Human Performance Reference Manual - Nuclear Safety Info · * INPO’s Professionalism Series is a set of industry documents that convey general principles on specific topics related

HumanPerformance ReferenceManual

GENERAL DISTRIBUTION

October 2006ManualINPO 06-003

HUMAN PERFORMANCE REFERENCE MANUAL

INSTITUTE OF NUCLEAR POWER OPERATIONS

October 2006

INPO 06-003

Plant Area: Human Performance

Key Words:

Human Performance, Human Factor, Personnel Error

GENERAL DISTRIBUTION: Copyright © 2006 by the Institute of Nuclear Power Operations. Not for sale or for commercial use. All other rights reserved.

NOTICE: This information was prepared in connection with work sponsored by the Institute of Nuclear Power Operations (INPO). Neither INPO, INPO members, INPO participants, nor any person acting on the behalf of them (a) makes any warranty or representation, expressed or implied, with respect to the accuracy, completeness, or usefulness of the information contained in this document, or that the use of any information, apparatus, method, or process described in this document may not infringe on privately owned rights, or (b) assumes any liabilities with respect to the use of, or for damages resulting from the use of any information, apparatus, methods, or process disclosed in this document.

i

FOREWORD This document collects into one convenient manual the concepts and principles that support the prevention of events triggered by human error in the nuclear workplace. This manual serves as the primary reference for students participating in INPO’s Human Performance Fundamentals Course. White space is provided in the right margin to accommodate note taking. It is useful to individuals involved with the design, construction, operation, maintenance, or management of nuclear power plants. Experience from the nuclear industry and research from numerous scientific and academic sources form the technical bases for the concepts and principles described in this document. Each chapter is extensively referenced. Because of the brevity of each topic, readers are encouraged to study related references to acquire additional insights. This manual assists managers, support staff, supervisors, human performance professionals, and workers to do the following:

• Develop a coherent strategic approach to minimizing the frequency and severity of events triggered by human error.

• Understand the factors that cause and prevent human error.

• Stimulate organizational improvement by finding and eliminating conditions that either provoke human error or inhibit the effectiveness of defenses against human error.

• Adopt leader practices that align the organization and its culture to more reliably support excellent human performance.

• Promote a common language and understanding of human performance concepts and terms.

This document is organized into four chapters and a glossary, as described below.

Chapter 1, A Strategic Approach, defines human performance, models the events human error triggers, and explains the principles, criteria, and strategic approach to managing human performance.

Chapter 2, Reducing Error, Re, explores human error, its causes, and its impact on the execution of work in the physical plant.

Chapter 3, Managing Defenses, Md, considers the roles and kinds of defenses, the need for defense-in-depth, and how to manage defenses in protecting key assets from human error.

Chapter 4, Culture and Leadership, addresses the role of culture and leadership in influencing the values, beliefs, and behaviors of people.

Glossary, Descriptions of Common Human Performance Terms and Phrases, describes the meaning and use of various terms used in the manual.

ii

This reference manual cannot cover every aspect of human performance and does NOT address information related to the following:

• specific error prevention tools and techniques • programmatic aspects of human performance • training methods • human reliability analysis • ergonomic and human factors related to the human-machine interface

This manual is periodically updated as the industry increases its understanding of human performance. Although this is the seventh revision of this document since the original was issued in 1997, it is the first time as a published INPO document. The following list summarizes the changes to the sixth revision:

• Clarified the strategy for achieving excellence in human performance in Chapter 1 • Incorporated the new performance objective on human performance (OR.3) into

Chapter 1 (INPO 05-003, Performance Objectives and Criteria, May 2005) • Consolidated topics related to human error scattered throughout the manual into

Chapter 2, and added content on the topic of violation • Enhanced the section on team errors in Chapter 2 by including the concept of

dependency • Transferred content related to human performance tools in old Chapter 2 to INPO 06-

002, Human Performance Tools for Workers, May 2006 • Incorporated the “Behavior Engineering Model – Nuclear” into Chapter 3 • Incorporated Safety Culture into new Chapter 4 • Added a “Performance Gap Analysis” tool to Chapter 4 • Incorporated old Chapter 5 (revision 6) into INPO 06-002, Human Performance

Tools for Workers, May 2006 • Deleted old Chapter 6

INPO members are encouraged to submit suggestions on the content and format of this document. This information will serve as input to a future revision of the document. Please direct comments to: Deputy Director, Organizational Systems Institute of Nuclear Power Operations 700 Galleria Parkway, SE, Suite 100 Atlanta, GA 30339-5943 770-644-8313 Also, you may e-mail your comments to the deputy director, Organizational Systems, using the e-mail address available on the INPO Web site.

iii

TABLE OF CONTENTS Section Page

FOREWORD i CHAPTER 1 – A STRATEGIC FOUNDATION 1

Excellence in Human Performance Human Performance Anatomy of an Event Strategic Human Performance Principles of Human Performance Performance Objective and Criteria (OR.3)

3568

1214

CHAPTER 2 – REDUCING ERROR, Re 19 Human Fallibility Performance Modes Error-Likely Situations Error Prevention Principles Work Execution

2134454957

CHAPTER 3 – MANAGING DEFENSES, Md 73 Defenses Defense-in-Depth Managing Defenses

757887

CHAPTER 4 – CULTURE AND LEADERSHIP 109 Safety Culture Leadership Key Leadership Practices

111113115

GLOSSARY – DESCRIPTIONS OF COMMON HUMAN PERFORMANCE 125 TERMS AND PHRASES

iv

This page is intentionally left blank.

INPO 06-003 Human Performance Reference Manual

1

1 A STRATEGIC FOUNDATION

EXCELLENCE IN HUMAN PERFORMANCE ...................................................3 Why the Emphasis on Human Performance ......................................................4 Individuals, Teams, Leaders, and Organizations ...............................................4

HUMAN PERFORMANCE...................................................................................5 Behavior.............................................................................................................5 Results................................................................................................................5

ANATOMY OF AN EVENT .................................................................................6 Initiating Action .................................................................................................6 Flawed Defenses ................................................................................................7 Error Precursors .................................................................................................7 Latent Organizational Weaknesses ....................................................................7

STRATEGIC HUMAN PERFORMANCE............................................................8 Strategic Approach.............................................................................................8 Reducing Error, Re ...........................................................................................10 Managing Defenses, Md...................................................................................10

PRINCIPLES OF HUMAN PERFORMANCE ...................................................12

PERFORMANCE OBJECTIVE AND CRITERIA (OR.3)..................................14 Performance Objective – Human Performance................................................15 Criteria – Organizational Factors .....................................................................15 Criteria – Job-Site Conditions..........................................................................16 Criteria – Individual Behaviors........................................................................16

Human Performance Reference Manual INPO 06-003

2



3

EXCELLENCE IN HUMAN PERFORMANCE

“We are what we repeatedly do. Excellence, then, is not an act but a habit.”

--Aristotle Greek philosopher (384 BC – 322 BC)

Success means being the best. Excellence means being your best—matching your practice with your potential. Excellence also means being better tomorrow than yesterday, which implies that the standards of excellence continually change.1 The quality of excelling is an ongoing pursuit, a habit of thought and action—a daily pursuit of high-performing stations. Each station’s safety culture and organizational effectiveness have a direct influence on the quality of human performance, for good or for bad. If the value of excellence is embedded in the station’s culture, the organization will find ways to better itself. Pursuing excellence, therefore, promotes the highest levels of safety and reliability. Human error is normal—a natural part of being human. But it can also be provoked by conflicting management and leadership practices and by weaknesses in the station’s organization, processes, and culture. Understanding human error helps one recognize that human beings are complex creatures possessing a wide range of capabilities and corresponding limitations. No matter how efficiently plant equipment functions; how good the training, supervision, and procedures are; and how well the best worker, engineer, or manager perform his or her duties, people cannot perform better than the organization supporting them.2 Therefore, to improve and preserve the plant’s resistance to human error and related events, defense-in-depth with respect to human activities is necessary. Building on Excellence in Human Performance, this manual promotes practical, ways of thinking about and managing the hazards related to human performance.* Fundamentally, achieving excellence in human performance requires a sound risk management strategy.3 This manual explores the foundations of individual and leader behaviors as well as organizational factors that either lead to or prevent errors and their events. Fundamental knowledge of human and organizational behavior is emphasized so that the manager, supervisor, and worker can better handle error-likely work situations to avoid both human error and plant events.

* INPO’s Professionalism Series is a set of industry documents that convey general principles on specific topics related to excellent nuclear plant operation.


4

Why the Emphasis on Human Performance A review of instances in which fuel was damaged while it was in the reactor—discussed in INPO 91-008, In-reactor Fuel Damaging Events—indicates that human error was the primary contributor. This report discloses that “the risk is in the people—the way they are trained, their level of professionalism and performance, and the way they are managed.” With economic deregulation a reality for some utilities, human error that impact people’s health and well-being or plant performance now becomes a costly occurrence that affects the economic bottom line of the business. Therefore, human performance remains a significant factor for management attention not only from a nuclear safety perspective, but also from a financial one.

Individuals, Teams, Leaders, and Organizations The goal of excellence in human performance is to strive toward event-free performance of nuclear power stations through the proactive management of human error and the strengthening of defenses, thereby optimizing the performance of individuals, leaders, and the organization. The professionalism series document Excellence in Human Performance uses a three-tiered perspective to explain how human performance can be improved—individual, leader, and organization. These terms are used throughout this manual.

• Individual – an employee in any position in the organization from the storeroom to the boardroom

• Leader – an individual who takes personal responsibility for his or her performance and the plant's performance and attempts to positively influence the processes and values of the organization that support plant performance

• Organization – a group of people with a shared mission, resources, and processes, which guide the organization’s behavior toward safe and reliable operation

When Excellence in Human Performance was published in 1997, team behaviors were not grouped together as a important organizational factor. Industry thinking has matured in this regard. The relationships and interactions among group members are important factors that influence human performance. For the purposes of this manual, a team is defined as a group of individuals working together toward a common goal.


5

HUMAN PERFORMANCE What is human performance? Because most people cannot effectively manage what they do not understand, this question is a good place to start. Understanding the answer helps explains why improvement efforts focus not only on results but also on behavior. Very simply, human performance is behavior and results (P=B+R).4

Behavior Behavior is what people do and say—a means to an end. During tasks involving manual effort, behavior is an observable act that can be seen and heard. It can be measured. If it can be measured, it can be changed. The adage, “If a dead man can do it, it is not a behavior.” sheds light on what is and is not behavior. “Not following procedures” and “inattention to detail” are not behaviors. Consistent behavior is necessary for consistent results. For example, a youth baseball coach cannot shout at a 10-year-old pitcher from the dugout to “throw strikes,” and expect improved performance. The child may not know how and become frustrated. An effective coach teaches specific techniques—behaviors—to help the child throw strikes consistently. Proper behavior is followed up with positive reinforcement. Sometimes, people make mistakes despite their best efforts, and their causes provide valuable insights to needed improvements to anticipate, prevent, and catch errors. For long-term, sustained good results, one must look closely at what influences behavior, what motivates it, what provokes it, what shapes it, what inhibits it, and what directs it, especially when handling plant equipment. The behavior engineering model-nuclear described in Chapter 3 provides insight into what these influences are and how to identify them.

Results Performance connotes measurable results. Results, good or bad, are the outcomes of behavior—the mental processes and physical efforts to perform a task.5 In our industry the “end” is that set of outcomes manifested by people’s health and wellbeing, the environment, and the safe, reliable, and efficient generation of electricity. Events usually involve challenges to reactor safety, industrial/radiological safety, environmental safety, and productivity/generation. Event-free performance is the desired result. Event-free performance depends on reducing error where people touch the plant and on ensuring the integrity of controls, barriers, and safeguards against the residual errors that still occur.

P = B + R


6

ANATOMY OF AN EVENT Events are caused. Typically, they are triggered by human action. In most cases, the human action causing the event was in error. However, the action could have been directed by a procedure; or it could have been a shortcut to get the job done—a violation. In any case, an act initiates the undesired consequences. On a plant-by-plant basis, experience has shown that significant events tend to occur every few years, but no law of nature says they must. The cycle can be broken, but only by understanding how events come about through human error. The Anatomy of an Event provides a picture (see illustration) of the elements that exist before an event occurs. Breaking the links will prevent events.

Event An event is an unwanted, undesirable change in the state of plant structures, systems, or components or in human/organizational conditions (health, behavior, administrative controls, environment, and so on) that exceeds established significance criteria. INPO defines a significant event as one that resulted in “an appreciable reduction in plant safety or reliability, excessive radiation exposure, the discharge of radioactivity off site, or serious harm to individuals.” Usually, consequences are relative to a series of d-words: death, damage, dollars, dose, delays, and disgrace.6 Also, events may involve serious degradation or termination of the ability of equipment to perform its required function.

Initiating Action An initiating action is an action by an individual, whether correct, in error, or in violation, that results in a plant event.7 Active errors are those errors that have immediate, observable, undesirable outcomes in the physical plant. They can be either acts of commission or omission. The majority of initiating actions are active errors. Therefore, a strategic approach to preventing events would be the anticipation and prevention of active errors where people touch risk-important equipment.

Event

ErrorPrecursors

LatentOrganizationalWeaknesses

Vision, Beliefs, &

Values

Mission

Goals

Policies

Processes

Programs

InitiatingAction

FlawedDefenses

Vision, Beliefs, &

Values

EventEvent

ErrorPrecursors

ErrorPrecursors


Vision, Beliefs, &

Values

Mission

Goals

Policies

Processes

Programs


Vision, Beliefs, &

Values

Mission

Goals

Policies

Processes

Programs

Mission

Goals

Policies

Processes

Programs

InitiatingActionInitiatingAction

FlawedDefensesFlawedDefenses

Vision, Beliefs, &

Values


7

Flawed Defenses Defects, under the right circumstances, may inhibit the ability of defensive measures to protect plant equipment or people against hazards or fail to prevent the occurrence of active errors. Defenses do the following:

• protect against various hazards (such as radiation, chemicals, heat, rotating machinery)

• promote consistent behavior—methods to consistently anticipate, prevent and catch errors at the job site

• mitigate the consequences of the hazard (for example, reduced reactor safety margin, personal injury, equipment damage, cost)

The terms, defense, control, barrier, and safeguard, are used interchangeably throughout this reference manual.

Error Precursors Error precursors are unfavorable conditions at the job site that increase the probability for error at the moment of a specific action, that is, error-likely situations. An error-likely situation—an error about to happen—typically exists when the demands of the task and its environment exceed the capabilities of the individual(s) or the limitations of human nature.8 Error-likely situations are also known as error traps.

Latent Organizational Weaknesses Hidden conditions in management control processes (for example, strategy, policies, work control, procedures, training, and resource allocation) or values (shared beliefs, attitudes, norms, and assumptions) that can provoke error (precursors) in the workplace and degrade the integrity of defenses (flawed defenses) are latent organizational weaknesses.9 Management’s decisions about expectations, resources, and rewards, as well as their personal style, determine what is done, where it is done, how well it is done, and when it is done, either contributing to the health of the organization or further weakening its resistance to error and events. The organization plays a greater role in the performance of a station than the workforce. When managers understand how their organizations work, they are better able to identify and eliminate latent conditions that either promote error or worsen the events triggered by error.

Bill

The ones that contribute to events are previously latent. If they were actually latent they would not have been involved in the causation of the evetn.


8

STRATEGIC HUMAN PERFORMANCE Achieving excellence in human performance requires a risk-based approach. Risk is a function of probability and consequence. Identifying and minimizing the risk of human error and its impact on plant equipment, personnel, and property (assets) should be the aim of management.10 The principal hazard to these assets is anyone who can touch and alter the status of the assets primarily workers. Regardless of how conscientious and careful people are, they can still err, sometimes at inopportune moments. Exposure to the hazard of human error is most acute when people touch the equipment. When assets are exposed to human error, the risk of a plant event is present. How often events occur tends to follow how often people make mistakes when working on plant equipment. Therefore, minimizing the frequency (reducing the probability) and severity (reducing consequences) of plant events triggered by human error will reduce the risk to plant, person, property, and production. When the risk of human error at the job site is systematically reduced or eliminated, the frequency of events will drop. Controls that reduce the chances of error include the use of human performance (error-prevention) tools as well as engineered, administrative, cultural, and oversight controls. Rigorous and thoughtful application of human performance tools primarily influences the frequency of events, not so much the severity of events. Defenses fulfill this function.

Strategic Approach A 2002 study sponsored by the Nuclear Regulatory Commission (NRC) supports this conclusion.11 Personnel at the Department of Energy’s Idaho National Laboratory (INL) explored the contributions of human performance to risk in operating events in the commercial nuclear power industry. Risk was measured by changes in the conditional core damage frequency using probabilistic risk analysis calculations. The INL analyzed 37 events, selected from licensee event reports (LERs) and augmented inspection team (AIT) reports, that had occurred over a six-year period. The results showed that human performance contributed significantly to these events. Analysts identified 270 human errors in the events reviewed. Of those errors identified 81 percent were latent and 19 percent were active. (See the Glossary for the definitions of active and latent errors.) The influence of active errors on the severity of the events was shown to be negligible, while latent errors had a significant impact. A review of the latent errors described in the report reveals that these errors are really flawed defenses.


9

Strategically, INPO’s four cornerstone programs (evaluation, assistance, training, and operating experience) help reduce the frequency and severity of plant events. The Anatomy of an Event model, which describes the origin and development of an event triggered by human error, illustrates two strategic focal points to reduce the frequency and severity of human performance events: initiating actions at the job site and latent organizational weaknesses. Academic sources and the NRC/INL study support the logic of this approach. Therefore, a coherent human performance management strategy should address two primary challenges:

1. Reduce the frequency of events by anticipating, preventing, and catching active errors at the job site.

2. Minimize the severity of events by identifying and eliminating latent weaknesses that hinder the effectiveness of defenses against active errors and their consequences.

Re + Md → ∅E Reducing active errors (Re) and managing defenses (Md) leads to zero significant events (∅E). As one plant manager said during an all-hands meeting, “Zero is not a number; it’s a vision.” Reducing the error rate minimizes the frequency, but not the severity of events. Only defenses prevent events. Traditionally, managers have simply reinforced the use of human performance tools—to pay attention and focus on the task at hand. This is a viable short-term strategy, but an Re strategy alone has a noteworthy shortcoming. Even if opportunities to err are systematically identified and prevented, people still err, although at a lower rate. Consequently, additional means to protect assets from residual active errors have to be introduced. Defense-in-depth—defenses, barriers, controls, and safeguards arranged in a layered, overlapping fashion—provides assurance such that if one fails, the remaining defenses will reduce the impact on station assets.

error reduction tools initiated

error reduction tools reinforced

area protected by managing defenses

time

errorrate


10

Reducing Error, Re An effective error-reduction strategy focuses on work execution because these occasions present workers with opportunities to harm key assets or reduce productivity through human error. Work execution involves jobs or tasks during which workers directly contact with plant equipment, that is, when they touch plant equipment. Examples of such tasks include control room operations, preventive and corrective maintenance, and the calculation and addition of chemicals to the feedwater system. During work execution the human performance objective is to anticipate, prevent, or catch active errors, especially at critical steps, where error-free performance is absolutely necessary. There are three phases to work execution:

• Work Preparation – planning – identifying what is to be accomplished and what is to be avoided, including critical steps; walkdowns – identifying potential job-site challenges to error-free performance; task assignment – putting the right people on the job in light of the job’s task demands; and prejob briefings – anticipating possible active errors and their consequences, and incorporating appropriate defenses, especially at critical steps

• Work Performance – performing work with a sense of uneasiness; maintaining situation awareness; rigorous use of human performance tools for important human actions, avoiding unsafe or at-risk work practices; supported with quality supervision and teamwork

• Work Feedback – reporting – conveying information on the quality of work preparation, related resources, and workplace conditions to supervision and management; behavior observations – workers receiving coaching and reinforcement on their performance in the field through observations by managers and supervisors

Chapter 2, Reducing Error, Re, focuses more on the fundamentals associated with anticipating, preventing, and catching human error at the job site.

Managing Defenses, Md Events always involve breaches in defenses, controls, barriers, or safeguards. As mentioned earlier, errors still occur even if the opportunities to err are systematically identified and eliminated. That is why an aggressive approach is needed to find and correct vulnerabilities with defenses. The most important aspect of this dual strategy is an aggressive and ongoing verification and


11

validation of the health of defenses. Defenses are scrutinized aggressively through ongoing self-assessments (among other methods), and then the vulnerabilities are mended using the corrective action program. Using a simple “Plan-Do-Check-Adjust” management approach, we can “manage defenses.” Defenses against human error involve four primary lines of defense—controls—all to improve station resilience to human error and related events:

• Engineered Controls – These provide the plant with the physical ability to protect itself from people’s errors. To optimize this set of controls and defenses, equipment is reliable and is kept in a configuration that is resistant to simple human error and allows plant systems and components to perform their intended functions when required. Plants with high equipment reliability, effective configuration control, and minimum human-machine vulnerabilities tend to experience fewer and less severe plant events than those that struggle with these issues. The integrity of this line of defense depends on how carefully plant equipment is designed, operated, and maintained (using human-centered approaches).

• Administrative Controls – Procedures, training, work processes, and various policies and expectations direct people’s activities so that they are predictable and safe, especially for work performed in and on the plant. All together such controls help people anticipate and prepare for problems. Written instructions specify what, when, where, and how work is to be done. The integrity of this line of defense depends on how rigorously people at all levels follow and perform work activities according to procedures, expectations, and standards.

• Cultural Controls – These are the assumptions, values, beliefs, and attitudes and related leadership practices that encourage either high standards of performance or mediocrity, open or closed communication, and high or low standards of performance. Personnel at excellent plants practice error-prevention rigorously, regardless of their perception of a task’s risk and simplicity, how routine it is, and how competent the performer. The integrity of this line of defense depends on people’s appreciation of the human hazard to safety, the respect they have for each other, and their pride in the organization and plant.

• Oversight Controls – Accountability helps verify margins, the integrity of defenses and processes, as well as the quality of performance. Performance improvement activities facilitate the accountability of line managers through structured and ongoing assessments of human performance, trending, field observations, and use of the corrective


12

action program, among others. The integrity of this line of defense depends on management’s commitment to high levels of human performance and consistent follow-through to correct problems and vulnerabilities.

