Failure 

Failure 

Figure C-1 

Post-initiator general HFE analysis framework 

This event tree format provides a natural vehicle for use of the ORE data. Because the 

HCR/ORE correlation is fitted to successful response times, it provides a characterization of the 

variation in time over which a correct detection, diagnosis, and decisions are made. In the figure 

C-1, P1 is quantified using CBDTM, P2 is quantified using HCR/ORE, P3 is quantified using 

THERP and the total HEP is the sum of all three probabilities. 

For existing EOP actions, which were previously modeled in the EPRI HRA methodology the 

HFE analysis follows this framework. For existing EOP actions not modeled in the EPRI HRA 

methodology, this is not necessarily true, and the base case must first be quantified in the EPRI 

HRA methodology and then modified to account for fire impacts. For fire response actions, if 

the EPRI HRA methodology is used for quantification the analysis will follow this framework. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-11 

For both fire HRA and internal events HRA there are several types of HFEs that can be 

evaluated to 1.0 based on a simple qualitative analysis. For the scenario identified, if anyone 

of the following is true the HEP evaluates to 1.0. It is outside the scope of the EPRI method to 

quantify these types of actions. 

• There is not enough time to complete the action. In EPRI terms this means Tsw is less that 

the sum of Tdelay, T1/2 and Tm

• There is not enough crew available to complete the action within the required time 

• There are no cues for diagnosis. The EPRI approach bases quantification of cognition on 

identification and interpretation of the cues. If the fire fails all the instrumentation required 

for diagnosis then there is no reason to expect the operator will respond correctly fire PRA 

C.4 Timing and Crew Response Structure 

Developing the timeline is fundamental to understand the EPRI approach. The EPRI HRA 

method applies the following definitions for time regardless of the method used for 

quantification: 

• TSW = System time window – This is defined as the time from reactor trip to an undesired end 

state. 

• Tdelay = Time from start of fire (or transient in the internal events case) until cue is reached 

• TM = Manipulation time 

• T1/2 = Median response time 

The Timing Analysis documents the source of the timing in accordance with ASME Standard 

Requirements HR-G4 and HR-G5 and is shown below. 

The HCR/ORE studies identified the three types of actions based on cue response structure and 

the timeline development. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-12 

Response

Starts

Response

Ends

Irreversible

Damage

State

Cue

TSW

T1/2 TM

time

CP1: DO immediately ...

Response

Starts

Response

Ends

Irreversible

Damage

State

Cue

TSW

T1/2 TM

time

Plant limit reached

(alarm/indication)

CP2: WHEN plant limit is reached THEN DO

Response

Starts

Response

Ends

Irreversible

Damage

State

Cue

TSW

T1/2 TM

time

Plant limit reached

(alarm/indication)

CP3: BEFORE plant limit is reached DO

Figure C-2 

Cue-response structure timelines for type CP operator actions 

CP1 HFEs are simple proceduralized actions and if the cue is received the operators will respond 

to it. An example of would be a procedure step that reads “Check AFW flow, if no flow then 

start AFW pump.” 

CP2 HFEs are actions where the operators receive an alert but must delay implementation until 

a specific plant parameter is reached. An example would be when the cues for feed and bleed are 

stated early in the procedure and the operators are directed to continue with procedure until SG 

level reaches a specific point, When the SG level limits are reached then the operators perform 

feed and bleed. CP2 actions require that the operators are instructed to perform an action when

and not before a plant limit is reached. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-13 

CP3 HFEs are actions where the operators must diagnosis and respond before a plant limit is 

reached. For a loss of all AFW the procedures direct the operators to try to restore AFW until the 

cues for feed and bleed are met. In this case the cue for restoring AFW would be loss of all AFW 

and the operators must complete this action before the cues for feed and bleed are reached. 

The HCR/ORE correlation uses these classifications to determine sigma which is a measure 

of crew to crew variability. 

C.5 Instrumentation Impact on Fire HFEs 

For discussion purposes there are three categories of potential instrumentation impacts on fire 

HFEs: 

• No impact – All the required instrumentation is available. 

• Partial impact – A minimum set of the required instrumentation is available. 

• Total impact – Less than the minimum set of required instrumentation is available. 

The information needed to evaluate the impact consists of the following: 

• Is the required indication available in the control room? 

– This is successful if all indication for the specific action is available or if a minimum set 

of information for the specific action is available. 

– This is unsuccessful if all indication for the specific action is failed. This will be the case 

for total impact i.e. no instrumentation available, in which case the HEP evaluates to 1.0. 

• Are the indications that are available accurate? 

– The indications are known to be accurate if the fire does not impact any of the 

instrumentation required for the specific action. 

– The indications are assumed to be inaccurate if there is a partial impact. 

• If the normally displayed information is expected to be unreliable, is a warning or a note 

directing alternate information sources provided in the procedures? 

– The procedure lists alternate instrumentation to perform the specific task or provides 

a warning of potentially incorrect readings. 

– The procedure provides no alternate instrumentation or a warning. In this case for 

existing EOP actions, there are no warnings in the EOPs for fire related impact on the 

instrumentation. 

• Has the crew received training in interpreting or obtaining the required information under 

conditions similar to those prevailing in this scenario? 

– The operating crew has received training in interpreting or obtaining the needed 

information under a fire situation. For cases where there is partial impact i.e. a minimum 

set of instrumentation remains available, the cognitive HEP evaluates to 5.0E-02 and no 

recoveries are applied. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-14 

– The operating crew has not received training in interpreting or obtaining the needed 

information under a fire situation. If operators do not get trained on performing the EOPs 

during fire scenarios, the cognitive HEP will evaluate to 0.5 for cases with partial impact 

on instrumentation and no recoveries are applied. 

These impacts can be modeled directly in the EPRI HRA methodology using the CBDTM and 

modifying the branch selections for pca and pcd and will be discussed in detail in the following 

sections. 

C.6 Quantification 

Using the EPRI HRA methodology, it is relatively easy to modify existing internal events HEPs 

to reflect fire impacts. Quantification of fire response actions follows the same approach as for 

existing actions but there is no previous analysis to build upon and the HFE must be developed 

as a new HFE within the fire contexts. Following detailed fire PRA development and operator 

interviews, the HFEs may be finalized by incorporating operator interview insights and/or other 

insights from the fire PRA model. 

C.6.1 Method Selection 

Similar to internal events HRA, both the CBDTM and the HCR/ORE are to be considered for 

fire HRA. Both methods address detection, diagnosis, and decision-making --the HCR/ORE 

implicitly, and the CBDTM explicitly. The CBDTM was developed to provide a lower limit 

on the probability, since the HCR/ORE calculates very low probabilities for HFEs for which 

the time available is long relative to the time required. For fire HRA, instrumentations impacts, 

and PSF impacts can be directly addressed using the CBDTM. 

In the EPRI HRA methodology, the results of the HCR/ORE and CBDTM evaluations 

(consistent with the internal events PRA) are used for fire HRA. The same questions that are 

asked for internal events HRA for quantification can be asked for fire HRA. The HRA analysts 

response (in many cases the selection in the decisions) will be very different between the fire and 

internal events case. The EPRI approach for quantification is symptom based not initiator based 

and thus the same questions are still applicable for fire HRA. 

C.6.2 EPRI HFE Approach and Documentation 

The subsections in this section follow the format of the EPRI HRA methodology. The fields 

described in this section are fields that are common to all methods used in the EPRI HRA 

methodology. The following sections apply to all HFEs - whether they are fire response HFEs 

or existing internal events HFEs. 

C.6.2.1 HFE Approach 

To begin quantification, a new HFE needs to be created. It is good practice to setup a naming 

convention for HFEs that will allow for multiple variations of the same HFE. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-15 

For existing HFEs, the basic event record can be copied to a new record to allow for consistency 

and easy modification. Figures C-3 and C-4 show screen shots of the basic event data for a fire 

HFE. The field Related Human Interactions, could list the variations of the basic event (if any). 

For existing EOP HFEs the field Related Human Interactions could list the basic event from 

which the HFE was derived. 

For fire response HFEs, a new basic event is created. 

Figure C-3 

EPRI HRA methodology basic event setup for fire HFE analysis 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-16 

Figure C-4 

EPRI HRA methodology screen shot showing multiple variations of a base case HFE 

C.6.2.2 Cues 

Cues are addressed in the same way in both fire and internal events HFE analyses. For fire HRA, 

the identification of the cues should list the specific instrumentation required for diagnosis. If 

the instrumentation is entered into the Initial Cue or Recovery Cue fields, a complete list of all 

instrumentation required for fire HRA can be generated and this list can easily be incorporated 

into in the component selection Task 2 of NUREG/CR-6850. Figure C-5 shows the how the 

identification of the cues are documented in the EPRI HRA methodology. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-17 

Figure C-5 

EPRI HRA methodology identification of cues 

C.6.2.3 Procedures 

Procedures are addressed in the same way for fire and internal events HFEs. For fire HRA there 

maybe both an EOP and a fire procedure in use at the same time. Figure C-6 shows how the 

procedures are documented in the EPRI HRA methodology for a specific HFE. This window 

is for documentation purposes and the effects the procedures have on cognition are modeled in 

decision trees pc

a, pcd, pce, pcf, and pch. The procedures are also used to identify the critical task 

required for execution modeled using THERP. 

In addition to the specific procedures for each HFE, the complete list of fire procedures reviewed 

during the fire procedures screening and review (ASME requirement HR-E2) could be added to 

the procedures database for documentation. The procedures database is shown in Figure C-7. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-18 

Figure C-6 

EPRI HRA methodology documentation of procedures 

Figure C-7 

EPRI HRA methodology documentation of fire procedure review 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-19 

C.6.2.4 Scenario Description 

The Scenario Description window (Figure C-8) is where the HFE is defined and documented 

in accordance to the ASME Standard high level requirement HR-F1. The Identification and 

Definition field should include descriptions about: 

• Initial conditions, 

• Accident sequence, 

• Preceding operator errors and successes, 

• Operator success criteria, 

• Consequence of failure 

Instrumentations impacts are also identified in the scenario description along with known 

equipment failed by the fire. 

Assumptions are to be documented in the Key Assumption field in accordance with ASME 

requirement HR-I3. 

Figure C-8 

EPRI HRA methodology scenario description window 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-20 

C.6.2.5 Operator Interviews 

The insights gained from the operator interviews are documented in the Operator Interview

Insights window (Shown in Figure C-9) and include: 

• Documentation of talk through with plant operations and training personnel to confirm that 

interpretation of the fire procedures are consistent with plant operation. (ASME requirement 

HR-E2) 

• Documentation of talk-thoughts with operators to confirm the response models for the 

scenarios modeled. (ASME requirements HR-E3) 

Figure C-9 

EPRI HRA methodology operator interview insights window 

C.6.2.6 Manpower Requirements 

As part of the analysis framework (see figure C-2), the crew requirements should be identified 

and documented in the Manpower Requirements window (Shown in Figure C-10). If there is not 

enough crew available to complete the actions then the HEP should be set to 1.0. 

It should be noted that NUREG/CR-6850 Task 12 assumes that 

“Even if one or more MCR persons are used to assist in ex-control room activities such as 

aiding the fire brigade, the minimum allowable number of plant operators remains available.” 

The man power requirements for individual HFEs are used in the dependency analysis to verify 

that sufficient manpower would be available to perform all the actions implied by the HFEs in a 

cutset or sequence. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-21 

Figure C-10 

EPRI HRA methodology manpower requirements window 

C.6.2.7 Time 

Timing is documented in the EPRI HRA methodology as shown in Figure C-11. 

Figure C-11 

EPRI HRA methodology timing window 

The EPRI HRA method applies the following definitions for time: 

• TSW = System time window – This is usually the time from reactor trip to an undesired end 

state 

• Tdelay = Time from start of transient until cue is reached 

• TM = Manipulation time 

• T1/2 = Median response time 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-22 

The timing analysis documents the source of the timing in accordance with ASME Standard 

Requirements HR-G4 and HR-G5. For existing internal events HFEs, this field can document 

both the internal events timing and any adjusts made to account for the fire. 

If the implementation of the EOPs is delayed due to the performance of the fire procedure/s, the 

delay time for all existing internal events HFEs is systematically increased by the average time it 

would take to perform the fire procedure/s, typically about 30 minutes. In this case, 

Tdelay = Tdelay base case +30 min 

The manipulation time (Tm) should account for any travel time to reach the execution location. 

This travel time could be significantly impacted due to the fire location. Tm can be obtained from 

a demonstration of feasibility, job performance measures (JPMs) or walk through or talk through 

with the operators. As an initial estimate for existing internal events HFEs, it is recommended to 

increase TM by at least 10 minutes. 

If the Time available for Recovery is less than zero as in the example shown in Figure C-12, 

the HEP should evaluate to 1.0, as there is insufficient time to perform the action. 

Figure C-12 

Time window – time available for recovery is less than zero 

C.6.3 Cognitive Modeling Using CBDTM 

The CBDTM is used to assess cognitive HEPs for procedure-directed actions. It is applied to 

major decision steps such as transfers to another procedure, or the decision to initiate some process. 

The CBDTM assesses HEPs by evaluating separate decision trees that evaluate each of the 

cognitive failure mechanisms shown in Table C-5. There are two high level failure modes; 

failure of the operator-information interface and failure of the operator-procedure interface. 

Each high level failure mode is comprised of a four failure mechanisms. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-23 

Table C-5 

CBDTM failure mechanisms 

High Level Failure Mode Designator Description 

pc a: Data not available 

pc b: Data not attended to 

pc c: Data misread or miscommunicated 

Failures in the Operator–

Information Interface 

pc d: Information misleading 

pc e: Relevant step in procedure missed 

pc f: Misinterpret instruction 

pc g: Error in interpreting logic 

Failures in the Operator–

Procedure Interface 

pc

 h: Deliberate violation 

Guidance from EPRI TR-100259 on each of the CBDTM decision trees is provided in the 

following sections. Where applicable, additional guidance on how to model fire scenario is also 

included. 

C.6.3.1 Failure Mechanism a, Data Not Available 

Training on

Indication

Warning or

Alternative

in

Procedure

Indication

Accurate

Indication

Available in

CR

Yes

No

(a) neg.

(b) neg.

(c) neg.

(d) 1.5E-03

(e) 5.0E-02

(f) 5.0E-01

(g) *

pc a

Figure C-13 

Decision tree for pca, data not available 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-24 

Table C-6 Guidance on decision nodes for pca, data not available 

Decision 

Node 

Guidance as Stated in EPRI 

TR-100259 [5] Guidance Specific for Fire HRA 

Indication Available in CR 

Is the required indication available in the control room? 

The yes branch is used when all indication for specific action set of information for the specific action is available. The no branch is used when all indications for the specific acthe case for total impact i.e. no instrumentation available, in wshould evaluate to 1.0. If branch g is selected for this decision tree, the HRA methodthat this HFE should be quantified as two separate actions. Ofor local actions. If there is no additional indicators (either in Ccredited for fire HRA then the HEP should be set to 1.0. The d0.0 or negligible should alert the analyst that HFE being modethis decision tree and needs to be redefined. 

HRA Calculator warning when selecting decision branch 
Detailed Quantification of Post-Fire Human Failure Events Usin

C-25 

Table C-6 Guidance on decision nodes for pca, data not available (continued) 

Decision 

Node 

Guidance as Stated in EPRI 

TR-100259 [5] Guidance Specific for Fire HRA 

Indication Accurate 

Are the available indications accurate? If they are known to be inaccurate (e.g., due to degradation because of local extreme environment conditions or isolation of the instrumentation) then select No. 

The yes branch is used when indications are known to be accthe fire. The no branch is used when the fire causes partial impact to therefore the indications are assumed to be inaccurate. 

Warning or Alternate in Procedure 

If the normally displayed information is expected to be unreliable, is a warning or a note directing alternate information sources provided in the procedures? 

The yes branch is used when the procedure lists alternate insspecific task or provides a warning of potentially incorrect reaThe no branch is used when the procedure provides no alternwarning during a fire. 

Training on Indication 

Has the crew received training in interpreting or obtaining the required information under conditions similar to those prevailing in this scenario? 

The yes branch is used when operating crew has received traobtaining the needed information in a fire situation. The no branch is used when the operating crew has not receior obtaining the needed information under a fire situation. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-26 

Figure C-14 

EPRI HRA methodology pca branch selection to account for instrumentation partially 

impacted by fire and general training credited 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-27 

C.6.3.2 Failure Mechanism b, Data Not Attended to 

(a) neg.

(b) 1.5E-04

(c) 3.0E-03

(d) 1.5E-04

(e) 3.0E-03

(f) 3.0E-04

(g) 6.0E-03

(h) neg.

(i) neg.

(j) 7.5E-04

(k) 1.5E-02

(l) 7.5E-04

(m) 1.5E-02

(n) 1.5E-03

(o) 3.0E-02

Alarmed vs.

Not

Alarmed

Front vs.

Back Panel

Check vs.

Monitor

Low vs.

High

Workload

pc b

Low

High

Check

Monitor

Check

Monitor

Front

Front

Front

Front

Back

Back

Back

Back

Alarmed

Alarmed

Alarmed

Alarmed

Alarmed

Alarmed

Alarmed

Value

Figure C-15 

Decision tree for pcb, data not attended to 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-28 

Table C-7 Guidance on decision nodes for pcb, data not attended to 

Decision 

Node Guidance as Stated in EPRI TR-100259 [5] Guidance Specif

Low vs. Hi Workload 

Do the cues critical to the HI occur at a time of high workload or 

distraction? Workload or distraction leading to a lapse of attention (omission of an intended check) is the basic failure mechanism for pcb, 

and it interacts with the next two factors. 

If the EOPs are implemented procedures, the workload is However, if the action is time base case HFE (for existing to have a low workload, the considered to have a low woassumed that the fire will be action is required. 

Check vs. Monitor 

Is the operator required to perform a one-time check of a parameter, or is he required to monitor it until some specified value is reached or approached. The relatively high probabilities of failure for the monitor branches are included to indicate a failure to monitor frequently enough to catch the required trigger value prior to its being exceeded, rather than complete failure to check the parameter occasionally. 

No additional guidance for fi

Front vs. Back Panel 

Is the indicator to be checked displayed on the front panels of the main control area, or does the operator have to leave the main control area to 

read the indications? If so, he is more likely to be distracted or to simply decide that other matters are more pressing, and not go to look at the cue immediately. Any postponement in attending to the cue increases the probability that it will be forgotten. 

No additional guidance for fi

Alarmed vs. Not Alarmed 

Is the critical value of the cue signaled by an annunciator? If so, the operator is more likely to allow himself to check it, and the alarm acts as a preexisting recovery mechanism or added safety factor. For parameters 

that trigger action when a certain value is approached or exceeded (type CP-2 and CP-3 HIs), these branches should only be used if the alarm setpoint is close to but anticipates the critical value of interest; where the alarm comes in long before the value of interest is reached, it will probably be silenced and thus not effective as a recovery mechanism. 

If the critical value of the cue annunciator it must also be uin order to credit the alarm foIf it is not known if the alarm then the alarm can not be usdown branch is used. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-29 

Figure C-16 

EPRI HRA methodology pcb branch selection to account for high workload due to use of 

fire procedures in parallel to EOPs 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-30 

C.6.3.3 Failure Mechanism c, Data Misread or Miscommunicated 

(a) neg.

(b) 3.0E-03

(c) 1.0E-03

(d) 4.0E-03

(e) 3.0E-03

(f) 6.0E-03

(g) 4.0E-03

(h) 7.0E-03

Formal

Comms

Good/Bad

Indicator

Indicator

Easy to

Locate

pc c Value

Yes

No

Figure C-17 

Decision tree for pcc, data misread or miscommunicated 
Detailed Quantification of Post-Fire Human Failure Events Usin

C-31 

Table C-8 Guidance on decision nodes for pcc, data misread or miscommunicated 

Decision Node Guidance as Stated in EPRI TR-100259 [5] Guidance Specific fo

Indicators Easy to Locate 

Is the layout, demarcation, and labeling of the control boards such that it is easy to locate the required indicator? The answer is no if there are obvious human factors deficiencies in these areas and the plausible candidates for confusion with the correct indicator are sufficiently similar that the values displayed would not cause the operator to recheck the identity of the indicator after reading it. 

No additional guidance for fire 

Good/Bad Indicator 

Does the required indicator have human engineering deficiencies that are conducive to errors in reading the display? If so the lower branch is followed. 

No additional guidance for fire 

Formal Communications 

Is a formal or semi-formal communications protocol used in which the person transmitting a value always identifies with 

what parameter the value is associated (this limited formality is sufficient to allow the person receiving the information to detect any mistakes in understanding his request)? 

If the fire requires the operators to wapparatuses then no credit is given communication and the No branch i
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-32 

Figure C-18 

EPRI HRA methodology pcc, branch selection to account for difficulties in communication 

C.6.3.4 Failure Mechanism d, Information Misleading 

General

Training

Specific

Training

Warning of

Differences

All Cues as

Stated pc d

(a) neg

(b) 3.0E-03

(c) 1.0E-02

(d) 1.0E-01

(e) 1.0

Value

Yes

No

Figure C-19 

Decision tree pcd, information misleading 
Detailed Quantification of Post-Fire Human Failure Events Usin

C-33 

Table C-9 Guidance on decision nodes for pcd information misleading 

Decision 

Node Guidance As Stated In EPRI TR-100259 [5] Guidance Specif

All Cues as Stated 

Are cue states or parameter values as stated in the procedure? For example, if high steamline radiation is given as one of the criteria for 

decision or action, the steamline radiation indicators will read high, rather than normal. The “No” branch is to be used if an indicator is not obviously failed but would not give the value stated in the procedure (as, for 

example, if the steamline were isolated). 

If the instrumentation is cimpacted by fire then the used. If the instrumentation is cpartially impacted or not the yes branch should be 

Warning of Differences 

Does the procedure itself provide a warning that a cue may not be as expected, or provide instructions on how to proceed if the cue states are 

not as stated? 

No additional guidance f

Specific Training 

Have the operators received simulator training in which the cue configuration was the same as in the situation of interest, and which 

emphasized the correct interpretation of the procedure in the face of the degraded cue state? 

Fire specific training is to staff and or operators. 

General Training 

Have the operators received training that should allow them to recognize 

that the cue information is not correct in the circumstances? That is, is it something that every licensed operator is expected to know? For the example of the radiation monitor on the isolated steamline, the answer is “yes” because isolations are so common; for instrument abnormalities that only occur under a very special set of circumstances, the answer would be “no” unless the particular situation had received some emphasis in training. Operators cannot be expected to reason from their general knowledge of instrumentation to the behavior of a specific indicator in a situation where they are not forewarned and there are many other demands on their time and attention. 

Fire specific training is to staff and or operators. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-34 

Figure C-20 

EPRI HRA methodology pcd branch selection to account for instrumentation partially 

impacted by fire 

C.6.3.5 Failure Mechanism e, Relevant Step in Procedure Missed 

(a) 1.0E-03

(b) 3.0E-03

(c) 3.0E-03

(d) 1.0E-02

(e) 2.0E-03

(f) 4.0E-03

(g) 6.0E-03

(h) 1.3E-02

(i) 1.0E-01

Placekeeping

Aids

Graphically

Distinct

Single vs.

Multiple

Obvious vs.

Hidden pc e Value

Yes

No

Obvious

Hidden

Single

Multiple

Figure C-21 

Decision tree for pce, relevant step in procedure missed 
Detailed Quantification of Post-Fire Human Failure Events Usin

C-35 

Table C-10 Guidance on decision nodes for pce, relevant step in procedure missed 

Decision 

Node Guidance as Stated in EPRI TR-100259 [5] Guidance 

Obvious vs. Hidden 

Is the relevant instruction a separate, stand-alone numbered step in which case the 

answer is Yes, or the upper branch is followed in the decision tree? Or is it “hidden” in some way that makes it easy to overlook, e.g., one of several statements in a paragraph, in a note or caution, or on the back of a page? 

No addition

Single vs. Multiple 

At the time of the HI (Human Interaction), is the procedure reader using more than 

one text procedure or concurrently following more than one column of a flowchart procedure? If so, then answer with Yes, or follow the upper branch in the decision tree. Generally Multiple procedures apply only to BWRs. 

If the EOPs parallel to tmultiple pro

Graphically Distinct 

Is the step governing the HI in some way more conspicuous than surrounding steps? 

For example, steps that form the apex of branches in flowchart procedures, steps proceeded by notes or cautions, and steps that are formatted to emphasize logic terms are more eye-catching than simple action steps, and are less likely to be overlooked simply because the look different than surrounding steps. However, this effect is diluted if there are several such steps in view at one time (as on a typical flowchart), and for this reason the only steps on flowcharts that should be credited as being graphically distinct are those at the junction of two branching flowpaths. A procedure step is considered graphically distinct (as used in pc e) if it is preceded by a CAUTION, NOTE, set-off in a box, or is the only step on the page. 

No addition

Placekeeping Aids 

Are placekeeping aids, such as checking off or marking through completed steps and marking pending steps used by all crews? The EOPs are written in a columnar “response/response not obtained” format. They 

may incorporate check-offs and may have provisions for placekeeping. Use of both of these aids would be noted during operator training on the simulator. 

No addition
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-36 

Figure C-22 

EPRI HRA methodology pce- branch selection to account for fire procedures that are used 

in parallel to EOPs 

C.6.3.6 Failure Mechanism f, Misinterpret Instruction 

(a) neg.

(b) 3.0E-03

(c) 3.0E-02

(d) 3.0E-03

(e) 3.0E-02

(f) 6.0E-03

(g) 6.0E-02

Value Training on

Step

All Required

Information

Standard,

Unamiguous

Wording

pc f

Yes

No

Figure C-23 

Decision tree for pcf, misinterpret instruction 
Detailed Quantification of Post-Fire Human Failure Events Usin

C-37 

Table C-11 Guidance on decision nodes for pcf, misinterpret instruction 

Decision Node Guidance as Stated in EPRI TR-100259 [5] Guidance Specific 

Standard Unambiguous wording 

Does the step include unfamiliar nomenclature or an 

unusual grammatical construction? Does anything about the wording require explanation in order to arrive at the intended interpretation? Does the proper interpretation of the step require an inference about the future state of the plant? Standard wording = Yes, Ambiguous; Unusual = No. 

All Required Information Does the step present all information required to 

identify the actions directed and their objects? 

Training on Step Has the crew received training on the correct 

interpretation of this step under conditions similar to those in this HI? 

No additional guidance for fire 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-38 

C.6.3.7 Failure Mechanism g, Error in Interpreting Logic 

(a) 1.6E-02

(b) 4.9E-02

(c) 6.0E-03

(d) 1.9E-02

(e) 2.0E-03

(f) 6.0E-03

(g) 1.0E-02

(h) 3.1E-02

(i) 3.0E-04

(j) 1.0E-03

(k) neg.

(l) neg.

Value Practised

Scenario

Both AND

& OR pc g NOT AND or OR

Yes

No

Figure C-24 

Decision tree for pcg, error in interpreting logic 
Detailed Quantification of Post-Fire Human Failure Events Usin

C-39 

Table C-12 Guidance on decision nodes for pcg, error in interpreting logic 

Decision Node Guidance as Stated in EPRI TR-100259 [5] Guidance Specific fo

“NOT” Statement Does the step contain the word “not”? “AND” or “OR” Statement 

Does the procedure step present diagnostic logic in which more than one condition is combined to determine the outcome? 

Both “AND” & “OR” Does the step contain a complex logic involving a combination of ANDed and ORed terms? Practiced Scenario Has the crew practiced executing this step in a scenario similar to this one in a simulator? 

No additional guidance for fire 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-40 

C.6.3.8 Failure Mechanism h, Deliberate Violation 

(a) neg.

(b) 5.0E-01

(c) 1.0

(d) neg.

(e) neg.

Policy of

Verbatim

Compliance

Reasonable

Alternative

Adverse

Consequence

if Comply

Belief in

Adequacy of

Instruction

Yes

No

Value

Figure C-25 

Decision tree for pch, deliberate violation 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-41 

Table C-13 

Guidance on decision nodes for pch, deliberate violation 

Decision 

Node Guidance as Stated in EPRI TR-100259 [5] Guidance Specific for Fire HRA 

Belief in 

Adequacy of 

Instruction 

Does the crew believe that the instructions presented are 

appropriate to the situation (even in spite of any potential 

adverse consequences)? Do they have confidence in the 

effectiveness of the procedure for dealing with the current 

situation? In practice, this may come down to: have they 

tried it in the simulator and found that it worked? 

Adverse 

Consequence 

if Comply 

Will literal compliance produce undesirable 

consequences, such as release of radioactivity, damage 

to the plant (e.g., thermal shock to the vessel), 

unavailability of needed systems, or violation of standing 

orders? In the current regulatory climate, a crew must 

have strong motivation for deliberately violating a 

procedure. 

Reasonable 

Alternatives 

Are there any fairly obvious alternatives, such as partial 

compliance or use of different systems, that appear to 

accomplish some or all of the goals of the step without 

the adverse consequences produced by the step as 

written? Does simply delaying implementation appear 

to offer a reasonable hope for averting undesirable 

consequences? Note that simply delaying all or part of 

the response may not be considered a violation if the 

response is ultimately executed successfully. 

Policy of 

“Verbatim” 

Compliance 

Does the utility have and enforce policy of strict verbatim 

compliance with EOPs and other procedures? 

No additional guidance for 

fire 

C.6.3.9 CBDTM Cognitive Recovery 

The EPRI HRA methodology uses the following rules based on crew availability for determining 

which recovery factors can be applied to each CBDTM decision tree: 

1. If Tdelay is greater than the Shift Length, then Shift Change can be credited. 

2. If Tsw is greater than or equal to 360 minutes, then Shift Change can be credited. 

3. If Tsw is greater than or equal to 60 minutes, then ERF Review can be credited. 

4. If Tsw is greater than or equal to 15 minutes, then STA Review can be credited. 

5. The self review and extra crew do not have time thresholds, but should not be credited for 

extremely time-limited cases, such as when the time required equals the time available. 

Multiple recoveries to a single decision tree are permitted by the CBDTM method. The 

dependency levels are applied to each recovery individually then the recoveries are multiplied 

together to obtain the value show in the Multiply By Column in Figure C-26. The dependency 

values are calculated using THERP. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-42 

Figure C-26 

Cognitive recovery 

For existing EOP actions, the dependency levels may need to be increased from the base case if 

the timing available has decreased. If the dependency level is below the minimum recommended 

level set by the EPRI HRA methodology the DF column shown in Figure C-26 will be red. 

If the base case applies multiple recoveries to decision tree pc

a and pcd, and the scenario being 

modeled involves impact on instrumentation then the recoveries need to be re-evaluated. 

For fire response actions, the assignment for recoveries follows the same process as for internal 

events HRA. 

C.6.4 Cognitive Modeling Using HCR/ORE 

The HCR/ORE is an empirical method that relies on time-reliability correlations. The crew nonresponse probability in this case represents the probability that an operating crew, while making 

the correct decision, takes too long a time in comparison with the time available to respond. 

This contribution to the crew overall non-response is particularly important for situations 

where a relatively fast response to an initiator must be made. The HCR/ORE correlation is 

a representation of the probability of crew non-response as a function of normalized time (the 

normalized time is a dimensionless unit which reflects the ratio of time available to crew median 

response time). Each non-response curve is characterized by two crew response time parameters: 

A crew median response time (T1/2) and a logarithmic standard deviation of normalized time (σ). 

With these two parameters, the probability of crew non-response in a time window (T1/2) is given 

as follows. 

Pc

 = 1 - Φ [ln(T/T1/2)/ σ] 

where: 

Φ = the standard normal cumulative distribution (refer to standard normal distribution 

tables) 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-43 

 T = (Tsw - Tm) 

 Tsw = the time window available (either the time to boil, or time to CD) 

 Tm = the manipulation time, the time required to complete the needed actions once they 

are identified 

 T1/2 = the crew median response time 

σ = the logarithmic standard deviation 

The timing information is defined the same for all methods in the EPRI HRA methodology For 

fire HRA the timing adjustments described in the timing sections apply directly to the HCR/ORE 

method. 

Sigma (σ) corresponds to the variability in operator response, and is determined from 

Table 3-1 in Reference [5]. It is based on the type of reactor, (either PWR or BWR) and the HFE 

categorizations as CP1, CP2, or CP3. It must be noted that Pc

 is based on the assumption that 

time window Tsw is a constant (i.e., no uncertainty). Figure C-27 and Figure C-28 below shows 

how the HCR/ORE is implemented in the EPRI HRA methodology. 

Figure C-27 

HCR/ORE sigma modeling in HRA methodology 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-44 

Figure C-28 

Timing information in the EPRI HRA methodology 

C.6.4.1 Estimation of σ for Fire HRA 

The σ represents the crew-to-crew variability in responding to a specific cue. For internal events 

HRA, the analyst has the option to use the average σ, the lower (10th percentile) or the upper 

(90th percentile) bound. For internal events most EOP driven HFEs use the average sigma. The 

upper bound can be used when the crew response is less certain such as cases where the primary 

cues are impacted and the operators must identify secondary cues to perform the action. The 

selection of secondary cues could vary significantly among crews and/or the time it would take 

to identify the cues would vary among crews. The lower bound can be used for cases where 

there is little crew variation expected such as the initial response to a reactor trip. 

For existing internal events HFEs, the same sigma value can be used for the HFE in a fire 

context - provided that there is no impact on instrumentation and hence cognition. If some 

of the instrumentation is impacted then the upper bound sigma is used. 

For fire response actions which are proceduralized in the fire procedures the average sigma is 

used when it has been confirmed by operator interviews that operators will use and believe in the 

adequacy of the fire procedures. If there is uncertainty of when and or how the fire procedures 

will implemented then the upper bound sigma is used. For typical U.S plants the main control 

room abandonment criteria is defined to be at the discretion of the shift manger, STA or other 

high level manager and this is one example where the upper bound would be used. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-45 

Table C-14 shows the corresponding sigma values to be use for fire HRA. 

Table C-14 

Estimates of average sigma with upper and lower bounds 

Standard 

Deviation *Note 1

Lower Bound 

*Note 2 

Upper Bound 

*Note 3 

Plant Type HI Category Average σ

 10th percentile 90th percentile

CP1 0.7 0.18 0.40 1.00 

CP2 0.58 0.23 0.20 0.96 

BWR 

CP3 0.75 0.10 0.59 0.91 

CP1 0.57 0.19 0.26 0.88 

CP2 0.38 0.19 0.07 0.69 

PWR 

CP3 *Note 5 0.77 ** 0.5 1.2 

Note 1: The standard deviation was calculated from data presented in EPRI-TR100259 [5]. 

Note 2: Lower bound 10th percentile σ = Average σ -1.64 X (Standard deviation of the sample 

of σs) 

Note 3: Upper bound 90th percentile σ = Average σ +1.64 X (Standard deviation of the sample 

of σs) 

Note 5: For PWR CP3 actions there is only 1 data point in the original data set. Thus no 

distribution can be calculated. Instead overly conservative estimates are presented and are to be 

used with caution. 

C.6.5 Execution Modeling 

Execution is modeled in the EPRI HRA methodology using THERP. 

C.6.5.1 PSF Execution 

The execution PSFs modeled in the EPRI HRA methodology are shown Figure C-29 below. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-46 

Figure C-29 

EPRI HRA methodology execution PSFs 

For fire HRA if the smoke will impact the operators then the smoke PSF should be checked and 

consequently the stress level will be at least moderate to high. 

If the operators have to travel through a area in which the fire has impacted the accessibility the 

accessibility field should be set to at a minimum to with difficulty. If the location of the action is 

inaccessible due to the fire then HEP should be set to 1.0. 

In the EPRI HRA methodology, if anyone of the PSFs shown above is considered negative the 

stress (determined in execution stress) should be at least moderate. 

C.6.5.2 Execution Stress 

Execution stress is determined by a decision tree shown in Figure C-30 based on workload and 

execution PSFs. The stress level is used as a direct multiplier to the execution probabilities and 

within the EPRI HRA methodology, the following multipliers are used: 

• Low Stress – PSF=1 

• Moderate Stress – PSF=2 

• High Stress – PSF=5 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-47 

Figure C-30 

EPRI HRA methodology execution stress 

In addition to low, moderate and high stress there should be a fourth level of stress, Fire Stress. 

Fire stress (PSF=10) is not implemented in version 4.0 of the EPRI HRA methodology and 

should be applied externally to the EPRI HRA methodology. 

For existing EOP actions, the stress levels should always be increased to a minimum of high 

stress. If the base case is already high stress, the fire stress must be implemented outside the 

EPRI HRA methodology. 

For fire response actions, a high stress level should be used, if any of the execution PSFs are 

negative. A fire stress level should be used if more than 2 executions PSFs are negative. For 

fire scenarios with impeded communications the stress should be fire stress. 

C.6.5.3 Execution Unrecovered and Recovered 

The Execution Unrecovered and Recovered window in the EPRI HRA methodology are where 

each critical step is modeled and the execution HEP is quantified. The actual values used for the 

execution HEPs of the individual error modes are clearly situation specific, and are made on the 

basis of an interpretation of the instructions in THERP. Quantification of the execution part of 

each human error probability is based on THERP data and techniques. The various tables in 

Chapter 20 are utilized in determining the HEPs for the subtasks comprising the operator action. 

The most commonly used THERP Tables are Table 20-7 for errors of omission (EOM) and 

Table 20-12 for errors of commission (EOC). 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-48 

Median HEP values from THERP are converted to mean values as documented in the EPRI 

HRA Calculator Software Users Manual [3], and applied as point estimates. An error factor is 

assigned to each human failure event, based on the resultant HEP using THERP Table 20-20. 

The following modeling conventions are used in determining Pe

 and apply to both Fire HRA 

and internal events HRA. 

1. For control room actions, only proceduralized recoveries are credited initially. For local 

actions (EOP directed actions outside the control room) a recovery is considered if 

completion of the local action, or lack of completion, produces a ‘compelling signal’ in the 

control room. [E.g., completing the local valve lineup for RWST refill using the CVCS boric 

acid blender actuates the boric acid and primary water totalizers on the Main Control Board.] 

2. Execution errors are calculated using the THERP tables. Values from these tables for errors 

of omission are divided by three based on notes in THERP Chapter 15. These notes describe 

adjustments to the nominal values, in particular to credit the layout of the procedures into a 

“response/response not obtained” format. 

3. The application of recovery is included when it is judged that there is enough time for revisitation, based on the sequence timing and time available for the human interaction. See #7 

for additional details on the impact of timing on dependencies. 

4. In modeling recovery, the recovery factor should be a procedural step and is typically 

modeled as the EOM (from Table 20-7) for the procedure step with the EOC modeled as 

failure to read the associated instrument. 

5. In determining the EOM pe

 values, if the human interaction takes place within ten procedural 

steps from the start of the procedure, Item 20-7(1) [short list, with checkoff provisions] from 

THERP is used. If the human interaction takes place > 10 steps into the procedure, Item 20-

7(2) [long list, with checkoff provisions] is used. Items 20-7(3) and 20-7(4) [no checkoff 

provisions] are usually used when the procedure is not an EOP. The start of the procedure is 

used vice the start of the accident sequence based on policies for the control room supervisor 

to conduct a brief and thus re-synchronize the entire crew upon transfer of procedures. 

6. Table 20-13 from THERP is for local manual valve operation. This table is also applied 

to operation of other local components such as switchgear breakers and room doors. 

7. The dependence between elemental HEPs in the subtasks that make up each pe

 is handled 

using the dependency rules in THERP. 

• If a human interaction required 2 of 2 manipulations for success, pe

 includes HEPs 

for EOC(1)+ EOC(2). 

• If a human interaction required 1 manipulation, with 2 switches available, failure 

to manipulate the first switch can be recovered by operating the second switch: 

EOC(1) * EOC(2). 

The Figure C-31, Figure C-32, and Figure C-33 show how the Pe is quantified within the EPRI 

HRA methodology. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-49 

Figure C-31 

EPRI HRA methodology execution unrecovered 

Figure C-32 

EPRI HRA methodology execution recovered 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-50 

Figure C-33 

EPRI HRA methodology execution summary 

C.6.6 Summary Modeling Existing EOP Actions within the EPRI HRA Methodology 

For existing EOP actions, it is only necessary to make small modifications from the base 

HFE for quantifications. The previous sections covered all the required steps to quantify and 

document a fire HEP using the EPRI HRA methodology. For existing EOP actions, most of this 

information will be the same for both the base case HFE and fire HFE. Table C-15 summarizes 

the previous sections and shows what needs to be modified between a base case HFE and fire 

HFE. Table C-15 is only applicable to existing EOP actions where the definition has not been 

changed for fire modeling. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-51 

Table C-15 

Summary between internal events HFE and fire HFE for existing EOP actions 

BE Data The HFE Name should be a Variation of the Base Case Name to Reflect the 

Fire Conditions 

Cues If not previously documented include the component ID in the cue identification 

field. Additionally, the fire impacts on instrumentation are to be noted. 

Procedures and 

Training 

No changes are need – This assumes that the expected procedure response is 

the same for both the response to a fire and to internal events scenario. 

Operator 

Interviews 

Document fire specific insights from operator interviews. 

Manpower 

Requirements 

No changes are need as a preliminary quantification. 

Time window If the implementation of the EOPs is delayed due to the performance of the fire 

procedure/s, the delay time is systematically increased by the average time it 

would take to perform the fire procedure/s, typically about 30 minutes. In this 

case, Tdelay = Tdelay base case +30 min. 

If an action is a local action the Manipulation Time (TM) needs to be increased to 

account for the additional time it could take for the operators to get to the location. 

The travel delay is highly dependent on the fire location and if it is not know how 

the fire will directly affect the operators travel, is recommended that TM be 

increased by 10 minutes from the base case. The 10 minutes is used as an 

estimated value and if the action is determined to be risk significant this value 

will need to be verified and/or justifiable in the context of the fire scenario. 

If the Time available for Recovery is less than or equal to zero the HEP evaluates 

to 1.0, as there is insufficient time to perform the action. 

Cognitive 

Unrecovered 

CBDTM 

Decision tree Pca – If the fire fully impacts the instrumentation such that 

indications are not available the HEP evaluates to 1.0. If the instrumentation is 

partially impacted by fire the indications are not considered accurate. If no 

instrumentation is impacted by fire then no modifications are made to this tree. 

Decision tree Pc

b – If the EOPs are implemented in parallel to the fire procedures 

then the workload is considered to be high. 

Decision tree Pc

c – If breathing apparatus are required due to fire the 

communications is considered poor. 

Decision tree Pc

d – If the fire fully impacts the instrumentation then cues are not 

available and HEP evaluates to 1.0. If instrumentation is partially impacted then 

cues are not as stated but credit can be taken for general and/or specific training. 

If the fire has no impact on instrumentation then the cues are not impacted by fire. 

Decision tree Pc

e – If the EOPs are implemented in parallel to Fire procedures 

then multiple procedures are used. 

Decision tree Pcf –No modifications are needed for fire 

Decision tree Pcg – No modifications are needed for fire 

Decision tree Pc

h –No modifications are needed for fire 

Table C-15 

Summary between internal events HFE and fire HFE for existing EOP actions (continued) 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-52 

BE Data The HFE Name should be a Variation of the Base Case Name to Reflect the 

Fire Conditions 

Cognitive 

Recovered 

CBDTM 

If the time was modified due to fire then the recoveries need to be re-evaluated to 

ensure that the minimum level of dependency is met. 

If the instrumentation is partially impacted by fire and recoveries have previously 

been applied to decision tree Pc

a and Pcd the recoveries need to be reconsidered. 

Cognitive 

HCR/ORE 

For fire HRA for existing internal events actions the same sigma value used for 

internal events HRA can be used for the fire HFE provided that there is no impact 

on instrumentation. If some of the instrumentation is impacted then the upper 

bound is used. If the fire fully impacts the instrumentation then cues are not 

available and HEP evaluates to 1.0. 

Execution PSFs Check to ensure that for local actions, the location is still accessible due to fire. If 

not accessible then HEP = 1.0 

If two are more executions PSFs are negative. For fire scenarios which impeded 

communications or smoke is present such that it will impact the operator 

performance the stress should be fire stress. 

Execution Stress Set the stress to high or fire stress. Fire stress is an additional multiplier of 2 to 

Pexe. 

Execution 

Unrecovered 

No changes are need 

Execution 

Recovered 

No changes are need 

C.6.7 Summary Modeling Fire Response Actions within the EPRI HRA 

Methodology 

The theory and parameters to consider for modeling fire response actions are the same as those 

for existing EOP actions. Sections C.1 thru C.6.5.6 are applicable to all type of HFEs. For fire 

response actions, there is no internal events action to use as a base analysis so the HRA analyst 

must evaluate each input parameter. Table C-16 below summarizes the key parameters that are 

unique to fire response actions. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-53 

Table C-16 

Summary of fire response actions 

EPRI HRA 

Methodology Fire Specific Parameters to Included in HFE Analysis 

BE Data In the Related Human Interaction Field the analyst should include both fire 

response actions and any EOP actions that are occurring in the same scenario. In 

many cases the fire response actions are performed as a recovery to an internal 

events action. 

Cues The cue field includes documenting the specific instrumentations and any 

instrumentation impacted by fire should be noted. 

For fire response actions, the cue may be a step in the fire procedures. If operator 

interviews confirm that they intend to follow the fire procedures step by step then 

crediting the step in the fire procedure as the cue would be appropriate. However, 

there are many cases where the operators will state during operator interviews 

that they will not follow the procedures step by step and instead use them for 

additional information. In this case the cue would need to be something to alert 

the operators to at least check the procedures. Simply using the step in fire 

procedures would be inappropriate. 

Procedures and 

Training 

If the fire procedures are implemented in parallel to the EOPs both the fire 

procedure and the EOPs are to be referenced. For fire response actions it is 

important to understand how the crew will use the fire procedures and the EOPs. 

This is critical to developing the timeline. 

Operator 

Interviews 

Document insights from operator interviews. The operator interviews include 

discussion on the expected usage of the fire procedures. Are the fire procedure 

implemented in parallel to EOP actions? Do the operators intend to use the fire 

procedures, and do they believe in the adequacy of the fire procedures. Typically, 

two rounds of operator interviews will be needed. The first will be to understand 

the general fire response and then a second set will be needed to talk through fire 

specific detailed scenarios. 

Manpower 

Requirements 

The manpower requirements are evaluated for the minimum number of people 

available during the back shift and the minimum number of staff available 

following detection of a fire. 

Time window For local actions, the manipulation Time (TM) should account for travel time to 

reach location including any detours due to the fire location. 

If the Time available for Recovery is less than or equal to zero the HEP should 

evaluate to 1.0, as there is insufficient time to perform the action. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-54 

Table C-16 

Summary of fire response actions (continued) 

EPRI HRA 

Methodology Fire Specific Parameters to Included in HFE Analysis 

Cognitive 

Unrecovered 

CBDTM

Decision tree Pca – If the fire fully impacts the instrumentation then indications are 

not available and the HEP evaluates to 1.0 .If the instrumentation is partially 

impacted by fire indications are not considered accurate. If no instrumentation is 

impacted by fire then no modifications are made to this tree. 

Decision tree Pcb – If the EOPs are implemented in parallel to Fire procedures 

then the workload is considered to be high. 

Decision tree Pc

c – If breathing apparatus are required due to fire the 

communications is considered poor. 

Decision tree Pc

d – If the fire fully impacts the instrumentation then the cues are 

not available and HEP evaluates to 1.0. If instrumentation is partially impacted 

then cues are not as stated but credit can be taken for general and/or specific 

training. If the fire has no impact on instrumentation then the cues are not 

impacted by fire. 

Decision tree Pce – If the EOPs are implemented in parallel to fire procedures 

then multiple procedures are used. 

Decision tree Pc

f – Use same guidance as for internal events 

Decision tree Pcg – Use same guidance as for internal events 

Decision tree Pch – Use same guidance as for internal events 

Cognitive 

Recovered 

CBDTM 

Use same guidance as for internal events 

Cognitive 

HCR/ORE 

For fire response actions which are proceduralized in the fire procedures the 

average sigma is used when it has been confirmed by operator interviews that 

operators will use and believe in the adequacy of the fire procedures. If there is 

uncertainty of when and or how the fire procedures will implemented then the 

upper bound is used. 

Execution PSFs For fire response actions, a high stress level should be used if any of the 

execution PSFs are negative. A fire stress level should be used if more than 2 

executions PSFs are negative. For fire scenarios which impeded communications 

or smoke is present such that it will impact the operator performance the stress 

should be fire stress. 

Ensure that for local actions, the room is still accessible due to fire. If components 

required for manipulation are not accessible due to fire then the HEP evaluates to 

1.0 

Execution 

Stress 

Set the stress to high or fire stress. Fire stress is an additional multiplier of 2 to 

Pexe. 

Execution 

Unrecovered 

Use same guidance as for internal events. 

Execution 

Recovered 

Use same guidance as for internal events. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-55 

C.6.8 Summary Modeling MCR Abandonment Actions within the EPRI HRA 

Methodology 

MCR abandonment actions are considered a subset of fire response actions. At most U.S nuclear 

plants, the MCR abandonment procedure is an AOP and is implemented in the same manner as 

all other AOPs and thus the actions can be quantified in the same manner as AOPs actions. The 

same guidance for fire response actions (Table C-16) can be applied to MCR abandonment 

actions. 

C.6.9 Summary Modeling Undesired Operators Response Actions within the EPRI 

HRA Methodology 

The EPRI approach for identifying undesired operator response actions is presented in Section 3 

of the main document. The following assumptions were made in the identification process: 

1. Actions that require multiple spurious indications on difference parameters can be screened 

from consideration. 

2. Actions that require indication on one of several redundant channels can be screen from 

considerations. If the action requires multiple spurious indication on redundant channels the 

actions can not be screened from consideration. 

3. Actions that have a proceduralized verification step can be screened from consideration. 

For quantification, the EPRI approach is not suitable to quantify the probability that the EOC 

will not occur. Instead, the EPRI approach assumes that the EOC has occurred and then models a 

recovery action. If the recovery action is proceduralized in the fire procedures then the guidance 

for fire response actions can be applied. If the recovery action is a proceduralized EOP action 

then the existing EOP guidance can be applied. 

C.7 Discussion on how Fire Effects are Modeled Using the EPRI Approach 

Because the EPRI approach is symptom based not initiator based is not always obvious how the 

specific fire effects described in Section 4, Section 4.3 are incorporated into the EPRI approach. 

This section provides a discussion for each PSF described in Section 4 and how it is addressed 

for fire HRA. However, PSFs are never considered independently. For example, the cues could 

impact timing and procedures could impact cues. Where appropriate this section has tried to 

capture some of the PSF overlap specific for fire and focused on how fire specific scenarios 

could be addressed. The PSF overlap is situation specific and the HRA analyst must have a 

qualitative understanding of the scenario and the EPRI approach before quantification. It is 

outside the scope of this appendix to reproduce all guidance related to the HRA methodology, 

and applied method such as THERP, CBDTM, HCR/ORE, and SHAPR/SHAPR1. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-56 

C.7.1 Cues and Indications 

Cue and indications can be mapped to the following parts of the EPRI approach: 

• Considered explicitly in decision tree pc

a and pcd 

• Cue are identified and documented in the cue field within the HRA methodology 

• The time at which the operators receive the cues is used as an input to Tdelay

• The time it takes for the operators to interpret the cues is considered in T1/2

The cue field within the HRA methodology includes documenting the specific instrumentation 

and any instrumentation impacted by fire are noted in this field. For HFE analyses that have been 

carried over from the internal events analysis, this field confirms that the cues and indications 

that are credited for internal events actions are still valid. For example, an operator action taken 

in response to certain indications credited in the internal events PRA may not be credible 

anymore if either (1) the indications are impacted by the fire or (2) the associated 

instrumentation cable routing is unknown. 

For discussion purposes there are three categories of potential instrumentation impacts on fire 

HFEs: 

• No impact – All the required instrumentation is available. 

• Partial impact – A minimum set of the required instrumentation is available and considered 

accurate. For this case, some of the instrumentation can either by failed by the fire or 

spuriously actuating giving false indications. 

• Total impact – Less than the minimum set of required instrumentation is available. All 

instrumentation required for diagnosis is failed by the fire. 

To illustrate how impacted cues are modeled, the following examples are considered. 

For an internal events case, consider an action where all SG level indicators are available and 

reliable. For the internal events case the following branches in decision pc

a and pcd are used 

and the impacts on cognition are considered negligible. 

Figure C-34 

Modeling of SG level indicators for internal events action in which there is no impact on 

instrumentation 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-57 

Consider the same action for the fire case, but in the fire case 2/4 SG level indicators are failed 

by the fire and the choices shown in Figure C-34 are applied. In the fire case, all instrumentation 

required for successful cognition is available in the control room but half the instrumentation 

is fail by the fire and hence considered inaccurate. All the cues are not as stated because the 

operators must determine which level indicators are the correct. In this fire scenario the sum of 

decision tree pca, pcd is 1.5E-1 with no recoveries applied. 

Figure C-35 

Modeling to reflect partial impact on instrumentation due to fire effects 

For fire response actions, the cue may be a step in the fire procedures. If operator interviews 

confirm that the crew intends to follow the fire procedures step by step then crediting the step 

in the fire procedure as the cue would be appropriate. However, there are many cases where the 

operators will state during operator interviews that they will not follow the procedures step 

by step and instead use them for additional information. In this case the cue would need to be 

something to alert the operators to at least check the fire procedures. Simply using the step in 

fire procedures would be inappropriate. 