Chapter 3, Managing Defenses, Md, focuses on controls and defenses and their management. Chapter 4, Culture and Leadership, emphasizes the role managers and informal leaders play in shaping the station’s safety culture.

PRINCIPLES OF HUMAN PERFORMANCE Excellence in human performance is more likely if front-line workers, support staff, and managers embrace the following underlying truths, or principles, that provide the bases for the behaviors promoted in this manual. Integrating these principles into management and leadership practices, worker practices, and the organization’s processes and values will help guide the development of a philosophy and strategy for improving human performance, as well as providing guidance for the planning and conduct of work in the plant.

1. People are fallible, and even the best people make mistakes. Human fallibility is a permanent feature of human nature. We recognize that human beings possess a wide range of capabilities as well as corresponding limitations. One shortcoming is our tendency to be imprecise—to err. Errors happens. No amount of counseling, training, or motivation can alter a person's fallibility. Therefore, considerable forethought is necessary before depending on human beings for compensatory action or as the only defense against a plant upset or personal injury. Human performance should not be solely relied on during activities critical to safety. Other more reliable defenses should be in place to back up the individual. Chapter 2, Reducing Error, Re, provides more detail on human fallibility.

2. Error-likely situations are predictable, manageable, and

preventable. Despite the certainty of human error in the long term, specific errors for particular tasks are preventable.12 Just as we can predict that a person writing a personal check at the beginning of a new year stands a good chance of incorrectly recording the previous year on the check, a similar prediction can be done in the context of work at the job site. Recognizing error traps and actively communicating these hazards to others permits us to manage situations proactively and prevent


13

errors and events. By changing the work situation to prevent, remove, or accommodate the presence of conditions that provoke error, job-site conditions (environmental and individual factors) can be managed to prevent, or at least minimize, the chance for error. Chapter 2, Reducing Error, Re, provides more detail on error-likely situations.

3. Individual behavior is influenced by organizational processes

and values. Organizations are characterized by goal-directed behavior, and producing electricity is the central business goal of any nuclear power plant. Consequently, managers develop processes and values to direct the behavior of the individuals in the organization. The organization is simply the sum of the ways work is divided into distinct jobs and then coordinated to produce electricity safely and reliably. Consequently, management is in the business of directing people's behavior. Traditionally, management of human performance has focused on the “individual error-prone or apathetic worker.”13 However, work is done within the context of the organization and the management planning and control systems, which contribute most of the root causes of human performance problems and resulting plant events.14 Chapter 3, Managing Defenses, Md, provides more detail on organization’s impact on job-site performance and defenses.

4. People achieve high levels of performance largely because of

the encouragement and reinforcement received from leaders, peers, and subordinates. The organization is perfectly tuned to get the performance it receives from the workforce. The level of safety and reliability of a plant is directly dependent on the behavior of people. All behavior, good and bad, is reinforced, whether by immediate consequences or by past experience. Most behavior is reinforced by the consequences the individual experiences when the behavior occurs.15 Human performance is a function of behavior and its results. Because behavior is influenced by its consequences, what happens to workers when they exhibit certain behaviors is an important factor in improving human performance. Chapter 4, Culture and Leadership, provides more insight on the impact of culture and reinforcement on performance.


14

5. Events can be avoided through an understanding of the reasons mistakes occur and application of the lessons learned from past events (or errors). In the past, improvement in human performance has been the outcome of corrective actions derived from an analysis of plant events and problem reports—reactive methods. Today, because there are fewer events to learn from, proactive approaches to organizational learning are needed as well. Events can be avoided reactively and proactively. Learning from our mistakes and the mistakes of others is reactive—it’s after the fact, but important for continuous improvement. Anticipating how an event or error can be prevented is proactive, and proactive methods provide a more cost-effective means of preventing events and problems from developing, which are addressed in detail in Chapter 3, Managing Defenses, Md.

PERFORMANCE OBJECTIVE AND CRITERIA (OR.3) In a practical sense, certain elements important for reliable human performance become evident when the principles are put into practice. These elements, included below, were incorporated into the new INPO Performance Objectives and Criteria (05-003) published in May 2005. The criteria were developed from previous work, including the documents Excellence in Human Performance (1997), “Human Performance Leadership Framework” (2000), NEI/INPO/EPRI Human Performance Process Benchmarking Report (2001), and industry human performance experience and best practices. These elements form a practical foundation for reliable human performance with respect to individual behaviors, job-site conditions, and related organizational factors that influence human performance in the field. The performance objective on human performance focuses on elements that cross organizational boundaries. Performance objective, OR.3, describes the expected result of an effective human performance program and its related activities from a systems perspective. Supporting criteria provide breadth and depth to the objective. The structure of OR.3 is based on the Performance Model described in Chapter 3, Managing Defenses, Md. Emphasis should be on achievement of the performance objective, rather than on the supporting criteria, because utilities may use different approaches or methods than those described in the criteria.


15

Performance Objective – Human Performance

“Station personnel select and apply appropriate human error-prevention techniques commensurate with the importance of assigned tasks to minimize the frequency and consequences [severity] of events.”16

Criteria – Organizational Factors 1. Expectations for the use and reinforcement of error-prevention tools in

all work and instructional settings are clearly established and communicated to workers and managers, including supplemental station personnel.

2. Managers establish expectations for procedure use that take into account

the complexity of the task, the skill and training of the worker, the extent of supervisory involvement, and the potential consequences of improper performance.

3. Procedures and other work documents are usable, technically accurate,

and controlled and are maintained up to date.

4. Changes in outage and on-line work plans and schedules are critically reviewed for conditions that could lead to human error or result in an undesirable impact on the plant.

5. Feedback processes, including postjob reviews and management

observations, are used to improve human performance.

6. Human performance events and trends are closely monitored, thoroughly evaluated for causes and contributors, and communicated to station personnel to increase their understanding and awareness.

7. Station processes are used effectively to reduce error-likely conditions at

the job site.


16

Criteria – Job-Site Conditions 8. Goals, roles, and responsibilities for the assigned task are discussed and

understood before work begins.

9. Assigned personnel are technically qualified for the task and are physically and mentally ready to perform the work.

10. Job-site conditions are properly established to enable qualified personnel

to accomplish work assignments successfully.

11. Job-site conditions and potential consequences are carefully evaluated to reinforce desired work behaviors, to reduce the potential for human error.

12. Work preparation and prejob briefings are conducted commensurate with

the risk of the work activity.

13. A variety of defense-in-depth measures are used at the job site, commensurate with the risk of the work activity, to reduce the probability of error, as well as to mitigate the effects of and provide for recovery from error.

Criteria – Individual Behaviors 14. Individuals demonstrate a great respect for the reactor core⎯for reactor

safety⎯in their decisions and actions and seek additional support when faced with uncertain conditions or situations not addressed by approved procedures and policies.

15. Individuals demonstrate personal integrity, have a questioning attitude,

challenge assumptions, and consider potential consequences prior to taking actions.

16. Individuals accept responsibility for their shortfalls and hold themselves

and others accountable to high standards of performance.

17. Individuals understand the error-prevention techniques, as well as the management expectations and bases for applying each technique to avoid plant events.


17

18. Individuals adhere to safety standards, follow procedures, and correct procedure deficiencies before continuing with tasks.

19. Individuals recommend improvements and willingly report problems,

near misses, error-likely situations, and safety hazards.

20. Individuals communicate freely, openly, and accurately to support each other to accomplish assigned work.

21. Individuals identify and eliminate conditions that might lead to human

error. They reinforce the use of defenses that mitigate the consequences of errors.

22. Individuals are receptive to feedback and continuously strive to improve

their knowledge, skills, and performance. They coach and provide feedback to others.

This reference manual does not prescribe how each of the criteria is to be implemented; rather it addresses the fundamentals that support them. Managers are in the best position to determine how to incorporate these elements into plant operations, in light of the principles of human performance. Because of differences in culture, customs, leadership, and resources, managers are cautioned that what works well at one station may or may not work as well at another station or even within departments of the same station.


18

REFERENCES

1 INPO, Long-Range Plan, 2005-2007, p.5. 2 Maurino, Reason, Johnston, and Lee. Beyond Aviation Human Factors, 1995. 3 Hillson and Murray. Webster. Understanding and Managing Risk Attitude. 2005, pp.17-37. 4 Gilbert. Human Competence, Engineering Worthy Performance. 1974, pp.15-19. 5 Reber. Dictionary of Psychology. 1995, 2nd ed., pp.86-87. 6 Corcoran. “Transparency,” The Firebird Forum, vol. 8, no. 7, July 2005. 7 Senders and Moray. Human Error: Cause, Prediction, and Reduction. 1991, p.20. 8 Reason. Managing the Risks of Organizational Accidents. 1998, p.142. 9 Reason. Managing the Risks of Organizational Accidents. 1998, p. 10-18. 10 Hillson and Murray-Webster. Understanding and Managing Risk Attitude. 2005, pp.17-37. 11 US Nuclear Regulatory Commission. “Review of Findings for Human Performance Contribution to

Risk in Operating Events” (NUREG/CR-6753), March 2002. 12 Center for Chemical Process Safety. Guidelines for Preventing Human Error in Process Safety.

American Institute of Chemical Engineers, 1994, pp.12-17, 103-107. 13 Reason. Managing the Risks of Organizational Accidents. 1998, p.127. 14 Demming. Out of the Crisis. 1986, p.315. 15 Daniels. Bringing Out the Best in People, 1994, pp.8-9. 16 INPO. Performance Objectives and Criteria (INPO 05-003). May 2005.


19

2 REDUCING ERROR, Re HUMAN FALLIBILITY .....................................................................................21

Common Traps of Human Nature....................................................................21 Unsafe Attitudes...............................................................................................24

Uneasiness – A Healthy Attitude.................................................................26 Slips, Lapses, Mistakes, Errors, and Violations...............................................27

Active Errors................................................................................................28 Latent Errors ................................................................................................28 Violations.....................................................................................................29

Dependency and Team Errors..........................................................................30 Equipment Dependencies ............................................................................31 Team Errors .................................................................................................31 Personal Dependencies ................................................................................34

PERFORMANCE MODES..................................................................................34 Information Processing and Attention .............................................................34 Generic Error Modeling System (GEMS)........................................................36 Skill-Based Performance..................................................................................37

Examples of Skill-Based Activities .............................................................38 Skill-Based Error Mode – Inattention..........................................................38

Rule-Based Performance..................................................................................38 Examples of Rule-Based Activities .............................................................39 Rule-Based Error Mode – Misinterpretation ...............................................40

Knowledge-Based Performance.......................................................................40 Examples of Knowledge-Based Activities ..................................................41 Knowledge-Based Error Mode – Inaccurate Mental Model ........................41 Mental Models .............................................................................................42 Assumptions ................................................................................................43 Mental Biases – Shortcuts............................................................................43 Conservative Decisions................................................................................44

ERROR-LIKELY SITUATIONS ........................................................................45 Error Precursors ...............................................................................................45 Common Error Precursors ...............................................................................46 TWIN Analysis ................................................................................................47


20

ERROR PREVENTION PRINCIPLES............................................................... 49 Positive Control ............................................................................................... 51 Clear Expectations for Human Performance Tools ......................................... 52 Critical Steps ................................................................................................... 53 Competence vs. Control .................................................................................. 55 Adaptability of Human performance Tools..................................................... 55 At-Risk Practices ............................................................................................. 55 Selecting Human Performance Tools .............................................................. 57

WORK EXECUTION ......................................................................................... 57 Work Preparation............................................................................................. 58 Work Performance........................................................................................... 58 Work Feedback................................................................................................ 59

ATTACHMENT A ERROR PRECURSORS .................................................... 60

ATTACHMENT B COMMON ERROR PRECURSOR DESCRIPTIONS ....... 62

ATTACHMENT C HUMAN PERFORMANCE TOOL .................................... 66 SELECTION GUIDE


21

HUMAN FALLIBILITY

There is always a chance of error. Humans possess an innate tendency to be imprecise—“to err is human.” Human nature comprises all mental, emotional, social, physical, and biological characteristics that define human tendencies, capabilities, and limitations. For instance, humans tend to perform poorly under high stress and time pressure. Because of human variability, the most reliable any human being can be is on the order of 99.99+ percent.1 Error is always a factor to be reckoned with in any human activity. Because of inherent fallibility, human beings are vulnerable to external working conditions that may test their limitations, such as lighting, heat, tools, coworkers, and procedures. Our vulnerability to such conditions increases our chances to err. This is especially true when people work within complex environments (such as nuclear power plants) that contain hidden flaws and weaknesses—latent conditions that can either provoke error or weaken defenses against the consequences of error. Human performance happens at the job site where workers touch plant equipment—that place where either the physical or paper plant can be changed. The physical plant comprises systems, buildings, pipes, valves, circuit breakers, and other such components that function to produce electricity or to protect the reactor core. The paper plant consists of the design bases and other documentation used to maintain control of the physical plant’s configuration. Inaccuracies in the paper plant, such as incorrect design calculations and inaccurate procedures, can lie dormant and lead to undesirable outcomes in the physical plant or even personal injury when the equipment does not function as anticipated. Not all decision-making, problem-solving, and manual actions are the result of conscious, intentional thoughts. A significant portion of mental activity occurs unconsciously.2 These common traps of human nature provide more reasons to be uneasy.

Common Traps of Human Nature Because consequential errors rarely occur, people tend to overestimate their ability to maintain control while they work. There is a general lack of appreciation of the limits of human capabilities. Whenever the limits of human capabilities are challenged, the likelihood of error increases. The following


22

characteristics of human nature, among others, are commonly encountered whenever performing tasks in a complex work environment.

• Stress – Stress is the body’s mental and physical response to a perceived threat in the environment. The important word is perceived; the perception one has about his or her ability to cope with the threat. Stress increases as familiarity with a situation decreases. It can result in panic, inhibiting the ability to effectively sense, perceive, recall, think, or act. Anxiety and fear usually follow when an individual feels unable to respond successfully. Along with anxiety and fear, memory lapses are among the first symptoms to appear. The inability to think critically or to perform physical acts with accuracy soon follows. Effective strategies for reducing the effects of stress and improving performance include good health, skills training, procedure adherence, and teamwork.

• Mental Strain Avoidance – Humans are naturally reluctant to engage in concentrated thinking, as it requires high levels of attention for extended periods. Thinking is a slow, laborious process that requires concerted effort.3 Consequently, people tend to look for familiar patterns and apply well-tried solutions to a problem. They are tempted to settle for satisfactory rather than the best solutions. Mental biases, or shortcuts, used to reduce mental effort include the following:

- assumptions – a condition taken for granted or accepted as true without verification of the facts

- habit – an unconscious pattern of behavior acquired through frequent repetition

- confirmation bias – the reluctance to abandon a current solution—to change one's mind—in light of conflicting information due to the investment of time and effort in the current solution; this bias orients the mind to “see” evidence that supports the original supposition and to ignore or rationalize away conflicting data.4

- similarity bias – the tendency to recall solutions from situations that appear similar to those that have proved useful from past experience

- frequency bias – a gamble that a frequently used solution will work; giving greater weight to information that occurs more frequently or is more recent

- availability bias – the tendency to settle on solutions or courses of action that readily come to mind and appear satisfactory; more


23

weight is placed on information that is available (even though it could be wrong).5, 6 This is related to a tendency to assign a cause-effect relationship between two events because they occur almost at the same time.7

• Inaccurate Mental Models – Humans remember information in terms of key words, phrases, and pictures. All details typically cannot be remembered. Human beings tend to minimize mental effort. Therefore, representations or simple pictures of the status of systems are inherently inaccurate because they do not contain all information, due in part to limits in our working memory.

• Limited Working Memory – This temporary, attention-demanding storeroom in our mind is used to remember new information and is actively involved during learning, storing, and recalling information.8 This mental “workbench” for problem-solving and decision-making is very forgetful. Most people can reliably remember three or four items at a time, with the upper limit being five to seven items.

• Limited Attention Resources – The limited ability to concentrate on two or more activities challenges the ability to process information to solve problems. Studies have shown that the mind can concentrate on, at most, two or three things simultaneously.9 Stress usually leads to “tunneling” or “vagabonding” effects in the ability to accurately focus on available and relevant information. Tunneling occurs when an individual focuses on only one source of information, to the exclusion of others, while vagabonding involves looking at everything without really “seeing” or understanding its meaning. Important information may be ignored or overlooked.

• Mind-Set – People tend to focus more on what they want to accomplish (goal) and less on what needs to be avoided because human beings are by nature goal-oriented. As such, people tend to “see” only what the mind expects, or wants, to see.10 The human mind seeks order, and, once established, it ignores anything outside that mental model. Information that does not readily fit that mind-set may not be noticed and vice versa, missing that which is not expected or seeing something that is not really there.11

• Difficulty Seeing One's Own Error – Individuals, especially when working alone, are susceptible to omissions. People who are too close to a task, or who are preoccupied with other tasks, may not detect abnormalities or possible hazards. People are encouraged to “focus on the task at hand.” However, this is a two-edged sword. Because of our


24

tendency for mind-set and our limited perspective, something may be missed.

• Limited Perspective – Humans cannot perceive all there is to notice. The inability of the human mind to perceive all facts pertinent to a decision challenges problem-solving. This is similar to attempting to see all the objects in a locked room through the door's keyhole. It is technically known as “bounded rationality.”12 Only parts of a problem receive one's attention, while other parts remain hidden to the individual. This limitation causes the individual to form an inaccurate mental model, or picture, of a problem and to underestimate the risk.13

• Emotional/Social Susceptibility – Anger and embarrassment adversely influence team and individual performance. Problem-solving ability, especially in a group, may be weakened by emotional obstacles. Pride, embarrassment, and the need to belong to the group may inhibit critical evaluation of proposed solutions, possibly resulting in team errors. Emotional issues distract from the task at hand. (See Team Errors later in this chapter.)

• Motivated Toward Goal Accomplishment – People want to succeed. We are naturally motivated to choose behaviors that result in achievement, comfort, convenience, efficiency, or even fun. However, an intense focus on a goal—a mind set—tends to conceal hazards, leading to inaccurate perceptions of risk.

• Fatigue – People get tired. Physical, emotional, and mental fatigue can lead to error and poor judgment. Fatigue is affected by both on-the-job demands (deadlines, the environment, and reduced staffing) and off-duty lifestyle (family relationships, diet, and sleep habits).14 Fatigue leads to impaired reasoning and decision-making, impaired vigilance and attention, slowed mental functioning and reaction time, loss of situation awareness, and temptations to take shortcuts.

Unsafe Attitudes An English language dictionary defines attitude as a state of mind, feeling, or mental disposition toward a fact, subject, or item of interest. In this case, the item of interest is human error and related workplace conditions that provoke it. Improper attitudes toward human error can be hazardous to your health—and to the plant. Hazards are threats of harm. Unsafe attitudes are developed from beliefs and assumptions about workplace hazards. Although influenced by many factors, attitudes are chosen.15 Unsafe attitudes blind people to the precursors to


25

harm (exposure to danger), and anyone can have an unsafe attitude. The unsafe attitudes described below have the potential to create danger in the workplace:

• Pride – An excessively high opinion of one's ability; arrogance. Being self-focused, pride tends to blind us to the value of what others can provide, hindering teamwork. People with foolish pride think their competence is being called into question when they are corrected about not adhering to expectations. The issue is human fallibility, not their competence. This attitude is evident when someone feels insulted and responds, “Don't tell me what to do!”

• Hero – An exaggerated sense of courage and boldness; the Admiral Farragut syndrome: “Damn the torpedoes, full speed ahead.” Usually, heroic reaction is impulsive, thinking that something has to be done fast or all is lost. This perspective is characterized by an extreme focus on a goal without consideration of hazards to avoid.

• Fatalistic – A defeatist belief that all events and situations are predetermined and inevitable and that nothing can be done to avert fate; “que será, será,” (what will be will be) or “Let the chips fall as they may.”

• Summit Fever – The zeal to finish the closer one gets to a goal. Nearness to goal accomplishment can cause individuals to disregard or not see conditions or factors important to safety; for example, an automobile driver running a red light at a busy intersection.16

• Invulnerability – A sense of immunity to error, failure, or injury. Most people do not believe they will err in the next few moments of a task; “That can’t happen to me.” Error is always a surprise when it happens. This is an outcome of the human limitation to underestimate risk.

• Pollyanna – People tend to seek order in their environment, not disorder, to fill in gaps in perception and to see wholes instead of portions.17 They tend to presume that everything is normal and correct in their immediate surroundings.18 They unconsciously believe that everything will go as planned. This is particularly true when people perform routine activities, unconsciously thinking that nothing will go wrong. This belief is characterized with quotes such as “What can go wrong?” and “It's a routine job.” This attitude promotes an inaccurate perception of risk and can lead individuals to ignore unusual situations or hazards, potentially causing them to react either too late or not at all (related to complacency).19


26

• Bald Tire – A belief that past performance is justification for not changing (improving) existing practices or conditions: “I've got 60,000 miles on this set of tires and haven't had a flat yet.” A history of success can promote complacency. Evidence of this attitude is characterized with quotes such as “We haven't had any problems in the past.” and “We've always done it this way.”

Awareness of the presence of attitudes such as those above is a healthy first step toward improving work planning, procedure development, and the application of human performance tools.

Uneasiness – A Healthy Attitude Human beings judge risk poorly, typically underestimating it. Subconsciously, each of us decides what to be afraid of and how much to be afraid. Most people think of risk in terms of likelihood, without fully considering the possible consequences of their actions. Our risk perception tends to be guided more by our hearts than our heads. As human beings, we consider the factors listed below, consciously or subconsciously, in varying degrees when assessing the personal risk of doing something potentially unacceptable to authority.20 People are less afraid of risks or situations:

• when they believe they are in control of the situation • that provide some benefit(s) they want • the more they know about and live with the hazard • they choose to take than those imposed on them • that are routine, in contrast to those that are new or novel • that come from people, places, or organizations they trust • when they are unaware of the hazard(s) • that are natural, versus those that are man-made • that affect others

What feels safe may, in fact, be dangerous. In light of the limitations of human nature, people should possess a keen sense of uneasiness during any activity, whether it involves managing, operating, maintaining, or engineering.21 Because of human fallibility, it is easy to err, and the person may not even know it. Appreciating human fallibility encourages a person to adopt a proactive attitude toward work and possess an nagging doubt


27

that the current job situation may be hiding something.22 Uneasiness is an attitude of apprehension regarding one’s capacity to err when working. Uneasiness prompts a person to expect success but anticipate failure and will foster an intolerance for uncertainty and error traps. Through practice, people become intolerant of working conditions that provoke error.