For the partial instrumentation impact case, identification and interpretation of the invalid 

indications could be time consuming, and in the worst case, cause the operators not to take the 

require actions within the time available. The time it would take for the operators to interpret 

and react to partial instrumentation case is to be captured in T1/2. In some cases the diagnosis 

is so complex due to a combination of spurious and failed indications that T1/2 is estimated to 

take longer than the total time available to complete the action and in this case the HEP would 

evaluate to 1. 0. 

C.7.2 Timing 

The EPRI HRA method applies the following definitions for time: 

• TSW = System time window – This is typically the time from reactor trip to an undesired end 

state. 

• TM = Manipulation time 

• T1/2 = Median response time 

The Timing Analysis field documents the source of the timing in accordance with ASME 

Standard Requirements HR-G4 and HR-G5. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-58 

Tdelay, T1/2, Tsw, and Tm are used as inputs to crediting recovering in CBDMT decisions trees 

and the HCR/ORE correlation. 

For fire HRA, Tsw is based on the defined accident sequence modeled in the FPRA. For risk 

significant actions, this time is based on realistic generic thermal hydraulic analysis or simulation 

from similar plants in order to meet ASME standard requirement HR-G4. 

If the dependency analysis module within the HRA methodology is applied, all HFEs must be 

aligned such that T=0 is the same starting point. It is good practice to set T=0 as the start of the 

fire, there maybe cases where the fire starts but does not require a reactor trip and no fire impacts 

are identified for several minutes, this fire growth time would be modeled in Tdelay. 

The output of NUREG 6850 Task 8 and Task 11 could provide a fire timeline that describes the 

(1) nature of the fire (fast or slow) (2) fire detector response times and (3) air flows that can 

impact fire growth. 

Tdelay represents the time at which the cue is received. When the cue is received is a function of 

the fire and also takes into account any procedure delay caused by the fire. If the implementation 

of the EOPs is delayed due to the performance of the fire procedure/s, the delay time for all 

existing internal events HFEs is systematically increased by the average time it would take to 

perform the fire procedure/s, typically about 30 minutes. In this case, 

Tdelay = Tdelay base case +30 min 

T1/2 is best obtained by simulator observations. For scenarios where no instrumentation is 

impacted by fire, the T1/2 time would be very similar to internal events time, since the EOPs are 

symptom based not initiator based and it is expected the operators will trust their instrumentation 

unless there is a compelling reason not to. For cases where the cues are partially impacted by the 

fire, the diagnosis many not be clearly identified in the procedures and these are the cases for 

which simulator observation would be the most beneficial. 

For fire response actions, the diagnosis will typically be in the control room and the execution 

will be local and thus it is still possible to observe a T1/2 time from simulator observations. If 

there is a need to model local cognition, thenT1/2 can be obtained by talk through and walk 

thoughts. 

The manipulation time (Tm) accounts for any of the following fire effects: 

• Travel time to reach the execution location. The fire may cause the operators to detour 

around the most direct route to perform local actions. It is assumed the operators will not 

travel directly thru a fire location. However, operators can travel through a smoky area to 

reach the local action. The travel time could be significantly impacted due to the fire 

location. As an initial estimate for existing internal events HFEs, it is recommended to 

increase TM by at least 10 minutes, and if the HFE is risk significant this time should be 

verified. 

• Time to don SCBA and additional time SCBA would take to perform the actions. The 

time to don SCBA can be observed during annual SCBA training, however, in training the 

operators do not feel time pressure and therefore this observed timing could be conservative. 

For HFEs that require SCBA gear it should be ensured that there is enough time to perform 

the action even with a conservative estimated to time to don gear is used. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-59 

• The presence of smoke could also impact the performance time. If the operators cannot 

clearly see the valve they need to open then there may be additional time involved in locating 

the correct valve thus increasing Tm. 

In some cases the fire procedures will specifically state that the local actions must be required 

with in a specified time and this time can be used as a preliminary estimate for Tsw or Tm. It can 

be used for Tm if it is expected that the time does not include diagnosis and detection. For risk 

significant actions the time for manipulation will need to be based on walk through and talk 

through with operators. 

NUREG-1792 and NUREG/CR-6850 point out that timing can be influenced by many other 

PSFs. In particular the time to perform an action is a function of (at least) the following factors 

which could be impacted by fire. The discussions of the bullets below are only considering the 

PSFs and how they related to time. Discussion of how each of the PFSs is addressed in the EPRI 

approach is shown in other parts of this section. 

• Crew – The HRA methodology addresses the number of crew required in the manpower 

field. If there is not enough crew to perform all required operator actions in the fire sequence 

within the total time available, then the HEP = 1.0. 

The crew is also considered in the timeline development. Within the CBDT additional crew 

can be credited as recoveries. During a fire, the technical support center will typically be 

activated within 2 hrs of the start of the fire and can be credited for actions that occur later 

(after TSC is actuated) in the scenario. 

The variation in crew response is characterized within the HCR/ORE by the use of sigma. 

The more expected variation among crews the higher the sigma value. For EOP actions, 

limited crew variation is expected. 

• Human Machine Interface – The manipulation time accounts for time it would take for the 

operators to interact with the plant, i.e. open valve or start pump. T1/2 also accounts for time it 

would take for the operators to interpret or locate cues. For example, if the operators have to 

go the back of the control room to read an indication then the T1/2 would be longer than if the 

indicators are located on the front computer panel. 

• Complexity of action involved – T1/2 accounts for complexity in diagnosis, as the more 

complex the diagnosis the longer it will take to make a correct diagnosis. Tm accounts for 

complexity of the action, the more complex an action the longer it will take to complete. 

• Special Tools or Clothing – Putting on SCBA gear is considered as part of Tm. Additionally, 

Tm accounts for locating and using special equipment such as ladders or keys. 

• Diversions and other concurrent requirements – Competing tasks can influence T1/2

because the operators will be distracted and could take longer to diagnosis the need for the 

action. This could also impact Tdelay, as it could take the operator longer to receive the cue. 

For example, if the cue is a step in the fire procedures and the operators will not refer to 

the fire procedures immediately following the reactor trip but instead enter EOPs, then Tdelay

accounts for the time it takes for the operators to get into the fire procedures. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-60 

• Procedures – The procedure usage will impact all aspects of timing. Tdelay is based on 

when the operators receive the cues and if the cue is a procedure step then Tdelay must 

account for the total time to perform all previous steps in the sequence. If the procedures are 

ambiguously worded then it would take the operators longer to make the diagnosis and this is 

reflected in T1/2. The manipulation time must account for the total time it takes to perform all 

the procedure steps. There could be several proceduralized steps that are not required for 

success but the operators will still perform these actions and this will lead to longer time to 

reach the final steps in the procedure. 

• Environmental Conditions – Environmental conditions may slow the operator’s response 

time and this is accounted for in TM. 

The EPRI HRA methodology uses the following rules based on crew availability for determining 

which recovery factors can be applied to each CBDTM decision tree: 

1. If Tdelay> Shift Length then Shift Change can be credited. 

2. If Tsw >= 360 minutes then Shift Change can be credited. 

3. If Tsw >= 60 minutes then ERF Review can be credited. 

4. If Tsw >= 15 minutes then STA Review can be credited. 

5. The self review and extra crew are not time based recoveries. 

NUREG/CR-6850 provides the following examples of how the overall estimates of the time 

available and time needed to complete the desirable action can be influenced by other PSFs 

during a fire. These scenarios are used to show how timing is applied within the HRA 

methodology to model fire effects. 

Scenario – 1: A spurious closure of a valve used in the suction path of many injection paths 

may need quick detection and response by the crew. For this example assume the following 

PWR scenario is given: The cue is an annunciators and the operators have 30 minutes to open the 

valve after the start of the fire before the pumps cavitate due to loss of suction. The fire causes 

a spurious closure of the valve but the fire does not impact instrumentation. Operator interviews 

were done and the operators stated they anticipate the following sequence of events: trip the 

reactor, enter E-0 and disperse the fire brigade. After they ensure they have a transient and the 

plant is stable (No SI, no station blackout) then, they start reviewing annunciators. This scenario 

was observed in the simulator to determine the some of the timing. In this scenario, Tsw = 30 

minutes by definition of the fire sequence, Tdelay = 0 since the loss of suction occurs at the start of 

the fire and the annunciators is received at the start of the fire. T1/2 was observed to be 5 minutes 

and this time accounts for the operators not acknowledging the annunciators within the first 4 

minutes because they are busy dispersing the fire brigade and working in E-0. Once the operators 

do acknowledge the alarm they immediately send an operators to locally open the valve. A walk 

down was performed and it took 5 minutes to reach the valve location with no fire impacts. 

(For this case assume the fire has no impact on travel time). A time for opening the valve can 

not be measured due to plant operations but during outages this valve is regularly opened and 

the operators estimate that is takes 2-5 minutes to open the valve. (approximately 30 turns). 

In this case, Tm = 5minutes for travel time and 5 minutes to open the valve thus the total Tm 

is 10 minutes. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-61 

The following scenario would be input into the HRA methodology as shown below. 

Figure C-36 

Modeling for timing scenario 1

This timing information is used directly in HCR/ORE and the results are shown below. This 

action is a CP2 and average sigma is used because this is an EOP action and it is expected that 

the crew variation will be limited as the scenario models a well trained proceduralized path with 

no impact on instrumentation. For a sensitivity case the upper bound can be used. 

Figure C-37 

Modeling of HCR/ORE for scenario 1 

Within the CBDT no recoveries are applied for cognition since only one operator is performing 

the annunciator panel review for this scenario, assume there is no formal process for annunciator 

panel review and thus self review is not credited. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-62 

Scenario – 2: Use of less familiar or otherwise different procedure steps and sequencing 

could change the anticipated timing of actions in response to a fire. This timing effect is 

best illustrated by creating a variation of Scenario 1. In Scenario 1, it was given that the cue for 

the HFE was a control room annunciator. For Scenario 2, the same scenario applies with the 

exception that the cue for the action is given in the fire procedures and there is no control room 

annunciator for the spurious valve closure. The operator interviews revealed that the STA 

is responsible for oversight of the fire procedures and that operators will not open the fire 

procedures unless directed by the STA. (This is a fictitious scenario for illustrative purposes). Tsw

and Tm, are the same between scenarios 1 and 2. For scenario 2, Tdelay would account 

for the time it takes for the STA to arrive at the control room and open the fire procedures. The 

valve still closes at T=0 however, in Scenario 1, an annunciator was lit at T=0 even though it is 

expected that the crew will not acknowledge the alarm. In Scenario 2 the only cue is a warning 

in the fire procedures and now Tdelay accounts for the time it takes to get to the step in the fire 

procedure. It is generally plant policy for the STA to be in the control room within 15 minutes of 

an event and this can be used to estimate Tdelay at 15 minutes. For Scenario 2, assume that the 

fire procedure provides a list of 15 valves that could spuriously close in the event of the a fire. 

There is a warning in the procedure that states if any of these valves spuriously close then locally 

open them. In this case the operators must check all the valves and determine which valves is 

closed and this would be modeled as a relatively long T1/2 time on the order of 7 minutes. For 

estimation, assume 30 seconds per valve position and if a better estimate is required then this 

process could be observed in the simulator. 

The following shows the Scenario 2 is implemented in the HRA methodology 

Figure C-38 

Timing for Scenario 2- not enough time to complete the action 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-63 

The HRA methodology provides a warning that there is insufficient time to complete the action 

and the HEP should evaluate to 1.0. These times could be revised if during operator interviews 

the operators stated that following diagnosis of a fire they would directly enter the fire 

procedures. 

Scenario – 3: Interfacing with the fire brigade may delay performing some actions. 

Fire HRA does not model fire brigade response directly but interaction with the fire brigade 

could impact the timing. For example at some plants members of the on-shift operating crew 

become members of the fire brigade but at other plants the fire brigade is a separate independent 

team. 

For illustrative purposes, assume that that upon diagnoses of a fire a local RO is assigned to join 

the fire brigade. In this case, the local RO would not be available to perform tasks directed by the 

control room. The additional time to locate a secondary person would be modeled in increase in 

Tm. 

Timing for MCR abandonment Actions 

For MCR abandonment scenarios, the timeline is difficult to model. Tdelay accounts for the time 

at which the control room would receive the cues and considering abandoning. If the scenario 

involves smoke in the control room then Tdelay would be the time at which the smoke reaches a 

specified level. For a loss of control scenario Tdelay represents the time at which all control is lost. 

This time may not necessarily be at T=0. 

T1/2 is the time from which the cue for abandonment is received until the operators make 

the decision to abandon. There will always be uncertainty in this time and typically a 

sensitivity analysis can be done to establish a bounding case. It would be difficult to perform a 

demonstration of this in the simulator and thus this value is typically an HRA analyst’s best 

judgment. 

Unlike T1/2, Tm can be observed; typically the MCR abandonment procedure is an ARP and is 

trained on annually. Depending on the plant, there may be JPMs available to obtain an estimate 

of the manipulation time. However, training and JPMs are not necessarily performed using 

SCBA gear or addressing local fire effect such as smoke. Given a fire in a specific location, 

the operators travel paths can be timed and any detours caused by fire can be measured. 

Because of the expected large crew to crew variation associated with when the operators 

abandon the control room, the upper bound for sigma will always in the HCR/ORE correlation. 

C.7.3 Procedures and Training 

Procedures guidance is identified and documented in the procedure field in the HRA 

methodology. Procedures are considered explicitly in decision tree pc

a, pcd, pce, pcf, pcg and pch 

and to model EOMs for execution. They are implicitly in used in quantification to identify the 

cues for cognition, critical task for execution, and to develop the timeline. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-64 

As stated in NUREG-1852 there are three roles of plant procedures which can aid in successful 

operator performance during a fire: 

1. The procedures can assist the operators in correctly diagnosing the type of plant event that 

the fire may trigger (usually in conjunction with indications), thereby permitting the 

operators to select the appropriate operator manual actions. 

2. The procedures direct the operators to the appropriate preventive and mitigative manual 

actions. 

3. The procedures attempt to minimize the potential confusion that can arise from fire-induced 

conflicting signals, including spurious actuations, thereby minimizing the likelihood of 

personnel error during the required operator manual actions. Written procedures contain the 

steps of what needs to be done, and unless it can be argued to be “skill-of-the-craft,” they 

should also contain guidance for how and where it should be done, and what tools or 

equipment should be used. 

These roles are addressed within the HRA methodology as follows: 

1. Failures in the Operator-Procedure Interface for diagnosis are modeled in decision trees pc

e, 

pc

f, pcg and pch. The way in which the operators interact with the procedures will impact the 

probability of failure to correctly diagnosis the action. 

2. Procedure usage specifically for execution is credited using THERP. The critical tasks and 

proceduralized recoveries are to be identified and each critical task is assigned an EOM and 

EOC. 

3. Decision tree pca, addresses procedure usage to assist the operator if the instrumentation 

is unreliable. The fire may cause the instrumentation to be unreliability because it is either 

failed by the fire or providing spurious readings. For cases where there is partial impact on 

instrumentation a warning in the procedure can be credited as having a positive impact on 

diagnosis. 

Decision tree pcd also considers procedure usage to assist the operator if the instrumentation 

is unreliable. The “All Cues As Stated” branch address if the cues are providing the correct 

readings. The fire may cause the instruments to spuriously actuate causing false readings. In 

this case the cues listed in the procedures would not be stated. The fire procedure may alert 

the operators that an instrument can spuriously actuate and the procedure warning is 

addressed in the second branch. 

If the EOPs are implemented in parallel to the Fire procedures, the workload is assumed high and 

this is modeled in decision tree pcb. However, if the action is time independent and the base case 

HFE (for existing EOP HFEs) is considered to have a low workload, the fire scenario can also be 

considered to have a low workload. In this case, it is assumed that the fire will be mitigated long 

before the action is required. 

Decision tree pce also addresses the use of multiple procedures and the effects of working two 

procedures at once. If the EOPs are implemented in parallel to the fire procedures, multiple 

procedures will be in effect and the multiple procedure branch is used. .In cases where the fire 

procedures are implemented prior the EOPs the workload could still be considered high if there 

are multiple fire procedures or multiple attachments be used at the same time. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-65 

In some cases, especially for some ex-CR actions, procedures might not exist or be readily 

retrievable, or ambiguous in some situations. The analyst needs to perform checks of the 

adequacy and availability of these other procedures that would be needed to address the fires 

modeled in the fire PRA. Obviously, the amount of training the crews receive on implementing 

the procedures and the degree of realism will be a critical factor. 

For cases where no procedures exist the important aspect to consider is the cue used for 

diagnosis. In these cases decision trees pcd, pce, pcf and pcg would not be applied and decision 

trees pca, pcb, and pcc will become more important for cognition. For execution, the EOM would 

typically come from following verbal instructions from memory. 

In cases where the procedure is ambiguously worded the down branch on decision tree pcf is 

used. There are very few cases of ambiguously worded procedure steps in the EOPs. The fire 

procedures however, often have cases of ambiguously worded procedures such as the following 

example. 

Table C-17 

Example of ambiguously worded procedure (fire zone 100) intake structure 

Affected Equipment Available Equipment 

1. SW

ASW Pps 1-1 and 1-2 ASW pp 1-1 will remain available. 

ASW Gates 1-8 and 1-9 ASW Gates 1-8 and 1-9 will not spuriously close. 

2. HVAC

ASW Pp Rms: E-101 and E-103 E-103 will remain available. 

In the example above it is not clear why the same equipment appears in both the affected column 

as well as the available column and the Ambiguously worded procedure branch would be 

applied. 

Like procedures, training for both control room and local actions, is an important factor in 

assessing operator performance. As stated in NUREG- 1852, training serves three supporting 

functions for operator performance during a fire: 

1. Training establishes familiarity with the Fire procedures and equipment needed to perform 

the desired actions, as well as, potential conditions in an actual event, 

2. Training provides the level of knowledge and understanding necessary for the personnel 

performing the operator manual actions to be well prepared to handle departures from the 

expected sequence of events, and 

3. Training gives personnel the opportunity to practice their response without exposure to 

adverse conditions, thereby enhancing confidence that they can reliably perform their duties 

in an actual fire event. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-66 

For internal events HRA, typically operators can be considered “trained at some minimum level” 

to perform their desired tasks. This is modeled in the CBDT decision trees by always selecting 

the yes branch for training. For fire HRA, the crew’s familiarity and level of training (for 

example the types of scenarios, frequency of training or classroom discussions and frequency of 

simulations) for addressing the range of possible fires compilations and potential actions to be 

performed may not be the same as for internal events. “Less familiarity” needs to be accounted 

for in assessing the impact of training for fire actions and in determining their HEPs. The less 

familiarity is accounted for in decision trees pc

a, pcd, pcf and pcg. Most plants provide some 

general training on the usage of the fire procedures, in this high level training the operators are 

trained to be aware of false instrumentation but there is no scenario specific training. Decision 

tree pca, pcg and pcd address general training, and decision trees pcd and pcf address scenario 

specific training. Scenario specific training would include addressing fire effects. In all the 

decision trees training is considered as a recovery to another PSF such as poor procedure 

wording, failed or misleading instrumentation or distractions due to workload. 

The type and frequency of training is identified and documented in the training fields within 

the HRA methodology. Training is considered explicitly in decision tree pc

a, pcd, pcf and pcg. 

C.7.4 Complexity 

As stated in NUREG-1792 the PSF complexity attempts to measure the overall complexity 

involved for the situation at hand and for the action itself (e.g., many steps have to be performed 

by the same operator in rapid succession vs. one simple skill-of-the-craft action). Many of the 

other PSFs bear on the overall complexity, such as the need to decipher numerous indications 

and alarms, the presence of many and complicated steps in a procedure, and/or a poor HMI. 

Nonetheless, this factor should also capture “measures,” such as the ambiguity associated with 

assessing the situation or in executing the task, the degree of mental effort or knowledge 

involved, whether it is a multivariable or single-variable associated task, whether special 

sequencing or coordination is required in order for the action to be successful (especially if it 

involves multiple persons in different locations), whether the activity may require very sensitive 

and careful manipulations by the operator. 

For quantification, complexity is not addressed explicitly for quantification within the EPRI 

HRA approach. Within the HRA methodology the HRA analyst must qualitatively make an 

assessment of the complexity of the action as simple or complex, both for cognition and 

execution in order to meet ASME standard requirement HR-G3 Category I. For quantification 

the EPRI approach addresses the following issues which together define complexity. 

Cognition complexity 

There are very few EOP actions that would require complex diagnosis since EOPs are symptom 

based and do not require the operator to make a diagnosis of the initiator for success. The 

assumption with the EOPs is that if the operators follow the procedures they will be successful. 

For fires, the cues and indications can be misleading and thus make the diagnosis more complex. 

Poor cues and indications are modeled in decision trees pc

a and pcd. Additionally, if the cues and 

indications are impacted by the fire then it will take the operators longer to make the correct 

diagnosis and this is reflected in the T1/2 value. Procedure usage for fire response is considered 

complex if the operators must interpret the instructions due to unclear wording. Ambiguous 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-67 

wording is modeled in decision tree pcf. Additionally, the usage of the fire procedures is not 

always straight forward which would lead to an increase in Tm. Sometime the usage of the 

procedure is left at the discretion of the operators and in this case the diagnosis would be 

complex. If the usage of the fire procedures is left to the discretion of the operators then there 

will be a greater variation among crew and the upper bound for sigma is used in the HCR/ORE. 

For cognitively complex actions additional crew may be credited in the CBDT decision trees as 

it assumed that the more crew available to assist the greater the success. Extra crew members, 

STA, and TSC can all be credited to assist in a complex diagnosis provided that there is enough 

time available. 

Execution complexity 

• Single vs. multiple procedure steps – If an action requires only a single task it is considered 

less complex than if multiple steps are required. The more critical task required the longer 

it will take to perform the actions and this impacts Tm. Using THERP each critical task is 

assigned failure probability and the more tasks required the higher the failure probability. 

• Multiple crew members performing coordinated steps – If multiple crew members 

are required to complete an action and the steps require coordination and communication 

between team members to successfully complete the action, then higher the complexity. If 

the action involves oral instructions among crew members then THERP table 20-8 is used for 

selecting and EOM. If a crew member must report back other members after completing a 

task an additional critical task of reporting back is included and is modeled as an EOM using 

either THERP or ASEP. 

• Multiple location steps – During the execution of an action, multiple locations may need 

to be visited either by different members of the staff or by one staff member. The necessity 

of visiting multiple locations (e.g., different electrical cabinets or different rooms, not just 

different panels in the MCR) increases the complexity, particularly if coordination and 

communication between the staff members is required. Generally, if multiple locations 

must be visited to complete the action, then high complexity is assumed. Visiting multiple 

locations requires a longer execution time and this is modeled by increasing Tm. The more 

locations involved the more critical tasks required thus by definition there are more EOC and 

EOMs that can results in a high failure probability. 

• Multiple functions – Multiple functions may need to be performed in the execution of an 

action (e.g., both align and controlling flow) that will increase the execution complexity of 

the action. For each function identified an EOC value is applied using THERP. For example: 

Failure to open valve – EOC is selected from THERP Table 20-13 for local action and 

Failure to monitor flow - EOC value would be selected from THEPR 20-11. If both opening 

and monitoring are required then the sum of both EOCs is used. 

• Accessibility of location or tools – Factors such as excessive heat, absence of adequate 

lighting, or the presence of the fire brigade in the area may make it more difficult for the 

operator to reach the location of the actions or to access tools necessary in performing the 

action. To the extent the action would become more difficult to complete because of such 

conditions, high complexity should be assumed. Within the HRA methodology the HRA 

analyst must identify these items and if any single PSF is present the stress level is set to 

high. If two or more of these PSFs are identified then an additional factor of 2 is applied to 

Pexe. Additionally, accessibility will impact the manipulation time and it is always ensured 

that there is enough time to complete this action. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-68 

C.7.5 Workload and Stress 

Workload is considered explicitly in decision tree pcd when modeling cognition and in the stress 

decision tree when modeling execution. 

Although workload, pressure and stress are often associated with complexity, the emphasis 

here is on the amount of work a crew or individual has to accomplish in the time available 

(e.g., task load), along with their overall sense of being pressured and/or threatened in some way 

with respect to what they are trying to accomplish [e.g., see Swain and Guttmann [3] for a more 

detailed definition and discussion of stress and workload]. To the extent crews or individuals 

expect to be under high workload, time pressure, and stress, it is generally thought to have a 

negative impact on performance (particularly if the task being performed is considered complex). 

For fires if the operators are working in both the EOPs and the fire procedures at the same time 

then the workload is considered high. For execution, if the workload is considered high the 

stress level is set to either high or moderate. If the number of required tasks equal or exceed the 

number of personnel, work load would be ‘High’. Time critical actions may also be perceived as 

high workload by the operators. Operator interviews will need to be performed to determine if 

the operators expect to feel time pressure due to a fire. 

Stress is addressed in the EPRI approach using a simplified decision tree shown below. 

Figure C-39 

Stress decision tree

Within the EPRI approach stress quantitatively only impacts execution. For diagnosis, PSFs that 

make up stress such as workload, training, procedures and cues and indications are considered 

explicitly and described above. The stress level determined in the stress decision tree is reflected 

as a direct multiplier to the execution using the values shown below. 

Table C-18 

Stress PSF Values

HRA Methodology Stress Level Multiplier to Pexe

Low 1 

Moderate 2 

High 5 

The first branch of the decision addresses if the operators believe the plant is responding as 

expected. For fire scenarios that involve a transient with no instrumentation impacts then the 

plant would be responding as expected. The spuriously actuation of equipment is not expected 

and if the fire scenario involves spurious actuation then the no branch would be used. Another 

example would be if the operators lose control from the control room due to fire impacts and 

MCR abandonment is required. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-69 

If any one of the following PSFs are considered poor due to the fire the PSFs branch of the stress 

decision tree is considered negative. 

• Poor lighting 

• Heat or smoke due the effects of the fire. It is assumed that the HRA analyst has assessed 

qualitatively that even though there is smoke present the action can still be completed. 

• Radiation levels are above background 

• Respirator/SCBA required 

• Special tools or clothing are required. 

• Radio communication required. 

• Accessibility is limited. 

If any two of the above PSFs are considered poor then the high stress is applied and Pexe is 

multiplied by an additional factor of 2. For example, if the local action requires the operators to 

travel thru a smoke filled area and a respirator is required then the additional factor of two would 

be applied. All of the above impacts are also considered in development of the timeline. If there 

is not enough time to complete the actions due to anyone of the PSFs above then the HEP should 

evaluate to 1.0. 

C.7.6 Human Machine Interface 

Human Machine Interfaces (HMI) impact operator performance differently depending on the 

location of the action. In general, NUREG-6580, NUREG-1852 and NUREG- 1792 all agree 

that for control room actions, the HMI will have minimal or positive affect on the human 

performance. This is because problematic HMIs have either been taken care of by control room 

design reviews and improvements or they are easily worked around by the operating crew due to 

the daily familiarity of the control room boards and layout. However, any known very poor HMI 

should be considered as a negative influence for an applicable action even in the control room. 

For control room actions for fire HRA, the human machine interfaces will remain similar to 

internal events with the exception of potential impacts on instrumentation. 

CBDT addresses HMI issues in decision trees pc

a, pcb and pcc. For most control room internal 

events actions these decision trees evaluate to negligible values. For fire HFEs this may not be 

the case if the cues and indications are effected by the fire. (See the discussion on cues above). 

For actions that require local diagnosis decision tree pcc could be important as the local 

indications may not be easy to locate and once located they could also be partially impacted by 

the fire. For MCR abandonment actions, the remote shutdown panel is a good example of where 

the indicators may not be easily identified. 

For execution of control room actions, the HMI is considered negligible and this is reflected in 

the selection of THERP values for EOC. Typically for control room actions that require manual 

control THERP Table 12-20 is applied. 

Fire response actions may require the operators to manipulate valves or switches which are not 

typically modeled in internal events. The valves may not be manipulated as often and thus not all 

the HMI issues have been addressed. Unclearly or ambiguously labeled, part of a group of two or 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-70 

more valves that are similar in all of the following: size and shape, state, and presence of tags are 

all addressed in the selection for the EOC using THERP. THERP Table 12-13 item 5 (HEP = 

1.3E-2) is used for the EOC for unclear or ambiguously labeled valves. 

C.7.7 Environment 

Within the HRA methodology, environmental impacts are considered within the stress level. 

If the fire does not directly impact the control room, the environmental conditions inside the 

control room are not usually relevant to success of operator actions since they rarely change 

control room habitability. However, if the fire directly affects the MCR either by smoke the 

introduction of toxic gases, or fire damage and requires the control room to be abandoned, 

environmental conditions need to be considered as negative impacts to the crew’s success. If any 

smoke or toxic gas is present in the control room then the stress decision tree evaluates to high 

stress because the plant is not responding as expected (since the HVAC system is failed) and an 

additional factor 2 is applied to Pexe. It is outside the scope of the EPRI approach to address 

different levels of smoke If smoke in the control room impacts the visibility such that operators 

will have difficulty locating the cues all instrumentation is considered impacted and the HFE 

should evaluate to 1.0. It is outside the scope of the EPRI approach to address visibility affecting 

cognition. 

For local actions, environmental conditions could be an important influence on the operator 

performance. Radiation, lighting, temperature, humidity, noise level, smoke, toxic gas, even 

weather for outside activities (e.g., having to go on a potential snow-covered roof to reach the 

atmospheric dump valve isolation valve) can be varied and far less than ideal. Fires can introduce 

additional environmental considerations not normally experienced in the response to internal 

events. These include heat, smoke, the use of water or other fire-suppression agents or chemicals, 

toxic gases, and different radiation exposure or contamination levels. Any or all of these may 

adversely impact the operator actions in the locations where the actions are to be taken and along 

access routes. If any one of the above PSFs are considered to have a negative impact then high 

stress is applied. If any two of the above PSFs are considered poor then the high stress is applied 

and Pexe is multiplied by an additional factor of 2. In most of the cases described above there is 

more than one negative PSF (since the PSFs are not independent) and therefore the additional 

multiplier of 2 will always be applied. 

During a fire, there is the potential that the crews ideal travel path to the action location will 

be blocked by the fire and will lead to a delay or inability to reach the action location. Where 

alternate routes are possible, the demands associated with identifying such routes and any 

extra time associated with using the alternate routes should be factored into the analysis. Per 

NUREG/CR-6850, if the action is required to be performed in the same location as the fire, the 

action should not be credited in the fire PRA. If the local actions required a detour due to the fire 

location then the time for the detours is to be included in Tm. Additionally the stress would be 

considered high since the accessibility for the action is limited by the fire location. 

An evaluation should be done addressing the issue that any equipment that is necessary for 

the completion of hot shutdown from the remote shut down panel is accessible and in working 

order such that it will not be adversely affected by the fire or its effects (for example, heat, 

smoke, water, combustible products, and spurious actuation). The timeliness and success rate in 

reaching systems and equipment should be assessed in the demonstration for feasibility or judged 

conservatively to adequately adjust for the greater stress and time pressure put upon the operators 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-71 

working in the likely unfamiliar environment and ex-CR controls. If it is qualitatively assessed 

that at the hotshot down panel a piece of equipment would not be in working order and this 

equipment is required for success then the HEP should be set to 1.0 It is not within the scope 

of this method to address repairing equipment damaged by the fire. 

C.7.8 Special Equipment 

Due to varying environmental conditions during a fire, the crew may require the use of special 

equipment. These items, identified in NUREG-1852 as portable equipment can include: keys, 

ladders, hoses, flash lights, clothing to enter high radiation areas and for fire special protective 

clothing and breathing gear. The accessibility of these tools needs to be checked to ensure they 

can be located and accessible during a fire. If they can not be accessed during the fire then the 

HEP evaluates to 1.0. It is outside the scope of the EPRI method to address locating secondary 

equipment if the primary pieces are not available. Furthermore, the level of familiarity and 

training on these special tools needs to be assessed. The familiarly with special equipment 

can be addressed by choices for EOCs in THERP. 

The call for abandoning the MCR might also call upon the need to don protective gear or self 

contained breathing apparatus (SCBA). The hindrance of the special clothing on the operators’ 

actions needs to be accounted for. The time to don SCBA can be observed during annual SCBA 

training and included in Tm. For HFEs that require SCBA gear it should be ensured that there 

is enough time to perform the action even when a conservative estimated to time to don gear 

is assumed. It is assumed that operators would not need SCBA gear to make diagnosis, and 

therefore SCBA gear would only impact execution. It is outside the scope of this method to 

address cognition while wearing SCBA gear. It is also expected that the fire PRA will not 

model these kinds of actions. If SCBA gear is required in most cases there will be more than 

one negative PSF and thus the stress level will be considered high and an additional factor of 

2 is applied to Pexe. 

Any additional special equipment needs are collectively addressed by applying high stress and 

applying an additional factor for 2. (See discussion on stress). 

C.7.9 Special Fitness Needs 

According to NUREG/CR-6850, the fire and its effects could cause the need to consider actions 

not previously considered under internal events, or changes to how previously considered actions 

are performed, checks should be made to ensure unique fitness needs are not introduced. Unique 

fitness needs could include: 

• Having to climb up or over equipment to reach a device. This could be to the fire blocking 

the ideal travel path. 

• Needing to move and connect hoses, using an especially heavy or awkward tool. 

• Physical demands of using respirators. This could impact communication as well. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-72 

If the fire cause any of the above unique fitness needs such that not all crew members could 

perform the required tasks then the HEP should be set to 1.0. If the operators are required to 

climb over equipment or move and connect awkward hoses this would be reflected in Tm and the 

stress level would be impacted due to accessibility. Communication impacts would be reflected 

in an increased stress level. 

C.7.10 Crew Communications, Staffing and Dynamics 

Crew to crew variability modeled is the HCR/ORE by using the appropriate bound for sigma. 

For EOP actions where there are no instrumentation impacts the average case is used. For cases 

where there could be crew to crew variability due to fire impacts such as confusion in procedure, 

instrumentation impacts or decision making for control room abandonment the upper bound for 

sigma will be used. Communication is explicitly addressed in decision tree pc

c and additional 

crew can be credited for recovery in the CBDT trees provided there is enough time available. 

The HRA methodology documents the total number of people required for success and if the 

total number of crew required is greater than the total number available then the HEP should 

be set to 1.0. 

Team crew dynamic 

Team/crew dynamics and crew characteristics are essential to understanding 1) how and where 

the early responses to an event occur and 2) the overall strategy for dealing with the event as 

it develops. In particular, the way the procedures are written and what is (or is not) emphasized 

in training (which may be related to an organizational or administrative influence), can cause 

systematic and nearly homogeneous biases and attitudes in most or all the crews that can affect 

overall crew performance. NUREG-1792 recommends a review of team dynamics include the 

following: 

• Are independent actions encouraged or discouraged among crew members (allowing 

independent actions may shorten response time but could cause inappropriate actions going 

unnoticed until much later in the scenario)? If this scenario is identified to be modeled this 

would considered as in decision tree pc

b – failure of attention. High workload would be 

assumed and no additional crew would be credited for recovery. If the HRA analysts wishes 

to model the recovery by a secondary person, this would be modeled by assuming the first 

person failed the action and the second member would receive a recovery cue to either check 

that the previous task was completed or to take another action. The timeline for the second 

action would be based on the recovery cue. Additionally, the dependency approach outlined 

in Section 7 of the main document could be used to assessed the dependency between the 

actions. 

• Are there common biases or “informal rules?” For example, is there a reluctance to do certain 

acts, is there an overall philosophy to protect equipment or run it to destruction if necessary, 

or are there informal rules regarding the way procedural steps are interpreted. Operator trust 

of the procedures are modeled in decision tree pc

g. If the operators believe in the adequacy of 

the procedures the informal rules are considered negligible. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-73 

• Operator interviews are performed to identify any informal rules that may not be obvious 

during a procedure review. For example, if the operators receive a cue such as an annunciator 

and they know that this is an important annunciators they may be allowed to set aside the 

EOPs and attend to the annunciator even if the documented plant protocol is to not leave the 

EOPs until directed to do so in the EOPs. For this case, T1/2 and Tdelay would reflective 

of the time at which the operators leave the EOPs and acknowledge then annunciator. 

Additional, if the interviews confirm that all operators will be following a specific cue then 

extra crew can be credited as a recovery in the CBDT. 

• Are periodic status checks performed (or not) by most crews so that everyone has a chance to 

“get on the same page” and allow for checking on what has been performed to ensure that the 

desired activities have taken place? This is addressed decision tree pc

b and proceduralized 

checks are modeled as recoveries for execution. The following example of a proceduralized 

recovery is shown below: 

For fire HRA, the typical internal events crew dynamics may change as a result of responding to 

a fire and need to be re-considered. For instance, the fire may create new or unique fire-related 

responsibilities that have to be handled by a crew member. If the total number of crew availed 

exceeds total number of crew required then the HEP =1.0. The HRA methodology provides 

a field for documenting both the number of crew required and the number of crew available. 

The use of plant status discussions by the crew may be delayed or performed less frequently, 

allowing less opportunity to recover from previous mistakes. This would be reflected in the 

timeline as well and not applying recoveries for cognition. Such differences may be best 

determined by talk-through with operations staff, as well as observing simulated responses 

of fire scenarios. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-74 

Figure C-40 

Crediting proceduralized recovery within Pexe

For MCR abandonment actions or alternate shutdown actions, the crew will be dispersed to 

various alternative shutdown panels and controls and this requires additional coordination among 

all crew members. It must be assured that there are adequate control room members necessary to 

fulfill the needs of proper shutdown actions from alternative and remote shutdown panels if not 

then the HEP =1.0. 

Communication 

For both internal events and fire HRA control room actions, communications among crew should 

be verified. Typically there will be an established strategy for communicating in the control 

room that ensures that directives are not easily misunderstood. Do crew members avoid the use 

of double negatives? It is expected that communication will not be problematic; however, any 

potential problems in this area (such as having to talk with special air packs and masks on in the 

control room in a minor fire) should be accounted for if they exist. Communications and its 

impact on cognition is modeled in decision tree pc

c and additional crew can be credited for 

recovery in the CBDT trees provided there is enough time available. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-75 

If SCBA is required to be worn, this apparatus might interfere with clarity in communications 

between the team. Execution while wearing SCBA gear is reflected as an increase in stress level. 

If communication is required for successful execution while wearing SCBA gear then the stress 

level considered to be high and Pexe is multiplied by an additional factor of 2. 

The general EPRI approach for communication is to verifies that is possible and if it not possible 

and required for success then the HEP =1.0. 

C.8 Example of Fire HFE quantified using the EPRI HRA Methodology 

This section provides an example HFEs modeled using the EPRI approach and the HRA 

methodology. This example is for an existing EOP action that is required for the fire HRA. In the 

fire scenario the position switch is failed by the fire so the control room operators can not open 

the valve from the control room and must dispatch a local operator to perform this action. The 

indication that the value is failed provides a correct reading and is not considered to impact the 

diagnosis. The fire procedures also direct the operator to locally open the valve. 

Scenario-1, Locally open 8804 A/B for high pressure recirculation following a spurious 

PORV LOCA 

Basic Event Summary 

Table C-19 

Scenario-1 summary

Analysis Method CBDTM/HCR Combination (Sum) 

P(cog) 3.4e-03 

P(exe) 2.5e-03 

Total HEP 5.9e-03 

Error Factor 5 

Assigned Basic Events 

None 

Related Human Interactions 

Switchover to Recirc on low RWST Level 

Initial Cue 

Charging Pump amps 

Charging injection flow 

SI Pump flow if Pumps are in operation 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-76 

Cue 

RCS Pressure decreasing would be the primary cue operators would be focused on for 

diagnosing stuck open PORV. 

Monitor light boxes - The indicators at the switch would not be available to alert the operators 

that the valve failed to close but the monitor light boxes would be giving conflicting information 

and the operators tend to look at both the position switch and the monitor light boxes. 

The cue for starting cold leg recirc is RSWT level <33% 

Degree of Clarity of Cues & Indications 

Very Good 

Procedures 

Cognitive: ES 1.3 (Transfer to Cold Leg Recirculation) Revision: 26 

Execution: ES 1.3 (Transfer to Cold Leg Recirculation) Revision: 26 

Other: CP-M-10 () Revision: 21A 

Cognitive Procedure

Step: 8.g.

Instruction: Check for charging pps amps, Charging injection flow and SI Pp flow if pps are in 

operation 

Procedure Notes 

By the time switch over to cold leg recirc is required the operators will also be looking at 

CP-M-10 (The fire procedure) 

The procedure step in CP-M-10reads

Manually close 8804A Power will be isolated (by opening 480V MCC feeder breaker 52-1G-58 

to preclude spurious operation of 8982A. If 8982A has opened, then locally close valve 8980 

after opening its power breaker 52-1F-31 

The operators are trained bi-annually on ES 1.3 but they are not specifically trained on ES 1.3 

following a fire with various valve failures. 

Training

Classroom, Frequency: 0.5 per year 

Simulator, Frequency: 0.5 per year

JPM Procedure

Not Selected 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-77 

Identification and Definition 

1. Initial Conditions: Steady State, Full power 

2. Initiating Events: 

Fire in Area 5A2 

PORV spuriously opens resulting in small LOCA 

The fire starts in TRY12 (transformer) and impacts targets in the plume and vertical trays 

adjacent to the flames. 

3. Accident sequence (preceding functional failures and successes): 

Reactor trip 

Turbine trip 

No containment spray required 

AFW successful 

SSPS not impacted 

SI actuates due to open PORV 

Cooldown and depressurization required. 

Switch over to recirc required. 

8804A failed to open from CR due to fire damage. 

4. Preceding operator error or success in sequence: 

Operator fail to detect spurious PORV opening prior to auto SI actuation. 

Operators controlled ECCS flow to match make-up flow with leakage rate 

RHR pumps tripped 

Cooldown and depressurization either failed or failed to be completed before RSWT reaches 

33% 

Procedure path: 

E-0 (Step 9b RNO transfer) 

E-1 (Step 12 Check RCS Pressure - GREATER THAN 300 PSIG) 

E-1.2 (RSWT level <33% Fold out page) 

E-1.3 (Step 8 - Place 8804 A RHR Hx No. 1 to Chg Pp Suction 

5. Operator action success criterion: 

Locally open 8804A and B located at 73’ RHR Access or 100’ GE - 8804A failed to open 

from CR due to fire damage. 

6. Consequence of failure: RWST depleted - Core damage 

7. Equipment Affected By Fire: 

Spuriously open of EP-1-52 HG15-DC (startup supply breaker to vital buses) 

EDG 1-2 failed 

RHR 1-1 failed 

CCP 1-2 failed 

Other Bus G equipment failed. 

PORV-455 C spuriously opens 

Block valve 8000B failed 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-78 

8. Notes: 

This is an internal events action but not currently modeled in PRA. It will be added to 

FPRA model. 

The current screening HEP for this action is 0.1 

Key Assumptions 

Operator Interview Insights 

The operators stated that it would be obviously that 8804A or B failed to close when attempted 

from the control room. In the control room in addition to the position switches the valve position 

are also monitored on monitor light boxes. The cabling for the monitor light boxes are separate 

from the valve cabling. 

The operators estimate that it will take 10 minutes to crank open valve and 15 minutes to travel 

to the valve location. 

The operators are aware that switch over to recirc is coming and they will have an operators 

preview E 1.3 (step 13 of E-1 PREVIEW EOP E-1.3, TRANSFER TO COLD LEG 

RECIRCULATION.) During the preview they anticipate that the preview will alter the 

operators to a failed valve. 

Manpower Requirements 

Crew Member Included Total Available Required for Execution Notes 

Reactor operators Yes 2 1 

Plant operators Yes 2 1 

Mechanics Yes 2 

Electricians Yes 2 

I&C Technicians Yes 2 

Health Physics Technicians Yes 2 

Chemistry Technicians Yes 1 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-79 

Execution Performance Shaping Factors 

Environment Lighting Normal 

Heat/Humidity Normal 

Radiation Background 

Atmosphere Normal 

 

Special Requirements 

Complexity of Response Cognitive Complex 

Execution Simple 

Equipment Accessibility Control Room Accessible 

73’ RHR ACCESS Accessible 

 

Stress High 

Plant Response As Expected: No 

Workload: N/A 

Performance Shaping Factors: N/A 

Performance Shaping Factor Notes 

Due to the fire and the spuriously opening of valves the plant is not responding as expected. 

The fire location does not impact the operators from reaching 73’ RHR ACCESS 

Stress is considered High. 

Timing 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-80 

Timing Analysis: Tsw - 300 min. Time to RWST depleted 

Tdelay =120 switchover to recirc. RWST <33% 

T1/2 = 2 minutes Estimated time attempt to close CR switch and relies that valve must be closed 

locally. 

Tm = 25 minutes from operator interviews 

Time available for recovery: 93.00 Minutes 

SPAR-H Available time (cognitive): 95.00 Minutes 

SPAR-H Available time (execution) ratio: 4.72 

Minimum level of dependence for recovery: ZD 

Cognitive Unrecovered CBDTM 

Scenario-1 

Table C-20 

Scenario-1 cognitive unrecovered 

Pc Failure Mechanism Branch HEP 

Pca: Availability of Information a neg. 

Pcb: Failure of Attention i neg. 

Pcc: Misread/miscommunicate data a neg. 

Pcd: Information misleading a neg. 

Pce: Skip a step in procedure c 3.0e-03 

Pcf: Misinterpret instruction b 3.0e-03 

Pcg: Misinterpret decision logic j 1.0e-03 

Pch: Deliberate violation a neg. 

Sum of Pca through Pch = Initial Pc = 7.0e-03 

Pca Notes

The monitor light boxes in the control room are unaffected by the fire. 

Pcb Notes 

2 hrs into the scenario the workload is still considered high because the operators will be 

working in both the fire procedure and the EOPs. The operators are only required to check the 

monitor light boxes located on the front panels of the control room for the valve positions. 

Pcc

 Notes 

The checking of the monitor light boxes does not require the use of formal communication to 

complete. However complete of step ES 1.3 does require formal communication. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-81 

Pcf Notes 

All the available information would not be available since the position indicator lights may have 

failed due to fire. All steps of EOPs are well trained on. 

Pcg

 Notes 

A valve failing due to fire is not trained on. 

Cognitive Recovery CBDTM 

Scenario-1 

Table C-21 

Scenario-1 cognitive recovery 

Initial 

HEP 

Self-Review 

Extra Crew 

STA Review 

Shift Change 

ERF Review 

DF 

Multiply HEP By 

Override Value 

Final 

Value 

Pca: neg. - - - - - - 1.0e+00 

Pcb: neg. X - - - - - 1.0e-01 

Pcc: neg. - - - - - - 1.0e+00 

Pcd: neg. - - - - - - 1.0e+00 

Pce: 3.0e-03 - - - - - - 1.0e+00 3.0e-03 

Pcf: 3.0e-03 - - X - - - 1.0e-01 3.0e-04 

Pcg: 1.0e-03 - - X - - - 1.0e-01 1.0e-04 

Pch: neg. - - - - - - 1.0e+00 

Sum of Pca through Pch = Initial Pc = 3.4e-03 

Notes 

Due to time available STA is credited for recovery. 
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-82 

Cognitive HCR/ORE 

Scenario-1 

Table C-22 

Sigma table

Plant Type Response Type LB Sigma UB 

BWR CP1 0.4 0.7 1 

CP2 0.2 0.58 0.96 

CP3 0.59 0.75 0.91 

PWR CP1 0.26 0.57 0.88 

CP2 0.07 0.38 0.69 

CP3 0.77 

Sigma: 3.8e-01 

HEP: Negligible 

Notes/Assumptions: The average sigma is used since this action is both proceduralized in the fire procedure and in the 

EOPs. By the time the operators reach this action, they will have reviewed the fire procedures. 
Detailed Quantification of Post-Fire Human Failure Events Usin

C-83 

Execution Unrecovered Scenario-1 

Table C-23 Scenario-1 execution unrecovered 

Procedure: ES 1.3, Transfer to Cold Leg Recirculation Comment 

THERP Step No. Instruction/Comment Error Type Table Item HEP Stress F

Locally open 8804 A (73’ RHR ACCESS) -- EOM 20-7b 4 4.3E-3 EOC 20-13 1 1.3E-3

5 

E-1.3 G RNO 

Total Ste

Check for charging pp amps, charging injection flow and SI pp flow if pps are in operation -- EOM 20-7b 4 4.3E-3 EOC 20-11 4 3.8E-3

5 

E-1.3 Step 8g 

Total Ste

Execution Recovery Scenario-1 

Table C-24 Scenario-1 execution recovery 

Critical Step 

No. 

Recovery 

Step No. Action HEP (Crit) HEP (Rec) Dep. Cond. 

(Rec

E-1.3 G RNO Locally open 8804 A (73’ RHR ACCESS) 2.8e-02 

 E-1.3 Step 

8g 

Check for charging pp amps, charging injection flow and SI pp flow if pps are in operation 

4.1e-02 LD 8.9e-

Total Unrecovered 2.8e-02 Total Recov
Detailed Quantification of Post-Fire Human Failure Events Using EPRI Fire HRA Methods 

C-84 

C.9 References 

1. Software Users Manual, The Human Reliability Calculator Version 4.0. EPRI, Palo Alto, 

CA, and Scientech, Tukwila, WA. January 2008. Product ID. 1015358. 

2. An Approach to the Analysis of Operator Actions in Probabilistic Risk Assessmen. Electric 

Power Research Institute, 1992. EPRI TR-100259. 

3. Operator Reliability Experiments Using Nuclear Power Plant Simulators. Electric Power 

Research Institute, July 1990. EPRI NP-6937. 

4. NUREG/CR-1278, “Handbook of Human Reliability Analysis With Emphasis on Nuclear 

Power Plant Applications”, A.D. Swain and H.E. Guttman, 1983. 

5. SHARP1 – A Revised Systematic Human Action Reliability Procedure. 1990. 

EPRI NP-7183-SL SHARP/SHARP1. 

6. EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities. September 2005. 

NUREG/CR-6850/EPRI 1011989. 

7. ASME RA-S-2000, “Standard for PRA for Nuclear Power Plant Applications”, Rev 14A, 

May 11, 2001 supplemented by ASME RA-Sa-2003, “Addenda to Standard For Probabilistic 

Risk Assessment For Nuclear Power Plant Applications”, December 5, 2003, supplemented 

by ASME RA-Sb-2005, “Addenda to Standard For Probabilistic Risk Assessment For 

Nuclear Power Plant Applications”, December 2005, all by American Society of Mechanical 

Engineers. 

8. NUREG-1792, “Good Practices for Implementing Human Reliability Analysis (HRA),” 

Sandia National Laboratories, 2005. 

9. NUREG-1852, “Demonstrating the Feasibility and Reliability of Operator Manual Actions 

in Response to Fire”, October 2007. 
D-1 

D

DETAILED QUANTIFICATION OF POST-FIRE HUMAN 

FAILURE EVENTS USING ATHEANA 

D.1 Objective 

The goal of this appendix is to provide an overview of describe the process of applying A 

Technique for Human Event Analysis (ATHEANA) used in quantifying many of the human 

failure events (HFEs) identified in the fire PRA models. Specific guidance describing the process 

for applying the method is presented in NUREG-1880 [1]. ATHEANA is a human reliability 

analysis (HRA) methodology designed to support the understanding and quantification of HFEs 

in nuclear power plants. This approach may be used in those instances in which a simpler HRA 

methodology is not valid due to the complexity of the scenario. Based on reviews of operating 

experience in technically challenging domains such as nuclear power plants, a key observation 

that drives the ATHEANA approach is that HFEs that contribute to equipment damage or 

other severe consequences, and that involve highly trained staff using considerable procedure 

guidance, do not usually occur randomly or as a result of simple inadvertent behavior such as 

missing a procedure step or failing to notice certain indications because they are on a back panel. 

Instead, HFEs in these situations occur when the operators are placed in an unfamiliar situation 

where their training and procedures are inadequate or do not apply or when some other unusual 

set of circumstances occur. In such situations, incorrect assessments are often made with regard 

to the status of the system being monitored or controlled, and subsequent human actions may not 

be beneficial or may even be detrimental. It is likely that some fire scenarios may have these 

characteristics and when fire scenarios and related HFEs cannot be adequately covered by the 

Simplified fire HRA, the potential for the scenarios being particularly challenging and the need 

to perform an ATHEANA analysis should be carefully considered. Certainly, fire scenarios with 

the potential for unexpected spurious indications or equipment actuations that would be difficult 

to track and understand would be strong candidates for an ATHEANA analysis. 

D.2 Summary of Method 

Step-by-step guidance for how to apply ATHEANA during an internal events PRA is covered in 

the ATHEANA User’s Guide (NUREG-1880 [1]). NUREG-1880 provides a simplified version 

of the multi-step analysis process covered in NUREG-1624 [2]. The ATHEANA process is much 

more than simply a quantification process and it entails several steps prior to quantifying HEPs. 

These steps are presented in Figure D-1. Detailed discussion of each of these steps can be found 

in NUREG-1880 [1]. While it is recommended that analysts review the introduction to the 

ATHEANA User’s Guide and all of the ATHEANA steps prior to quantifying fire scenario 

HFEs, the identification of HFEs, their inclusion in the fire PRA models, and much of the fire 

context and related information needed to apply the ATHEANA quantification process will have 
Detailed Quantification of Post-Fire Human Failure Events Using ATHEANA 

D-2 

already been identified in applying steps 1 - 3 (Sections 3 – 5) of this report. However, it will 

still be useful to review ATHEANA steps 1-5, particularly step 5, given the fire context, before 

proceeding. It may not be necessary to perform Step 6, the deviation analysis, since the fire 

scenarios can be looked at as deviation scenarios1

 themselves. However, to the extent there 

may be aleatory factors that could significantly alter the likelihood of crew success (e.g., worst 

case fire scenario for a given fire area, significant staffing shortage for particular scenario) then 

explicit modeling of such factors may be useful. Steps 5, 6, and 9 of the ATHEANA process 

provide guidance for identifying, modeling, and quantifying such factors. Steps 7-9, which 

includes the quantification process, will usually need to be applied (see discussion below). 