Slips, Lapses, Mistakes, Errors, and Violations People do not err intentionally. Error is a human action that unintentionally departs from an expected behavior.23 Expected behavior is typically specified by management using procedures. Error is a behavior, without malice or forethought, not a result. Errors usually develop from either incomplete information or assumptions, involving difficulties with the mental processing of task- or work-related information, not motivation. Human error is provoked by a mismatch between human limitations and environmental conditions at the job site, including inappropriate management and leadership practices, and organizational weaknesses that set up the conditions for performance. While slips occur when the physical action fails to achieve the immediate objective, lapses involve a failure of one’s memory or recall. Such errors are usually the result of inattention. Slips and lapses can be classified by type of behavior when it occurs with respect to physical manipulation of plant equipment.24 The following categories describe how an incorrect or erroneous action can physically manifest itself or ways an action can go wrong:

• timing - too early, too late, omission • duration - too long, too short • sequence - reversal, repetition, intrusion • object - wrong action on correct object, correct action on wrong object • force - too much, too little • direction - incorrect direction • speed - too fast, too slow • distance - too far, too short

Mistakes, on the other hand, occur when a person employs an inadequate plan to achieve the intended outcome. Mistakes usually involve misinterpretations or lack of knowledge.25


28

Active Errors Active errors are observable, physical actions that change equipment, system, or plant state, resulting in immediate undesired consequences.26 Such actions may be acts of either omission or commission. The key characteristic that makes the error active is the immediate unfavorable result to plant equipment and/or personnel. Because they “touch” plant equipment, in most cases it is front-line workers who commit active errors. Most errors are trivial in nature, resulting in little or no consequence, and may go unnoticed. However, grievous errors may result in loss of life, disabling injury, or severe consequences to the physical plant such as forced outages and equipment damage. Active errors spawn immediate, unwanted consequences, while the unwanted consequences of latent errors are not readily apparent.

Latent Errors Latent errors result in hidden organization-related weaknesses or equipment flaws that lie dormant.27 Such errors go unnoticed at the time they occur and have no immediate apparent outcome to the plant or personnel. Latent errors include actions, directives, and decisions that either create the preconditions for error or fail to prevent, catch, or mitigate the effects of error on the physical plant. Latent errors typically manifest themselves as degradations in defense mechanisms, such as weaknesses in processes, inefficiencies, and undesirable changes in values and practices. Managers, supervisors, and technical staff, as well as front-line workers, are capable of latent errors. Inaccuracies become embedded in paper-based directives, such as procedures, policies, drawings, and design bases documentation. Workers unknowingly alter the integrity of physical plant equipment, such as by installing an incorrect gasket, mispositioning a valve, hanging a danger tag on the wrong component, and attaching an incorrect label. Usually, there is no immediate feedback that an error in judgment or an incorrect decision has been made. Similarly, engineers have performed key calculations incorrectly that slipped past subsequent reviews, invalidating the design basis for safety-related equipment. The following table summarizes the general characteristics of each kind of error.


29

Active Errors Latent Errors

Who? workers managers, engineers, workers, corporate and support staff

What? equipment paper, values, and beliefs

When? immediately later or delayed; dormant

Visible? yes no

As one can see, latent errors are more subtle and threatening than active errors, making the plant more vulnerable to events triggered by occasional active errors.

Violations Violations are characterized as the intentional (with forethought) circumvention of known rules or policy. A violation involves the deliberate departure from an expected behavior, policy, or procedure. Most violations are well intentioned, arising from a genuine desire to get a job done according to management’s wishes.28 Such actions may be acts of either omission or commission. Usually consequences are unintended; violations are rarely acts of sabotage. The deliberate decision to violate a rule is a motivational issue. The willingness to violate known rules is generally a function of the accepted practices and values of the immediate work group and its leadership and/or the individual’s character. In some cases, the individual achieved the desired results wanted by the manager, while knowingly violating expectations. Workers, supervisors, managers, engineers, and even executives can be guilty of violations. Violations are usually adopted for convenience, expedience, or comfort. Events become more likely when someone makes a mistake while disregarding a safety rule or expectation. A couple of strong situations that tempt a person to do something other than what is expected involve conflicts between goals or the occurrence of a previous mistake. The individual typically underestimates the risk, unconsciously assuming he or she will not err, especially in the next few moments. People are generally overconfident about their ability to maintain control. Research has found that the following circumstances, in order of influence, prompt a person to violate expectations:29

• low potential for detection • absence of authority in the immediate vicinity


30

• peer pressure by team or work group • emulation of role models (according to the individual concerned) • practices previously not corrected by those in authority • individual’s perception that he or she possesses the authority to change the standard • standard appears unimportant to management • unawareness of potential consequences; perceived low risk • competition with other individuals or work groups • interferences or obstacles to achieving the work goal • conflicting demands, or goals, forcing the individual to make a choice • precedent: “We've always done it this way.” (tacitly acceptable to authority)

Although violations happen from time to time, they are rare compared to the occurrence of error. And, because the nuclear industry is made up of highly professional people, this manual focuses on managing human error.

Dependency and Team Errors For defenses to be reliable, they must be independent; that is, the failure of one does not lead to the failure of another. If the strength of one barrier can be unfavorably influenced by another barrier or condition, they are said to be dependent. Dependency increases the likelihood of human error due to the person’s interaction or relationship with other seemingly independent defense mechanisms. For example, in the rail transportation industry, although a train engineer monitors railway signals during transit, automatic warning signals are built into the transportation system as a backup to the engineer. However, the engineer can become less vigilant by relying on an automatic warning signal to alert him/her to danger on the track ahead. What if the automatic signal fails as a result of improper maintenance intervals? Instead of one barrier left (an alert engineer), no barriers are left to detect a dangerous situation. There are three situations that can cause an unhealthy dependency, potentially defeating the integrity of overlapping defenses:30

• Equipment dependencies – lack of vigilance due to the assumption that hardware defenses or physical safety devices will always work

• Team errors – lack of vigilance created by the social (interpersonal) interaction between two or more people working together

• Personal dependencies – unsafe attitudes and traps of human nature leading to complacency and overconfidence


31

Dependency is similar in concept to the medical condition “co-dependency,” in which a person becomes psychologically dependent in an unhealthy way on another person, who exhibits self-destructive behavior. The first person is unable to think independently of the second person.

Equipment Dependencies When individuals believe that equipment is reliable, they may reduce their level of vigilance or even suspend monitoring of the equipment during operation. Automation, such as level and pressure controls, has the potential to produce such a dependency. Boring tasks and highly repetitive monitoring of equipment over long periods can degrade vigilance or even tempt a person to violate inspection requirements, possibly leading to the falsification of logs or related records. Monitoring tasks completed by a computer can also lead to complacency. In some cases, the worker becomes a “common mode failure” for otherwise independent plant systems, making the same error or assumption about all redundant trains of equipment or components. Diminishing people’s dependencies on equipment can be addressed by:

• applying forcing functions and interlocks • eliminating repetitive monitoring of equipment through design

modifications • alerting personnel to the failure of warning systems • staggering work activities on redundant equipment at different times, or

assigning different persons to perform the same task • diversifying types of equipment or components, thereby forcing the use

of different practices; for example, for turbine-driven and motor-driven pumps

• training people on failure modes of automatic systems and how they are detected

• informing people on equipment failure rates • minimizing the complexity of procedures, tools, instrumentation, and

controls

Team Errors Just because two or more people are performing a task does not ensure that it will be done correctly. Shortcomings in performance can be triggered by the social interaction between group members. In team situations, workers may not be


32

fully attentive to the task or action because of the influence of coworkers. A team error is a breakdown of one or more members of a work group that allows other individual members of the same group to err—due to either a mistaken perception of another’s abilities or a lack of accountability within the individual’s group. The logic diagram below illustrates the mathematical impact of such a dependency, using the example of a supervisor (or peer) checking the performance of a maintenance technician. Assuming complete independence between the technician and the supervisor, the overall likelihood for error is one in a million; the overall task reliability is 99.9999 percent. However, should the supervisor (or peer) assume the technician is competent for the task and does not closely check the technician’s work, the overall likelihood for error increases to one in a thousand, the same likelihood as that for the technician alone. Overall task reliability is now 99.9 percent. 31 System reliability is only as good as the weakest link, especially when human beings become part of the system during work activities. The perception of another’s capabilities influenced the supervisor’s decision not to check the technician’s performance—a team error.

Several socially related factors influence the interpersonal dynamics among individuals on a team. For instance, data at one nuclear station shows that operations' configuration control issues, which usually involve concurrent or independent verification, are particularly subject to the dangers of “social loafing.” 32 Because individuals are usually not held personally accountable for a group's performance, some individuals in a group may not actively participate. People refrain from becoming involved, believing that they can avoid accountability, or “loaf,” in group activities.33 Team errors are stimulated by, but are not limited to, one or more of the following social situations:


33

• Halo Effect – blind trust in the competence of specific individuals because of their experience or education—Consequently, other personnel drop their guard against error by the competent individual, and vigilance to check the respected person's actions weakens or ceases altogether.

• Pilot/Co-Pilot – reluctance of a subordinate person (co-pilot) to challenge the opinions, decisions, or actions of a senior person (pilot) because of the person’s position in a group or an organization—Subordinates may express “excessive professional courtesy” when interacting with senior managers, unwittingly accepting something the boss says without critically thinking about it or challenging the person’s actions or conclusions.34

• Free Riding – the tendency to “tag along” without actively scrutinizing the intent and actions of the person(s) doing the work or taking the initiative—The other person takes initiative to perform the task, while the free-riding individual takes a passive role in the activity.

• Groupthink – reluctance to share contradictory information with other members of the group about a problem for the sake of maintaining group harmony—This is detrimental to critical problem-solving. Highly cohesive, tight-knit groups are susceptible to this kind of team error. Usually, this is worsened by one or more dominant team members who possess considerable influence on the group's thinking (pilot/co-pilot or halo effect). Consequently, critical information known by individuals in the group may remain hidden from other team members. Groupthink can also result from too much “professional courtesy”—subordinates passing on only good news or sugar-coating bad news so as to not displease their bosses or higher-level managers.

• Risky Shift – tendency to gamble with decisions more as a group than if each group member was making the decision individually35—Accountability is diffused in a group. As the saying goes, “there is safety in numbers.” If two or more people agree together that they know a better way to do something, they will likely take the risk and disregard established procedure or policy. This has been referred to as a “herd mentality,” and, in the worst case, a riot occurs.

The following strategies tend to reduce the occurrence of team errors:

• Maintain freedom of thought from other team members. • Challenge actions and decisions of others to uncover underlying

assumptions.


34

• Train people on team errors, their causes, and intervention methods. • Participate in formal team development training. • Practice questioning attitude/situation awareness on the job and during

training. • Designate a devil's advocate for problem-solving situations. • Call “time outs” to help the team achieve a shared understanding of plant

or product status. • Perform a thorough and independent task preview before the prejob

briefing.

Personal Dependencies An unsafe personal dependency exists when an individual relies on his or her personal experience, proficiency, or qualifications to maintain control. Because past practices have not led to a problem before, the individual becomes indifferent toward the need for care and attention. Competence does not guarantee positive control. At the beginning of this chapter, “Traps of Human Nature” and “Unsafe Attitudes” were discussed regarding their impact on human fallibility. Such psychological and physiological factors can create unsafe personal dependencies and lead to error. Of particular concern is overconfidence in one’s own ability at a critical step, inhibiting the rigorous use of human performance tools. Overcoming personal dependencies usually involves:

• training that addresses the limitations of human nature • promoting a culture that supports situation awareness and a questioning

attitude • reinforcing and coaching the proper application of human performance

tools during in-field observations • improving the knowledge of risk-important equipment and critical steps

PERFORMANCE MODES

Information Processing and Attention To better anticipate and prevent error, one should understand how people process information, as illustrated. The brain is designed to transfer and process information, but sometimes it fails36 because error is a function of how the brain processes information. When people err, there is typically a fault with one or


35

more of the stages of information processing, not with one's motivation, as is the case in violations. Information processing consists of three stages:

• Sensing – visual, audible, and other means used to perceive information in one's immediate vicinity (displays, signals, spoken word, or cues from the immediate environment)—Recognition of information is critical to error-free performance.

• Thinking – mental activities involving decisions on what to do with information—This stage of information processing involves interaction between one's working memory and long-term memory (capabilities, knowledge, experiences, opinions, attitudes).

• Acting – physical human action (know-how) to change the state of a component using controls, tools, and computers, including verbal statements to inform or direct others37

A pool of shared attention resources, as shown in the illustration, enables the mind to attend to information while performing one or more tasks (such as driving a car and talking on a cellular telephone at the same time).38 How much attention is required to perform a task satisfactorily defines the mental workload for an individual, as some tasks require more attention than others, and is typically determined by the person’s familiarity with the task. 39 Knowledge, skill, and experience with a task decrease the demand for attention. However, attention at critical points in a risk-important activity can be improved by training, procedures, equipment design, and teamwork.40 Inattention to detail is commonly cited as a cause of human performance problems. Human beings cannot pay attention to everything all the time, which leads to the occasional error.41 Attention can be focused, divided, or selective. If attention is focused,

What?

When?

Where?

Error

Desired

What?

When?

Where?

Error

Desired

SharedAttentionResources

InformationFlow Path

Thinking ActingSensing


InformationFlow Path

Thinking ActingSensing





InformationFlow PathInformationFlow Path

Thinking ActingSensing ThinkingThinking ActingActingSensingSensing


36

something has to be ignored. By focusing on one thing, other items cannot be perceived. Divided attention involves paying attention to two or more sources of information on a time-share basis, similar to using a flashlight in a dark room and trying to see two different items by moving the flashlight back and forth. Divided attention can be dangerous; for example, a driver's attention is significantly distracted while using a cell phone. Studies show that drivers are four times more likely to be in an accident if using a cell phone, even “hands-free” styles. Selective attention occurs when an individual gives preference to distinct information, such as one's name in a noisy meeting room. Attention varies. Studies show that trained, experienced operators can consciously attend to a maximum of two or three channels of information (such as flow, temperature, pressure, another person) and still be effective.42 Performers may not recognize when to focus their attention, what to pay attention to, or even where to pay attention (see above illustration). A worker once stated, “We are so good at self-checking, we can do it in our sleep.” It is obvious that self-checking does not work for that person. If attention is not correctly focused, error is likely. During a game of baseball, an infielder's attention can vary considerably between pitches. For most competent players, attention becomes focused at the beginning of the pitcher's windup (when), toward the opposing batter (where), and finally, on the ball when it is hit (what). Generic Error Modeling System (GEMS) This model (flowchart) shows how humans select the level of information processing for a particular performance situation, work or play. Depending on the individual’s perception of the situation, he or she will chose a processing mode—that is, a performance mode—that seems appropriate to control the situation. Awareness of the performance mode chosen for a specific task helps a person anticipate the kind of errors that could be made and which error prevention techniques would be most effective.

None

No

Yes

No

YesNo

Yes

Subsequent Attempts

Select problem solution:

Develop corrective action. Apply toproblem situation. Observe results.

Problem-solving mode:

Recall mental model. Apply observedsymptoms and fundamental principlesto update mental model.

THEN:Apply known action.

Solved?

Is taskproceeding

OK?

Is taskproceeding

OK?

Identify availablesymptoms

IF:familiar

situation?

Identify availablesymptoms or otherfamiliar analogy

Recognizeproblemsituation

Skill-basedPerformanceRoutine actions in afamiliar situation

Rule-basedPerformancePre-packaged actionsdetermine byrecognition of familiarproblem situations

Knowledge-basedPerformanceAnalysis of unfamiliarproblem situationusing stored knowledge

Source: Reason (1990) and Rasmussen (1981)

None

No

Yes

No

YesNo

Yes

Subsequent Attempts






Solved?

Is taskproceeding

OK?

Is taskproceeding

OK?


IF:familiar

situation?







None

No

Yes

No

YesNo

Yes

None

No

Yes

No

YesNo

Yes

Subsequent Attempts






Solved?

Is taskproceeding

OK?

Is taskproceeding

OK?


IF:familiar

situation?







Subsequent Attempts






Solved?

Is taskproceeding

OK?

Is taskproceeding

OK?


IF:familiar

situation?






Subsequent Attempts






Solved?

Is taskproceeding

OK?

Is taskproceeding

OK?


IF:familiar

situation?



Subsequent Attempts





Subsequent AttemptsSubsequent Attempts



Select problem solution:Select problem solution:




Problem-solving mode:Problem-solving mode:



Solved?

Is taskproceeding

OK?

Is taskproceeding

OK?


IF:familiar

situation?




Solved?

Is taskproceeding

OK?



Solved?Solved?

Is taskproceeding

OK?

Is taskproceeding

OK?

Is taskproceeding

OK?

Is taskproceeding

OK?

Is taskproceeding

OK?


IF:familiar

situation?



Is taskproceeding

OK?

Is taskproceeding

OK?

Is taskproceeding

OK?


IF:familiar

situation?





IF:familiar

situation?

IF:familiar

situation?













37

Information processing (sensing-thinking-acting) operates in one or more of three modes: skill-based (SB), rule-based (RB), and knowledge-based (KB). The performance mode is usually a function of the familiarity an individual has with a specific task and the level of attention (information processing) a person applies to accomplish the activity. The following chart illustrates the distinctions between the three modes of performance.43 Uncertainty declines as knowledge about a situation improves (learning and practice). Consequently, familiarity (knowledge, skill, and experience) with a task will establish the level of attention or mental functions the individual chooses to perform an activity. As uncertainty increases, people tend to focus their attention to better detect critical information needed for the situation. People want to boost their understanding of a situation in order to respond correctly.44 But people tend to default to the lowest level of mental effort they perceive necessary to accomplish the task (avoidance of mental strain). As a result, information important for the situation may be missed. The level of information processing is usually dependent on the individual’s training (knowledge and skills), experience with the task (familiarity), and the frequency of performing that task (proficiency). Also, the individual may (likely) alternate between each level of information processing during any given task, regardless of its simplicity or frequency. Error modes are the prevalent ways people make mistakes—not the only way—for the particular performance mode. Error modes are generalities that aid in anticipating and managing error-likely situations aggravated by inattention, misinterpretation, and inaccurate mental models.

Skill-Based Performance Skill-based performance involves highly practiced actions in very familiar situations. They are usually executed from memory without significant conscious thought or with little attention (see chart above). Behavior is governed by preprogrammed instructions developed by either practice or experience and is less dependent on external conditions.45 The time devoted to processing the information—reaction time—is on the order of milliseconds.46 Many actions in a typical day are controlled unconsciously by human instinct, such as writing one’s

Familiarity (w/ task)Low High

High

Low

Atte

ntio

n(to

task

)

SB

KB

RBIf - Then

Auto

Patterns

Inattention

Misinterpretation

InaccurateMental Picture

Δ

?


High

Low

Atte

ntio

n(to

task

)

SB

KB

RBIf - Then

Auto

Patterns

Inattention

Misinterpretation


Δ

?


High

Low

Atte

ntio

n(to

task

)

SB

KB

RBIf - Then

Auto

Patterns

Inattention

Misinterpretation



High

Low

Atte

ntio

n(to

task

)

Familiarity (w/ task)Low HighFamiliarity (w/ task)Low HighLow High

High

Low

Atte

ntio

n(to

task

)

High

Low

High

Low

Atte

ntio

n(to

task

)

SB

KB

RBIf - Then

Auto

Patterns

Inattention

Misinterpretation


SB

KB

RBIf - Then

Auto

Patterns

SB

KB

RBIf - Then

Auto

Patterns

Inattention

Misinterpretation


ΔΔ

??


38

signature, a classic example of skill-based performance. Also, a very familiar procedure is typically performed at the skill-based level.

Examples of Skill-Based Activities Skill-based activities involve those that can be done very reliably without much conscious thought. Common examples of skill-based activities are as follows:

• manipulating valves and switches • taking logs • using a hammer or other hand tool • controlling various processes

manually • hanging a tag • swapping strainers • analyzing the chemical

composition of a sample

• performing repetitive calculations • moving control rods • using measure and test equipment • attaching test jumpers • operating a circuit breaker • walking through a fire door or opening a

cabinet door • performing a commonly used procedure

Skill-Based Error Mode – Inattention The error mode for skill-based performance is inattention. Skill-based errors are primarily execution errors, involving slips and lapses in attention or concentration. Errors involve inadvertent slips and unintentional omissions triggered by simple human variability or by not recognizing changes (note the Δ symbol on above chart) in task requirements, system response, or plant conditions related to the task. Under ideal conditions, the chance for error is less than 1 in 10,000.47 People most often possess an accurate understanding of the task and have correct intentions. Roughly 90 percent of a person’s daily activities are spent in the skill-based performance mode.48 However, only 25 percent of all errors are attributable to skill-based errors.49 Potentially, a person can be so focused on a task that important information in the workplace is not detected.50 Another concern for skill-based tasks is that people are familiar with the task. The greater the familiarity the less likely perceived risk will match actual risk. People become comfortable with risk while focused on the task at hand and eventually grow insensitive to the presence of hazards.51

Rule-Based Performance Rule-based behavior is based on the selection of stored rules derived from one's interpretation of a change in the work situation; it follows an IF (symptom X), THEN (situation Y) logic (denoted by the Δ symbol on previous chart). The


39

situation, although possibly familiar, is usually unanticipated. Problems or challenges encountered during a task usually require a different skill than originally planned to accomplish the task successfully.52 Many events have occurred because people did not recognize that the original task had changed, such as the transition from preventive maintenance to troubleshooting. The work situation changed such that the previous activity (skill) no longer applies. Therefore, the big picture in rule-based performance is to improve one's interpretation of the work situation so that the appropriate response is selected and used when required.53 Using the GEMS model above, procedures provide the user with predetermined solutions to anticipated work situations that require specific responses. Rules are necessary for those less-familiar, less-practiced work activities for which a particular person or group is not highly skilled. For instance, if the reactor scram annunciator alarms, the operator then performs the immediate actions for a reactor scram and follows the appropriate emergency procedures to guide plant stabilization and recovery. The time devoted to processing the information—reaction time—is on the order of seconds to recognize the right thing to do.54 Most rules are documented in procedures or recalled from previous training, but many rules are developed from experience (thumb rules) or from accepted group practices. Not all activities guided by a procedure are necessarily rule-based performance. In normal work situations, such activities are commonly skill-based for the experienced user.