Objectives and 

technical concerns 

of the analysis

PRA perspective 

and model

development

(initiating events, 

sequences,

success criteria, 

relevant human

actions)

1.

Define and Interpret 

the Issue

2.

Define the Scope of

the Analysis

3.

Describe the PRA

Scenario and Its

Nominal Context

4.

Define the

Corresponding HFE

or UA (or EOC)

6.

Search for Plausible

Deviations of the PRA

Scenario

5.

Assess Human

Performance Information

And Characterize Factors

That Could Lead to Potential

Vulnerabilities

7.

Evaluate Potential to

Recover from the

HFE/UA

8.

Estimate the HEPs for

The HFEs/UAs

9.

Incorporate

HFEs/UAs and

Corresponding HEPs

into the PRA

Nominal Context

Error-Forcing Context

Figure D-1 

Steps in the ATHEANA methodology 

If the ATHEANA method is selected for use, the quantification step is to be performed as 

usual. However, the analyst must consider that the fire context creates a number of factors that 

influence crew performance and these factors must be accounted for within the ATHEANA 

analysis. This information will be provided by following the guidance in the body of this report 

 

1

 A deviation scenario is a plausible deviation from the nominal conditions or plant evolutions normally assumed for 

the PRA sequence of interest (the nominal scenario), which might cause problems or lead to misunderstandings for 

the operating crews. 
Detailed Quantification of Post-Fire Human Failure Events Using ATHEANA 

D-3 

and may be supplemented by following the ATHEANA steps. The ATHEANA methodology 

uses a formalized expert opinion elicitation process to estimate the HEP rather than specific rule 

sets or a similar structure to convert the effects of these important influences into an HEP. When 

applying ATHEANA to a fire context, although experts in operations and training should be 

included, experts who are familiar with the important relevant factors for plant personnel under 

fire conditions should also be included. 

D.3 Application of Method 

Although the early steps (steps 1-4 and step 5 to some extent) within the ATHEANA 

methodology will most likely be completed through the progression through sections 3-5 of this 

document, it is recommended that the analyst address the search for vulnerabilities described 

in Step 5 of ATHEANA to make sure that the various influencing factors identified using the 

guidance in this report and their potential impact on crew performance have been thoroughly 

considered. After applying Step 5, if potentially important aleatory factors have been identified 

(see ATHEANA User’s Guide section 3.5.2.3), then section 3.6.2.2 of the User’s Guide should 

also be reviewed. This section provides guidance for determining whether deviation scenarios, 

such as those with potentially important aleatory influences, should be carried forward to the 

quantification process. It will also be necessary to apply the final qualitative step (step 7) within 

ATHEANA before continuing forward with quantification. In step 7, the analyst examines the 

recovery potential for the HFE being analyzed in the context of each scenario documented. Upon 

the completion of this step, the description of each scenario is extended using the information 

obtained in the evaluations, in order to justify the judgment of either a high or low recovery 

potential. This information is then carried forward for quantification. 

Following the completion of the qualitative analysis, ATHEANA offers a quantification 

technique that uses an expert elicitation process that can take advantage of the entire knowledge 

base gained in performing earlier steps. The approach for quantification in ATHEANA relies 

on a very structured, facilitator led, expert opinion elicitation where experts provide their review 

and insights on the factors judged to be driving performance, along with their judgments as to 

the appropriate estimate for the HEP. In estimating each HEP, the experts consider the plant 

conditions and relevant PSFs associated with context in a holistic and integrated manner, 

and ultimately arrive at an estimate for each HEP. Guidance on forming the team of experts, 

controlling for biases when performing elicitations, addressing uncertainty, and other issues 

associated with eliciting probabilities is given in the ATHEANA User’s Guide (NUREG-1880 

[1]). A reminder that the team of experts should be expanded to include experts knowledgeable 

in important relevant factors within a fire context. 

Fire-Specific Application of ATHEANA 

This section provides some discussion of how to specifically apply ATHEANA HRA method 

when using this document. 
Detailed Quantification of Post-Fire Human Failure Events Using ATHEANA 

D-4 

As described in Section 6, an analyst may decide to perform detailed HRA analysis using 

ATHEANA for all HFEs modeled in the FPRA.2 Alternately, the analyst may be using 

ATHEANA because the scoping HRA method did not or could not provide the desired analysis 

results for some specific HFEs. 

In both cases, it is expected that qualitative HRA analysis, such as that described in Section 5, 

has been performed. From such a qualitative analysis, it is expected that the analyst(s) will have 

developing a general understanding of possible operator performance in fire scenarios, for 

example, a general understanding of: 

• procedures used in fire scenarios 

• usage of procedures 

• potential fire effects and their impact on human performance 

• Fire PRA scenarios with associated equipment and indication failures 

• possible crew responses to fire scenarios (both possible errors of omission & errors of 

commission) 

If not already developed in implementing Section 5, it is important to the application 

of ATHEANA that the following additional types of qualitative analysis are performed: 

• identification of important decision points or branching, and other possible places 

in procedures where operators may make different choices 

• identification of plant-specific “informal rules” (i.e., informal operational guidance or 

practice) and other guidance (e.g., administrative procedures) that may supplement or, 

at times, slightly deviate relevant procedural guidance (see Table 9.13 in NUREG-/1624, 

Rev. 1 [2] for examples) 

• development of insights from training, experience, or demonstration of fire-related operator 

actions (both in-control room and ex-control room), including use of specialized equipment 

• timelines or other ways of representing the time sequencing of events (e.g., plant behavior, 

equipment & operator response) in fire scenarios 

Then, for each HFE and associated fire scenario, qualitative HRA analysis using ATHEANA 

should address the following (with the help of and input from operator trainers and, as needed, 

other experts in operations, PRA, and thermal-hydraulics, for example): 

• identification of any factors (e.g., specific fire scenario conditions, timing of plant conditions 

and behavior associated with scenario, availability of specific equipment – including 

equipment degradations) that may influence different operator decisions (identified above) 

2

 However, the authors recommend the use, to the extent possible, of the scoping HRA method provided in this 

report. The scoping HRA method is consistent with the ATHEANA method since it is based, in part, on some 

of the underlying concepts and principles in ATHEANA. Also, because the number of influencing factors 

addressed by the scoping method is limited, it is expected to require fewer resources to apply. However, there are 

two instances in which the use of ATHEANA is recommended: a) important plant-specific or scenario-specific 

features cannot be addressed using the scoping HRA method, or b) the analyst thinks that a detailed HRA analysis 

would result in lower HEP value(s) than that assigned by the scoping HRA method. 
Detailed Quantification of Post-Fire Human Failure Events Using ATHEANA 

D-5 

• identification of any tradeoffs (i.e., operators have to make impromptu choices between 

alternatives, for which they may be both positive and negative effects) or other difficult 

decisions (see Table 9.15a in NUREG-1624, Rev.1 [2] for other examples of other potential 

problems in “response planning”) that operators may need to make 

• identification of potential situations (or other reasons) why operator may not understand the 

actual plant conditions (e.g., spurious indications mislead operators to take, or not take, an 

action) (see Table 9.15b in NUREG-1624, Rev. 1 [2] for examples of scenario characteristics 

that could lead to problems in “situation assessment” – spurious indications would fall under 

the category of “missing information”) 

• identification of different ways by which an HFE could occur (i.e., define sub-events), 

starting with the fire PRA scenario description, different procedural paths or choices, and 

the reasons for these different choices (note that, for each different sub-event, this analysis 

results in the development of the qualitative description of the “error-forcing context”) 

After the qualitative analysis described above has been performed, then HFE quantification 

using ATHEANA can be performed. (It should be noted that, in ATHEANA, there can be some 

iteration between quantitative and qualitative analysis in using ATHEANA. The only concern is 

that each HFE (and sub-event HFEs) and associated can be understood by all participants in the 

quantification process. 

For HFE quantification, NUREG-1880 is the best reference for analysts to use in applying 

ATHEANA. Because it is possible that HFE sub-events may be identified, quantification may 

include three major elements: 

1. quantification of the frequency of different plant or fire conditions (that would cause or 

influence operator understanding and/or choices), 

2. quantification of the probability of different operator understanding and/or choices 

(given the plant or fire conditions), and 

3. quantification of the failure probability for the HFE (or HFE sub-event) given #1 & #2. 

Analysts have the choice of defining new HFEs (instead of HFE sub-events – called unsafe 

actions in NUREG-1880 [1] and NUREG-1624, Rev. 1 [2]), or summing the HFE sub-event 

probabilities. 

D.4 References 

1. NUREG-1880, “ATHEANA User’s Guide,” June 2007. 

2. NUREG-1624 Rev 1, “Technical Basis for Implementation Guidelines for A Technique 

for Human Event Analysis (ATHEANA),” May 2000. 

E-1 

E

DEFINITION OF TERMS 

accident sequence: A representation in terms of an initiating event followed by a sequence of 

failures or successes of events (such as system, function, or operator performance) that can lead 

to undesired consequences, with a specified end state (e.g., core damage or large early release) 

(ASME-RA-2002/RA-Sb-2005 [2]). 

adversely affect: In the context of fire PRA, to impact, via fire, plant equipment items and 

cables leading to equipment or circuit failure (including spurious operation of devices). 

cable: Referring solely to “electric cables,” a construction comprising one or more insulated 

electrical conductors (generally copper or aluminum). A cable may or may not have other 

physical features such as an outer protective jacket, a protective armor (e.g., spiral wound or 

braided), shield wraps, and/or an uninsulated ground conductor or drain wire. Cables are used to 

connect points in a common electrical circuit and may be used to transmit power, control signals, 

indications, or instrument signals. 

cable failure mode: The behavior of an electrical cable upon fire-induced failure that may 

include intra-cable shorting, inter-cable shorting, and/or shorts between a conductor and an 

external ground. (Also see “hot short.”) 

circuit failure mode: The manner in which a conductor fault is manifested in the circuit. Circuit 

failure modes include loss of motive power, loss of control, loss of or false indication, open 

circuit conditions (e.g., a blown fuse or open circuit protective device), and spurious operation. 

concurrent hot short: The occurrence of two or more hot shorts such that the shorts overlap 

in time (e.g., a second hot short occurs before a prior hot short has self-mitigated or has been 

mitigated by an operator action). 

containment failure: Loss of integrity of the containment pressure boundary from a core 

damage accident that results in unacceptable leakage of radionuclides to the environment 

(ASME-RA-2002/RA-Sb-2005 [2] and ANSI/ANS-58.212OO7 [1]). 

core damage: Uncovery and heatup of the reactor core to the point at which prolonged 

oxidation and severe fuel damage involving a large fraction of the core are anticipated 

(ASME-RA2002/RA-Sb-2005 [2]). 

core damage frequency (CDF): Expected number of core damage events per unit of time 

(ASME-RA-2002/RA-Sb-2005 [2] and ANSI/ANS-58.21-2007 [1]). 
Definition of Terms 

E-2 

damage criteria: Those characteristics of the fire-induced environmental effects that will be 

taken as indicative of the fire-induced failure of a damage target or set of damage targets. 

damage threshold: The values corresponding to the damage criteria that will be taken as 

indicative of the onset of fire-induced failure of a damage target or set of damage targets. 

damage target: See “target.” 

distribution system: Piping, raceway, duct, or tubing that carries or conducts fluids, electricity, 

or signals from one point to another (ANSI/ANS-58.21-2007 [1]). 

electrical overcurrent protective device: An active or passive device designed to prevent 

current flow from exceeding a predetermined level by breaking the circuit when the 

predetermined level is exceeded (e.g., fuse or circuit breaker). 

equipment: A term used to broadly cover the various components in a nuclear power plant. 

Equipment includes electrical and mechanical components (e.g., pumps, control and power 

switches, integrated circuit components, valves, motors, and fans), and instrumentation and 

indication components (for example, status indicator lights, meters, strip chart recorders, 

and sensors). Equipment, as used in the fire PRA standard, excludes electrical cables. 

event tree: A logic diagram that begins with an initiating event or condition and progresses 

through a series of branches that represent expected system or operator performance that either 

succeeds or fails and arrives at either a successful or failed end state (ASME-RA-2002/RA-Sb2005 [2] and ANSI/ANS-58.21-2007 [1]). 

exposed structural steel: Structural steel elements that are not protected by a passive fire 

barrier feature (e.g., fire-retardant coating) with a minimum fire-resistance rating of 1 hour. 

external event: An initiating event originating outside a nuclear power plant that causes safety 

system failures, operator errors, or both, that in turn may lead to core damage or large early 

release. Events such as earthquakes, tornadoes, and floods from sources outside the plant and 

fires from sources either within or outside the plant (e.g., forest fires or other wild- fires) are 

considered external events (see also “internal event”). By convention, loss of off-site power not 

caused by another external event is considered to be an “internal event” (ANSI/ANS-58.2l-2007 

[1]). 

failure mechanism: Any of the processes that result in failure modes, including chemical, 

electrical, mechanical, physical, thermal, and human error (ASME-RA-2002/RA-Sb-2005 [2] 

and ANSI/ANS-58.21-2007 [1]). 

failure mode: A specific functional manifestation of a failure (i.e., the means by which an 

observer can determine that a failure has occurred) by precluding the successful operation of 

a piece of equipment, a cable, or a system (e.g., fails to start, fails to run, leaks) (ASMERA2002/RA-Sb-2005 [2] and ANSI/ANS-58.21- 2007 [1]). Special Note: In the context of fire 

PRA, “spurious operation” (see definition below) is also considered a failure mode above and 

beyond failures that “preclude successful operation.” 
Definition of Terms 

E-3 

failure probability: The likelihood that an SSC will fail to operate upon demand or fail to 

operate for a specific mission time (ASME-RA2002/RA-Sb-2005 [2] and ANSI/ANS-58.21-

2007 [1]). 

fire analysis tool: As used in this standard, “fire analysis tool” is broadly defined as any method 

used to estimate or calculate one or more physical fire effects (for example, temperature, heat 

flux, time to failure of a damage target, rate of flame spread over a fuel package, heat release rate 

for a burning material, and smoke density) based on a predefined set of input parameter values as 

defined by the fire scenario being analyzed. Fire analysis tools include, but are not limited to, 

computerized compartment fire models, closed-form analytical formulations, empirical 

correlations such as those provided in a handbook, and lookup tables that relate input parameters 

to a predicted output. 

fire area: A portion of a building or plant that is separated from other areas by rated fire barriers 

adequate for the fire hazard (RG 1.189 [4]). (Note that a rated fire barrier is a fire barrier with a 

fire-resistance rating.) 

fire barrier: A continuous vertical or horizontal construction assembly designed and constructed 

to limit the spread of heat and fire and to restrict the movement of smoke (NFPA805 [5]). 

fire compartment1

: A subdivision of a building or plant that is a well-defined enclosed room, 

not necessarily bounded by rated fire barriers. Afire compartment generally falls within a fire 

area and is bounded by noncombustible barriers where heat and products of combustion from 

a fire within the enclosure will be substantially confined. Boundaries of a fire compartment 

may have open equipment hatches, stairways, doorways, or unsealed penetrations. This is a 

term defined specifically for fire risk analysis and maps plant fire areas and/or zones, defined 

by the plant and based on fire protection systems design and/or operations considerations, into 

compartments defined by fire damage potential. For example, the control room or certain areas 

within the turbine building may be defined as a fire compartment (Reference: This definition 

derived from NUREG/CR-6850, TR- 1011989 [6]). In this standard “physical analysis unit” 

is used to represent all subdivisions of a plant for fire PRA. Physical analysis units include fire 

compartments. 

fire-induced initiating event: That initiating event assigned to occur in the fire PRA plant 

response model for a given fire scenario (adapted from NUREG/CR-6850-EPRI TR1011989 

[6]). 

fire modeling: As used in this standard, “fire modeling” refers to the process of exercising a fire 

analysis tool including the specification and verification of input parameter values, performance 

of any required supporting calculations, actual application of the fire analysis tool itself, and the 

interpretation of the fire analysis tool outputs and results. 

 

1

 It is noted that the term “fire compartment” is used in other contexts, such as general fire protection engineering, 

and that the term’s meaning as used here may differ from that implied in an alternate context. However, the term 

also has a long history of use in Fire PRA and is used in this standard based on that history common Fire PRA 

practice. 
Definition of Terms 

E-4 

fire protection defense-in-depth: The principle of providing multiple and diverse fire protection 

systems and features that will, collectively, prevent fires from starting; detect rapidly, control, 

and extinguish promptly those fires that do occur; and provide protection for SSCs important to 

safety so that a fire that is not promptly extinguished by the fire suppression activities will not 

prevent the safe shutdown of the plant (derived from 1OCFR5O, Appendix B, Sec. II.A [7]). 

fire protection design elements: Any aspect of the fire protection program that is supported by 

specific design requirements and/or analyses. 

fire protection feature: Administrative controls, fire barriers, means of egress, industrial fire 

brigade personnel, and other features provided for fire protection purposes (NFPA 805 [5]). 

fire protection program: The integrated effort involving equipment, procedures, and personnel 

used in carrying out all activities of fire protection. It includes system and facility design, fire 

prevention, fire detection, annunciation, confinement, suppression, administrative controls, fire 

brigade organization, inspection and maintenance, training, quality assurance, and testing (RG 

1.189 [4]). 

fire protection program element: Any specific aspect or provision included as a part of the fire 

protection program. 

fire protection system: Fire detection, notification, and fire suppression systems designed, 

installed, and maintained in accordance with the applicable NFPA codes and standards (NFPA 

805 [5]). 

fire-resistance rating: The time, in minutes or hours, that materials or assemblies have 

withstood a fire exposure as established in accordance with an approved test procedure 

appropriate for the structure, building material, or component under consideration (NFPA 805 

[5]. 

fire scenario: A set of elements that describes a fire event. The elements usually include a 

physical analysis unit, a source fire location and characteristics, detection and suppression 

features to be considered, damage targets, and intervening combustibles. 

fire scenario selection: The process of defining a fire scenario to be analyzed in the fire PRA 

that will represent the behavior and consequences of fires involving one or more fire ignition 

sources. Fire scenario selection includes the identification of a fire ignition source (or set of fire 

ignition sources); secondary combustibles and fire spread paths; fire damage targets, detection 

and suppression systems and features to be credited; and other factors that will influence the 

extent and timing of fire damage. 

fire suppression system: Generally refers to permanently installed fire protection systems 

provided for the express purpose of suppressing fires. Fire suppression systems may be either 

automatically or manually actuated. However, once activated the system should perform its 

design function with little or no manual intervention. 
Definition of Terms 

E-5 

fire wrap: A localized protective covering designed to protect cables, cable raceways, or other 

equipment from fire-induced damage. Fire wraps generally provide protection against thermal 

damage. 

Fire PRA plant response model: A representation of a combination of equipment, cable, 

circuit, system, function, and operator failures or successes, of an accident that when combined 

with a fire initiating event can lead to undesired consequences, with a specified end state (e.g., 

core damage or large early release).2

high-energy arcing fault: Electrical arc that leads to a rapid release of electrical energy in the 

form of heat, vaporized copper, and mechanical force. 

high-hazard fire source: A fire source that can lead to fires of a particularly severe and 

challenging nature. High-hazard fire sources would include, but are not limited to, the following: 

catastrophic failure of an oil-filled transformer, an unconfined release of flammable or 

combustible liquid, leaks from a pressurized system containing flammable or combustible 

liquids, and significant releases or leakage of hydrogen or other flammable gases. 

hot short: Individual conductors of the same or different cables coming in contact with each 

other where at least one of the conductors involved in the shorting is energized resulting in an 

impressed voltage or current on the circuit being analyzed. 

human failure event: A basic event in the fire PRA plant response model that represents a 

failure or unavailability of a piece of equipment, system, or function that is caused by human 

inaction or inappropriate action (ASMERA-2002/RA-Sb-2005 [2]). 

ignition frequency: Frequency of fire occurrence generally expressed as fire ignitions per 

reactor-year. 

ignition source: Piece of equipment or activity that causes fire (RG 1.189 [4]). 

ignition target: See “target.” 

initiating event: Any event either internal or external to the plant that perturbs the steady- state 

operation of the plant, if operating, thereby initiating an abnormal event such as transient or 

LOCA within the plant. Initiating events trigger sequences of events that challenge plant control 

and safety systems whose failure could potentially lead to core damage or large early release 

(ASME-RA-2002/RA-Sb-2005 [2] and ANSI/ANS-58.21-2007 [1]). 

Inter-cable (as in inter-cable conductor-to- conductor short circuit): Electrical interactions 

(shorting) between the conductors of two (or more) separate electrical cables (also see 

“intracable”). 

 

2

 definition has been adapted to suit Fire PRA needs from the definition of “Accident Sequence” as provided in 

ANSI/ANS-58.21-2007 [1]. A variety of equivalent terms have been used in other Fire PRA related documents 

including, but not limited to, postfire safe shutdown model, Fire PRA model, and postfire plant response model. 
Definition of Terms 

E-6 

internal event: An event originating within a nuclear power plant that, in combination with 

safety system failures and/or operator errors, can affect the operability of plant systems and may 

lead to core damage or large early release. By convention, loss of off-site power not caused by 

another external event is considered to be an internal event (ASME-RA-2002/RA-Sb-2005 [2]). 

intracable (as in intracable conductor-to- conductor short circuit): Electrical interactions 

(shorting) between the conductors of one multiconductor electrical cable (also see “inter-cable”). 

key safety functions: The minimum set of safety functions that must be maintained to prevent 

core damage and large early release. These include reactivity control, reactor pressure control, 

reactor coolant inventory control, decay heat removal, and containment integrity in appropriate 

combinations to prevent core damage and large early release (ASME-RA2002/RA-Sb-2005 [2]). 

large early release: The rapid, unmitigated release of airborne fission products from the 

containment to the environment occurring before the effective implementation of off-site 

emergency response and protective actions such that there is a potential for early health effects 

(ANSI/ANS-58.21-2007 [1] and ASME-RA-2002/RA-Sb-2005 [2]). 

large early release frequency (LERF): Expected number of large early releases per unit of time 

(ANSI/ANS-58.21-2007 [1] and ASMERA-2002/RA-Sb-2005 [2]). 

LERF analysis: Evaluation of containment response to severe accident challenges and 

quantification of the mechanisms, amounts, and probabilities of subsequent radioactive material 

releases from the containment (ASME-RA2002/RA-Sb-2005 [2]). 

Level 1 analysis: Identification and quantification of the sequences of events leading to the onset 

of core damage (ANSI/ANS-58.21-2007 [1] and ASME-RA-2002/RA-Sb-2005 [2]). 

licensee-controlled area: Areas of the plant site that are directly controlled by the nuclear power 

plant licensee. 

limiting failure threshold: Given a set of damage targets, the failure threshold associated with 

the first fire-induced failure of any member of that target set. 

limiting failure mechanism: Given a set of damage targets, the failure mode associated with the 

first fire-induced failure of any member of that target set. 

may: Used to state an option to be implemented at the user’s discretion (ANSI/ANS-58.21-2007 

[1] and ASME-RA-2002/RA-Sb-2005 [2]). 

multi-compartment fire scenario: A fire scenario involving targets in a room or fire 

compartment other than, or in addition to, the one where the fire was originated. 

multiple spurious operations: Concurrent spurious operations of two or more equipment items. 
Definition of Terms 

E-7 

physical analysis units: The spatial subdivisions of the plant upon which the fire PRA is based. 

The physical analysis units are generally defined in terms of fire areas and/or fire compartments 

under the plant partitioning technical element. 

plant: A general term used to refer to a nuclear power facility (for example, “plant” could be 

used to refer to a single unit or multiunit site) (ANSI/ANS-58.21-2007 [1]). 

point estimate: Estimate of a parameter in the form of a single number (ANSI/ANS-58.21- 2007 

[1] and ASME-RA-2002/RA-Sb-2005 [2]). 

probabilistic risk assessment (PRA): A qualitative and quantitative assessment of the risk 

associated with plant operation and maintenance that is measured in terms of frequency of 

occurrence of risk metrics, such as core damage or a radioactive material release, and its effects 

on the health of the public [also referred to as a probabilistic safety assessment (PSA)] (ASMERA-2002/RA-Sb-2005 [2] and ANSI! ANS-58.21-2007 [1]). 

probability of non-suppression: Probability of failing to suppress a fire before target damage 

occurs. 

PRA configuration control program: The process and document used by the owner of the PRA 

to define the PRA technical elements that are to be periodically maintained and/or upgraded and 

to document the methods and strategies for maintenance and upgrading of those PRA technical 

elements (ANSI/ANS-58.21- 2007 [1], but it is referred to as “P(Configuration Control Plan”). 

raceway: An enclosed channel of metal or nonmetallic materials designed expressly for holding 

wires, cables, or bus bars, with additional functions as permitted by code. Raceways include, but 

are not limited to, rigid metal conduit, rigid nonmetallic conduit, intermediate metal conduit, 

liquid-tight flexible conduit, flexible metallic tubing, flexible metal conduit, electrical 

nonmetallic tubing, electrical metallic tubing, underfloor raceways, cellular concrete floor 

raceways, cellular metal floor raceways, surface raceways, wireways, and busways (RG1.189 

[4]). 

reactor-year: A calendar year in the operating life of one reactor, regardless of power level 

(ASME-RA-2002/RA-Sb-2005 [2]). 

risk: Probability and consequences of an event, as expressed by the “risk triplet,” that is the 

answer to the following three questions: (1) What can go wrong? (2) How likely is it? and (3) 

What are the consequences if it occurs? (ANSI/ANS-58.21-2007 [1] and ASME-RA-2002/RASb-2005 [2]). 

risk-relevant consequences: The fire-induced failure of any risk-relevant target or the fireinduced creation of environmental conditions that may complicate or preclude credited postfire operator actions. 

risk-relevant ignition source: Any ignition source considered in the fire PRA fire scenario 

definitions that could cause a fire that might induce a plant initiator or adversely affect one or 

more damage targets. 
Definition of Terms 

E-8 

risk-relevant damage targets: Any equipment item or cable whose operation is credited in the 

fire PRA plant response model or whose operation may be required to support a credited postfire operator action. 

risk-significant equipment: Equipment associated with a “Signification Basic Event” as defined 

by ASME-RA-2002/RA-Sb-2005 [2]. 

safety function: Function that must be performed to control the sources of energy in the plant 

and radiation hazards (ANSI/ANS-58.2l- 2007 [ii]). 

screening: A process that eliminates items from further consideration based on their negligible 

contribution to the probability of an accident or its consequences (ASME-RA-2002/RA-Sb-2005 

[2]). 

screening criteria: The values and conditions used to determine whether an item is a negligible 

contributor to the probability of an accident sequence or its consequences (ANSI/ANS-58.21- 

2007 [1] and ASME-RA-2002/RA-Sb-2005 [2]). 

secondary combustible: Combustible or flammable materials that are not a part of the fire 

ignition source that may be ignited if there is fire spread beyond the fire ignition source. 

severity factor: Severity factor is the probability that fire ignition would include certain specific 

conditions that influence its rate of growth, level of energy emanated, and duration (time to selfextinguishment) to levels at which target damage is generated. 

shall: Used to state a mandatory requirement (ANSI/ANS-58.21-2007 [ii and ASME-RA2002/RA-Sb-2005 [2]). 

should: Used to state a recommendation (ANSI/ANS-58.21-2007 [1] and ASME-RA-2002/RASb-2005 [2]). 

significant contributor: (a) In the context of an accident sequence, a significant basic event or 

an initiating event that contributes to a significant sequence. (b) In the context of an accident 

progression sequence, a contributor that is an essential characteristic (e.g., containment failure 

mode, physical phenomena) of a significant accident progression sequence and if not modeled 

would lead to the omission of the sequence; for example, not modeling hydrogen detonation in 

an ice condenser plant would result in a significant LERF sequence not being modeled (RG 

1.200 [8]). In the context of fire PRA, the following is also included: (c) a fire ignition source, 

physical analysis unit, or fire scenario that contributes to a significant sequence. 

skill-of-the-craft actions: those actions that one can assume trained staff would be able to 

readily perform without written procedures (e.g., simple tasks such as turning a switch or 

opening a manual valve as opposed to a series of sequential actions or set of actions that need to 

be coordinated).

spurious operation: The undesired operation of equipment resulting from a fire that could affect 

the capability to achieve and maintain safe shutdown (RG 1.189 [4]). 
Definition of Terms 

E-9 

state-of-knowledge correlation: The correlation that arises between sample values when 

performing uncertainty analysis for cutsets consisting of basic events using a sampling approach 

(such as the Monte Carlo method); when taken into account this correlation results, for each 

sample, in the same value being used for all basic event probabilities to which the same data 

apply (ASME-RA-2002/RA-Sb-2005 [2]). 

statistical model: A model in which a modeling parameter or behavior is treated as a random 

variable with specified statistical characteristics. 

support system: A system that provides a support function (e.g., electric power, control power, 

or cooling) for one or more other systems (ANSI/ANS-58.21-2007 [1] and ASME-RA2002/1{A- Sb-2005 [2]). 

target: May refer to a fire damage target and/or to an ignition target. A fire damage target is any 

item whose function can be adversely affected by the modeled fire. Typically, a fire damage 

target is a cable or equipment item that belongs to the fire PRA cable or equipment list and that 

is included in event trees and fault trees for fire risk estimation. An ignition target would be any 

flammable or combustible material to which fire might spread (NUREG/CR-6850—EPRI 

TR1011989 [6]). 

target set: A group of damage targets that will be assumed to suffer fire-induced damage based 

on the same damage criteria and damage threshold in any given fire scenario. Discussion: The 

collection of target sets associated with a fire scenario often represents a subset of the damage 

targets present in the fire compartment but may also encompass all risk-relevant damage targets 

in a single physical analysis unit or a collection of damage targets in multiple physical analysis 

units. This definition implies that all members of any single target set will be assumed to fail 

when the first member of the target set fails (i.e., “. . . damage based on the same damage criteria 

and damage threshold”). Progressive or time-dependent states of fire damage may be represented 

through the definition of multiple target sets for a single fire scenario (e.g., cables in raceways 

directly above a fire source versus cables in raceways remote from the fire source). The level of 

detail associated with target set definition will generally parallel the level of detail employed in 

fire scenario selection and analysis (e.g., screening level analysis versus detailed analysis). 

transient combustible: Combustible materials that are not fixed in place or an integral part of an 

operating system or component (RG 1.189 [4]). (Note that the term “component” as used in this 

definition is considered interchangeable with the terms “equipment” or “piece of equipment” as 

those terms are used in this standard.) 

transient ignition source: Temporary ignition source that is usually associated with, but not 

limited to, maintenance or modifications involving combustible and flammable liquids, wood 

and plastic products, waste, scrap, rags, or other combustibles resulting from the work activity. 

uncertainty: A representation of the confidence in the state of knowledge about the parameter 

values and models used in constructing the PRA (ANSI/ANS-58.21-2007 [1] and ASMERA2002/RA-Sb-2005 [2]). 
Definition of Terms 

E-10 

verify: To determine that a particular action has been performed in accordance with the 

requirements of this standard, either by witnessing the action or by reviewing records (ANSI) 

ANS-58.21-2007 [1]). 

walkdown: Inspection of local areas in a nuclear power plant where structures, systems, 

equipment, and cables are physically located in order to ensure accuracy of procedures and 

drawings, equipment location, operating status, and environmental effects or system interaction 

effects on the equipment that could occur during accident conditions (ASME-RA-2002/RA-Sb2005 [2] and ANSI/ANS-58.21-2007 [1]). 
F-1 

F

SUMMARY OF TESTING AND PEER REVIEW 

F.1 Objective 

Two important steps in the development of the Joint EPRI/NRC-RES fire HRA guidelines were 

subjecting the guidelines to an independent peer review, and subjecting the processes included 

in the guidelines to some level of hands-on testing. Early in the development process the draft 

guidelines were submitted to a panel of independent technical area experts from both industry 

and within the NRC for their review and feedback. After the peer review was completed, the 

methods were subjected to hands-on testing at two nuclear power plants. 

Both the peer review and the testing exercise were highly valuable to the development of this 

document. As a result of lessons learned and feedback received from both the peer review and 

the testing exercises, the methodology and documentation underwent a number of revisions. The 

project team is very grateful to those who contributed to all of these exercises for their time and 

invaluable input to this project. An overview and some details about these exercises are provided 

in the sections that follow. 

F.2 Peer Review Exercise 

The objectives of the peer review were: 1) to evaluate the methodology to ensure that it is 

technically sound and will meet the needs of the intended users; 2) to identify any significant 

deficiencies in the proposed approach early enough in the development process that they could 

be addressed such that the methodology could be modified in time to meet the needs of the 

intended users, and 3) to ensure that the methodology is documented in a manner that is clear, 

concise, logical and usable for the intended audience. 

Along with the draft copy of the document, the independent review panel members were given 

a set of instructions that included the following questions that they were to keep in mind while 

they were conducting their review. 

1. Is the technical approach sound and reasonable? 

2. Are the selected HRA models appropriate for the application? 

3. Are the assumptions presented in this methodology reasonable? 

4. Does the guidance meet its stated objectives? 

5. Is the writing clear and of acceptable quality? 

6. Is the proposed methodology usable and understandable? 

7. Is uncertainty adequately addressed? 

8. Can you provide any suggestions for reducing the uncertainty that is present? 
Summary of Testing and Peer Review 

F-2 

After independently reviewing the document, the peer reviewers were asked to participate 

in a meeting between the entire peer review panel and the guideline development team. The 

purpose of this meeting was to give the peer review panel an opportunity to ask the guideline 

development team questions and to clear up any ambiguities they may have encountered in their 

initial review of the document. This meeting also gave the peer review panel an opportunity to 

share their initial feedback and impressions of the document. After the meeting, each reviewer 

documented his or her feedback and submitted this documentation to the guidance development 

team. Each of the comments from the peer review panel was reviewed and assessed by the 

project team. Based on these comments and the feedback received during the peer review 

meeting a number of changes were made to the document and to the scoping trees to prepare 

them for hands-on testing. 

F.3 Testing Objectives and Scope 

After the peer review was completed the guidelines were subjected to two rounds of hands-on 

testing. Testing was included in the process because the guideline development team felt that 

it was necessary to put the methods through a process to help determine whether the assumptions 

used in developing the guidance would hold up when applied to actual plant specific fire 

scenarios. Subjecting the methods to testing also provided a high level “reasonableness” check 

for the human error probability (HEP) values generated by the method. Other objectives of 

testing the method included identifying any limitations and inaccuracies, and assessing the 

methods usability when practically applied. The testing conducted as a part of this project did not 

constitute a verification or validation of the methodology results. Due to the limited availability 

of adequate detailed HRA data, a quality verification and validation (V&V) analysis is not 

feasible and is therefore outside the scope of this analysis. 

For the purposes of this project, “reasonableness” was defined as yielding HEP values that a) 

were generally logical from a PRA perspective, b) were not lower than values derived in the test 

plant’s internal events analysis for the same action, and c) were not higher than the screening 

values obtained using the NUREG/CR-6850 HRA screening method. The underlying assumption 

behind this definition of reasonableness is that the probability of an operator committing an error 

when conducting a given action in most cases should increase when fire effects are introduced. 

Conversely, the probability of an error should not decrease given that fire effects are present. If 

the fire HRA methodology yields a lower HEP than the one yielded by the plants internal events 

HRA, it would suggest that the assumptions in one of the two analyses are incorrect. A key point 

to remember is that the internal events HRA analyses and the fire HRA analyses are done using 

different methods and therefore their results are not and should not be expected to be in perfect 

alignment. However, both analyses should hold up to part a) of the reasonableness assumption 

of being generally logical from a PRA perspective. If both analyses yield logical results, the fire 

HRA methodology should yield higher HEP results. 

Testing exercises were conducted at two nuclear power plants, one of which was a boiling 

water reactor (BWR) and the other a pressurized water reactor (PWR). They are identified 

in this summary as Plant #1 and Plant #2. 
Summary of Testing and Peer Review 

F-3 

Plant #1: Two Unit BWR manufactured by General Electric. 

Plant #2: Two Unit PWR manufactured by Westinghouse. 

For each exercise a team of three or four members of the EPRI/NRC-RES Fire HRA project 

team visited the plant sites and met with key plant PRA and training personnel. 

The test plan, the testing scenarios, and the lessons learned from the testing exercise are 

described in the sections that follow. 

F.3.1 Test Plan 

Objective 

Exercise fire HRA method broadly enough to evaluate adequacy of analysis guidance and test 

applicability of scoping and detailed HRA approaches. 

Results should identify areas where guidance is insufficient or where improvements to logic 

structure of quantification approaches are needed. 

In particular, the following items should be tested: 

1. Test the scoping flow charts by applying the system to at least one action for each branch 

in the structure. 

a. Verify that the qualitative questions are appropriate. 

b. Check the quantification values for reasonableness (i.e., the new HEP values 

are not lower than the internal events values nor greater than the screening values). 

2. If possible also apply the EPRI CBDT approach and compare with the internal events 

assessment. 

Reasonableness of the obtained HEPs, both in terms of face validity and the relative ranking 

of HEPs across the different types of conditions should be evaluated. The method will be 

tested for both a BWR and a PWR. There is an assumption that there will be an existing 

fire PRA available at the selected plants, or at least a fire PRA that has developed the PRA 

models to the extent that the HFEs have been identified and included in the PRA models. 

Step 1. Prior to plant visit 

• Obtain copy of existing fire PRAs and relevant plant procedures (EOPs, FEPs, alarm 

procedures) for review (two weeks before plant visit). 

• Evaluate existing identification and definition of HFE results. Characterize the level of the 

study progress relative to the 6850 task structure. Do the fire PRA models include 

the types of actions needed to test the fire HRA method? Determine whether additional 

identification and definition steps are needed. To the extent possible, test the fire HRA 

Method’s identification and definition process, independently. Try to apply the feasibility 

criteria in the identification and definition step. 
Summary of Testing and Peer Review 

F-4 

• If 6850 HRA screening approach was used, revisit screening analysis to see if revised 

screening approach provided in fire HRA method would lead to different results for 

long-term events. 

• Identify initial set of HFEs for quantification using the scoping and/or detailed approaches. 

Testing should include both risk significant and non-risk significant actions (if relevant 

information on these actions can be obtained). The set of HFEs should include: 

1) Existing internal events in control room HFEs 

a. No expected fire effects in terms of smoke 

b. No expected fire effects on instrumentation or control 

c. Potential fire effects on instrumentation (potential EOCs or EOOs) 

2) Existing internal events ex- control room HFEs 

a. No expected fire effects ex-control room in terms of smoke etc. 

b. Potential fire/smoke effects ex-control room 

3) Fire response actions 

a. Fire manual actions (FMAs) – including preventative and reactive type actions per 

NUREG-1852) 

b. HFEs with potential fire effects on instrumentation (EOC and EOOs ) 

4) HFE(s) from MCR abandonment due to habitability scenario 

5) HFE(s) from alternative shutdown scenario – fire could introduce problems with 

controlling safe shutdown equipment, but non-abandonment scenario 

• If possible characterize recovery actions, dependencies between actions and uncertainty 

range in the result. 

Step 2. Visit plant (two days at plant) and obtain support from plant PRA and training staff to 

• Perform qualitative analysis of selected actions, including obtaining information on event 

timing (occurrence of cues for the actions, estimates of time available, and estimates of time 

to accomplish the actions) and other PSFs given the expected plant conditions. 

• Revise selected HFEs if some events are not suitable for testing. 

• Apply scoping quantification approach and where appropriate, the EPRI CBDT approach, to 

selected HFEs. 

– Support will be needed from training and other plant personnel to make scoping path 

selections and to provide needed information (e.g., for information on requirements for 

ex-control actions). 

– If the detailed methods are to be applied to at least some extent, significant detailed 

information is required to achieve a realistic analysis. Analysts will need to be well 

prepared to collect the relevant information for a given HFE and obtain the needed plant 

support. 
Summary of Testing and Peer Review 

F-5 

Step 3. After the plant visit 

• Document results identifying problem areas. 

• Compare scoping, detailed, and existing plant HRA results (if any) for HFEs addressed 

in the test and those already analyzed for the fire PRA. 

Step 4. Review analysis and results with plant 

After the HEPs have been reviewed and quantified by the team we need to then provide 

the results to the plant and ask for feedback. Are the results what you need to complete the 

FPRA? Are the results reasonable and are there any actions that you would require detailed 

analysis on based on the results the scoping trees? Question to the plant: What are you thoughts 

on the method application? 

F.3.2 Testing Scenarios Plant #1 

Prior to the plant visit, the project team was provided with a set of plant procedures. A set of 

five scenarios were proposed for use in evaluating the scoping methodology on Plant #1. They 

included one or more scenarios in the five categories of (1) Existing internal events that are 

important to the fire PRA, (2) New FPRA HEP not in the internal events PRA, (3) Spurious 

induced scenario, (4) Spurious/False Indication Causes Inappropriate Operator Action, and 

(5) Main control room abandonment. 

These scenarios are summarized below: 

F.3.2.1 Existing Internal Events HEPs Important to FPRA Fire Scenario 

Fire starts in the turbine building causing loss of offsite power and an emergency diesel; the 

redundant emergency diesel fails to start. The emergency condensers successfully actuate 

on high RPV pressure, there is no stuck open ERV, and there is no major increase in reactor 

recirculation pump leakage (no LOCA). The following operator actions are important relative 

to reaching a success state: 
Summary of Testing and Peer Review 

F-6 

• ZEC01 – controlling emergency condensers per procedures, which instruct operators to stay 

within pressure band and cool down rate. Operators will isolate one EC relatively early and 

eventually isolate the second and then unisolate the second EC to control RPV pressure (and 

cool down rate). 

– Procedures: N1-EOP-2 “RPV Control” and SOP-1 

– Cues/Instrumentation: PI-39-113A and 39A on the main control board 

– Actions are from the control room 

– Time window: 50 minutes 

• Success of this action ensures that an EC is used to control pressure, heat removal and 

inventory for several hours until EC makeup is required with the diesel fire pump (see 

ZLT01 below) and the batteries discharge (see ZHRA1 below). 

• Failure of this action means that pressure is not controlled, ERVs will open, and 

eventually sufficient inventory will be lost resulting in blow down at top of active fuel or 

a lower level. 

• ZOMU1 (with ZOU01) and ZLT01 – makeup to the ECs is required in order to continue EC 

success for 24 hours. Procedures instruct operators to control EC makeup (ZZOMU1 models 

this but assumes they isolate per cool down and then ZOU01 or 02 is required to ensure valve 

is opened – these should probably by combined into one HEP) so as not to waste makeup 

water (FCV from makeup tank to EC shell fails open allowing makeup tank to overfill shell 

and flow out the overflow to drains), but failure to conduct this only shortens the time 

window for ZLT01. 

– Procedures: ZOMU1 N1-SOP-33A and SOP-21.1 Table 21.1-4 

– Procedures: ZLT01 N1-SOP-33A and SOP-21.1 at the bottom 

– Cues/Instrumentation: EC shell, makeup tank levels, procedure directions in CR 

– An operator is required to be at EC makeup tanks (El 369 of TB) 

– Time window: within 1⁄2 hour for ZOMU1 and between 2 and 18 hours after fire initiator 

for ZLT01 (depends on ZOMU1 and availability of EC shells) 

• Success means that an EC can control pressure, heat removal and inventory for 24 hours. 

• Failure is assumed to result in core damage although with future modifications and use of 

portable charger a success path is possible as described above for ZEC01. 

• ZHRA4 – when batteries discharge (4 to 8 hours dependent on load shedding, ZOLS1), RPV 

pressure and level can be monitored for plant control purposes in the East/West Instrument 

Room and is assumed necessary to reach a success state unless the new modifications 

(coming) have been implemented (portable charger allows ERV to stay open and ensures 

instrumentation in the CR). 

– Procedures: SOP-21.1 for ZOLS1 and SOP-29.1 “Alternate Instrumentation” 

– Cues/Instrumentation: loss of CR instruments, battery voltage 
Summary of Testing and Peer Review 

F-7 

– An operator is required to be in East/West Instrument Rooms (El 281 of RB) 

– Time window: 4 hours after fire initiator if no load shedding 

• Success means that plant control is retained without DC power 

• Failure means that operators have lost control and core damage is assumed. 

F.3.2.2 New FPRA HEP Not in the Internal Events PRA 

There are potentially a few new operator actions not in the internal events PRA but that are in 

SOP-21.1 and SOP-21.2. These could become important during the detailed fire modeling and 

scenario development. Consider HRA1 Operator copes during SBO without instrumentation 

Reactor Bldg SOP-29) [DC load shedding] or actions required to transfer control to remote 

locations. 

F.3.2.3 Spurious Induced Scenario 

There are several spurious induced equipment failures identified at Test Plant #1. The most 

important of which are most likely associated with several single main feedwater equipment 

failures that could result in an RPV overfill. Overfill would take out main condenser, if available 

initially (water in the steam lines); there are probably fires that take both main condenser out and 

start overfill. EC actuation with water in the EC steam lines could result in EC isolation 

(assumed in the PRA). 

Fire Scenario – fire starts in the turbine building causing FCV-29-137 or FCV-29-141 to fail 

open. There are two key operator actions associated with this scenario: 

• ZFL03 – operators prevent overfill given MSIV closure or loss of instrument air 

– Procedures: N1-SOP-1 

– Cues/Instrumentation: RPV Level 

– Main Control Board 

– Time window: 3 minutes 

• ZFL02 – operators prevent overfill given general transient 

– Procedures: N1-SOP-1 

– Cues/Instrumentation: RPV Level 

– Main Control Board 

– Time window: 3 minutes 

• ZFL01 – operators recover an EC 

– Procedures: N1-SOP-1 

– Cues/Instrumentation: RPV Level and Pressure 

– Main Control Board 

– Time window: 50 minutes 
Summary of Testing and Peer Review 

F-8 

F.3.2.4 Spurious/False Indication Causes Inappropriate Operator Action Fire Scenario 

Fire starts in reactor building (e.g., R2A or R3A or R4A) or turbine building (T3B, El 261 West) 

impacting cables to Annunciator K1-4-3 (EC11) and K1-4-5 (EC12); false indication of EC line 

break. (Signal on X of Y channels, need to check in simulator) The turbine building event is 

likely most important because fires in T3B can also impact feedwater and or normal AC power 

making the ECs important. Plant #1 assumed ECs would become unavailable without recovery 

and therefore did not pursue more detailed evaluation. 

F.3.2.5 Control Room Abandonment Fire Scenario 

For the EPRI/NRC methodology test two MCR panel fires are modified by assuming that the 

fires produce sufficient smoke and toxic fumes to cause the operators to abandon the control 

room or put on special breathing gear in the evolution even though the amount of combustible 

material in the panels is small. Furthermore, it is assumed that the HVAC air circulation system 

is off. The operators take actions locally and at the safe shutdown panel(s). 

In the C3Ga scenario, the fire in panels A4-A5 is assumed to cause failures in breaker control 

switch circuits on these Main Control Room panels such that buses 101, 102, 103, and power 

boards 11 and 12 all lose power because of potential combinations of spurious breaker openings 

and other failures to breaker controls so that all power feeds are open to these buses/boards 

(including no power from the diesels). For the postulated fires, there is not likely to be 

irreparable damage to the buses/boards; they have simply lost all their power feeds, thereby 

causing loss of all loads on these buses/boards. Offsite power actually remains available – it 

needs to be re-provided to the buses/boards by reclosing of necessary breakers though it is 

assumed this cannot be done from the Main Control Room because of damage to the breaker 

switch controls on panels A4 and A5. 

In the C3Na fire scenario, occurring in the area of the feedwater controls on the panels in the 

Main Control Room, the fire causes a ramping up of the feedwater supply to the reactor vessel 

(e.g., via spuriously speeding up the pump speeds and/or fully opening the feedwater regulation 

valves) and an overfill of the vessel. For initial fire PRA modeling purposes, this is assumed to 

result in an automatic plant trip, loss of condenser, likely loss of feedwater (either because of 

effects on the control circuits and/or a high level trip of the pumps or operator shutdown and 

isolation of the system as directed in N1-SOP-1, Reactor Scram), loss of control rod drive (CRD) 

initial injection (no credit is given in the initial fire PRA model for early CRD injection and N1-

SOP-1 directs securing of CRD pumps by the operator in such a situation), and the overfill 

condition is assumed to make the emergency condensers (ECs) unavailable or at least ineffective 

due to the vessel overfill condition. It is further assumed that the smoke and conditions of the fire 

are sufficient to cause the operators to abandon the control room. 

F.3.3 Testing Scenarios Plant #2 

Prior to the plant visit an engineer from plant #2 provided the project team with a set of plant 

procedures as well as four detailed fire scenario descriptions intended to challenge the scoping 

HRA flowcharts in different ways. The four scenarios that were chosen were modeled in the 

plants fire PRA and needed analysis beyond a screening analysis to obtain a better HEP. These 

scenarios had detailed fire modeling available and the impacts to instrumentation were known. 
Summary of Testing and Peer Review 

F-9 

The table below lists the scenarios that were tested, the scenarios classification, and the flow 

charts that were used to test them. 

Scenario 

# Description Classification Flow Charts Used for Testing 

1 Locally open 8804 A/B for high 

pressure recirculation following a 

spurious PORV LOCA 

Internal events action but not 

currently modeled in PRA 

New & Existing 

Ex-CR action 

2 Heat load reduction/swap to 

alternate CCW train 

Internal events EOP action New and Existing 

MCR action 

3 CP M-10 (Fire procedure) directed 

action to manually control 

LCV110/111 

New Operator Manual Action New & Existing 

Ex-CR action 

4 Operator responses to spurious 

4KV Bus F ground annunciator 

Undesired operator response 

action 

Spurious EOO and 

Spurious EOC 

5 Operator fails to de-energize 

PORV/closed to mitigate spurious 

operation during MCR 

abandonment 

New action added for FPRA MCR abandonment 

The scenarios are described below: 

Scenario #1: Locally open 8804 A/B for high pressure recirculation following a spurious 

PORV LOCA 

The fire starts in a transformer and impacts targets in the plume and vertical trays adjacent to the 

flames. Important impacts involve a spurious opening of startup supply breaker to vital buses and 

other bus startup equipment. 

Critical impacts are to spuriously open a PORV and disable its block valve. Attempts to 

manually close associated (800b) prior to auto safety injection fail. 

Operator Action: Locally open (8804A or B) prior to depletion of RWST 

HFE Scenario Description: 

1. Assumptions/Initial Conditions including Initiating Event: Reactor trip, spuriously opened 

PORV results in a small LOCA, no containment spray required 

2. Preceding Functional Failures and Successes: RT successful, TT successful, Aux Feedwater 

successful, BUS G ECCS equipment is impacted by fire 

3. Operator Actions preceding the key action: Controlled ECCS flow to match make-up flow 

with leakage rate. Tripped RHR pumps 

4. Symptoms/ Indications (Other than the Cue): PK03 (RWST level <33%) 

5. Consequences of success or failure: If unsuccessful, core damage 
Summary of Testing and Peer Review 

F-10 

6. Operator Action Success Criteria: Align cold leg recirculation via (8804A/B) 

7. Time Cue is Received: 180 minutes 

8. Manipulation time: 25 minutes 

9. Tsw=120 minutes +180 minutes 

10. Tw=Tsw-Tm=95 minutes 

Scenario #2: Heat load reduction/swap to alternate CCW train 

The fire starts in the 125V DC cabinet and, after a short progression, results in damage to all 

equipment in the fire zone. 

HFE Scenario Description 

1. Assumptions/Initial Conditions including Initiating Event: Fire starts in cabinet, reactor 

trip occurs simultaneous with fire alarm actuation in the control room, CCW outlet valve 

spuriously closes and CCW flow is lost 

2. Preceding Functional Failures and Successes: Fire damages equipment in room. Includes 

most SSD equipment associated with bus F 

3. Operator Actions preceding the key action. Immediate operator actions, action to open 

spuriously closed valve is directed in (CP M10). This recovery is unlikely to occur prior to 

EOP action to align standby train 

4. Symptoms/Indications(Other than Cue): Numerous annunciators/alarms from reactor trip, 

loss of some indication due to fire, may see other annunciators actuate as a result of CCW 

flow loss 

5. Consequences of success or failure: Overheat the CCW system to above 140 degrees, and 

fails its loads 

6. Operator Action Success Criteria: Place the standby heat exchanger in service with flow from 

an ASW pump 

7. Time cue is received: N/A 

8. Manipulation Time: About 5 minutes 

9. TSW=90 minutes 

10. Tw= Tsw-Tm=85 

Cue: Fire alarm actuated 

Scenario #3: CP M-10 directed action to manually control LCV110/111 

HFE Scenario Description: 

1. Assumptions/Initial Conditions including Initiating Event: fire starts in electrical cabinet, 

reactor trip occurs simultaneous with fire alarm actuation in the control room. AFW pumps 

1 and 2 are impacted and LCV is impacted 
Summary of Testing and Peer Review 

F-11 

2. Preceding Functional Failures and Successes: Fire damages equipment in room due to hot 

gas layer development (~20 minutes). Potential equipment impacts include : spurious closure 

of CCW thermal barrier cooling supply valves, CCW heat exchanger outlet valves. Potential 

loss of offsite power due to spurious CB opening. Impact to diesel generator, 480V 

switchgear ventilation and AFW FTs. AFW pump 1-2 available 

3. Operator Actions preceding the key action. Immediate operator actions IAW E-0 

4. Symptoms/Indications(Other than Cue): RCS temperature and pressure increasing 

5. Consequences of success or failure: core uncovery 

6. Operator Action Success Criteria: Successfully operate LCV to control level in SG prior to 

core uncovery 

7. Time cue is received: N/A 

8. Manipulation Time: About 15 minutes (although continuous control is required) 

9. TSW= 135 minutes 

10. Tw= TSW – TM = 120 minutes 

Cue: Fire alarm actuated. Decreasing SG level all SG and level instrumentation avail 

Scenario #4: Operator responses to spurious 4KV Bus F ground annunciator 

In order to test the spurious EOO and EOC flow charts the plant provided the following example 

of an HFE they identified in their review of ARP procedures. The review of the ARP was 

performed in accordance with the guidance in Section 3 of the draft guideline. The complete 

fire scenario was not provided or defined since this action has not yet been incorporated into the 

FPRA. The analysis for this HFE focused on how to use the flow chart and it was concluded that 

the spurious flow charts need additional clarification. 