Examples of Rule-Based Activities Rule-based activities involve decisions based on an “if-then” logic. Examples are as follows:

• deciding whether to replace a ball bearing inspected during preventive maintenance

• responding to a control board annunciator • estimating the change in tank level based on a temperature change

(thumb rules) • feeling equipment for excessive vibration or temperature on operator

rounds • performing radiological surveys • facilitating a training seminar (choosing responses to participant

statements)


40

• using emergency operating procedures • developing work packages and procedures

Rule-Based Error Mode – Misinterpretation Since rule-based activities require interpretation through use of if-then logic, the prevalent error mode is misinterpretation. People may not fully understand or detect the equipment or plant conditions that call for a particular response. Errors involve deviating from an approved procedure, applying the wrong response to a work situation, or applying the correct procedure to the wrong situation.55 For example, blocking automatic actuation of safety injection used to be an accepted rule whenever a reactor operator perceived a reactor scram as uncomplicated when, in fact, the scram was not. The chance for error increases when people make choices or decisions, especially in the field. Rule-based and knowledge-based performance modes involve making choices. With less familiarity with the activity, the chance for error increases to roughly 1 in 1,000.56 In terms of reliability, performance is still respectable (99.9 percent). In the nuclear industry, one study has shown that roughly 60 percent of all errors are rule-based.57

Knowledge-Based Performance Knowledge-based behavior is a person’s response to a totally unfamiliar situation (no skill or rule recognizable by the individual). The person relies on his or her understanding and knowledge of the system, the system's present state, and the scientific principles and fundamental theory related to the system to develop an appropriate response.58 People enter into a knowledge-based situation when they realize they are uncertain about what to do (denoted by the ? symbol on the previous chart). If uncertainty is high, the need for information becomes paramount.59 To gather information more effectively, one’s attention becomes more focused.60 Thinking takes more effort and energy, and the time devoted to processing the information—reaction time—can be on the order of minutes to hours to decide on how to address the problem.61 Not all hazards, dangers, and possible situations can be anticipated such that appropriate procedures can be developed in advance. Even training is unable to anticipate all possible scenarios that can be encountered. For some rare situations, no procedure guidance exists and no apparent skill applies. Knowledge-based situations are puzzling and unusual to the individual. In many cases, information sources contain conflicting data, too much data, or not enough


41

data, amplifying the difficulty of problem-solving. Because uncertainty is high, knowledge-based tasks are usually stressful situations. Knowledge-based performance is the riskiest performance mode when it comes to the likelihood of error.62 When encountering an unfamiliar situation, people tend to make assumptions to ease their mental workload. Consequently, they tend to generate solutions using rules they find similar to the present situation. Such solutions are often based on insufficient information. As time to respond to a knowledge-based situation decreases, the chance for error increases. The chance for error is highest when an unfamiliar situation (especially involving physical danger) strikes suddenly and requires quick reaction.63 Because of the limitations of human nature and an incomplete knowledge of the situation, error is almost inevitable. Therefore, all attempts should be made to change the work situation or buy time so that the individual (or team) can perform in either the rule-based or skill-based performance modes.

Examples of Knowledge-Based Activities Knowledge-based activities involve problem-solving and related mental search routines. Such situations usually require “thinking on your feet.” Common knowledge-based performance situations include the following:

• troubleshooting • performing an engineering evaluation • reviewing a procedure for “intent of

change” • resolving conflicting control board

indications • responding to an unknown plant

transient • holding meetings to address problems

• resolving human performance problems

• planning business strategies, goals, and objectives

• performing root cause analyses of events

• conducting trend analyses • designing equipment modifications • making budget allocation decisions • revising policies and expectations

Knowledge-Based Error Mode – Inaccurate Mental Model Knowledge-based activities require diagnosis and problem-solving. Decision-making is erroneous if problem-solving is based on inaccurate information. Most decisions are made with limited information and assumptions. Consequently, the prevalent error mode is an inaccurate mental model of the system, process, or situation. The chance for error is particularly high, approximately 1 in 2


42

(50 percent) to 1 in 10.64 In the nuclear industry, one study has shown that roughly 15 percent of all errors are knowledge-based.65 Front-line workers (operators and technicians) spend most of their working hours in the skill-based and rule-based performance modes because of the prescriptive nature of their jobs. On the other hand, managers, supervisors, engineers, and other “knowledge workers” spend most of their time in rule-based and knowledge-based performance modes because of the discretionary character of their jobs. Knowledge workers spend a great deal of time solving problems and making judgments and decisions. Obviously, people in these positions need to apply appropriate human performance tools to their jobs just as those who manipulate plant equipment.

Mental Models A person handles a complex situation by simplifying the real system into a mental image he/she can remember (such as a simple one-line drawing). A mental model is the structured understanding of knowledge (facts or assumptions) a person has in his or her mind about how something works or

operates (for example, plant systems).66,67 Mental models are used in all performance modes. In fact, mental models give humans the ability to detect skill-based slips and lapses. They aid in detecting deviations between desired and undesired system states, such as manually controlling tank water level.68 Fundamentally, a mental model is an internalized picture or map of a system or situation that organizes knowledge about the following:

• what a system contains • how components work as a system • why it works that way • current state of a system • fundamental laws of nature

An individual’s mental model may reflect 1) the true state of the system, 2) a perceived state of the system, or 3) the expected state of the system and is developed through training and experience with the system and recent interactions with the system. Note that all mental models are inaccurate to some extent69 because of the limitations of human nature. It is important to remember that knowledge-based performance involves problem-solving, and mental models should be considered explicitly when a team works on a problem.70 Team members should agree with the model they intend to use to diagnose and solve a problem. Otherwise, misunderstandings and


43

assumptions may occur. Frequent time-outs can help teams keep mental models up to date.

Assumptions Knowledge-based situations can be stressful, anxious situations. Assumptions reduce the strain on the mind, allowing a person to think without excessive effort. Consequently, assumptions tend to occur more often, when people experience uncertainty, leading to trial-and-error problem-solving approaches. Assumptions also occur as an outgrowth of unsafe attitudes and inaccurate mental models. Statements such as “I think ...,” “We've always …,” or “I believe ...” are hints that an assumption has been or is being made. These phrases are known as “danger words” at some stations. Inaccurate mental models, in turn, can promote erroneous assumptions that may lead to errors. Often, assumptions are treated as fact. Challenging assumptions is important in improving mental models, solving problems, and optimizing team performance. Assigning a devil’s advocate in a critical problem-solving situation may be worthwhile to achieve a better solution. Also, challenging assumptions helps detect unsafe attitudes and inaccurate mental models. A devil’s advocate can challenge assumptions using the following process:71

• Identify conclusion(s) being made by another person or yourself. • Ask for or identify the data that leads to the conclusion(s). “How did

you get that data?” “What is the source of your concern?” • Ask for the reasoning (mental model) that connects the data with the

conclusion. “Do you mean…?” “Why do you feel that way?” • Infer possible beliefs or assumptions. • Test the assumption with the other person. “What I hear you saying is…”

Mental Biases – Shortcuts Humans tend to seek order in an ambiguous situation and to seek patterns they recognize. Mental biases, or mental shortcuts, offer the human mind several unconscious methods to create order and simplicity amid uncertainty, reducing mental effort.72 Personnel should be aware of the potential for error this creates during problem-solving and decision-making, such as troubleshooting and diagnostics during emergency operation. In some form or another, all humans use mental biases. Biases were discussed earlier in this chapter with respect to the limitations of human nature and include the following:


44

• confirmation bias • similarity bias • frequency bias • availability bias.

Conservative Decisions To be conservative means to be cautious and protective of what is truly important—safety and reliability. It is an attitude that nuclear and personnel safety must be protected regardless of current schedule and production pressures. The following statement in the foreword of the Principles for Enhancing Professionalism of Nuclear Personnel (1989) expresses this attitude clearly:

“The nuclear professional is thoroughly imbued with a great respect and sense of responsibility for the reactor core—for reactor safety —and all his decisions and actions take this unique and grave responsibility into account.”

In light of the limitations of human nature, it makes sense to be conservative, especially when a decision potentially affects nuclear or personnel safety. Who knows what information is missing, or what data was not considered? Obviously, a systematic, team-based approach is called for. Safety considerations are not compromised. In several INPO documents related to conservative decision-making, the following factors are repeatedly mentioned as important to success in making conservative decisions:

• Recognize conditions that could challenge safety and reliability. • Place plant structures, systems, and components in a known safe condition when uncertain. • Seek prompt assistance from persons with relevant expertise. • Avoid hasty decisions and hurried actions. • Assign roles and responsibilities. • Explore and evaluate alternatives rigorously, asking challenging questions to confirm

technical assumptions. • Understand the potential consequences to safety and reliability of various alternatives. • Adopt a deliberate and carefully controlled approach. • Make a deliberate decision, providing clear direction, roles and responsibilities,

contingencies, and abort criteria. • Do not proceed in the face of uncertainty.

The reader is encouraged to review INPO’s Principles for Effective Operational Decision-Making (December 2001) for more details on this subject.


45

ERROR-LIKELY SITUATIONS

A work situation in which there is greater chance for error when performing a specific action or task due to the presence of error precursors.73

The job site is that location where people can “touch” and alter physical plant equipment. Because of innate fallibility, human beings are vulnerable to their working conditions, which could provoke errors. Consequently, plant equipment is vulnerable to the errors of front-line workers when they touch the equipment. The risk [to the plant] is in people.74 External conditions (to the individual) that can provoke error at the job site are a key concern for successful performance. Such job-site conditions create error-likely situations when work is performed. An error-likely situation—an error about to happen—typically exists when task-related environmental factors exceed the capabilities and limitations of the individual (a mismatch) at the point of performing work on the physical plant.75 Notice the words action or task in the definition. The simple presence of adverse conditions cannot be error-likely unless a specific action is about to occur within that set of adverse conditions. A person cannot fall off a bicycle unless he or she rides the bicycle. Darkness is not a factor for performance until an instrument technician attempts to read a label on an instrument in the dark. Error-likely situations are also referred to as error traps.

Error Precursors Unfavorable conditions embedded in the job site that create mismatches between a task and the individual are known as error precursors. This phrase should not be confused with “precursor events,” such as near misses or minor events. Error precursors interfere with successful performance and increase the probability for error for the individual.76 Undesirable job-site conditions can be categorized into one or more of the following four categories:77

• Task Demands – specific mental, physical, and team requirements to perform an activity that may either exceed the capabilities or challenge

Degree of mismatch due toerror precursors

Error likely Situation

unintentionaldeviation frompreferred behavior

Job-site Conditions• environment• individual


Error likely Situation




Error likely SituationError likely Situation






46

the limitations of human nature of the individual assigned to the task; for example, excessive workload, hurrying, concurrent actions, unclear roles and responsibilities, and vague standards

• Work Environment – general influences of the workplace, organizational, and cultural conditions that affect individual behavior; for example, distractions, awkward equipment layout, complex procedures, at-risk norms and values, and cavalier work group attitudes toward various hazards

• Individual Capabilities – unique mental, physical, and emotional characteristics of a particular person that fail to match the demands of the specific task; for example, unfamiliarity with the task, unsafe attitudes, lack of education, lack of knowledge, unpracticed skills, unsociability, inexperience, health and fitness problems, poor communication practices, and low self-esteem

• Human Nature – generic traits, dispositions, and limitations common to all human beings that may incline individuals to err under unfavorable conditions; for example, habit, short-term memory, fatigue, stress, complacency, and mental shortcuts

When relevant error precursors are addressed to reduce a mismatch, the risk for error is minimized; but a chance for error always remains simply because of human nature. Contamination in radiological controlled areas is controlled to minimize the risk of being contaminated. Similar to the ALARA (as low as reasonably achievable) concept, error precursors can be minimized to reduce the chances of error. Most error precursors are outcomes of latent organizational weaknesses (see Anatomy of an Event in Chapter 1) and can be corrected by addressing the respective processes, programs, values, and so forth. As such conditions are minimized, the error rate should drop, resulting in a lower frequency of events.

Common Error Precursors Conditions at the job site that can provoke error are not mysterious and obscure. They are noticeable, if people look for them. The error precursors listed below were compiled from a study of INPO's event database as well as several reputable sources on human performance, ergonomics, and human factors. Error precursors are, by definition, prerequisite conditions for error and, therefore, exist before the error occurs. Job-site conditions can be changed proactively to minimize the chance of error. This is more likely if people possess


47

an intolerant attitude toward error traps. For example, knowing that drugs and alcohol impair one's ability to drive an automobile safely, an individual chooses not to drink or take drugs, even prescription drugs, before or while driving. Many conditions can provoke error. The error precursors listed below appear to be the more common conditions associated with events triggered by human error.

Task Demands Individual Capabilities

• Time pressure (in a hurry) • Unfamiliarity with task/first time

• High workload (large memory) • Lack of knowledge (faulty mental model)

• Simultaneous, multiple actions • New techniques not used before

• Repetitive actions/monotony • Imprecise communication habits

• Irreversible actionsα • Lack of proficiency/inexperience

• Interpretation requirements • Indistinct problem-solving skills

• Unclear goals, roles, or responsibilities • Unsafe attitudes

• Lack of or unclear standards • Illness or fatigue; general poor health

Work Environment Human Nature

• Distractions/interruptions • Stress

• Changes/departure from routine • Habit patterns

• Confusing displays or controls • Assumptions

• Work-arounds/OOSβ instrumentation • Complacency/overconfidence

• Hidden system/equipment response • Mind-set (intentions)

• Unexpected equipment conditions • Inaccurate risk perception

• Lack of alternative indication • Mental shortcuts or biases

• Personality conflict • Limited short-term memory αIrreversible actions are not necessarily precursors to error but are often overlooked, leading to preventable events. This item is included in this list because of its importance. βOOS - out of service

A table describing the above conditions (Common Error Precursor Descriptions), along with a more extensive list of error precursors (Error Precursors), is provided at the end of this chapter. Managers are encouraged to adapt the list to more closely reflect the prevailing job-site conditions experienced by specific work groups.

TWIN Analysis Understanding error precursors provides insight into the potential for error for a specific task. TWIN is a memory aid that stands for task demands, work environment, individual capabilities, and human nature. Remember, by


48

themselves, error precursors do not define an error-likely situation. A human act or task must be either planned or occurring concurrent with error precursors to be considered error-likely. When recognized, attempts to remove or alter the error precursor or to put in place relevant countermeasures or defenses help the performer maintain positive control. This is especially important for critical steps. Several examples of error-likely situations are provided below. For each example, notice the bolded action. TWIN analysis is ineffective without consideration of the specific action, which is usually a step in the specified procedure or work package. Error: Writing the wrong year on personal checks at the beginning of a new year

• Change – new year • Repetitive task – write several checks

Error Precursors:

• Habit – written previous year numerous times during the previous year

Error: Turning the charging pump switch instead of the dilution valve switch

• Identical switches – both pistol-grip style • Adjacent – both pistol-grip controls very

close together • Interruption – acknowledging the

occurrence of several annunciator alarms just before starting dilution

Error Precursors:

• Repetitive task – done several times during shift while performing a plant startup


49

Error: Isolating the wrong flow transmitter during a calibration of several instruments while one is in test

• Poor lighting – incandescent lights casting shadows

• Repetitive task – several transmitters calibrated previously

• Random placement of transmitters – components not located together in sequential order

Error Precursors:

• Small lettering (black-on-gray) – difficult to read unless person is positioned directly in front of label plate

As indicated above, hundreds of factors can affect performance. Considering the number and variety of factors involved with a specific job, many things can change, even with simple, repetitive tasks. Consequently, no work should be considered routine. When people believe a job is routine, they subconsciously think that “nothing can go wrong,” expecting only success, leading to complacency and overconfidence. Then, when something does go wrong, people tend to rationalize the situation away, inhibiting proper response in time to avert the consequences.78 Most events originate during routine activities.

ERROR PREVENTION PRINCIPLES

There are two ways to prevent human error from disturbing the plant or harming other important assets: either keep people from making errors (error prevention) or prevent the errors from harming the plant (defenses). The design of plant systems, structures, and components aids in performing the latter through engineered controls such as physical barriers, interlocks, keyed parts, shaped/color-coded controls, automation, and alarms. However, the prevention of errors generally depends more on people, either the performer or other people. For example, self-checking and procedures provide individuals with the means of avoiding mistakes, while peer-checking and three-way communication engage another person. Human performance tools are designed to help people anticipate prevent, and catch active errors. Methods of controlling latent errors are designed more to catch them than to prevent them because, by definition, people are usually unaware when latent errors occur.


50

Individuals who performs physical work on plant equipment, having direct contact (touching) with equipment, and capable of altering its condition, characterize most workers. INPO 06-002, Human Performance Tools for Workers, describes the following 16 human performance tools, which focus primarily on anticipating, preventing, and catching active errors: Fundamental Human Performance Tools

• Situation Awareness - Task Preview - Job-Site Review - Questioning Attitude - Stop When Unsure

• Self-Checking • Procedure Use And Adherence • Effective Communication

- Three-Way Communication - Phonetic Alphabet

Conditional Human Performance Tools • Prejob Briefing • Verification Practices

- Concurrent Verification - Independent Verification - Peer-Checking

• Flagging • Placekeeping • Turnover • Post-Job Review

INPO 05-002, Human Performance Tools for Engineers and Other Knowledge Workers, describes the following 15 human performance methods, which focus more on preventing and catching latent errors:

• project planning • vendor oversight • technical task prejob briefing • self-checking • questioning attitude • validate assumptions • do not disturb sign • peer review

• problem-solving • decision-making • signature • turnover • product review meeting • technical task postjob review • work product review

The word tool applies broadly to devices used to facilitate the performance of work. More specifically, it usually denotes a small, manually operated device used to carry out one’s occupation or profession. Human performance tools are a set of discrete behaviors to aid personnel in performing their activities without error. They provide workers with “off-the-shelf,” informal methods to help them anticipate, prevent, or catch errors before they cause harm to person, plant, or property. Most human performance tools were derived from the observed


51

practices of high-performing workers across the industry—people known to regularly perform their work error-free and with a high degree of quality. The human performance tools are not addressed in this manual but are described in detail in the respective documents. Each tool is describe as follows:

• Background – practical information as to the tool’s purpose and potential limitations • When to Use the Tool – cues as to when the tools could be used • Commonly Accepted Practice – behaviors generally used to apply the tool properly • At-Risk Practices to Consider Avoiding – a set of behaviors, beliefs, assumptions, or

situations that tend to diminish the effectiveness of the tool The proper use of these tools means nothing to safety if the worker does not possess a solid foundation in the technical fundamentals of the equipment, systems, and processes he or she works with. Nothing is always as it seems. Plant equipment, work processes, the organization and its culture, and its oversight processes all contain hidden flaws or latent conditions that could harm person, plant, or property if work is done without thinking. Safety is not obtained by the mindless use of human performance tools, but by people conscientiously using their knowledge, skills, insights, and the tools to accomplish their work goals.

Positive Control The fundamental purpose of human performance tools is to help the worker maintain positive control of a work situation—that is, what is intended to happen is what happens, and that is all that happens. This is another way of saying, “Do the job right the first time.” Every person wants to do good work, to be 100 percent accurate, 100 percent complete, and meet 100 percent of the requirements. However, error is a normal characteristic of being human. Regardless of one’s intention to do a job well, errors and defects still occur because of the inherent fallibility and variability of all human beings. On occasion, people still err despite how rigorously they use human performance tools. Not all hands-on activities require the use of a human performance tool, because the possibility of error may be remote or the effect of an error may not be important to safety or reliability. Some tools are more suitable for certain work situations and unsuitable for others. However, more is not always better. Overuse of a technique can lead to mechanical, unthinking performance, without


52

full attention or comprehension by the performer. Regardless of how often a tool is used, performers cannot afford to relax their attentiveness to the task of error prevention, especially when the risk of error is high.

Clear Expectations for Human Performance Tools Developing clear expectations for error prevention and other work practices requires an obvious understanding of what is desired. Expectations for error prevention must specify what behaviors are required and when those behaviors are to be used. Expectations explicitly define acceptable and unacceptable (at-risk or unsafe) behaviors. With the involvement of front-line workers, managers can identify at-risk/unsafe behaviors that are unacceptable as well as human performance tools that workers would readily accept, reinforce, and correct. Many expectations are consolidated in department “Conduct of …” administrative procedures. The standards for human performance tools are well defined in terms of behavior. Good expectations satisfy the following attributes.79

• Specific – The behavior or action is countable; measurable. • Observable – The behavior is visible to anyone when it occurs. • Objective – Two or more independent observers detect the same behavior. • Doable – The performer is able to carry out the behavior in the field. • Active – The behavior satisfies the “dead man rule,” which means that if a dead person could

do it, it is NOT a behavior. 80 To anticipate, prevent, and catch errors, performers must use the tools competently, thoughtfully, and rigorously. Therefore, performers need to know and understand the human performance tools and their respective behavior standards, possess the skills to use them, and use them rigorously. The quality of a person’s performance depends on the care each person applies to the task. Similarly, if managers, especially first-line supervisors, are going to coach and correct workers effectively on the proper use of human performance tools during in-field observations, they too must know the expectations and standards—be able to explain and model each tool. For this reason, managers perhaps need to know the human performance tools better than the workforce.


53

Critical Steps A critical step is a procedure step, series of steps, or action that, if performed improperly, will cause irreversible harm to plant equipment, people or significantly impact plant operation. A typical work activity may contain one or two critical steps. Many activities do not have a critical step. Not all steps of a procedure are equally important. Some actions are more important from a risk perspective. Some human actions by operators have been identified as “risk important” and specifically identified in the plant safety analysis report. Alterations of safety-related structures, systems, or components receive higher priority. Some steps are irreversible—that is, once the action is taken, the reverse action cannot be taken to recover, such as when the reactor scram switch is actuated inadvertently. Some steps become critical because human contact with a risk-important component is frequent, meaning there are more chances for error. Some steps may be critical only during transient or steady-state conditions. Some actions considered “skill-of-the-craft,” which are not proceduralized, may be critical. A graded, risk-based approach helps assign controls to human activities proportionate with the risk or potential consequences of error. Graded approaches assess the human activity’s potential impact on personal, nuclear, radiological, plant, and environmental safety. SAFER is one such graded approach that can be used during work preparation:

1. Summarize the critical steps. 2. Anticipate errors for each critical step and relevant error precursors. 3. Foresee probable and worst-case consequences should an error occur

during each critical step. 4. Evaluate controls or contingencies at each critical step to prevent, catch,

and recover from errors and to reduce their consequences. 5. Review previous experience and lessons learned relevant to the specific

task and critical steps. See the task preview tool in INPO 06-002, Human Performance Tools for Workers, for details about the background of SAFER.