Scenario Description 

The following annunciator spuriously actuates in the control room 

AR PK-18-23 – 4KV Bus F Ground OC Alarm 

The logic for the 4KV Bus F ground is shown below 

Charging pp 

SI Pp Fdr 

ASW Pp 

Aux Fwp 

CCW pp 

480 v Bus 1F 4Kv 

Alarm 
Summary of Testing and Peer Review 

F-12 

Step 5 of the procedure is the following steps 

5.1 Check annunciator typewriter printout for equipment having the group. 

5.2 Shutdown the running pump or open 4KV breaker 52-HF-10 feeding 480 V Bus F. 

5.3 Notify Maintenance Services to locate and repair defective circuit. 

The fire scenario has not been defined such that it is known which device will cause the spurious 

alarm. However, stopping any of the pumps will be considered an undesired response action. 

Scenario #5: MCR Abandonment scenario 

The test plant is not modeling MCR abandonment scenarios in their FPRA model. Therefore 

the team created a fictitious scenario to test the MCR Control Room abandonment flow charts. 

Description of action: Operator fails to de-energize PORV/closed to mitigate spurious operation 

during MCR abandonment. The fire is in A-7 Cable spreading room. 

There is smoke in the control room and NUREG- 6850 MCR abandonment criteria are met. 

Tsw = 180 minutes. 

This action is proceduralized in OP AP-8A – Control room abandonment Step 14. 

The cues for this action are RCS wide range pressure at hot shutdown panel, HSDP, DSDP. 

F.3.4 Operator Interviews 

On the first day of the plant visit the HRA team, along with the plant engineer met with two 

reactor operators gain insights on how they would execute the procedures given the specific fire 

scenarios. The intention was to find areas where the operators could potentially be tripped up 

by the circumstances of the scenarios and to figure out whether the assumptions that were made 

when developing the scenarios were valid. In general the operators believed in all cases that the 

actions could be successfully carried out given all circumstances presented. This was as expected 

given that operators should generally be confident about their abilities to safely handle any 

situation that develops in the plant. 

After the interviews with the operators the team sat down with the plant engineer and stepped 

through the flowcharts using the scenarios that he provided. This exercise gave the team a 

number of insights on how the logic in the charts held up given realistic scenarios. The plant 

engineer also provided the team with some suggestions on minor adjustments that could be made 

to improve the charts. 
Summary of Testing and Peer Review 

F-13 

F.3.5 Testing Results/Lessons Learned 

Overall the testing exercises were highly beneficial to the fire HRA guidance development team. 

The team got an interim look at how the flow charts performed given realistic scenarios. The 

team also got an opportunity to introduce the methods to some of its potential users and get their 

feedback. The plant personnel at both plants posed a number of insightful questions, and made 

valuable suggestions on how to improve the scoping flowcharts. The interviews with the plant 

personnel prior to testing the flowcharts also provided the team with insights on how the 

operators are trained, how they use their procedures, and how they use their instruments to 

diagnose problems. This gave the team a better idea how well the scoping trees actually modeled 

operator actions. 

For example, during the interviews at plant number #2, the operators emphasized that they 

would not open the fire procedures until they had completed the emergency operating procedures 

(EOPs) because they trusted that the EOPs would guide them correctly. 

A number of the questions asked by plant personnel resulted in changes to the scoping trees. 

For example, the plant engineer at Plant #2 asked a question during testing about whether an 

action required personnel to travel through smoky areas. This resulted is the addition of a 

question to the Ex-MCR Actions flowchart about whether the fire was in the vicinity of the 

action and whether the travel path was accessible. Branches were added to the flowcharts to 

account for short time events per a comment made at one of the plants during testing. Confusing 

language in the scoping trees was also identified by the plant engineers, which resulted in several 

changes and clarifications in the wording. 

In general the HEPs derived at Plant #1 through the use of the scoping flowcharts were 

conservative when compared to the internal events HEPs. One of the observations made by a 

plant engineer at Plant #1 was that perhaps the 100% time margin requirement contained in the 

flowcharts at the time was inappropriate for longer term actions. This requirement may have 

resulted in the overly conservative HEP results. 

Overall the plant engineers at both plants thought the scoping tree guidance was useful and were 

appreciative of the team’s efforts to develop guidance for performing this part of their fire PRA. 

The scoping trees underwent a number of iterations after the peer review and both the first and 

second round of testing exercises to get to the resulting trees included in the guidance. Many of 

the improvements that resulted from these iterations can be attributed to the input provided by 

the test plants. 

G-1 

G

HRA ASSOCIATED WITH FIRE-RELATED ELECTRIC 

BUS CLEARING AND RESTORATION PROCEDURES 

G.1 Objective 

The fire HRA guidance provided in the main body of this report is expected to be applicable 

to the majority of scenarios, but may need to be adjusted or expanded to address certain special 

cases. 

Revision 1 to Regulatory Guide 1.189 (dated March 2007), “Fire Protection for Nuclear Power 

Plants” describes certain Assumptions under its stated Fire Protection Program Goals/Objectives. 

One such assumption (on page 17) discusses a special case involving Loss of Offsite 

Power/Station Blackout: 

Several operating plant licensees have alternative methodologies that rely on intentional 

disconnection of alternating current (ac) power to specific equipment or to the entire plant 

as a means to achieve safe shutdown after a fire. The purpose of these self-induced station 

blackouts (SISBOs) is to eliminate potential spurious actuations that could prevent safe 

shutdown and allow manual control of required equipment. Some licensees have procedures 

that cause a SISBO condition to be created as a result of fire effects [e.g., procedures that 

direct operators to manually trip the credited safe-shutdown emergency diesel generator 

(EDG) in the event of fire damage to circuits of vital EDG support systems]. The 

acceptability of safe-shutdown procedures that voluntarily enter, or otherwise create, 

a SISBO condition is determined on a case-by-case basis. 

The ability to cope with SISBO as part of the post-fire safe-shutdown methodology depends 

on such issues as time-line logic; assumptions and bases for plant and operator response 

relative to component realignment; the ability of plant operators to monitor and control 

plant parameters and align plant components before, during, and after SISBO control room 

evacuation and abandonment; and the practicality and reliability of EDG start and load 

(and restart, if applicable) under post-fire safe-shutdown SISBO conditions. 

The risk of self-imposed SISBO may exceed the actual risk posed by the fire, and the 

licensee should consider the risk carefully when evaluating the plant safe-shutdown design 

and procedures. 
HRA Associated with Fire-Related Electric Bus Clearing and Restoration Procedures 

G-2 

A plant typically uses this approach to avoid or minimize the need for operator manual actions 

after a fire. However, acceptable operator manual actions that are implemented in accordance 

with Regulatory Position 5.3.3 and NUREG-1852, “Demonstrating the Feasibility and Reliability 

of Operator Manual Actions in Response to Fire” may present a lower risk than the SISBO 

approach.

NUREG-1852 does not specifically address SISBO situations but rather provides a set of 

“criteria and associated technical bases for evaluating the feasibility and reliability of post-fire 

operator manual actions”. Examples of these technical bases are: adequate time available to 

implement actions, environmental factors (e.g., radiation, temperature, and smoke), and 

procedures and training. 

Regulatory Position 5.3.3 of Rev. 1 to Reg Guide 1.189 states that “The post-fire safe-shutdown 

analysis should describe the methodology necessary to accomplish safe shutdown, including any 

operator actions required,’ but also that required protection of redundant systems located in the 

same fire area per Appendix R, Sections III.G.1 or III.G.2 must be provided. 

This essentially means that an analysis of SISBO or single circuit fault clearance strategies 

should be conducted as part of a safe shutdown analysis to ensure that Appendix R (or NFPA805) safe shutdown system protection requirements are met and that operator manual actions 

are considered feasible and reliable per the criteria in NUREG-1852. 

According to reviews of fire PRAs conducted by Brookhaven National Lab in 1995, eight 

units have procedures that require initiating a station blackout (SBO) condition to comply with 

Appendix R/NFPA-805 requirements and an additional fifteen units have procedures for dealing 

with fires in critical areas that could result in an SBO. 

As this indicates, there is a range of fault clearance scenarios from small single circuits, to 

massive safety bus clearing and power restoration, to clearing a limited portion of the bus. Each 

case involves different procedures for when a bus clearing would be performed. For example, 

one part of the bus may be in a fire zone unrelated to the selected train of equipment and the 

operators would therefore want to isolate that bus since they are protecting a train. For plants 

where uncertainty exists about equipment wiring schemes, the preference might be to clear out 

and start over to ensure they do not have a short or ground that would cause problems on the 

preferred bus. However, since each plant has its own strategy and procedure for this process, 

generalizations are difficult to make. Typically, these strategies are implemented through the 

use of fire location-specific, and often complicated, procedures. 

This appendix provides some considerations for evaluating HRA issues for NPPs that use FEPs 

to clear electrical faults associated with fire induced spurious events. Because plant-specific 

variations and explicit guidance for performing fire HRA cannot be provided here, this appendix 

instead includes some general recommendations for how fire HRA tasks might need to be 

performed differently in order to address the HRA issues of concern for fault clearance 

strategies. 
HRA Associated with Fire-Related Electric Bus Clearing and Restoration Procedures 

G-3 

These recommendations have been organized consistent with the structure of the main body of 

this report, first discussing identification and definition of Human Failure Events (HFEs), then 

quantitative screening, followed by qualitative analysis, and finally quantification of HEPs with 

respect to issues associated with clearing electrical faults. 

G.2 Identifying and Defining HFEs 

As discussed in Section 3.1 of the main report, this step of the fire HRA addresses (1) the 

identification of operator actions that are necessary for successful mitigation of fire scenarios, 

and (2) representation of these operator actions through the definition of human failure events 

(HFEs) that are modeled in the fire PRA. 

Implementation of some fire procedures use fault clearance strategies to ensure that a cooling 

train is protected if portions of a required bus are within the effected zone. Consequently, the 

fire HRA must make use of input from procedures, Appendix R/NFAP-805 assumptions, and the 

experience of operations and training personnel to aid in understanding how the procedures are 

interpreted and implemented as operator actions and therefore, as potential HFEs. 

To identify operator actions taken in response to a fire, a detailed review of the FEPs is needed 

to examine the cues and procedure steps. In addition, it is important for the analysis to review 

the plant-specific training on the procedures, and conduct an in-plant visit to the locations where 

an action would be taken to identify new actions that introduce HFEs into the fire PRA model. 

The following are some issues that should be considered in identifying and defining HFEs for the 

fault clearance scenario through the review of FEPs: 

1. Successful safety functions require success of specific operator actions that can be identified 

in the FEPs. These actions are selected for inclusion in the HRA. Operator actions identified 

by Fault Tree logic, pertaining to system alignment, are also included. Typical emergency 

procedures, alarm response procedures and normal or abnormal operating procedures 

(prefixed: EOP, ARP, and AOP) are used as bases and sources for selecting the subtasks 

for the specific operator actions. 

2. Once the FEPs are entered in response to a fire in a specific location, the cues for action are 

determined by the procedural steps and checking with the control room supervisor rather than 

cues from parameters in control room. Each subtask is selected for modeling on the basis that 

failure of the operator to perform that specific step would significantly impact or result in 

failure of a safety function or system. 

• For example, assuming fire induced FEP entry conditions exist, failure to implement the 

function(s) implies that non-recovered equipment unavailability, LOCA, or interfacing 

LOCA conditions also exist, and lead to core damage. 

• Most monitoring and checking steps are screened out if they are follow-through from or 

to an operator action, and do not involve some physical operator activity. Such actions 

typically involve steps for verifying expected system parameters while performing other 

major (physical) steps. 
HRA Associated with Fire-Related Electric Bus Clearing and Restoration Procedures 

G-4 

3. The assumption is that if the plant response is normal or as expected for the accident 

scenario, then normal system parameter responses would be attained, and no new actions 

would be triggered. 

4. The HRA review of the FEP needs to identify groups of steps that the operators use to 

achieve each safety function in controlling the plant response to a fire as a function of the 

fire zone, and other performance shaping factors. 

5. The same function may be called for in different steps in the FEPs, or different functions 

impacted within the same FEPs. 

6. If unexpected conditions occur during the application of FEPs the operators can insert 

contingency actions, some of which are preplanned for fires, some are in the emergency 

procedures, and others are from general training. Only equipment and hardware with verified 

cable routing outside the fire zone are used for such contingency actions. 

7. PRA modeled paths through the plant procedures are pre-identified through the review of 

the plant procedures that organize the FEPs for a specific fire zone to identify the specific 

response associated with each step in the overall fire procedure, including both major parts 

and attachments. 

8. The path through the procedures is dependent on the preceding events in the PRA event tree 

and zone specific FEPs. 

9. Secondary cues provide a basis for using alternate cooling paths. Operators can initiate 

a new response based on the Critical Safety Function Status Trees (CSFSTs) or alarms, 

for example. These provide the opportunity for recovery of an HFE if the initial cues or 

directives are missed. This is particularly useful if the alternate cooling path is provided 

by a different crew member than the primary path. 

10. The success criteria of the events modeled in the PRA event tree follow the Level 1 model, 

with some additional fire specific conditions considered (transition to cold shutdown has 

no time requirement, and the operators will be able to verify operability of all needed 

components before initiating the transition to cold shutdown, therefore if hot shutdown 

is successful, then the likelihood of cold shutdown failure is nil). 

11. Several operator actions may be required in order for success of a specific system or 

function. In addition, these multiple actions may be performed in multiple locations 

(including field locations) by multiple operators. Furthermore, communication between 

the various performers may need to be coordinated or sequenced in a particular way, 

requiring communication between the various operators. In such cases, analysts might 

consider modeling separate HFEs for the decision-making and execution actions that must 

fail together, if the system or function is to fail. For example, the decision-making and 

action-coordinating parts that are likely to be performed by control room operators can be 

modeled as one or more actions. (If either of these types of actions fail, then field actions also 

must fail.) Separately (if control room decision-making is successful), analysts would model 

HFEs that represent the failure of executing field actions (possibly different HFEs for 

different locations). 
HRA Associated with Fire-Related Electric Bus Clearing and Restoration Procedures 

G-5 

In an example for the specific case of fault clearance, according to some plant designs, operator 

actions are required within fire emergency procedures (FEPs) to manually check or position 

valves by “resetting” all electrically controlled valves, and then manually “realigning” selected 

valves in a single cooling train. Therefore, modeling operator success involves two distinct 

phases of valve alignment when entering the FEPs: 

1. If the operator is successful in implementing the FEP reset steps by de-energizing appropriate 

electrical buses, all valves and components are placed in the fail-safe position. 

2. Then, only those valves and components used in the specified train (outside the fire zone) 

are restored for active cooling. The operator is then considered to have been successful in 

implementing the realign steps in the FEPs by re-energizing the appropriate electrical buses, 

and ensuring that at least one train of cooling is operating. 

3. Operator errors during either the reset or realignment steps are assumed to leave key valves 

and components that are modeled in the PRA in the wrong position (e.g., blocks the initiating 

of the specified cooling train, could also initiate a LOCA or fail to block a spuriously induced 

LOCA) and should therefore be included as HFEs in the fire PRA model. 

G.3 Quantitative Screening 

The method discussed in Section 4.2 of the Guidelines supports the assignment of screening 

values by addressing the conditions that can influence crew performance during fires, ensuring 

that the time available to perform the necessary action is appropriately considered (given the 

other on going activities in the accident sequence), and ensuring that potential dependencies 

among HFEs modeled in a given accident sequence are addressed. 

Screening Set 1 criteria apply only to pre-existing HFEs in the Internal Events PRA. Set 2 

addresses a special case for HFEs modeled in related scenarios in the Internal Events PRA, 

but that did not meet the Set 1 criteria. 

Set 3 criteria address (1) new HFEs added to the fire PRA or (2) prior Internal Events PRA 

HFEs needing to be significantly altered or modified in Step 1 of this procedure because of 

fire conditions, and are therefore considered to be the screening criteria applicable to the fault 

clearance scenario. 

Depending on the Set 3 criteria below, a screening value of either 1.0 or 0.1 may be used to 

determine the initial impact and the need for scoping or detailed modeling. 

G.3.1 Set 3 Criteria 

1. If the action being considered is either a MCR or local (i.e., ex-control room) manual action 

and it is to be performed within approximately 1 hour of the fire’s initiation, set the HEP to 

1.0 for screening. The 1-hour limit is both a reasonable limit for early response actions that 

will most likely be (or need to be) completed, as well as a time beyond which most plants 

can have additional personnel and any technical support group available at the plant site. 
HRA Associated with Fire-Related Electric Bus Clearing and Restoration Procedures 

G-6 

2. If the action is not necessary within the first hour, the fire can be assumed to be out and 

thus not continuing to cause delayed spurious activity and other late-scenario complicating 

disturbances, and that there is plenty of time available to diagnose and execute the action, set 

the HEP to 0.1 for screening or 10 times the internal events HEP which ever is lower for the 

initial action. 

3. The analyst still needs to ensure that potential dependencies across HFEs in the models 

and the joint probabilities of multiple HEPs in the same sequence are accounted for per the 

ASME Standard [2]. That is, that the fire effects and the inclusion of the new actions in the 

model do not create significant new dependencies among the HFEs (new and old) in the 

model. If unaccounted-for dependencies are likely to exist, a 1.0 screening value should be 

used for the second and third HEPs that appear in the sequence, or dependencies accounted 

for by separation of events or questions in the scoping process, or in methods associated with 

the detailed quantification. The main difference between the first and second group in this 

criteria set is that the fire is assumed to be out after the first hour. 

G.4 Qualitative Assessment 

The qualitative assessment portion of the fault clearance scenario evaluation should be 

performed consistent with the discussion in Section 5 of the main report, since a thorough 

evaluation would be needed of the context, Performance Shaping Factors (PSFs), procedures 

and training, complexity, workload/stress, human machine interface (HMI), environment, 

special equipment needs, and crew dynamics. 

One process which has been implemented for SISBO evaluation is to qualitatively model the 

human response to a fire as a chain of elements. The chain begins with a cue and ends in either 

a success or failure event as shown below. 

Cue |→ Error → Failure of Recovery → Failure Event. 

 |→ Success → New cue or Success Event. 

This structure facilitates the evaluation of success and failure states that are needed for modeling 

the procedure selection between EOPs and FEPs allowing the analysis to focus on those HFEs 

that could fail a safety function required to prevent core damage. This process can assist in 

grouping the analysis of many steps in the procedures. For the SISBO condition this involves 

two major steps. First is clearing the bus or circuit by removing power. The second is restoring 

the section of the bus or circuit needed to operate a selected safe shutdown cooling configuration. 

Within each main step there are many opportunities to define HFEs from the procedures. Also, 

the workload from these additional steps should also be considered in qualitatively evaluating 

each HFE. 
HRA Associated with Fire-Related Electric Bus Clearing and Restoration Procedures 

G-7 

G.5 Quantification 

It is expected that HFEs associated with the bus clearing strategy scenarios will be quantified 

using detailed HRA quantification. For this type of situation, it is not recommended to use 

the scoping trees provided in Section 6.2 of the main report due to the complexities, crew 

interactions and various PSFs involved in these scenarios. The scoping trees were not 

constructed to address these bus clearing and reconfiguring actions. Detailed HRA quantification 

will be needed for any HFEs that survive screening quantification using the EPRI HRA 

methodology approach presented in Appendix C of this report or the ATHEANA HRA method 

(NUREG-1880) [2] presented in Appendix D. With appropriate consideration of the fire context 

as described in Section 5 of this report (Qualitative Analysis), the two detailed HRA 

methodologies presented can be used to address fire-specific issues and PSFs. 

Among the PSFs which could be expected to be important for the fault clearance scenarios 

would be: 

• complicated procedures and potential interaction between EOPs, AOPs and FEPs, 

particularly the consideration of hesitancy by operators to enter procedures that might require 

SISBO, 

• difficult communications (e.g., involving SCBAs) between control room and field operators, 

• coordination of multiple actions, and 

• field actions in a variety of locations (with possibly different environmental conditions to be 

reflected). 

Other special considerations for detailed modeling of fire-related SISBO and single fault clearing 

scenarios are the following: 

1. Detailed modeling is required for unscreened fire zones where additional attachments or parts 

called for in FEP entry procedures have the potential for a loss of safety functions due to 

errors in applying these modified parts and added attachments. 

2. Detailed modeling is required for conditions prior to entering the FEPs where hot shorts have 

occurred as a result of the fire. This causes valves, and other components to be in undesired 

positions, and the operators are not able to make appropriate realignments using EOPs. 

3. Top events identified in the IPEEE are often used to define the initial system level operator 

actions based on the success criteria for the equipment. Additional event tree analysis may be 

needed to construct a logic model that links realigned functional safety elements to the HEP 

calculation. 

4. The HEPs for HFEs associated with staying in the EOPs are lower than those for 

implementing the FEPs in many cases. This is an operator decision that impacts whether the 

clearing and restoring actions are carried out. 

• The choice of procedures to use can significantly impact the HEP for the fire zone. 

• An assumption for initial modeling of the HEP is that given the fire was not put out 

quickly; the operators always go directly to the FEPs. 
HRA Associated with Fire-Related Electric Bus Clearing and Restoration Procedures 

G-8 

• Use of FEPs is delayed until the operators cannot control the plant. 

• A detailed decision model is needed to evaluate the error potential associated with 

decisions that the operators could make for either entering the FEPs from the EOPs 

or not. 

• Data for implementing this model can be obtained through operator interviews. 

An interview form can be used to record the results. 

5. If abnormal conditions arise due to independent equipment failures prior to FEP 

implementation, only equipment that is re-positioned or verified within the FEPs steps are 

recovered. Cues for equipment failures outside the FEPs or after application of FEPs are 

assumed to be unobserved and not recovered in the model contributing to the HEP value. 

6. Once the safety function has been identified for one or more actions in a portion of the 

procedure, the likelihood of failure for that procedure element is based on the probability 

that one or more steps are omitted or performed incorrectly; and the approximate time 

window for success associated with the scenario is based on the deterministic safe shutdown 

assessment documented in the Fire Hazards report. These include immediate actions, those 

within 30 minutes, those within 90 minutes and longer term actions. 

G.6 References 

1. Regulatory Guide 1.189, “Fire Protection for Nuclear Power Plants”, U.S. Nuclear 

Regulatory Commission, Washington, DC, Revision 1, March 2007. 

2. FIN L-2629, Brookhaven National Laboratory, Draft Technical Letter Report, “Risk 

Evaluation of the Response of PWRs to Severe Fires in Critical Locations”, May 30, 

1995 (Draft Predecisional). 

3. FIN L-1311, Brookhaven National Laboratory, Technical Evaluation Report, , “A RiskBased Approach for Evaluation of Fire Mitigation Features in Nuclear Power Plants”, 

November 21, 1995 (Draft Predecisional). 
H-1 

H

JUSTIFICATION FOR SCOPING APPROACH 

This appendix addresses the basis for the scoping quantitative approach. Issues include why 

the demonstration of feasibility and use of time margins are required, what PSFs are addressed 

implicitly and explicitly, and what the basis is for the HEP values assigned through the use of the 

flowcharts. 

H.1 Demonstration of Feasibility 

The feasibility demonstration outlined in Section 5 is conducted to exhibit that a given action or 

set of actions for a HFE can be diagnosed and performed within the time available. Of primary 

importance within the demonstration is the consideration of the timing of the event and the 

action. An operator action is considered feasible if the time available exceeds the time required. 

As discussed in Sections 4 and 5 of this document, the time available is typically derived from 

thermal-hydraulic studies and is the time from the initiating event (fire induced reactor trip) until 

an undesired or irreversible plant damage state is reached (e.g., core damage). 

Demonstrating the time required to formulate and execute a response can be problematic. Under 

normal conditions, walk-throughs, or even talk-throughs, with control room operators can be 

used to estimate this time. However, a fire situation represents less than optimal conditions that 

can greatly impact the crew performance during diagnosis and execution. Thus, for the HFEs 

modeled in the fire PRA, the conditions under which the diagnosis and execution will have to 

take place should be carefully addressed, and it is even more important that the estimation of the 

time required should be made during well structured demonstrations performed under as realistic 

circumstances as possible. 

In addition to showing that the action can be performed in the time available, the demonstration 

also includes inherent characteristics of the action such as complexity, the retrieval of needed 

tools, the wearing of SCBAs (if expected to be required), and other factors that could affect 

performance. By directly including these conditions in determining the feasibility of the actions, 

there are fewer PSFs and conditions that need to be estimated in determining the HEPs using the 

fire scoping HRA approach and uncertainty is reduced. 

However, there are a number of situations or factors in the fire context that may be very difficult 

to recreate. For instance, simulating a smoky environment is beyond the scope of a walk-through 

demonstration. Thus, although the demonstration lends confidence that the action is feasible 

under the assumed conditions, it is necessary to show that there is some additional time available 

(i.e., a time margin) in order to have some confidence that the effects of factors that could not be 

simulated or predicted, would not usually prevent the action from being completed. 
Justification for Scoping Approach 

H-2 

H.2 Time Margin 

The time margin (the difference between the available time and the time required, essentially the 

extra time available) is included not only to account for potential shortcomings in the ability to 

adequately simulate the actual plant conditions during the demonstration, but also to account 

for potential variability in crew response times. Furthermore, time for recovery is implicitly 

accounted for in extra time being available for performing the action. 

As discussed in section 5.2.2, ideally, in order to get as realistic estimate of the time 

required to perform the actions as possible, several crews would be used in conducting the 

demonstrations. However, since this may not always be possible and data from one crew may 

not be representative of all crew response times, time margins are used to account for potential 

variability in crew response times in determining HEPs using the scoping flowcharts. The larger 

the time margin, the more likely the variability in crew performance will be enveloped and the 

lower the HEPs that can be assigned. 