Identifying a critical step involves consideration of three risk factors:81

• the significance of the potential harm • the irreversibility of the action and its potential harm • the immediacy of the potential harm (if critical step is defined in terms of immediacy)

Harm is usually defined by the managers of the particular organization. The significance of the harm is typically characterized by the severity of the consequences suffered by one or more of the following:

• nuclear safety (margin of integrity of the reactor core) • industrial safety (death or disabling injury) • radiological safety (serious overexposure to radiation) • environmental safety (uncontrolled off-site releases of hazardous substances) • plant safety (damage to nonsafety-related plant equipment or facilities) • generation (impact on the reliable production of electricity)

An action is considered irreversible if it would be impossible to reverse the results of the action. It may be possible to reverse the action, but not the results. For instance, once an operator selects “close” on a valve selector switch in the residual heat removal (RHR) system, the demand signal is locked in until the valve is fully closed. Selecting “open” on the selector switch has no effect while the valve is closing. There is no “undo” button to push once the action is taken. The consequences suffered may be recoverable, but usually at a substantial cost. Most critical steps involve immediate consequences upon occurrence of the initiating action, whether in error or violation. Typically, there is no delay between action and outcome; there is not enough time between the error and its consequences for people to intervene. The final action of a series of related procedure steps (for example, lining up an instrument for testing) may be considered critical. In such cases, concurrent verification is the human performance tool of choice. But, in some cases, such as after mechanical maintenance or an engineering modification, harm would not be realized until restoration of equipment to operational status. Determination of critical steps would have to be evaluated in light of the specific consequences to be avoided and the actions that could lead to those specific consequences, which is in essence the purpose of the SAFER process.

54


55

Competence vs. Control82 Any person in any position in an organization can err. Therefore, controls (defenses and human performance techniques) are adopted to prevent or catch error. The purpose of these controls is to make the job or task go smoothly, properly, and according to high standards.83 Remember, positive control means that ”what is intended to happen is what happens, and that is all that happens.” Some people may be insulted when others check their work. When people are directed to check or review another person's performance, the competence of the performer is not being called into question, as some may think. Controls are necessary because of human fallibility, not incompetence. The fact that a person is assigned a task means he or she is considered competent, or qualified, to perform the activity. Human nature is the problem, and controls are needed to reduce the chances for human error. The consistent and rigorous use of human performance tools depends on the performer possessing an attitude that respects human fallibility.

Adaptability of Human performance Tools Every task or work situation is different. Supervisors are encouraged to adapt the tools to specific work situations or task demands to avoid specific errors—to retain positive control at critical steps. Most human performance tools were conceived within the context of “normal” (nonemergency) work situations. Managers are encouraged to define equipment and related work situations that require the use of specific human performance tools, define specific methods for performing the tools, and train people in those unique situations commonly encountered and the adapted error-prevention methods. Specific adaptations will vary with the type of work, the work situation, and the type of component, such as manual valves, motor/air/solenoid-operated valves, removable links and fuses, circuit breakers, electrical leads, potentiometers, and throttle valves. For example, adjustments to the concurrent verification behavior standard are necessary when a component inside an instrument cubicle needs to be located and only one person can view the component at one time. Adaptations should still meet the intent of the particular human performance tool.

At-Risk Practices At-risk behaviors are actions that involve shortcuts, that violate error-prevention expectations, or that are intended to improve efficient performance of a task, usually at some expense of safety. At-risk practices involve a move from safety


56

toward danger. Most at-risk practices are error precursors. These acts have a higher probability, or potential, of a bad outcome. This does not mean such actions are “dangerous” or that they should never be performed. However, the worker and management should be aware of at-risk practices that occur, under what circumstances, and on which systems. At-risk behavior usually involves taking the path of least effort and is rarely penalized with a plant event, a personal injury, or even correction from peers or a supervisor. Instead, it may be consistently reinforced with convenience, comfort, time savings, and, in rare cases, with fun.84 Examples of at-risk behaviors are as follows:

• performing two manipulations, one with each hand, simultaneously • performing a task using two or more procedures • hurrying through an activity • following procedures cookbook-style (blind compliance) • removing several danger tags quickly without annotating removal on the clearance sheet • reading a document while controlling an unstable system in manual • not following a procedure when a task is perceived to be routine • attempting to lift too much weight to reduce the number of trips • listening to someone on the telephone and someone else standing nearby • using a “reader-doer” process during a critical step • signing off several steps of a procedure before performing the actions • working in an adverse physical environment without proper protection (such as working on

energized equipment near standing water—progress would be slowed to clean up the water or to get a rubber floor mat).

Automatic responses, or skill, are learned through practice and experience. Persistent use of at-risk behaviors unconsciously builds overconfidence and trust in personal skills and ability. This is dangerous, because people presume they will not err. Without correction, at-risk behaviors can become automatic (skill-based), such as rolling through stop signs at residential intersections. Over the long term, people will begin to underestimate the risk of hazards and the possibility of error at the job site and will consider danger (or error) more remote.85 People will become so used to the practice that, under the right circumstances, an event occurs. Managers and supervisors must provide specific feedback to the performer when at-risk practices are observed. People are more likely to avoid an at-risk practice if they know it is unacceptable. Also, peer coaching is becoming a more popular expectation for the workforce at excellent-performing stations. Preferably, peers


57

correct peers. Otherwise, without coaching and correction, uneasiness toward equipment manipulations and intolerance of error traps tend to wane. High-quality procedures also minimize at-risk practices. Poorly conceived written procedures, including work packages, prompt users to be creative in accomplishing the intent of the procedure.86 When work planning and scheduling are weak, workers compensate by adopting at-risk practices to get the job done. Problems such as poor access to the work site and lack of or inadequate tools or equipment may also provoke at-risk practices or even violations.

Selecting Human Performance Tools Attachment C, Human Performance Tool Selection Guide, shows a high-level diagram that can be used during the work preparation stage to choose the most appropriate tool for a given situation. The criteria used to select a particular tool depend on an action step’s risk, complexity, and other factors relevant to the physical component to be acted on. Procedure writers, work planners, and supervisors can use the diagram, using factors relevant to the task, to help identify the human performance tool most appropriate for a specific action. Additionally, understanding the context of a risk-important step can help supervisors take into account unique factors of individual worker(s) when assigning work. In some cases, the supervisor and the workers may realize that specific adaptations to a tool are necessary, given the physical constraints of the step. Field use of the selection guide is discouraged because the diagram is general in nature and it would tend to distract personnel from their primary task.

WORK EXECUTION

Work execution provides the framework in which to consider the best use of human performance tools, because work offers the occasions for people to physically touch plant equipment. The context of work preparation includes situations in which work has been assigned to a work unit or crew and is scheduled to be accomplished. The focus of human performance planning is to anticipate, prevent, and catch active errors at points in work activities that involve direct contact with plant equipment. Work execution involves three phases: work preparation, work performance, and work feedback.


58

Work Preparation From a human performance perspective, work is organized to anticipate, prevent, or catch human error. In particular, this phase of work execution aims to help the assigned field worker maintain positive control of specific actions important for task success, especially critical steps. Work preparation activities involve planning, walkdown, task assignment, and the prejob briefing, which are described below.

• Work planning – identifying the risks of error and of potential events and minimizing them, especially at critical steps, during work review and preparation

• Walkdown – physically visiting and inspecting the job site, in light of the proposed work objectives, to assess the impact of environmental conditions on human performance

• Task assignment – assigning the right person to the job relevant to the risk, complexity, and the individual’s level of proficiency with the task

• Prejob briefing – having a thoughtful conversation—a dialogue among all participants—about what is to be accomplished and what is to be avoided regarding a specific task before performing it; identifying additional controls, contingencies, compensatory actions, and abort criteria

Work Performance Work performance comprises all those activities involving close, physical contact with plant equipment where the risk of human error is greatest—the job site. The touching of plant equipment makes the plant vulnerable to human error. Active errors, in particular, can trigger plant events. Minimizing the occurrence of active errors at the job site, which will help reduce the frequency of events, involves healthy attitudes toward the risks involved, situation awareness, the rigorous use of human performance tools, and effective teamwork and supervision.

• Healthy attitudes – uneasiness and wariness toward the potential for human error and its effects on safety and reliability

• Situation awareness – the accuracy of a person’s understanding of the work situation, including plant and equipment conditions and the task at hand, compared to actual conditions


59

• Rigorous use of human performance tools – care taken to maintain positive control of one’s actions in light of their potential impact on safety and reliability

• Teamwork – a spirit of cooperation, mutual respect, honesty, and fairness among supervisors and coworkers that promotes interdependence and open communication

• Supervision – healthy relationships and in-field oversight of work performance that offer opportunities for reinforcement of proper work practices and coaching and correcting of improper, at-risk, or unsafe behaviors. (See INPO 04-003, Guidelines for Effective Nuclear Supervisor Performance (Preliminary).)

Work Feedback Safety and human performance are dynamic, and managers need valid and up-to-date information about what is going on in the plant in order to make appropriate improvements. To manage human performance effectively, the organization’s managers must understand the threats, hazards, and workplace deficiencies that assigned workers face in the plant. Work feedback provides opportunities to improve not only the procedures, work structure, and related work plans, but also presents occasions to improve the performance of personnel involved in the work activity. Feedback from the field depends on the quality of field observations by managers and reports from workers.

• Reporting – feedback from workers that provides managers with a relevant and fresh source of information about task-specific conditions, procedures, resources, coordination, incentives, and disincentives

• Field observations – the opportunity to acquire firsthand information about the effectiveness of work planning and to better understand worker challenges, concerns, readiness, and actual performance

INPO 06-002, Human Performance Tools for Workers, May 2006, provides specific guidance on the bases and practice of postjob reviews.


60

ATTACHMENT A ERROR PRECURSORS

The conditions listed below were derived from an in-depth study of INPO’s event database and several highly regarded technical references on the topic of human error. Many references refer to error precursors as behavior-shaping factors or performance-shaping factors. The bolded error precursors are more common and are listed in order of influence. Other error precursors are not listed in any particular order.

Task Demands Individual Capabilities 1. Time pressure (in a hurry) 1. Unfamiliar with task/first time 2. High workload (memory requirements) 2. Lack of knowledge (faulty mental model) 3. Simultaneous, multiple tasks 3. New technique not used before 4. Repetitive actions/monotony 4. Imprecise communication habits

5. Irreversible actsα 5. Lack of proficiency/inexperience

6. Interpretation requirements 6. Indistinct problem-solving skills 7. Unclear goals, roles, or responsibilities 7. Unsafe attitudes for critical task 8. Lack of or unclear standards 8. Inappropriate values 9. Confusing procedure/vague guidance 9. Poor manual dexterity 10. Excessive communication requirements 10. Low self-esteem; moody 11. Delays; idle time 11. Questionable ethics (willingness to bend the

rules) 12. Complexity/high information flow 12. Sense of control/learned helplessness 13. Long-term monitoring 13. Personality type 14. Excessive time on task 14. Major life event: medical, financial, or

emotional

Work Environment Human Nature 1. Distractions/interruptions 1. Stress (limits attention) 2. Changes/departure from routine 2. Habit patterns 3. Confusing displays/controls 3. Assumptions (inaccurate mental picture)

4. Workarounds/OSSβ instrumentation 4. Complacency/overconfidence

5. Hidden system response 5. Mind-set 6. Unexpected equipment conditions 6. Inaccurate risk perception (Pollyanna) 7. Lack of alternative indication 7. Mental shortcuts (biases)

α Irreversible actions are not necessarily precursors to error but are often overlooked, leading to preventable events. It is included in this list because of its importance. β OOS - out of service


61

Work Environment Human Nature 8. Personality conflicts 8. Limited short-term memory 9. Backshift or recent shift change 9. Pollyanna effect 10. Production overemphasis 10. Limited perspective (bounded rationality) 11. Adverse physical climate (habitability) 11. Avoidance of mental strain 12. No accounting of performance 12. First day back from vacation/days off 13. Conflicting conventions; stereotypes 13. Sugar cycle (after a meal) 14. Poor equipment layout; poor access 14. Fatigue (sleep deprivation and biorhythms) 15. Fear of consequences of error 15. Tunnel vision (lack of big picture) 16. Mistrust among work groups 16. “Something is not right” (gut feeling) 17. Meaningless rules 17. Pattern-matching bias 18. Nuisance alarms 18. Easily bored 19. Unavailable parts or tools 19. Close-in-time cause-effect correlation 20. Acceptability of “cookbooking” practices 20. Difficulty seeing own errors 21. “Rule book” culture 21. Frequency and similarity biases 22. Equipment sensitivity (inadvertent actions) 22. Availability bias 23. Lack of clear strategic vision or goals 23. Imprecise physical actions 24. Identical and adjacent displays or controls 24. Limited attention span 25. Out-of-service warning systems 25. Spatial disorientation 26. Lack of procedure placekeeping 26. Physical, instinctive reflex 27. Excessive group cohesiveness/peer pressure 27. Deference to authority

(excessive professional courtesy) 28. Anxiety (involving uncertainty)


62

ATTACHMENT B COMMON ERROR PRECURSOR DESCRIPTIONS

The first eight error precursors from Attachment A are described below. These tend to be the more commonly encountered conditions that provoke errors.

Task Demands Description 1. Time pressure (in a hurry) Urgency or excessive pace necessary to perform action or task

Manifested by shortcuts, being in a hurry, and an unwillingness to accept additional work or to help others

No spare time

2. High workload (high memory requirements)

Mental demands on individual to maintain high levels of concentration; for example, scanning, interpreting, deciding, while requiring recall of excessive amounts of information (either from training or earlier in the task)

3. Simultaneous, multiple tasks Performance of two or more activities, either mentally or physically, that may result in divided attention, mental overload, or reduced vigilance on one or the other task

4. Repetitive actions/monotony Inadequate level of mental activity resulting from performance of repeated actions; boring

Insufficient information exchange at the job site to help the individual reach and maintain an acceptable level of alertness

5. Irreversible acts Action that, once taken, cannot be undone without some significant delay

No obvious means of reversing an action

6. Interpretation requirements Situations that require “in-field” diagnosis, potentially leading to misunderstanding or application of wrong rule or procedure

7. Unclear goals, roles, or responsibilities

Unclear work objectives or expectations

Uncertainty about the duties an individual is responsible for in a task in which other individuals are involved

Duties that are incompatible with duties of others

8. Lack of or unclear standards Ambiguity or misunderstanding about acceptable behaviors or results; if unspecified, standards default to those of the front-line worker (good or bad)


63

Work Environment Description 1. Distractions/interruptions Conditions of either the task or work environment that require

the individual to stop and restart a task sequence, diverting attention to and from the task at hand

2. Changes/departure from routine

Departure from a well-established routine

Unfamiliar or unforeseen task or job-site conditions that potentially disturb an individual's understanding of a task or equipment status

3. Confusing displays/controls Characteristics of installed displays and controls that could confuse or exceed the working memory capability of an individual

Examples: • missing or vague content (insufficient or irrelevant) • lack of indication of specific process parameter • illogical organization and/or layout • insufficient identification of displayed process

information • controls placed close together without obvious ways to

discriminate conflicts between indications

4. Workarounds/out-of-service instrumentation

Uncorrected equipment deficiency or programmatic defect that necessitates compensatory or nonstandard action to comply with a requirement; long-term materiel condition problems that place a burden on the individual

5. Hidden system response System response invisible to individual after manipulation

Lack of information conveyed to individual that previous action had any influence on the equipment or system

6. Unexpected equipment condition

System or equipment status not normally encountered, creating an unfamiliar situation for the individual

7. Lack of alternative indication Inability to compare or confirm information about system or equipment state because of the absence of instrumentation

8. Personality conflict Incompatibility between two or more individuals working together on a task, causing a distraction from the task because of preoccupation with personal differences


64

Individual Capabilities Description

1. Unfamiliarity with task/first time

Unawareness of task expectations or performance standards

First time to perform a task (not performed previously; a significant procedure change)

2. Lack of knowledge (mental model)

Unawareness of factual information necessary for successful completion of task; lack of practical knowledge about the performance of a task

3. New technique not used before

Lack of knowledge or skill with a specific work method required to perform a task

4. Imprecise communication habits

Communication habits or means that do not enhance accurate understanding by all members involved in an exchange of information

5. Lack of proficiency/inexperience

Degradation of knowledge or skill with a task because of infrequent performance of the activity

6. Indistinct problem-solving skills

Unsystematic response to unfamiliar situations; inability to develop strategies to resolve problem scenarios without excessive use of trial-and-error or reliance on previously successful solutions

Unable to cope with changing plant conditions

7. Unsafe attitude for critical tasks

Personal belief in prevailing importance of accomplishing the task (production) without consciously considering associated hazards

Perception of invulnerability while performing a particular task

Pride; heroic; fatalistic; summit fever; Pollyanna; bald tire

8. Illness/fatigue Degradation of a person's physical or mental abilities caused by a sickness, disease, or debilitating injury

Lack of sufficient physical rest to support acceptable mental alertness and function


65

Human Nature Description 1. Stress Mind's response to the perception of a threat to one's health, safety,

self-esteem, or livelihood if task is not performed to standard; Responses may involve anxiety, reduced attention, reduced working memory, poor decision-making, transition from accurate to fast

Degree of stress reaction dependent on individual's experience with task

2. Habit patterns Ingrained or automated pattern of actions attributable to repetitive nature of a well-practiced task; inclination formed for particular train/unit because of similarity to past situations or recent work experience

3. Assumptions Suppositions made without verification of facts, usually based on perception of recent experience; provoked by inaccurate mental model; believed to be fact; stimulated by the inability of the human mind to perceive all facts pertinent to a decision

4. Complacency/ overconfidence

A “Pollyanna” effect leading to a presumption that all is well in the world and that everything is ordered as expected; self-satisfaction or overconfidence with a situation; unaware of actual hazards or dangers; particularly evident after 7-9 years on the job

Underestimating the difficulty or complexity of a task based on past experiences

5. Mind-set Tendency to “see” only what the mind is tuned to see (intention); preconceived idea

Information that does fit a mind-set may not be noticed and vice versa; may miss information that is not expected or may see something that is not really there; contributes to difficulty in detecting one's own error(s)

6. Inaccurate risk perception Personal appraisal of hazards and uncertainty based on either incomplete information or assumptions; unrecognized or inaccurate understanding of a potential consequence or danger

Degree of risk-taking behavior based on individual’s perception of possibility of error and understanding of consequences; more prevalent in males

7. Mental shortcuts (biases) Tendency to look for or see patterns in unfamiliar situations; application of thumb rules or “habits of mind” (heuristics) to explain unfamiliar situations

8. Limited short-term memory

Forgetfulness; inability to accurately attend to more than 2 or 3 channels of information (or 5 to 9 bits of data) simultaneously

The mind’s “workbench” for problem-solving and decision-making; the temporary, attention-demanding storeroom we use to remember new information


66

ATTACHMENT C HUMAN PERFORMANCE TOOL SELECTION GUIDE

A chart similar to the one on this and the next two pages can be used during work preparation as a general guide in selecting appropriate human performance tools given the characteristics of a task or job. It should not to be used at the job site. Users can adapt this chart to match the station’s unique expectations and standards.

Flagging

Is equipmentcondition unverifiable

after performanceof step?

Yes

No

Yes Yes

No No

YesDoes guiding

document specifytool for step?

No

Can resulting condition go undetected?

Yes

Is statuscontrol required

or desirable?

Yes

Arepotential adverse

outcomes immediate or irreversible?

No

Yes

Yes

Arepotential adverse

outcomes immediate or irreversible?

Self-Checking

Use specifiedtool.

Job-SiteReviewPrejob Briefing

Is thereany confusion or

uncertainty?

IndependentVerification

ConcurrentVerification

ConcurrentVerification

No

Yes

Procedure Use& Adherence

Is step arisk-importanthuman action?

No

No

Proceed to physical work

location.

PlacekeepingDoes procedure’s

level-of-use require ”continuous use?”

Yes

No

Are theresimilar and multiple components in close

proximity?

Continue withtool in use.

Yes

No

Peer-Checking

Yes

No - Review industrial safety hazards.

No

APage 2

Is verbal communication

required?

BPage 2

No

Yes

Doestask involve

significant human interaction with plant

equipment?

TaskAssigned

Is thereany confusion or

uncertainty?

Task Preview


67

ATTACHMENT C Page 2 of 3


68

ATTACHMENT C Page 3 of 3

Postjob reviewunnecessary.

PostjobReviewDo any apply? Yes

No

Occurrence of minor problems

or surprises

Recent completion of risk-importantproject or work

activity

Completion of emergent work

activity

Completion of a risk-important phase of work

TurnoverDo any apply? Yes

No

Permanenttransfer of

responsibilities

Transfer ofresponsibilities

for work in progress

Emergent work activity exceeds

one shift Turnover unnecessary.

Shift changefor continuously

mannedwork stations


69

REFERENCES 1 Swain & Guttman. Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant

Applications (NUREG/CR-1278). 1983. 2 Strater, O. Cognition and Safety. 2005, p.28. 3 Dorner. The Logic of Failure. 1996, pp.185-186. 4 Senders & Moray. Human Error Cause, Prediction, and Reduction. 1991, pp.44, 67. 5 Reason. Human Error. 1990, pp.38-39. 6 Wickens. Engineering Psychology and Human Performance. 1992, pp.277-281. 7 Swain & Guttman. Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant

Applications (NUREG/CR-1278). 1983. 8 Wickens. Engineering Psychology and Human Performance. 1992, pp.211-222. 9 Spettell & Liebert. “Training for Safety in Automated Person-machine Systems,” American

Psychologist. May 1996. 10 Weick and Sutcliffe. Managing the Unexpected. 2001, pp.33-41. 11 Russel. The Brain Book. 1979, pp.211-215. 12 Reason. Human Error. 1990, pp.38-39. 13 Turner and Pidgeon. Man-Made Disasters. 1997, pp.109-115. 14 Hursh. “Fatigue and Alertness Management using FAST™.” Presentation at nuclear industry annual

workshop on Human Performance/Root Cause/Trending in Baltimore, MD, June 6, 2001. Dr. Steven Hursh is a professor at Johns Hopkins University School of Medicine. FAST™ (Fatigue Avoidance Scheduling Tool) is a software program aimed at minimizing personnel fatigue.

15 Keller. Attitude is Everything. 1999, pp.14-16. 16 Krakauer, Into Thin Air, 1997. This is the story of how 12 climbers died during an ascent of Mount

Everest in 1996. 17 Dorner. The Logic of Failure. 1996, p.109. 18 Yates. Risk-Taking Behavior. 1992, p.52. 19 Turner and Pidgeon. Man-Made Disasters. 1997, p.34. 20 Ropeik and Gray. Risk: A Practical Guide for Deciding What’s Really Safe and What’s Really

Dangerous in the World Around You. 2002, pp.15-18. 21 Yates. Risk-Taking Behavior. 1995, p.52. 22 Weick and Sutcliffe. Managing the Unexpected. 2001, p.94. 23 Senders and Moray. Human Error: Cause, Prediction, and Reduction. 1991. 24 Hollnagel. Cognitive Reliability and Error Analysis Method. 1998, pp. 164. 25 Reason. Managing the Risks of Organizational Accidents. 1998, p.71. 26 Center for Chemical Process Safety. Guidelines for Preventing Human Error in Process Safety,

American Institute of Chemical Engineers. 1994. 27 Rummler and Brache. Improving Performance. 1990, p.73. DOE and Demming also noted that the

overwhelming majority of problems are organizational in nature. 28 Health and Safety Executive. Improving Compliance with Safety Procedures, Reducing Industrial

Violations. 1995. The Violations Sub-group of the Human Factors Reliability Group (HFRG) prepared this report for HSE. HSE is an arm of the government of the United Kingdom.

29 Reason. Managing the Risks of Organizational Accidents. 1998, p. 146. 30 Health and Safety Executive. “Preventing the propagation of error and misplaced reliance on faulty

systems: A guide to human error dependency,” Offshore Technology Report 2001/053. 2001, pp.12-16.


70

31 Greenstreet and Berman, Ltd., for Health and Safety Executive. “Preventing the Propagation of

Error and Misplaced Reliance on Faulty Systems: A Guide to Human Error Dependency.” 2001, pp.7-11.

32 Coovert & Smit, “Are Two Heads Better Than One?” Braidwood Nuclear Station. 1999. 33 Latane, “Many heads make light the work: The causes and consequences of social loafing.” Journal

of Personality and Social Psychology. 1979. 34 Hopkins. Preventing Human Error, A Practical Guide to Quality - Safety - Effectiveness. 2000, p.

44-45. 35 Yates. Risk-Taking Behavior. 1992, pp.168-173. 36 Restak. Brainscapes. 1995, p.60. 37 Wickens. Engineering Psychology and Human Performance. 1992, pp.17-20. 38 Marrietta Daily Journal. “Scientists: People cannot drive safely, talk at same time.” July 30, 2001. 39 Wickens. Engineering Psychology and Human Performance. 1992, p.69. 40 Wickens. Engineering Psychology and Human Performance. 1992, pp.20-21. 41 Wickens. Engineering Psychology and Human Performance. 1992, pp.386-391. 42 Spettell & Liebert. “Training for Safety in Automated Person-machine Systems,” American

Psychologist. May 1996. 43 Reason. Managing the Risks of Organizational Accidents. 1998, pp.68-70. 44 Turner and Pidgeon. Man-Made Disasters. 1997, pp.124-126. 45 Reason. Human Error. 1990, p.56. 46 Strater, O. Cognition and Safety. 2005, p.36. 47 Health and Safety Commission. “Advisory Committee on the Safety of Nuclear Installations Study

Group on Human Factors, Second Report: Human Reliability Assessment - A Critical Overview.” Her Majesty's Stationery Office. 1991, p.9.

48 Catoe, J. “Hypnotherapy.” Atlanta Journal and Constitution. November 22, 1998. 49 Performance Improvement International. An internal study of errors across the nuclear industry

revealed that 25 percent of errors were skill-based, 60 percent were rule-based, and 15 percent were knowledge-based. 2000.

50 Health and Safety Commission. Advisory Committee on the Safety of Nuclear Installations Study Group on Human Factors, Second Report: Human Reliability Assessment – A Critical Overview. Her Majesty's Stationery Office. 1991, p.7.

51 Geller. The Psychology of Safety. 1998, p.61. 52 Center for Chemical Process Safety. Guidelines for Preventing Human Error in Process Safety,

American Institute of Chemical Engineers. 1994, pp.78-80. 53 Reason. Managing the Risks of Organizational Accidents. 1998, p.70. 54 Strater. Cognition and Safety. 2005, p.36. 55 Reason. Human Error. 1990, pp.74-86. 56 Swain & Guttman. Handbook of Human Reliability Analysis with Emphasis on Nuclear Power

Plant Applications (NUREG/CR-1278). 1983. 57 Performance Improvement International. An internal study of errors across the nuclear industry

revealed that 25 percent of errors were skill-based, 60 percent were rule-based, and 15 percent were knowledge-based. 2000.

58 Reason. Human Error. 1990, pp.53-55. 59 Turner and Pidgeon. Man-Made Disasters. 1997, pp.124-126. 60 Wickens. Engineering Psychology and Human Performance. 1992, p.20. 61 Strater. Cognition and Safety. 2005, p.36. 62 Swain & Guttman. Handbook of Human Reliability Analysis with Emphasis on Nuclear Power

Plant Applications (NUREG/CR-1278). 1983.


71

63 Turner and Pidgeon. Man-Made Disasters. 1997, pp.33-34. 64 According to a conversation with Dr. James Reason, former professor of psychology at the

University of Manchester in the United Kingdom, the chances for error in a knowledge-based situation are roughly a toss-up, “If you're good.” Otherwise, the chances for success get worse. February 1997.

65 Performance Improvement International. An internal study of errors across the nuclear industry revealed that 25 percent of errors were skill-based, 60 percent were rule-based, and 15 percent were knowledge-based. 2000.

66 Dorner. The Logic of Failure. 1996, pp.71-79. 67 Reason. Human Error. 1990, pp.61-66, 86-89. 68 Howlett. The Industrial Operator's Handbook. 1995, p.45. 69 Baxter & Bass. “Human Error Revisited: Some Lessons for Situational Awareness.” Fourth

Symposium On Human Interaction with Complex Systems. March 22-24, 1998, pp.81-87. 70 Dorner. The Logic of Failure. 1996, p.42. 71 Senge. The Fifth Discipline Fieldbook. 1994, pp.245-246. 72 Senge. The Fifth Discipline Fieldbook. 1994, pp.86-95. 73 Swain and Guttman. Handbook of Human Reliability Analysis with Emphasis on Nuclear Power

Plant Application, Final Report (NUREG/CR-1278). 1983. 74 INPO. “In-Reactor Fuel-damaging Events, A Chronology (INPO 91-008).” 1991. 75 Center for Chemical Process Safety. Guidelines for Preventing Human Error in Process Safety,

American Institute of Chemical Engineers. 1994, pp.12-15. 76 Health and Safety Commission. “Advisory Committee on the Safety of Nuclear Installations Study

Group on Human Factors, Second Report: Human Reliability Assessment - A Critical Overview.” Her Majesty's Stationery Office. 1991, p.33.

77 Gilbert. Human Competence, Engineering Worthy Performance. 1996, pp.82-89. 78 Turner and Pidgeon. Man-Made Disasters. 1997, p.34. 79 Daniels. Performance Management. 1989, pp.135-140. 80 Daniels. “Making Positive Reinforcement Work for You.” 1994. 81 Center for Chemical Process Safety of the American Institute of Chemical Engineers. Guidelines

for Preventing Human Error in Process Safety. 1994, pp.209-211. 82 Hollnagel. Cognitive Reliability and Error Analysis Method. 1998, pp. 154-155. 83 Drucker. Management: Tasks, Responsibilities, Practices. 1974, p.218. 84 Geller. The Psychology of Safety. 1998, pp.41-43. 85 Turner & Pidgeon. Man-Made Disasters. 1997, p.34. 86 Reason. Managing the Risks of Organizational Accidents. 1998, pp.49-51.


72



73

3 MANAGING DEFENSES, Md

DEFENSES ..........................................................................................................75 An Organization’s Role in Defenses................................................................75 Defense Functions............................................................................................76 The Severity Pyramid ......................................................................................77 Reliability of Defenses.....................................................................................78

DEFENSE-IN-DEPTH.........................................................................................78 Engineered Controls.........................................................................................79

Example Engineered Controls .....................................................................79 Common Flaws with Engineered Controls ..................................................80

Administrative Controls...................................................................................80 Example Administrative Controls ...............................................................80 Common Flaws with Administrative Controls ............................................81

Cultural Controls..............................................................................................82 Values ..........................................................................................................82 Beliefs ..........................................................................................................83 Attitudes.......................................................................................................83 Work Group Norms .....................................................................................84 Leadership Practices ....................................................................................84 Common Flaws with Cultural Controls .......................................................85

Oversight Controls ...........................................................................................85 Human Performance Steering Committee ...................................................86 Performance Improvement Processes ..........................................................86 Human Performance Improvement Plans ....................................................87

MANAGING DEFENSES ...................................................................................87 Performance Model..........................................................................................88

Organizational Factors .................................................................................89 Job-Site Conditions......................................................................................90 Individual Behaviors....................................................................................90 Plant Results ................................................................................................91 Leadership....................................................................................................91


74

Behavior Engineering Model – Nuclear .......................................................... 91 Warning Flags – Factors that Defeat Defenses................................................ 95 Finding and Correcting Latent Weaknesses .................................................... 96

Self-Assessment .......................................................................................... 97 Performance Indicators and Trending ......................................................... 98 Benchmarking ............................................................................................. 99 Operating Experience ................................................................................ 100 Independent Oversight .............................................................................. 101 Behavior Observations .............................................................................. 101 Problem Reporting .................................................................................... 102 Problem (Causal) Analysis........................................................................ 103 Management Oversight ............................................................................. 104 Surveys and Questionnaires ...................................................................... 105 Corrective Action Program ....................................................................... 105 Change Management................................................................................. 105

ATTACHMENT A PERFORMANCE MODEL (WITH DEFENSES)............ 107


75

Mission

Goals

Policies

Processes

Programs

Mission

Goals

Policies

Processes

Programs

DEFENSES

To “defend” something means “to make or keep safe from danger, attack, or harm.” It also means to avert, care for, cover, guard, insure, oppose, prevent, protect, safeguard, secure, shield, sustain, and watch. In any station, defenses comprise any human, technical, or organizational features used to protect plant, property, environment, and personnel against hazards in the plant.1 The primary hazard is human error. Other hazards include radiation, industrial safety hazards, hazardous chemicals, and various forms of energy, such as electricity and rotating equipment. Defenses are built into the fabric of everyday life. They take the form of controls, barriers, safeguards, and so on. There are many such defenses in driving an automobile. For example, traffic lights signal drivers to proceed or stop at an intersection. Speedometers help the operator control the speed of the vehicle by indicating its speed. Drivers’ licenses provide proof that people are qualified to operate an automobile. Seat belts and air bags mitigate the effects of collisions. Asphalt ripples built into highway berms alert drivers with a rumbling noise when the vehicle veers off the highway. Similarly, defenses in the station take the form of procedures, physical interlocks, redundant equipment and power sources, and annunciators, as well as those that rely on people, such as self-checking, peer-checking, three-way communication, reviews and approvals, and supervisory oversight. Research and experience have shown that the integrity and effectiveness of defenses are linked to the effectiveness of the station’s organization.

An Organization’s Role in Defenses Human performance occurs within the context of the organization—its processes, physical structures, and culture. A nuclear station’s organization acquires, organizes, and coordinates the use of resources (people, money, and equipment) in the support of plant operations. Daily, the organization’s managers make decisions about the division of labor and the coordination of effort—who does what, when to do it, where to do it, and how to do it. Occasions when plant operations do not accomplish what is intended are generally referred to as events. The severity of an event—its significance—is not the outcome of an active error, but the result of failed or flawed defenses.


76

Consequently, significant events triggered by human error are better characterized as organizational failures. Extreme organizational failures are reflected by significant events, extreme regulatory oversight, and, in some cases, extended plant shutdowns. At the other extreme, plants demonstrating sustained excellence have strong organizations characterized by effective execution of key processes and a workforce that adheres to high standards. Procedures, policies, programs, training, and culture influence worker behavior. All of these factors are the outcomes of organization and management. Because of the size and complexity of a nuclear generating station and its supporting organizational structures, people doing normal work unknowingly create variances and irregularities in plant operations. Equipment suffers wear and tear. The latent flaws and defects in an organization’s facilities and processes, as well as its culture, explain why some events are as bad as they are. As illustrated in the Anatomy of an Event, the organization and its associated management control systems contain the prevalent “root” causes of significant events. Chapter 1 described an NRC-sponsored study by Idaho National Laboratory (INL) to explore the contributions of human performance to risk in operating events at commercial nuclear power plants. The study’s conclusions reveal that latent errors, not active errors, govern the severity of events in nuclear power plants. When studied closely, the latent errors listed in the report look like deficiencies with an organization’s controls, defenses, barriers, and safeguards.

Defense Functions Whenever an event occurs, either flaws exist with current defenses or defenses were not in place. There is no such thing as a perfect set of defenses just as human error cannot be totally eliminated. Therefore, multiple, overlapping defenses are needed. Defense-in-depth is achieved by systematically and redundantly embedding defenses in an overlapping fashion into the organization, its culture, and the physical plant such that if one fails or is ineffective, others will fulfill the same defensive function. Defenses perform one or more the following functions:2

• Create awareness – understanding the risks and recognizing the presence of hazards; examples: prejob briefing, postjob reviews, risk assessment, procedures, component labeling, color coding, self-checking, computer screen layout, logs, meetings, communication practices, danger tags, radiological postings


77

600

1

3010Major

Events

SeriousAccident

NonconsequentialErrors

NearMisses

600

1

3010Major

Events

SeriousAccident


NearMisses

600

1

3010

600

1

3010

600

1

3010Major

Events

SeriousAccident


NearMisses

MajorEvents

SeriousAccident


NearMisses

• Detect and warn – alerted to the presence of off-normal conditions or imminent dangers; examples: alarms and annunciators, equipment operator rounds, concurrent verification, peer-checking, supervision, problem-solving methodology, confined-space entry requirements, self-checking

• Protect – guarding people, equipment, and the environment from error or harm; examples: personal protective equipment, residual heat removal system, supervision, equipment lockout, interlocks

• Recover – restoration from off-normal conditions and restoring the system to a safe state; examples: reactor scram, turbine trip, steam dump system, eye wash station, emergency procedures, independent verification

• Contain – restricting or limiting the accidental release of harmful energy or substances; examples: containment, tank berms, piping and valves

• Enable escape – providing the means to flee from uncontrolled hazards; examples: emergency plan, crash bars on doors, emergency lighting

Defense-in-depth is a two-edged sword. Redundant defenses improve safety margins but also increase complexity. Defects, process flaws, traps, flawed defenses, and safety hazards become more difficult to detect. This is a primary reason latent conditions persist.

The Severity Pyramid The significance, or severity, of an event lies in the consequences suffered, not the error that initiated it. The error that triggers a serious accident and the error that is one of hundreds with no consequence can be the same error that has historically been overlooked or uncorrected. Therefore, for a significant event to occur, multiple breakdowns in defenses or barriers usually have to occur. The existence of so many flawed defenses can only be attributable to weaknesses in the organization and its oversight control systems. Trends regarding a study of industrial safety incidents illustrate this principle in the figure at the right.3 For every death or disabling injury, 10 first-aid cases, 30 occasions involving equipment damage, and 600


78

Rel

iabi

lity

of D

efen

se

Degree of Human ControlLow High

High

Self-checking

PPEInterlocks

Reactor VesselShield Wall

Caution TagsSupervision

EngineeredSafeguards

Procedure Use

Document Reviews

Rel

iabi

lity

of D

efen

se


High

Rel

iabi

lity

of D

efen

se


High

Self-checking

PPEInterlocks




Procedure Use

Document Reviews

Self-checking

PPEInterlocks




Procedure Use

Document Reviews

nonconsequential violations or errors occurred. The boxed phrases represent related nuclear industry outcomes. Most stations in the nuclear industry have traditionally focused on worker error reduction. However, the real success in minimizing the severity of events will be realized by aggressively managing defenses in combination with error-reduction efforts.

Reliability of Defenses All defenses are not created equal—some are more reliable than others. If a control, barrier, or safeguard does not depend on people to perform its protective function, then it tends to be a more reliable control, barrier, or safeguard. Physical defenses tend to perform their intended functions despite human action or inaction. However, if the effectiveness of a defense mechanism relies on the performance of people—as do procedures, training, self-checking, and verifications—then it is less reliable. Engineered controls, such as physical interlocks and equipment design, are more reliable than administrative controls such as procedures, human performance tools, and training programs. When plant safety and reliability are dependent on people during risk-important activities, the physical plant is more vulnerable to their errors. A continuum illustrates the principle of reliability. Reliability is related to the dependability of the defense or barrier to perform its intended function when needed. If it is absolutely imperative to prevent error, then physical, engineered controls are more appropriate, if feasible.

DEFENSE-IN-DEPTH

Defense-in-depth is the overlapping capacity of various defenses to protect plant personnel and plant equipment from human error. If a failure occurs with one defense, another would compensate for that failure, thereby preventing harm. The four lines of defense mentioned in Chapter 1—engineered, administrative, cultural, and oversight controls—should work together to anticipate, prevent, or catch active errors before suffering a significant event.


79

Controls include various devices, methods, or practices that make an activity or process go safely, effectively, efficiently, predictably, and according to high standards to protect key assets from human error—usually taking an engineered, administrative, cultural, or oversight form.

Engineered Controls Engineered controls include all those items (hardware, software, and equipment) in the physical environment that affect people’s behavior, choices, and attitudes and that are the result of engineering design. Engineered controls act either actively or passively. Active controls include equipment such as pumps or valves that perform a specific function related to safety. Passive controls include pipes, berms, or vessels that provide containment and generally do not have moving parts. The most reliable defense mechanisms are passive because they require no operational or maintenance support to remain effective, eliminating dependence on human involvement.

Example Engineered Controls The human-machine environment contains several opportunities to “control” human error. Human-centered designs consider human error and its potential consequences, eliminating or minimizing error traps with equipment. Consideration is given to the habitability and accessibility of the physical work environment. Unnecessary human interactions with plant equipment can be either eliminated or automated. Otherwise, interlocks and error-tolerant designs have to be used to mistake-proof human-machine interactions, especially with risk-important systems and critical components. Interlocks and protection systems are provided to prevent improper operator actions and to initiate appropriate automatic protective actions when necessary. They will not prevent all possible operator errors but can substantially reduce the risks if properly maintained. Workarounds and human-machine interface deficiencies are modified to eliminate or minimize such conditions, especially at critical steps. Configuration control, materiel condition, foreign material exclusion (FME), and housekeeping practices are other important elements relevant to effective engineered controls. Finally, problems with environmental conditions, labeling, accessibility, lighting, and habitability are resolved, if possible, to minimize their impact on performance, especially on risk-important equipment.


80

Common Flaws with Engineered Controls The following list highlights some of the more common equipment-related conditions that have challenged worker performance, contributing to plant events:

• out-of-service equipment, controls, alarms, and indicators • workarounds, temporary repairs, or long-term temporary

modifications/alterations • nuisance alarms and disabled annunciators • excessive noise • missing labels, or labels oriented such that they cannot be seen or read

easily • breaches in the “righty-tighty-lefty-loosey” convention, such as a

setpoint controller has to be turned counterclockwise to increase the setpoint

• poor lighting, high temperatures, or high humidity (heat stress factors) • unusual plant or equipment conditions • lack of observable equipment response after performing a control action • poor accessibility, cramped conditions, or awkward layout of equipment

Administrative Controls Administrative controls, such as procedures, inform people about what to do, when to do it, where to do it, and how well to do it and are usually documented in various written policies, programs, and plans. Administrative controls rely on human judgment, training, and personal initiative to follow the direction contained in these documents. Consequently, administrative controls are not as reliable as engineered controls.

Example Administrative Controls A wide range of management methods exist to ensure proper plant operations and to control various hazards. Administrative controls that significantly impact human performance include the following:

• strategic business planning (goals, budgeting, priorities, plans, resource acquisition, and so forth)

• formal organizational structure, lines of authority, roles, and responsibilities


81

• policies, programs, and processes for the conduct of production work activities (preventive maintenance, procedure development, modifications, configuration control, operations, and so forth)

• communication methods (conversations, e-mail, logs, meetings, reports, newsletters, signs, postings, telephones, radios, alarms, and so on)

• technical and administrative procedures (clearances/tagging, foreign material exclusion, industrial safety, human performance, troubleshooting, records, parts and materials, self-assessment, corrective action, and so forth)

• training programs • work management processes (work initiation, prioritization, review and

approval, planning, and scheduling) • human performance tools, expectations, and standards • human resources policies and practices related to staffing levels,

overtime, and discipline • information technology and information handling

Common Flaws with Administrative Controls The following administrative conditions, among others, have been identified as causes or contributing factors in past plant events:

• two or more actions embedded in one procedure step • vague expectations and standards • lack of training on adapting human performance tools to physical

constraints of particular tasks • superficial document reviews or the lack of a “qualified reviewer”

process for technical procedure development • critical steps not identified in procedures and work packages • excessive work package backlog that exceeds planner resources • work packages planned without the use of operating experience • unresponsive procedure revision process • lack of structured causal analysis methods, and insufficient personnel

qualified and proficient to perform investigations • work packages printed in all capital letters (more difficult to recognize

words without the use of lowercase characters) • unavailable foreign material exclusion (FME) caps and covers • excessive deferred preventive maintenance • insufficient staffing leading to excessive overtime, workload, and fatigue


82

• routine authorization to exceed overtime limits (leading to chronic fatigue)

• inadequate time for direct supervision of work in the field • unclear qualification standards • incomplete or missing electrical load lists to aid in ground isolation

Cultural Controls An effective safety culture engenders the belief that when production and safety conflict, safety will prevail. Cultural controls include those leadership practices that teach (consciously or unconsciously) people how to perceive, think, feel, and behave toward challenges to safety.4 These values may or may not match up with those espoused by management. Culture is defined by people’s behavior, and safe behavior is value-driven.5 What an organization says its values are may not be reflected in its behavior. For instance, when procedures are vague or incomplete, people tend to default to what they think is important for success as they define it. The true values of an organization are reflected in the observed acts of its people, especially its managers.6 Organizational culture is that set of shared assumptions, values, and beliefs that characterize the choices and behaviors of an organization’s members. Culture is for the group what character and personality are for the individual. Because of the special nature and unique hazards of nuclear power—radioactive byproducts, concentration of energy in the reactor core, and decay heat after shutdown—a nuclear generating station needs a strong safety culture. “Strong” implies the extent to which the organization’s members adopt or internalize such values and behaviors. Chapter 4, Culture and Leadership, offers more insights on how leadership develops a strong safety culture.