A time margin also provides a safety margin against potentially poor performance of expert 

judgment in predicting the amount of time required for aspects of the response that cannot be 

simulated, especially under stress [1]. Specifically, the extra time is included to account for 

potential unexpected fire effects and variabilities such as: 

• Individual differences 

• Crew differences 

• Variations in fire type and related plant conditions 

• Factors unable to be recreated in the feasibility demonstration 

NUREG-1852 [2], in addition to providing the guidance for demonstrating the feasibility of 

the relevant actions that the guidance in Section 5 of this document is based on, also provides 

guidance for developing timelines to help with the assessment of the time margins that can be 

assumed to be available. 

In general, for the scoping HRA quantification, a time margin of at least 100% or a factor of 2 

additional time must be available to provide a safety margin and allow assignment of an optimal 

HEP for the conditions present. Although in some cases HEPs assuming smaller time margins 

are provided, these HEPs are increased. Similarly, in some special cases, a time margin greater 

than 100% is required to obtain the optimal HEP for the conditions present. The basic time 

margin of 100% was established based on discussion in Appendix B of NUREG-1852 [2] in 

which an expert panel was convened to determine appropriate time margins for operator manual 

actions. During these meetings, a factor of 2 was decided upon to be sufficient for allowing an 

appropriate safety margin of time. Although this factor was established for operator manual 

actions to achieve and maintain post-fire hot shutdown, the application of the factor of 2 rule 

is applied a bit more broadly for the scoping fire HRA approach in which the actions may be 

performed in the MCR. This decision was made because the scoping fire HRA quantification 

approach should be slightly more conservative than a detailed approach to account for PSFs 

not directly considered. It should be noted that a factor of 2 time margin is consistent with 

ANSI/ANS Standard 58.8 [3], which addresses time response design criteria for safety-related 

operator actions. 
Justification for Scoping Approach 

H-3 

There are circumstances within the scoping flowcharts when a different time margin is required. 

Extended time margins (e.g., 200% or a factor of 3) are required in the presence of certain 

conditions (e.g., short vs. long time frame events or simple vs. complex actions) when the effects 

of the fire may be greater and induce larger variability in crew response times. 

H.3 Performance Shaping Factors 

In the construction of the scoping fire HRA quantification, the PSFs explicitly addressed were 

those deemed to be the most relevant for the fire context that would account for variation in 

crew performance. In particular, the concern was with factors that were thought to lead to the 

greatest variation in crew response and the desire to encompass the stressors affecting human 

performance of actions taken during a fire. The PSFs considered for inclusion were based on 

those identified by ASME/ANS standard requirement HR-G3 [4] and those discussed in 

NUREG/CR-6850 [5], which are based on reviews of fire events. 

Before entering the scoping flowcharts, there are a minimum set of PSF criteria that must be met. 

As described in Section 5 of this document, meeting these minimum criteria does not preclude 

the consideration of these PSFs later in quantification. First, there must be plant procedures in 

place supporting the diagnosis and execution of the operators’ action(s) being modeled, unless 

the action can be assumed to be skill-of-the-craft.1 Next, the operators should be trained on the 

use of the procedures and the actions being performed. This training on the action should include 

all steps of the action including any coordination of team members and communications that may 

be required. Finally, any equipment and tools that would be required for the completion of the 

action must be available and accessible. 

When this minimum set of criteria have been established, there are PSFs that must be addressed 

within the demonstration of feasibility. Section 5 of this document outlines explicitly which 

PSFs should be addressed and provides guidance on how to perform the demonstration and 

assessment. The factors addressed in the demonstration (including: environment, equipment 

functionality and accessibility, available indications and MCR response, communications, 

portable equipment, personnel protection equipment, procedures and training, and staffing) could 

be impacted by the fire and are especially important in calculating the time to perform the action. 

Finally, a number of PSFs are addressed explicitly within the flowcharts. Some of these PSFs 

are covered within the flowcharts because it is likely they were unable to be simulated in the 

demonstration of feasibility. However, other of the PSFs addressed explicitly in the flowcharts 

may have been covered to some extent in the demonstration of feasibility as well (e.g., the 

complexity of the task is an inherent characteristic that will be part of the demonstration). 

They are explicitly addressed in the flowcharts as it is expected that these PSFs could induce 

significant variability in crew performance and response times and it is important that they 

are adequately addressed. 

 

1

 In the case of recovery following an EOO or EOC due to spurious instrumentation, specific procedural guidance 

directing the recovery may not be necessary. However, an argument must be made as to why existing procedures, 

training, and available cues would be adequate to support recovery of the error(s), and this argument should be 

consistent with ASME/ANS requirements HR-H1 and HR-H2 [4]. 
Justification for Scoping Approach 

H-4 

The PSFs explicitly addressed through the flowcharts include: 

• Diagnostic complexity – The diagnostic complexity is assessed in a yes-no framework. To 

evaluate this factor, it is asked whether the procedures match the scenario (i.e., the expected 

pattern of cues will be consistent with the procedures that lead to a correct response). If the 

cues received do not match the procedures, it is assumed that a much more complex 

diagnostic scenario is in play and the HEP is automatically set to 1.0. If the procedures do 

match the situation and the cues, the diagnosis of the event is assumed to be relatively 

straight forward. 

• Execution complexity – The execution complexity of the response is quantified at two levels, 

either high or low. Section 5 of this document details what is required in deciding whether 

the complexity should be assessed at the high or low level. 

• Likely status of the fire (ongoing or extinguished) – The likely status of the fire is measured 

based on the time since the initiating event. For conservative estimates, the initiating event 

is considered to coincide with the start of the fire. Based on information in Appendix P of 

NUREG/CR-6850 [5] and FAQ 50 [6], most fires are extinguished or contained within 60 

minutes of the start of the fire.2

 The measurement of time since start of fire is a contextual 

variable that is included within the scoping flowcharts as it addresses other important factors 

that may be critical, but that are not directly asked within the scoping flowcharts. For 

instance, if an action needs to be completed before the fire has been fully suppressed, 

additional factors not directly addressed within the flowcharts may inhibit the ability to 

perform the action (e.g., fire in the path limiting accessibility to the action site; increased 

distractions in the MCR due to implementing fire procedures and coordinating and tracking 

the ongoing fire fighting). Greater time margins and/or higher HEPs are assigned to account 

for these possibilities. Furthermore, if the fire has not been fully suppressed and fire-effects 

may be ongoing, there are additional PSFs that should be evaluated in determining an 

appropriate HEP level (e.g., level of smoke or other hazardous toxin in the air). Therefore, 

these additional PSFs are only asked in the instances where the fire has not been suppressed. 

• Length of time window – This is an additional timing question posed in the scoping approach 

to distinguish between long-term and short-term events. The time window is the amount of 

time from the occurrence of the relevant cues that is available to diagnose a problem and 

complete the action; therefore, it includes time for diagnosis, execution, and any remaining 

extra time (i.e., the time margin). Within the scoping flowcharts, a distinction is made 

between long-term events (i.e., events that have more than a 30 minute time window) 

and short-term events. The distinction is based on the simple assumption that shorter time 

window events could be more susceptible or sensitive to minor distractions and diversions 

related to the occurrence of the fire than longer time frame events. With only a relatively 

small time window, such distractions could have a proportionally greater impact than when 

larger time frame events are involved. Within the scoping fire HRA approach, for the shorter 

time window events (i.e., less than or equal to 30 minutes available), higher HEPs are 

assigned and a greater time margin is required to achieve a relatively low HEP. These 

 

2

 An important exception to this 60-minutes rule are more challenging fires such as fires of turbine generators, 

outdoor transformers, high energy arching faults, and flammable gas fires. For modeling of actions during these 

events, the analyst should always assume the cue occurs before the fire has been suppressed, regardless of when the 

cues occur relative to the start of the fire. 
Justification for Scoping Approach 

H-5 

requirements are intended to account for potential distractions related to the fire (even if it 

has been extinguished) that could significantly delay response times and pose a greater threat 

to completing actions for short-term events. 

• Environmental condition (specifically, level of smoke or other hazardous gas in the area) – 

The level of smoke or other hazardous gases or toxins in the area can cause additional stress 

by lowering the visibility and/or by requiring special equipment (e.g., SCBA) be worn. In the 

presence of an on-going fire, these factors are especially a concern. Furthermore, the impact 

they may have on a crew performing the necessary action may be difficult to simulate in the 

demonstration of feasibility. 

• Wearing of special equipment – The requirement to wear special equipment (e.g., SCBA) 

may negatively affect the physical performance of the team member or hinder 

communications between team members. 

• Accessibility of location – The ability to access the location may be constrained either due to 

ongoing fire effects at the place of the action or in the path to the action location. Fire effects 

limiting the ability to proceed to or through an area may include, but are not limited to, the 

presence of flames, intolerable heat, water on the floor or in area, high amounts of smoke or 

other toxin impeding breathing or visibility, and illumination of the area. 

• Time margin – As discussed in Section H.2, a measure of time margin is included to account 

for the uncertainty not directly addressed through the feasibility demonstration or other PSFs 

included within the flowcharts. 

H.4 HEP Values 

H.4.1 Optimal HEP Value 

The scoping fire HRA approach differs from the screening fire HRA approach in an effort to 

reduce undue conservatism by allowing credit for conditions of various PSFs and for substantial 

time margins. Therefore, the HEPs assigned are based on the level of the PSFs and can be 

compared to other traditional HRA methods used for internal events analysis. The initial HEP 

values were set based on expert judgment. The values were then compared against existing 

methods as a reasonableness check. 

A HEP value of 1E-3 is set for the base fire scenario in which the conditions represent the best 

possible for the fire context. In this manner, this HEP is the best achievable in the scoping fire 

HRA approach. The value of 1E-3 is defined in ATHEANA [7] as the value for “The operator is 

‘Extremely Unlikely’ to fail” and this definition is consistent with how the value is used in the 

scoping approach. The specific conditions required to attain the HEP of 1E-3 are: 

• Minimum PSF criteria has been met prior to entering the flowcharts, 

• Feasibility has been demonstrated, 

• Procedures match the scenario, indicating a straightforward diagnostic situation, 

• Diagnosis and execution take place within the MCR, 

• Fire effects are not ongoing, 
Justification for Scoping Approach 

H-6 

• Action time window is greater than 30 minutes, 

• Execution complexity is low, 

• Time margin is at least 100%. 

Although the HEP assigned in the scoping fire HRA approach does not have separate values 

for the diagnosis and execution components, it can be compared to the individual HEPs for 

diagnosis and action from SPAR-H [8], THERP [9], and ASEP [10]. SPAR-H, in particular was 

chosen for this comparison as they have made a concerted effort to align their HEPs with other 

methods [8, 11]. The comparison of the scoping fire HRA approach to the internal events HRA 

methods was made for the select case for which the conditions resemble those of an internal 

events analysis (i.e., the fire effects are not on-going). These methods do not explicitly address 

obtaining HEPs under fire conditions, so we only use them to show consistency with our 

“baseline” HEP. 

In consideration of the diagnosis component, assuming the diagnosis related conditions noted 

above are met (i.e., it is a straightforward and relatively simple action, based on the assessment 

of the scenario matching the procedures), the argument is made that the base HEP of 1E-3 is 

consistent with the SPAR-H assessment of an HEP of 1E-3 for similar conditions, which is the 

nominal value of 1E-2 adjusted downward to reflect extra time being available. If the nominal 

HEP from SPAR-H is also adjusted downward to reflect low complexity (“obvious diagnosis” in 

SPAR-H), which is consistent with the conditions for the base or optimal case in the scoping fire 

HRA approach, an HEP of 1E-4 is obtained. This implies that the base HEP for the scoping fire 

HRA approach (fire is no longer ongoing and essentially optimal conditions are present) is 

conservative by an order of magnitude relative to similar conditions in SPAR-H. 

The base HEP in the scoping approach is also consistent with that assigned through the use 

of ASEP [10] for diagnosis within time allowed if time for diagnosis is equal to 30 minutes. It 

also matches the HEP for diagnosis if time is equal to 20 minutes and the lower bound is used. 

Justification for the use of the lower bound in this instance is assumed due to the diagnosis of 

the action being relatively simple and straight forward, with more than adequate time available. 

It is believed that the positive conditions assumed for the base scoping value, including the 

assumption of a longer time frame event (> 30 minutes time available) and a 100% time margin, 

parallel the conditions in ASEP that produce a similar value. Furthermore, it should also be noted 

that the HEPs produced from ASEP [10] are argued to be conservative values. 

For quantification of the execution portion of the HEP, SPAR-H [8] stipulates a value of 1E-3 

for executing actions under nominal conditions and would produce even lower values if the 

conditions assumed for the scoping fire HRA approach were treated in SPAR-H. ASEP [10] 

provides somewhat higher HEPs for executing actions relative to the scoping fire HRA approach 

base value, but also builds in the ability to reduce these values significantly (i.e., to 4E-3) when 

it is a simple task, with moderate stress and a second crew member can verify the action. Thus, 

it is argued that there is not significant disagreement between the scoping approach and ASEP. 

Similarly, walking through the tables in Chapter 20 of the THERP manual [9] in the following 

manner results in an HEP on the order of 1E-3: 
Justification for Scoping Approach 

H-7 

1. The Search Scheme of Figure 20-1 directs the analyst to Table 20-7 to quantify the execution 

portion of the action based on the error being an error of omission and written, procedural 

direction being available. 

2. Table 20-7 offers an HEP value of 1E-3 for there being written procedures in use that consist 

of a short list with check-off provisions or 3E-3 for a list without check-off provisions. 

These HEPs are assumed to be suitable even for local actions, rather than the simple MCR 

actions being addressed in the nominal conditions for the scoping fire approach. 

Thus, the assumption of a base or optimal HEP (which requires a rigorous set of conditions to 

be met [see list above]) of 1E-3 (including diagnosis and execution) is argued to not be largely 

different than those obtained for similar conditions using existing methods such as ATHEANA 

[7], THERP [9], ASEP [10], and SPAR-H [8], and is likely to be conservative relative to the 

values obtained using the other methods. 

H.4.2 HEP Multipliers for PSFs 

As conditions deteriorate from this “optimal” condition, Table H-1 shows the multipliers that 

are applied to the HEP depending on the level of the PSFs. These multipliers were used in the 

determination of the HEP values displayed in the HEP lookup tables featured in Section 5. In the 

determination of the HEPs, as the conditions of the scenarios deteriorated or conditions became 

more negative (for example, time margin of less than 100%, smoke levels high requiring the 

crew to wear SCBAs), the multipliers were applied cumulatively. In other words, if a situation 

was such that two (or more) PSFs were applicable (negative influence on performance), the 

multipliers for the PSFs were applied consecutively in determining the final HEP. 

Along with these multipliers, an additional constraint is added to those actions that are either 

considered to be highly complex or are to be performed in an action time window less than 

(or equal to) 30 minutes. For these instances, the base time margin level is set to a factor of 3 

(i.e., an additional 200% of the demonstrated time). It is reasoned that extra time would be 

necessary to deal with distractions or problems should they occur while attempting a highly 

complex action. Similarly, extra time would be needed to buffer problems or distractions that 

occur when only a short action time window is available. 
Justification for Scoping Approach 

H-8 

Table H-1 

Multipliers used for increasing HEP values to reflect negative changes in conditions or 

poorer conditions 

Change in PSF Scoping Approach Multipliers 

Fire effects ongoing (i.e., less than 60 minutes from the 

start of the fire) 

10 

Action time window less than or equal to 30 minutes 5 

High execution complexity 5 

Increases in smoke level (multiplier is applied for each of 

the two levels) 

2 

Decrease in time margin available 5 

H.4.3 HEP Multipliers Across Flowcharts 

The HEP values assigned for HFEs in which the diagnosis and execution of the action(s) takes 

place within the MCR are the minimum values obtainable (i.e., those values assigned through 

the use of flowchart depicted in Figure 5-2). The HEP values assigned when using the other 

flowcharts (i.e., execution takes place locally, HFE for MCR abandonment or alternative 

shutdown, or HFE for action(s) in response to an error due to spurious indicators) reflect 

assumptions about increasing difficulty due to those changes in conditions. Multipliers are used 

to reflect the changes in conditions addressed by the different flowcharts and are accounted for 

in the HEP lookup tables in Section 5. For instance, the HEPs assigned in Figure 5-3 (EXCR) 

covering HFEs for actions that are executed locally are two times greater than those HEPs 

assigned for HFEs covering actions executed within the MCR (INCR, Figure 6-2). This 

multiplier is based on the assumption that actions executed within the MCR will be practiced 

more regularly, will be clearly outlined in procedural guidance, and will be subject to fewer 

extraneous variables. Similarly, the HEPs assigned for the HFEs covering actions for MCR 

abandonment or the use of alternative shutdown (CRAB, Figure 5-4) are five times greater than 

the HEPs assigned for HFEs involving locally executed actions (EXCR, Figure 5-3). Finally, 

the HEPs for HFEs covering recovery actions in response to EOOs or EOCs due to spurious 

instrumentation (SPI, Figure 5-5) take into account the greater ambiguity created by spurious 

instrumentation as well as where the execution of the action takes place. If the recovery of the 

EOO or EOC is to be executed in the MCR, the HEP is five times greater than the normal HEPs 

for actions executed within the MCR (INCR, Figure 5-2). On the other hand, if the recovery of 

the EOC or EOO is to be executed locally, the HEP is five times greater than the HEPs assigned 

for locally executed actions (EXCR, Figure 5-3). The multipliers applied to the flowcharts are 

illustrated in Table H-2. 
Justification for Scoping Approach 

H-9 

Table H-2 

Calculation of HEP values across scoping flowcharts 

Scoping 

Flowchart 

Multiplier Applied to Base Flowchart to 

Adjust Values in Scoping Flowchart Base Flowchart 

EXCR (Figure 5-3) 2 INCR (Figure 5-2) 

CRAB (Figure 5-4) 5 EXCR (Figure 5-3) 

SPI (Figure 5-5) 

5 

INCR (Figure 5-2) for in MCR 

actions; 

EXCR (Figure 5-3) for ex-CR 

actions 

An example may help to illustrate the use of the multipliers. A scenario involving the same PSFs 

is illustrated for each of the flowcharts to demonstrate the application of the multipliers across 

the flowcharts. The PSFs for the illustrative scenario are: 

• Minimum PSF criteria has been met prior to entering the flowcharts, 

• Feasibility has been demonstrated, 

• Procedures match the scenario, indicating a straightforward diagnostic situation, 

• Procedures exist for executing the ex-CR action (when applicable), 

• Fire effects are ongoing (i.e. < 60 minutes since the start of the fire), 

• Area is accessible and there is no fire in the vicinity of the action, 

• Action time window is greater than 30 minutes, 

• Execution complexity is low, 

• There is no smoke present, 

• Time margin is 75%. 

If this situation represented an action to be diagnosed and executed within the MCR, the final 

HEP would be 0.05 (INCR30 from HEP Lookup Table J).3 This same scenario represented as a 

local, ex-CR action would have an HEP of 0.1 (EXCR31 from HEP Lookup Table X), which is 

equal to a factor of two applied to the INCR HEP. Similarly, these same PSFs when applied to an 

action for MCR abandonment or alternative shutdown would result in an HEP of 0.5 (CRAB12 

from HEP Lookup Table AE), which is equal to five times the ex-CR HEP. If this same situation 

represented a recovery of an EOO or EOC due to spurious instrumentation and was executed in 

the MCR, the HEP would be equal to 0.25 (SPI16 from HEP Lookup Table AK). This value is 

the same as the HEP for normal in-MCR actions multiplied by 5. Finally, if the recovery is 

needed to be executed locally as an ex-CR action, the HEP would be equal to 0.5 (SPI28 from 

HEP Lookup Table AP), which is five times larger than the normal HEP for an ex-CR action. 

 

3

 The HEP of 0.05 can be obtained either by referencing HEP Lookup Table J or by applying the multipliers 

discussed in Section H.4.2. For instance, beginning with the base value of 1E-3, and applying the multipliers 

of 10 for ongoing fire effects and 5 for decreased time margin results in a final HEP of 0.05 (= 0.001 * 10 * 5). 
Justification for Scoping Approach 

H-10 

H.5 References 

1. “Criteria for Safety Related Nuclear Plant Operator Actions: A Preliminary Assessment of 

Available Data”, Haas, P. M. & Bott, T. F., Reliability Engineering, vol. 3, pp. 59-72. 

2. NUREG-1852, “Demonstrating the Feasibility and Reliability of Operator Manual Actions 

in Response to Fire,” October 2007. 

3. ANSI/ANS Standard 58.8-1994, “American National Standard Time Response Design 

Criteria for Safety-Related Operator Actions,” American Nuclear Society, La Grange Park, 

Illinois. 

4. ASME RA-Sb-2005, “Standard for PRA for Nuclear Power Plant Applications”, December 

2005,(Note statement in Foreword about standards). Available from American Society of 

Mechanical Engineers. 

5. NUREG/CR-6850/EPRI 1011989, “EPRI/NRC-RES Fire PRA Methodology for Nuclear 

Power Facilities,” September 2005. 

6. FAQ 50. 

7. NUREG-1880, “ATHEANA User’s Guide”, May 2007. 

8. NUREG/CR-6883, “The SPAR-H Human Reliability Analysis Method,” August 2005. 

9. NURGE/CR-1278, “Handbook of Human Reliability Analysis with Emphasis on Nuclear 

Power Plant Applications,” August 1983. 

10. NUREG/CR-4772, “Accident Sequence Evaluation Program Human Reliability Analysis 

Procedure,” February 1987. 

11. “The Origins of the SPAR-H Method’s Performance Shaping Factor Multipliers”, Boring, 

R. L. & Blackman, H. S., Joint 8th IEEE HFPP/13th HPRCT, 2007. 
NRC FORM 335

(9-2004)

NRCMD 3.7

U.S. NUCLEAR REGULATORY COMMISSION 11. REPORT NUMBER

(Assigned by NRC, Add Vol., Supp., Rev.,

and Addendum Numbers, if any.)

BIBLIOGRAPHIC DATA SHEET

(See instructions on the reverse)

2. TITLE AND SUBTITLE

EPRI/NRC-RES Fire Human Reliability Analysis Guidelines

Draft Report for Public Comment

5. AUTHOR(S)

Jeff Julius (Scientech), Jan Grobbelaar (Scientech) , Kaydee Kohlhep (Scientech), John

Forester (Sandia National Laboratories), Stacey Hendrickson (Sandia National Laboratories),

Bill Hannaman (SAIC), Susan Cooper (US NRC), Kendra Hill (US NRC), Bijan Najafi (SAIC),

Erin Collins (SAIC)

NUREG-1921

3. DATE REPORT PUBLISHED

MONTH I YEAR

November I 2009

4. FIN OR GRANT NUMBER

6. TYPE OF REPORT

Draft

7. PERIOD COVERED (Inclusive Dates)

8. PERFORMING ORGANIZATION - NAME AND ADDRESS (If NRC, provide Division, Office or Region, U.S. Nuclear Regulatory Commission, and mailing address; if contractor,

provide name and mailing address.)

Sandia National Laboratories, P.O. Box 5800, Albuquerque, NM 87185

Scientech, A Cutiss Wright Flow Control Company, 16300 Christensen Rd. Suite 300 Tukwila, WA 98038

SAIC, 1671 Dell Ave #100, Campbell, CA 95008

U.S. Nuclear Regulatory Commission, Office of Nuclear Regulatory Research, Washington, DC 20555-0001

9. SPONSORING ORGANIZATION - NAME AND ADDRESS (If NRC, type "Same as above"; if contractor, provide NRC Division, Office or Region, U.S. Nuclear Regulatory Commission,

and mailing address.)

Division of Risk Analysis

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, DC 20555-0001

10. SUPPLEMENTARY NOTES

11. ABSTRACT (200 words or less)

Electric Power Research Institute

3420 Hillview Ave

Palo Alto, CA 94303

In 2001, EPRI and the USNRC's Office of Nuclear Regulatory Research (RES) embarked on a cooperative project to improve

the state-of-the-art in fire risk assessment to support a new risk-informed environment in fire protection. This project produced

NUREG/CR-6850 (EPRI1011989), entitled "Fire PRA Methodology for Nuclear Power Facilities" which addressed fire risk for

at-power operations. NUREG/CR-6850 developed high level guidance on the process for identification and inclusion of human

failure events (HFEs) into the fire PRA (FPRA), and a methodology for assigning quantitative screening values to these HFEs.

It outlined the initial considerations of performance shaping factors (PSFs) and related fire effects that may need to be

addressed in developing best-estimate human error probabilities (HEPs). However, NUREG/CR-6850 did not describe a

methodology to develop best-estimate HEPs given the PSFs and the fire-related effects.

In 2007, EPRI and RES embarked on another cooperative project to develop explicit guidance for estimating HEPs for human

failure events under fire generated conditions, building upon existing human reliability analysis (HRA) methods. This document

provides a methodology and guidance for conducting a fire HRA. This process includes identification and definition of post-fire

human failure events, qualitative analysis, quantification, recovery, dependency, and uncertainty. This document provides three

approaches to quantification: screening, scoping, and detailed HRA.

12. KEY WORDSIDESCRIPTORS (List words or phrases that will assist researchers in locating the report.)

Human Reliability Analysis (HRA), Fire, Probabilistic Risk Assessment (PRA)

NRC FORM 335 (9-2004)

13. AVAILABILITY STATEMENT

unlimited

14. SECURITY CLASSIFICATION

(This Page)

unclassified

(This Report)

unclassified

15. NUMBER OF PAGES

16. PRICE

PRINTED ON RECYCLED PAPER


Electric Power Research Institute

3420 Hillview Avenue, Palo Alto, California 94304-1338 • PO Box 10412, Palo Alto, California 94303-0813 USA

800.313.3774 • 650.855.2121 • askepri@epri.com • www.epri.com

© 2009 Electric Power Research Institute (EPRI), Inc. All rights reserved. Electric Power 

Research Institute, EPRI, and TOGETHER...SHAPING THE FUTURE OF ELECTRICITY are 

registered service marks of the Electric Power Research Institute, Inc.

Electric Power Research Institute

3420 Hillview Avenue, Palo Alto, California 94304-1338 • PO Box 10412, Palo Alto, California 94303-0813 USA

800.313.3774 • 650.855.2121 • askepri@epri.com • www.epri.com

Program:	

Nuclear Power

1019196

The Electric Power Research Institute, Inc. (EPRI, www.epri.com) 

conducts research and development relating to the generation, 

delivery and use of electricity for the benefit of the public. An 

independent, nonprofit organization, EPRI brings together its scientists 

and engineers as well as experts from academia and industry to help 

address challenges in electricity, including reliability, efficiency, health, 

safety and the environment. EPRI also provides technology, policy and 

economic analyses to drive long-range research and development 

planning, and supports research in emerging technologies. EPRI’s 

members represent more than 90 percent of the electricity generated 

and delivered in the United States, and international participation 

extends to 40 countries. EPRI’s principal offices and laboratories are 

located in Palo Alto, Calif.; Charlotte, N.C.; Knoxville, Tenn.; and 

Lenox, Mass.

Together...Shaping the Future of Electricity