Values What managers place importance on and what is considered “high priority” becomes valued in the organization, whether publicly espoused or not. Management’s espoused values are usually framed and displayed on the walls of meeting rooms and high-traffic areas of the plant so everyone sees them. If behaviors are consistent with espoused values over the long term, then the workforce has truly internalized those values. Ultimately, managers want all personnel to demonstrate a great respect for the reactor core⎯for reactor safety⎯in their decisions and actions. They want


83

personnel to seek additional support when faced with uncertain conditions or situations not addressed by approved procedures and policies.

Beliefs A widely accepted notion is that perception is reality. Therefore, what people believe to be true tends to drive their attitudes and behavior. A belief is an acceptance of and conviction in the truth, existence, or validity of something, including assumptions about what will be successful. People erroneously believe they can always maintain control whenever and wherever. Typically, this is the case when people decide to take shortcuts or violate a safety policy. The following beliefs have had a significant positive impact on event-free performance:

• Human beings are fallible. • People want to do a good job. • Human error is normal. • There is no such thing as a “routine” activity. • Significant events are organizational failures. • Error is an opportunity to learn and improve organizational effectiveness. • Absolutely safe environments do not exist.

Attitudes An attitude is a state of mind, or feeling, toward an object or subject. However, attitudes affect people’s choices and behaviors toward safety and error prevention. Positive feelings follow safe behaviors if people experience positive and consistent feedback from supervisor and peers and understand why the feelings are important. If people experience pain, fear, anxiety, frustration, humiliation, embarrassment, boredom, or discomfort when they use safe behaviors, people will tend to avoid those behaviors and develop “bad” feelings about the practices. The following attitudes promote safe work behaviors:

• Uneasiness toward human fallibility – individuals acknowledging their capacity to err, to make a mistake or slip at any time, and being wary of conditions conducive to error; tending to follow procedures carefully and applying human performance tools rigorously

• Questioning attitude – maintaining vigilant situation awareness toward surrounding working conditions to detect error-likely situations, unsafe


84

or hazardous working conditions, or otherwise unusual conditions; not proceeding in the face of uncertainty and basing decisions on facts

• Conservative approach – taking actions or making decisions that err in the direction of safety rather than production, especially when doubt exists; exhibited by placing systems, equipment, or the plant in a safe condition before stopping an activity

• Avoiding “unsafe” attitudes – being aware of and avoiding attitudes and practices detrimental to high levels of reliability, such as Pollyanna, summit fever, heroic, pride, fatalism, and invulnerability to error

Work Group Norms A person’s peer group is the largest, single determinant of an individual’s behavior on the job. Norms tell people what they are supposed to do, wear, say, and believe; what is acceptable and what is unacceptable; what to look for; what to ignore; how to see things; and how to interpret what they see and hear. Norms are passed on by word of mouth and are enforced by how a person’s peers respond when a norm is broken.7 If work group members think one person is working too hard, they may make jokes and unkind remarks to the person until he/she adopts the group’s norm for what is considered an appropriate level of effort. In extreme cases, the peer group may shun or attack the person until he/she complies with the group’s “rules.”

Leadership Practices Nothing drives a culture more than management’s style and response to various challenges or opportunities. Management, through the following leadership practices as described in Excellence in Human Performance and in Chapter 4, Culture and Leadership, tends to shape the culture of the station staff through the following:

• facilitating communication • promoting teamwork • coaching and reinforcing expectations • eliminating latent organizational weaknesses • valuing the prevention of error


85

Common Flaws with Cultural Controls Sometimes it is easier to know when a culture is unhealthy by observing the practices, choices, interactions, and decisions of the organization’s personnel. The following examples illustrate flawed cultural controls:

• placing importance on personal judgment • being confident in one’s own abilities to solve problems • being reluctant to challenge the decisions of others • relying on one’s own resources; “standing on one’s own feet” • applying human performance tools carelessly • lacking correction or coaching of at-risk practices, or using human

performance tools improperly • having inconsistencies between what managers say they want and what

they reward or pay attention to • having undisciplined housekeeping practices; not cleaning as you go • making uncritical observation comments so as to not offend those

observed • initiating disciplinary action for honest mistakes • holding unintelligible conversations during meetings involving a large

group • allowing supplemental personnel to perform work for which they are not

qualified • getting angry with someone for being corrected • providing bonuses based solely on productivity measures • proceeding to the next action or step before signing off concurrent

verification

Oversight Controls Vulnerabilities with defenses can be found and corrected, but only if management decides it is important enough to devote resources to the effort. Latent conditions do not wave a flag to let you know where they are. The fundamental aim of oversight is to improve station resilience to significant events triggered by active errors in the workplace—that is, to minimize the severity of plant events. Oversight controls provide opportunities to see what is actually going on in the plant, to identify specific vulnerabilities or performance gaps, to take action to address those vulnerabilities and performance gaps, and to verify that they have been resolved.


86

Human Performance Steering Committee Since human error is one of the greater sources of risk to plant and nuclear safety, the senior management team must give it careful and regular consideration. Most stations have instituted a committee structure to monitor human performance. This structure promotes management awareness of current challenges to human performance and their effects on plant performance. This group establishes the station vision, strategy, and processes for managing human performance toward a vision of event-free operations. The members of the senior management team typically serve on a Human Performance Steering Committee, and the plant manager or above chairs this committee. The steering committee promotes accountability for human performance at the department manager level using various measures of human performance, self-assessments, the corrective action program, and other sources of feedback. Managers closely monitor human performance events and trends, thoroughly evaluate their causes and contributors, and communicate the results to station personnel to increase their understanding and awareness. This system of accountability helps verify that human performance processes and changes are implemented as intended, consistent with the organization’s purposes, resources, and goals; that expectations are performed to stated standards; and that performance gaps are identified and closed.

Performance Improvement Processes In light of management’s oversight role, the senior management team is encouraged to apply INPO 05-005, Guidelines for Performance Improvement at Nuclear Power Stations, August 2005, to aid in monitoring, assessing, and improving human performance. Systematic performance improvement processes promote continuous improvement. However, weaknesses with oversight and performance improvement have contributed to long-term poor performance. The following flawed oversight controls, among several others, tend to degrade this line of defense:

• Senior management oversight of human performance is inadequate, or meetings of the Human Performance Steering Committee are held irregularly.

• Self-assessments are not formally performed or tracked. • The measurement and trending of risk-important processes are

insufficient or are not performed.


87

• Root cause analyses are shallow and focus on individual errors without addressing organizational contributors to events.

• There is a lack of intrusive observations of work in the field. • Managers are unaware of current human performance challenges in their

organizations. • Performance indicators of human performance are ineffective or are not

in place. • Expectations for change management are inadequate. • Benchmarking outside the station or utility or industry is inadequate.

Human Performance Improvement Plans Human performance improvement plans (HPIP) provide management with a systematic approach to correcting identified problems or focus areas. Without plans, improvement is unlikely and rework is probable. Human performance is a core business issue for plant safety. In fact, human error is the primary hazard to reactor safety. Because human fallibility cannot be eradicated, an ongoing HPIP addresses the latest challenges to safety related to human performance. The HPIP is a living plan that is updated as new issues emerge over the life of the station and that is reviewed during every Human Performance Steering Committee meeting to verify improvement is actually occurring.

MANAGING DEFENSES

Most people want to do a good job. But regardless of how careful people are, they still make mistakes. Consequently, management has to devote time toward strengthening station resistance against the errors that still occur. A review of the INPO industry event database confirms that events occur more often because of error-prone tasks and error-prone work environments than because of error-prone individuals.8 The causes of these weaknesses are commonly attributable to latent weaknesses—hidden defects, loopholes in the system’s defenses. “Managing” is the ongoing act of planning, directing, or controlling activities and resources toward accomplishing or achieving a purpose. Many managers are familiar with the Plan-Do-Check-Adjust management process.9 In particular, “managing defenses” means:

• Plan – Identify specific hazards and vulnerabilities to key assets due to human interaction with those assets (exposure to hazard); and, in turn, develop controls and plans to address the hazards or vulnerabilities.


88

• Do – Implement controls, barriers, or safeguards to anticipate, prevent, catch, or mitigate the occurrence of human errors and their consequences (to minimize risk).

• Check – Monitor, assess, and understand the effectiveness of these controls (such as the self-assessment process).

• Adjust – Correct vulnerabilities or deficiencies (using the corrective action program).

Latent conditions once created do not fade away on their own—they accumulate. Because of their hidden characteristic, management’s primary challenge is to limit the time these vulnerabilities exist. Managers at successful stations aggressively identify and correct vulnerabilities with controls and defenses at the earliest opportunity. At best, latent errors are difficult to prevent. This is why successful management teams persistently search for and eliminate these problems when they are discovered. The more effective tools available to accomplish this effort include the self-assessment and corrective action programs, which are described in more detail later in this chapter.

Performance Model

“Liberation and mobilization of human energies—rather than symmetry and harmony—constitute the purposes of organization. Human performance is its goal and its test.” [Emphasis added.]

--Peter Drucker, distinguished management expert

A system is a network of elements that work together to produce repeatable outcomes. In order to achieve repeated high levels of performance, managers create systems to achieve their goals. These systems take many forms. The plant contains many hardware systems, such as the electrical system, reactor coolant system, telephone systems, lubricating oil systems, and ventilation systems. There are management systems, such as the outage planning and scheduling process and training programs. Social systems exist in several work groups. For instance, work group norms that specify unstated work standards, the seniority system, incentives and disincentives, families, and personal belief systems are all systems that function behind the scenes. Human performance is also a system, a process.


89

4.PLANT

RESULTS

2.JOB-SITE

CONDITIONS

3.INDIVIDUALBEHAVIOR

1.ORGANIZATIONAL

FACTORS

Leadership

4.PLANT

RESULTS

2.JOB-SITE

CONDITIONS


1.ORGANIZATIONAL

FACTORS

4.PLANT

RESULTS

2.JOB-SITE

CONDITIONS


1.ORGANIZATIONAL

FACTORS

4.PLANT

RESULTS

2.JOB-SITE

CONDITIONS


1.ORGANIZATIONAL

FACTORS

Leadership

The Performance Model illustrates the organizational context of human performance. Understanding organizational systems, their key elements, leadership dynamics, and their impact on individual behavior and the plant is important to managing human performance. Systems-thinking involves reflecting on the multiple causes and effects of the variables (factors) that come to bear on the worker at the job site, where he/she touches plant equipment. Boxes in the model represent either conditions or action, and arrows indicate influence or causality. Attachment A provides an enlarged view of the model with example defenses shown in bubbles for each respective element in the model, which are described below.

Organizational Factors Organizational factors have the greatest influence on performance, individually or the plant. Organizational factors encompass all the ways management uses to direct and coordinate the work of the station, which together shape the behavior of the people performing their jobs.10 Collectively, they are the hub of all that goes on at the station. Recall human performance Principle 3 – Individual behavior is influenced by organizational processes and values. Organizational factors comprise all the processes, conditions, relationships, assumptions, values, and so forth that directly or indirectly influence the behavior of station employees. Through various means, the organization specifies what work people do, who can do work, when people do their work, where people perform their work, and how well people do their work. Organizational factors reveal themselves in engineered controls, administrative controls, cultural controls, and oversight controls. Some of the more important organizational factors known to impact performance are as follows:11

• communication methods and practices

• management styles and degree of workforce participation

• tools and resources


90

• procedure development and review

• cleanliness of the work environment

• layout of facilities and structures • staffing levels • experience level of the workforce • work processes

• management visibility • human resources policies and practices • training programs • priorities (production and safety) • expectations and standards • emphasis on health and safety • work planning and scheduling • design and modification

For specific jobs or tasks, organizational factors create a unique array of job-site conditions—good or bad—that set people up for either success or failure.

Job-Site Conditions These factors define the unique set of conditions for a particular worker about to perform a specific task or action. The job site is that location or place where behavior occurs during task performance and can be characterized by either environmental or individual factors. Environmental factors include conditions external to the individual and often beyond his or her direct control, such as procedure quality, component labeling, human-machine interface, heat, and humidity. Individual factors include conditions that are a function of the person assigned the task, some of which are also beyond his or her direct control, such as knowledge, skills, experience, family problems, and color blindness. A special subset of job-site conditions that provoke human error are called error precursors, which were described in Chapter 2. When such conditions cause a significant mismatch between the task environment and the individual, an active error is likely to occur. The individual’s capabilities and limitations (mental, physical, or emotional) may or may not match well with the environmental factors for the work as planned. In summary, job-site conditions shape worker behavior, for good or for bad. More detail is provided in the section on the Behavior Engineering Model.

Individual Behaviors Individual behaviors include all the actions (or inactions) by an individual at the job site. Examples are component manipulations, use of human performance tools and other work practices, calculations, tool use, verbal exchanges, shortcuts, and procedure use. The effect of individual behavior is a change in the state of plant structures, systems, and/or components—plant results—for good or bad.


91

Plant Results This element of the performance model represents the outcomes to the physical plant—good or bad. Examples of plant results include unit capacity factor, forced outages, heat rate, equipment reliability, safety-system availability, and outage effectiveness, as well as injuries, overexposures, spills, damage, trips, and transients. The quality of plant performance depends on the presence, integrity, and effectiveness of defenses. Through various feedback mechanisms, the quality of human performance and plant results can be monitored. Performance improvement processes, such as trending, observations, self-assessment, operating experience, and the corrective action program, can be used to make appropriate changes in the organization of work.

Leadership Resources devoted to production will always compete with those devoted to safety and prevention. Without aggressive value-based leadership, production tends to usurp prevention. Production is goal-directed; prevention is value-directed. If people do not value safety and reliability, productivity will suffer in the long term. Leaders have to verify that safety and reliability will always take priority if there is a conflict with production goals. Leaders—good and bad—pass on their values, most often face to face, anywhere and any time, that affect people’s shared values, beliefs, attitudes, and practices. Chapter 4 provides more specific insights about culture and leadership.

Behavior Engineering Model – Nuclear The behavior engineering model is an organized structure for identifying potential factors that impact performance at the job site, and for analyzing the organizational contributors to those factors. As previously stated, job-site conditions that affect behavior can be categorized into two types of variables: 1) the environment and 2) the individual. Environmental factors include conditions external to the individual, while individual factors include internal conditions generally under the person’s control. However, some aspects of human nature, such as stress, instinctive reflexes, and mental biases, are not always controllable. The BEM-N specifies those factors relevant to the individual performer and the environment in which the person performs. The BEM is denoted with the letter “N” for nuclear, because this version is an industry-specific adaptation of the original BEM from Tom Gilbert’s book Human Competence, Engineering


92

Worthy Performance (1978). The BEM-N is illustrated in two tables on the following pages. Antecedent conditions that stimulate behavior—direction to act—include directives, knowledge, or cues that inform or prompt a person to act. Job-site conditions that set the occasion for behavior—opportunity to act—include those factors that make action achievable or realizable. Lastly, conditions that tend to reinforce the act—willingness to act—are shaped by the match of the individual’s motives with the incentives associated with the job or task. These categories attempt to describe the “stimulus-response” components of human behavior.12 Strategically, organizational factors provide the greatest leverage in terms of potential for improving human performance. Leverage and cost are important factors to consider when determining corrective actions. Think back to the Anatomy of an Event. It is estimated that 85 percent or more of the causes of plant events have their origins in the processes and culture of the organization. Changes in environmental factors offer greater impact at less expense on performance improvement than changes at the individual level.13 For example, if the causes of a performance problem point to individual factors (motives, capacity/readiness, and knowledge and skills), implementation of corrective actions would have less immediate influence and the cost in generating the desired improvement will likely be greater.14

MoreLess Leverage to Affect PerformanceMore LessCost of Corrective Actions

Incentives &Disincentives

Resources &Environment

Job/Task-RelatedInformation

MotivesCapacity &ReadinessKnowledge

& Skill

Individual Factors Environmental Factors

Performance

Improvement

(Reprinted with permission of the International Society for Performance Improvement, www.ispi.org.)

MoreLess Leverage to Affect PerformanceMore LessCost of Corrective Actions





& Skill

Individual Factors Environmental Factors

Performance

Improvement

MoreLess Leverage to Affect Performance MoreLess Leverage to Affect PerformanceLeverage to Affect PerformanceMore LessCost of Corrective ActionsMore LessCost of Corrective ActionsCost of Corrective Actions




Incentives &DisincentivesIncentives &Disincentives

Resources &EnvironmentResources &Environment




& Skill

MotivesMotivesCapacity &Readiness

Capacity &ReadinessKnowledge

& SkillKnowledge

& Skill

Individual Factors Environmental FactorsIndividual Factors Environmental Factors

Performance

Improvement

(Reprinted with permission of the International Society for Performance Improvement, www.ispi.org.)


93

The BEM-N is illustrated in the following tables. The table below describes those job-site conditions that are relevant to the performer’s work environment. Deficiencies with the numbered items can create error-likely situations for the individual during the task at hand.

Direction to Act Opportunity to Act Willingness to Act

Job or Task-Related Information (requirements / guidance on what one is supposed to do and how well)

Resources and Environment (external conditions affecting performance of the job or task)

Incentives and Disincentives (an environment of rewards and sanctions explicitly or implicitly associated with the job or task)

Fact

ors

1. Job or task goals, desired results, roles and responsibilities, and criteria for success are clearly identified.

2. The risk importance of the job or task and critical steps, if any, have been denoted and communicated as such.

3. Clear expectations and standards for the conduct of work exist and have been communicated.

4. The usability, accuracy, and availability of procedures support error-free performance.

5. Relevant feedback on previous job or task performance, including opportunities for development, has been given to the individual (if applicable).

1. Tools, material, clothing, furniture, facilities, systems, and equipment accommodate human limitations and are available and accessible.

2. Other individuals or organizations are available for support, if needed.

3. Adequate time is allotted, and other work conditions that could hinder performance are eliminated or minimized.

4. The values, attitudes, and beliefs of the person’s immediate work group about hazards in the workplace support safe practices.

1. Financial and non-financial rewards and disincentives are contingent on performance.

2. Competing incentives for poor performance are eliminated.

3. The job or task provides opportunities for success and career advancement, meets employee needs, and result in identifiable pieces of work traceable to the individual.

4. People are treated with honesty, fairness and respect regardless of position in the organization.

5. Work group standards are consistent with the above.

Env

iron

men

tal Relevant Error precursors:

• simultaneous, multiple tasks • repetitive actions; monotonous • irreversible actions • interpretation demands • unclear goals, roles, and

responsibilities • lack of or unclear standards • confusing procedure or

vague guidance • unclear strategic vision • meaningless rules • excessive communication

requirements • delays or idle time • long-term monitoring

Relevant Error precursors: • time pressure • distractions / interruptions • changes / departures from routine • confusing displays or controls • identical and adjacent displays or

controls • workarounds • OOSφ instrumentation or warning

systems • hidden equipment response • unexpected equipment conditions • lack of alternative indication • complexity • unavailable tools, parts, etc. • high data flow • back shift / recent shift change • adverse physical climate /

habitability • conflicting conventions;

stereotypes • backshift; recent shift change • poor equipment layout / access • nuisance alarms • equipment sensitivity to vibration

Relevant Error precursors: • high workload • fear of consequences of mistakes • production overemphasis • personality conflict • excessive time on task • repetitive actions / monotony • mistrust among coworkers /

workgroups • regular use of at-risk practices • excessive time on task • excessive group cohesiveness /

peer pressure • no accounting of performance • acceptability of “cookbooking”

φ OOS – out of service (Adapted with permission of the International Society for Performance Improvement, www.ispi.org.)


94

The table below describes those job-site conditions that are relevant to the individual performer. Deficiencies with the numbered items can create error-likely situations for the performer during the task at hand.

Direction to Act Opportunity to Act Willingness to Act

Knowledge and Skills (basic/specialized understanding of concepts, theories, system construction, fundamentals, and skills)

Capacity and Readiness (physical, mental, and emotional factors influencing individual’s ability / capacity to perform a job or task)

Personal Motives (intrinsic & induced motivation related to an individual’s needs for achievement, affiliation, security, and control)

Fact

ors

1. Individual is qualified for the job or task and possesses the knowledge, skills, experience, and proficiency necessary to perform the task successfully.

2. Individual understands the job or task objective(s), critical steps, and potential consequences if performed improperly.

3. Individual understands the roles and responsibilities of others.

1. Individual possesses the intelligence, sociability, aptitude, size, strength, and dexterity to perform the job or task successfully.

2. Individual is available for work, undistracted, and fit for duty.

1. Individual cares about performing the job or task well.

2. Individual possesses a healthy work ethic and is willing to do what is right regardless of what others would do.

3. Individual feels that the job or task is meaningful and attainable, progress is recognizable, and the task generates a personal sense of accomplishment.

Indi

vidu

al Relevant Error precursors:

• unfamiliarity with task • first time with task • new technique not used before • lack of proficiency • lack of experience • imprecise communication habits • indistinct problem-solving skills • unaware of critical parameters • tunnel vision (lack of big picture)

Relevant Error precursors: • stress • habit patterns • assumptions • complacency or overconfidence • mind set • Pollyanna risk perception • mental shortcuts (biases) • limited short-term memory;

attention span • limited perspective (bounded

rationality) • illness or fatigue • anxiety • poor teamwork skills • major life event • sugar cycle (after a meal) • poor manual dexterity • low self-esteem; moody • physical reflex or imprecise

physical action • physical size too large or small for

task • human variability • spatial disorientation

Relevant Error precursors: • production, “get-r-done” mindset • willingness to sidestep the rules for

personal gain • “unsafe” attitude toward critical

steps • questionable ethics • boredom • fear of failure / consequences • excessive professional courtesy • excessive group cohesiveness • social deference • no sense of control /

learned helplessness • avoidance of mental strain

(Adapted with permission of the International Society for Performance Improvement, www.ispi.org.)

The BEM-N can serve as an analysis tool for evaluating performance problems, providing a framework for exposing the real root causes that originate within the organization. The BEM-N contains many of the factors—good and bad—that influence human performance, including error precursors. This is not intended to replace the TWIN model of error precursors, but is included here to show that error


95

precursors, like other job-site conditions, are the result of organizational processes and values. In each case, one or more aspects of the organization that establish a job-site condition or error precursor can be identified. For instance, an individual’s level of knowledge is likely an outcome of the organization’s training program, or the human resources selection process may have overlooked required abilities necessary for the task at hand.15

Warning Flags – Factors that Defeat Defenses With the assistance of several utility executives in 1999, INPO conducted a study of utilities that experienced extended plant shutdowns. The results of the study identified several common organizational themes. These weaknesses with organization and management have been termed “warning flags.” These latent conditions are important in that they are conducive to the degradation and accumulation of flawed defenses and human-performance-related events. Each factor described below possesses a predictive quality, and if not responded to aggressively, they may lead to permanent plant shutdown and possible closure:

• Overconfidence – The “numbers” are good, and the nuclear staff is living off past successes. Consequently, the staff does not recognize low-level problems and remains unaware of hazards.

• Isolationism – There are few interactions with other utilities, INPO, and industry groups. Benchmarking is seldom done or is limited to “industrial tourism,” without the implementation of good practices learned. As a result, the plant lags the industry in many areas of performance and may be unaware of it.

• Managing Relationships – The mind-set toward the NRC or INPO is defensiveness or “do the minimum.” Internal to the organization, employees are not involved and are not listened to, and raising problems is not valued. Adversarial relationships hinder open communication.

• Operations and Engineering – Operations standards, formality, and discipline are lacking. Other issues, initiatives, or special projects overshadow plant operational focus. Engineering is weak, usually through a loss of talent, or lacks alignment with operational priorities. Design basis is not a priority, and design margins erode over time.

• Production Priorities – Important equipment problems linger, and repairs are postponed while the plant stays on line. Nuclear safety is assumed and is not explicitly emphasized in staff interactions and site communications.


96

• Managing Change – Organizational changes, staff reductions, retirement programs, and relocations are initiated before their impacts are fully considered. Recruiting or training is not used to compensate for the changes. Processes and procedures do not support strong performance following management changes.

• Plant Events – Event significance is unrecognized or underplayed, and reactions to events and unsafe conditions are not aggressive. Organizational causes of events are not explored in depth.

• Nuclear Leaders – Managers are defensive, lack team skills, or are weak communicators. Managers lack integrated plant knowledge or operational experience. Senior managers are not involved in operations and do not exercise accountability or do not follow up.

• Self-Critical – Oversight organizations lack an unbiased outside view or deliver only good news. Self-assessment processes, such as management observation programs, do not find problems or do not address them; or the results are not acted on in time to make a difference.

Finding and Correcting Latent Weaknesses Because fewer significant events are occurring, less information is available about the presence of flawed controls and defenses. Therefore, more dependence is placed on the gathering of performance information from other sources. Greater reliance is now placed on field observations, self-assessments, benchmarking, apparent cause evaluations, and trending, among others, to provide management with information to improve performance and to eliminate vulnerabilities to plant events. Since performance improvement is a line responsibility, INPO published the document, INPO 05-005, Guidelines for Performance Improvement at Nuclear Power Stations, to aid management in identifying and closing vulnerabilities and performance gaps. Performance improvement involves three primary activities:

• Performance monitoring – activities that assess current performance, identifying gaps between current and desired levels of performance or results

• Analyzing, identifying, and planning solutions – activities that determine actions needed to close the gaps

• Implementing solutions – the collective activities that result in applying the chosen solutions and verifying their effectiveness to close the gaps


97

Performance Improvement Model

LEADERSHIP AND

OVERSIGHT

KNOWLEDGEAND SKILLS

CULTURE

Excellence in Performance Improvement

ImplementingSolutions

Task Assignment

Action Tracking

Management Oversight/

Reinforcement

Organizational Accountability

Resource Management

Analyzing, Identifying and

Planning SolutionsProblem Analysis

Action Planning

Management Review & Approval

Business Planning

Considerations

Performance Monitoring

Standards

EffectivenessReviews

PerformanceAssessment

Benchmarking

Independent Oversight

Industry OE

Performance Indicators

SelfAssessments

Behavior Observations

Problem Reporting

Trending

ACTIONS

RESULTS

GAPS

Performance Improvement Model

LEADERSHIP AND

OVERSIGHT

KNOWLEDGEAND SKILLS

CULTURE



Task Assignment

Action Tracking


Reinforcement


Resource Management



Action Planning


Business Planning

Considerations


Standards



Benchmarking


Industry OE


SelfAssessments


Problem Reporting

Trending

ACTIONS

RESULTS

GAPS

LEADERSHIP AND

OVERSIGHT

KNOWLEDGEAND SKILLS

CULTURE



Task Assignment

Action Tracking


Reinforcement


Resource Management



Action Planning


Business Planning

Considerations


Standards



Benchmarking


Industry OE


SelfAssessments


Problem Reporting

Trending

LEADERSHIP AND

OVERSIGHT

KNOWLEDGEAND SKILLS

CULTURE


LEADERSHIP AND

OVERSIGHT

LEADERSHIP AND

OVERSIGHT

KNOWLEDGEAND SKILLSKNOWLEDGEAND SKILLS

CULTURE




Task Assignment

Action Tracking


Reinforcement


Resource Management



Task Assignment

Task Assignment

Action TrackingAction

Tracking


Reinforcement


Reinforcement

Organizational AccountabilityOrganizational Accountability

Resource Management

Resource Management



Action Planning


Business Planning

Considerations Analyzing, Identifying and

Planning Solutions


Planning SolutionsProblem AnalysisProblem Analysis

Action Planning

Action Planning



Business Planning

Considerations

Business Planning

Considerations


Standards



Benchmarking


Industry OE


SelfAssessments


Problem Reporting

Trending



Standards



Benchmarking


Industry OE


SelfAssessments


Problem Reporting

Trending

StandardsStandards



PerformanceAssessmentPerformanceAssessment

BenchmarkingBenchmarking



Industry OEIndustry OE



SelfAssessments

SelfAssessments



Problem ReportingProblem

Reporting

TrendingTrending

ACTIONSACTIONS

RESULTSRESULTS

GAPSGAPS

Without self-critical self-assessments, defenses can degrade over time without management’s knowledge and can accumulate. Undetected irregularities, variations, and defects can develop surreptitiously. Effective continuous improvement processes include the following methods:

• self-assessments • performance indicators • trending • benchmarking • operating experience • independent oversight • behavior observations • problem reporting • problem (causal) analysis • surveys and questionnaires

• management oversight, involvement, and reinforcement

• corrective action program The following paragraphs address selected methods from INPO 05-005, Guidelines for Performance Improvement at Nuclear Power Stations, August 2005, including additional insights unique to human performance not specifically dealt with in the document.

Self-Assessment Self-assessment involves finding problems through comparison of actual performance to standards of excellence. The guidance in INPO’s Principles for Effective Self-Assessment and Corrective Action Programs (December 1999)


98

provides a high-level description of an effective approach to self-assessment. Self-assessments are likely the most effective means of identifying latent weaknesses in the organization and the plant. Therefore, managers should take an aggressive posture toward the performance of self-assessments, especially for their respective organizations and processes. Additionally, process mapping offers an effective method for finding systemic and programmatic problems with station processes and programs. Process mapping makes work visible, showing who is doing what, with whom, with what, when, and for how long. Handoffs and interactions among work groups become evident. Also, process maps are good for streamlining work activities and telling new people, as well as customers, "what we do around here." They also can help in the effort to reduce cycle time, avoid rework, eliminate some inspections or quality control steps, and prevent errors.16

Performance Indicators and Trending Performance indicators, combined with effective analysis of lower-tier databases, allow quick identification of undesirable trends and help managers focus actions on pressing issues to drive continuous improvement. The following indicators, in order of frequency of use, are commonly employed by the industry.17

• event rate (count of event-free days between events) • error rate (number of errors from all problem reports submitted during a

period of time) • culture index (changes in employee survey parameters from survey to

survey) • industrial safety accident rate • self-identification ratio • document revision requests • indices (weighted calculation of several other indicators related to human

performance; for example, events, industrial safety, security, radiological)

• procedure compliance • observations (scoring of work performance and coaching feedback) • rework (amount of maintenance-related work that results in delays or

additional costs over a given period) • out-of-service errors (error rates associated with lockout/tagout

activities)


99

• repeat events • workarounds • backlogs

Pareto charts help identify the factors or conditions contributing to the lion’s share of problems. The Pareto principle, or 80/20 rule, is a naturally occurring pattern that helps identify the “big hitters,” so that limited resources can be concentrated on resolving or improving the issues that comprise 80% of all the problems. A Pareto chart is not time dependent. Therefore, after identifying the big-hitter categories, analysts can plot each category for the past 6 to 12 months as appropriate. Low-cost corrective actions are implemented to address apparent causes of those issues. Additionally, analysts can plot data over time for these categories to see how each category trends over time—a control chart. This lets management know if the corrective actions helped resolve the issue. If the control chart reveals a potential adverse or non-improving trend, then the analysts generate a problem report to document the need for further evaluation and review of corrective action effectiveness. A fundamental understanding of the presentation of data and its variation should guide management’s interpretation of trend data. A common management error is taking premature action on what may appear to be an undesirable trend when, in fact, there is no trend, only normal statistical variation. Adverse trends should be defined such that action is taken only when a clear systemic cause is evident. Goals are a major source of motivation. Aggressive and achievable goals tend to produce higher levels of output than generalized goals such as “do your best.” Also, the specificity of a goal itself acts as an internal motivator for the individual.18 However, managers may become content, perhaps even complacent, if an indicator currently satisfies a specific goal, which can imply that performance is acceptable. Human performance is a constant struggle with human nature, and it cannot be assumed to be acceptable if a goal is reached. In the spirit of continuous improvement, human performance cannot be managed like a simple project. Goals associated with human performance should be in terms of its trend and direction, not whether it is meeting some target value.

Benchmarking Benchmarking compares current practices with those elsewhere to identify vulnerabilities, performance gaps, and opportunities for improvement. Comparison of station practices with the practices of other stations considered


100

“best in class” should occur on an ongoing basis, managed by a strategic benchmarking plan. The benchmarking process is guided by a structured approach to gather information on a specific issue. Improvements are documented and progress monitored via the corrective action process. Practical managers avoid “industrial tourism,” which involves visiting other facilities but not identifying or following through on areas for improvement within their own stations.

Operating Experience People have an innate or natural tendency to think “It can’t happen here” or “That won’t happen to me.” Humans underestimate risk and overestimate their ability to maintain control. This sense of invulnerability is an unsafe attitude. Prudent use of operating experience must be a relentless pursuit of leadership. Operating experience is most effective when the right information is communicated to the right people in time to make a difference. Lessons learned can be reinforced during various training forums and through day-to-day activities such as prejob briefings, coaching and reinforcement by supervisors, and engineering design reviews. Prejob briefings offer one of the more timely opportunities to use operating experience. To better internalize the lessons learned, individuals with key responsibilities in the work activity are asked to explain how they will avoid specific errors committed in the events described. Supervisors consider appropriate defenses to avoid or mitigate errors and the consequences suffered in the event. One source of operating experience commonly overlooked that may shed light on latent weaknesses is work history associated with specific jobs. Individuals experienced with the task and assigned to the present job have information that is usually pertinent to the task. Work history often provides more useful insights to the assigned workers than industry operating experience, especially if the industry operating experience is irrelevant to the task at hand. Prudent managers make effective use of operating experience tools (for example, Nuclear Network® and the INPO Web site) and have a systematic way of providing just-in-time, relevant operating experience information to workers. Relevant is a key word. The right information on events should be useful to the user as he or she prepares to perform the assigned task. Finally, the “Prevent Events” section in INPO operating experience documents provides insights that may be pertinent to a person’s role and the technical elements of a task.


101

Independent Oversight Reviews of station activities by outside organizations or agencies provide an opportunity to reveal “blind spots” to station management and plant personnel that otherwise would have remained hidden⎯that is, latent. Quality assurance departments, corporate oversight groups, consultants, regulators, and INPO evaluations and assistance provide opportunities to identify latent conditions. With an emphasis on reactor safety, INPO plant evaluations and WANO peer reviews identify conditions, processes, and practices that fall short of industry best practices, possibly leading to degraded plant performance if uncorrected.

Behavior Observations In-field monitoring of individual performance is an excellent way to gather information about how well the organization supports job-site performance. The purpose of an observation is not to criticize or to judge people, but to review the quality and effectiveness of work preparation, policies, and work practices, as well as their implementation. An important purpose of observations is to identify opportunities to improve the organization of work, not just worker practices. The scope of behavior observations should include the whole job, not just worker behavior. Not only it is important to pay attention to worker practices and attention but to monitor the job-site context, potential hazards, and the controls relevant to the work activity. Results are recorded for trending purposes to help identify strengths and weaknesses. Consequently, behavior observations bring to light organizational weaknesses that may not be obvious by other means, especially when the data is considered in the aggregate. The quality of behavior observations is important to gathering accurate performance data. Managers and supervisors must be willing to be critical and intrusive during an observation. Effective observations are planned, involve watching specific activities and critical steps, require feedback, and are recorded. Successful managers and supervisors are able to model expected behaviors. Knowledge of human performance tools and at-risk practices must be exact. To remind managers and supervisors what to watch for, several stations have created behavioral checklists, such as scorecards or coaching cards.19 For specific tasks, knowledge of critical steps, potential errors specific to the task, and targeted worker weaknesses are included within the scope of the observation.20 To improve the quality of observations, senior managers or trained professionals can


102

periodically conduct paired observations to provide feedback to the subordinate manager, peer, or supervisor. When managers and supervisors spend time in the field with workers, performance improves. Error rates tend to decrease when managers and supervisors monitor work in the field.21 The following in-field supervisory practices have contributed to fewer errors by the workforce:

• checking that workers accurately perceive the risk and priorities associated with the task

• observing work practices at critical steps • reinforcing people appropriately when they exhibit proper and effective

work practices • correcting people on the spot for at-risk and unsafe practices and

coaching performance that otherwise does not meet expectations • solving production problems and removing performance obstacles for the

work team or individual

Problem Reporting Finding and eliminating latent weaknesses improve dramatically when worker feedback and communication are encouraged. The workforce is the best source of information about weaknesses in the organization as it applies to support of work in the field. It is important that those not in positions of management or supervision realize the influence they have on station performance. Who is in a better position than workers to provide the feedback managers need to optimize related work processes that support work in the field? Field workers are the beneficiaries of what the organization provides them, and they know its shortcomings. Feedback via postjob reviews provides another credible and fresh source of information. The fundamental purpose of information gained from this review is to improve the organization of work as it supports worker performance at the job site—procedures, work packages, training, supervision, workarounds, and so forth. Such information will help improve productivity, identify opportunities to strengthen defenses against error and events, and eliminate error precursors embedded in the task. To promote the occurrence of postjob reviews on a routine basis, they should be easy and quick to do, and the worker must see appropriate changes in response to his or her feedback.


103

Problem (Causal) Analysis Problem analysis⎯using tools or combinations of tools such as root or apparent cause analysis, common cause analysis, and stream analysis⎯uncovers the underlying causes of problems or adverse trends, commensurate with their significance. It is not the intent of this manual to describe each analysis tool in detail. To gain a deeper appreciation of the various analysis tools available, review INPO 05-005, Guidelines for Performance Improvement at Nuclear Power Stations, August 2005. When it comes to root cause analysis of significant plant events, rather than simply focus on who caused an event, the analyst focuses on what could have prevented the event. Also, it would be worthwhile to determine what kept the event from being more severe—defenses that worked. If causal analysis tends to focus on individual culpability, finding effective corrective actions will be elusive, because it is unlikely the analyst will identify the real causes of the event.22 An effective investigation focuses on discovering the latent weaknesses embedded in the organization, its culture, and the physical plant, rather than simply singling out one or two individuals for counseling or training. “Inattention to detail” and “not following procedures” are not root causes even though these are still commonly cited as such throughout the industry. A root cause is the cause that, if corrected, will prevent recurrence of the event. Human error cannot be eliminated completely—inattention will continue to occur despite our best efforts to eliminate it. Therefore, root cause statements such as “failure to self-check,” cannot be considered root causes, because recurrence cannot be eliminated. Investigations of events triggered by active error are usually distorted by hindsight— the analyst’s knowledge of facts after the event that were not known, or knowable, by the principal individuals before the event. Hindsight predisposes the analyst to search for data that confirms the apparent shortcomings of the individual(s). Also, explaining what people could have or should have done explains nothing about why they did what they did. To err or not to err is not a choice. The challenge for the analyst is to determine why actions of the individuals made sense to them at the time. An analyst can build that context by identifying the following for each individual: 23

• what they were trying to accomplish (goals) • what they were paying attention to (focus)


104

• what each person knew at critical points in the sequence of events (knowledge and situation awareness)

This information is obtainable from the individuals, through interviews, and by a review of the job-site conditions for each individual (procedures, recorder traces, logs, computer printouts, and so forth.). The Anatomy of an Event model, introduced in Chapter 1, offers another structured approach to analyzing human performance issues. Working backward through the Anatomy of an Event, from the event consequences to the organizational weaknesses that stimulated the event, helps explain the context of performance. Four major areas of fact need to be uncovered: the specific consequences; initiating actions (active errors) and error precursors that provoked the active errors; flawed defenses that either failed to prevent the active errors or failed to prevent or mitigate the event consequences; and the organizational weaknesses that contributed to every factor just mentioned.24 In the end, the analysis should clearly show the causal links (line of sight) from the organizational weaknesses to the event consequences. Stream analysis is another powerful technique that aids in the discovery of the organizational underpinnings of inadequate performance. It presupposes that individual behavior determines the characteristics of an organization and its outcomes. Sustained, successful organizational improvement occurs only when the organization’s members—managers, supervisors, and workers—improve their behaviors. Historical performance issues are categorized into four or five key organizational dimensions, or streams, that influence individual behavior. These key dimensions are similar to the lines of defense: engineered controls (physical plant and technology, administrative controls (procedures), cultural controls (leadership and values), and oversight controls (performance improvement). Effective application of stream analysis depends on active participation of the respective management team during facilitated meetings. More information about stream analysis is available from the book Stream Analysis, A Powerful Way to Diagnose and Manage Organizational Change, by Dr. Jerry Porras.

Management Oversight Fundamentally, management must have assurance that the risk of human error is minimized and controlled, especially during risk-important activities. A system of accountability helps verify that challenges to human performance are


105

aggressively identified and addressed. Management verifies that expectations are performed to standards, that performance gaps are identified and closed, that corrective actions are completed effectively, and so on. See Human Performance Steering Committee earlier in this chapter to review one way the senior management team can perform its oversight responsibilities.

Surveys and Questionnaires Monitoring changes in employee attitudes via periodic surveys identifies trends in values and beliefs. Surveys and standard questionnaires enable comparison of attitudes, values, and beliefs across an organization and detection of changes over time.25 Survey results help managers determine where their time and effort can be applied most effectively to address misunderstandings and inappropriate values. However, there is a tendency to “ask, but not act.” If people are uninformed of the results and changes derived from the information gathered, they become frustrated, doubtful of management’s sincerity in wanting improvement, and uncooperative with future surveys.

Corrective Action Program The corrective action program provides management with a tool to systematically adjust defenses and performance. The program helps management identify, document, evaluate, and trend performance issues to facilitate the development and implementation of appropriate actions to correct problems. An effective learning organization depends on a strong corrective action program. The document Principles for Effective Self-Assessment and Corrective Action Programs (INPO, December 1999) provides key insights into developing and maintaining an effective corrective action program.

Change Management Change management is a methodical process that enables managers to establish the direction of change, align people and resources, and implement the selected modifications throughout the organization. Regardless of the scope of the change, it should be managed. Typically, change management has been reserved for large-scale organizational change and is not considered for day-to-day activities. However, most daily management activity involves some degree of change, such as changes in crew composition, outage schedule, policies, procedures, and equipment. More specifically, schedule changes are a common contributor to plant events, especially during outages.


106

Experience has shown that change fails most often when implemented without the following:26

• a clear vision • a plan • an obvious or self-revealing value added (especially for those most

affected) • consulting the people affected (without their participation) • sufficiently considering the new values, attitudes, and beliefs needed • positive reinforcement of new behaviors by supervision and management • patience and perseverance

Effective change management reduces the potential of error by managers when they change things. Without a structured approach to planning and implementing change, the error potential of managers and the support staff is higher. Organizations that have been successful with change have used a systematic process driven by quality leadership as well as excellent management.27 Several approaches to change management exist; and several books on the topic are sold commercially. Whether it is a popular method used by Wall Street or one developed in-house, successful managers use change management on a regular basis.


107

ATTACHMENT A PERFORMANCE MODEL (with defenses)

Se

lf-C

heck

ing

Plac

e-K

eepi

ng

Effe

ctiv

e C

omm

unic

atio

n

Con

curr

ent

Verif

icat

ion

Proc

edur

e U

se&

Adh

eren

ce

Supe

rvis

ion

Man

agem

ent

Mon

itorin

g

Stop

Whe

nU

nsur

e

Crit

ical

Par

amet

ers

Prob

lem

-sol

ving

Met

hodo

logy

Con

serv

ativ

eD

ecis

ion-

Mak

ing

Team

Skill

s

Peer

-Che

ckin

g

Rec

ogni

zing

Erro

r Tra

ps

Rig

or

Flag

ging

Que

stio

ning

Atti

tude

Job-

site

Rev

iew

Safe

guar

dsEq

uipm

ent

Rea

ctor

Prot

ectio

nSy

stem

s

Con

tain

men

t

Equi

pmen

tR

elia

bilit

y

Equi

pmen

t Lab

elin

g&

Equ

ipm

ent C

ondi

tion

Proc

edur

e / W

ork

Pack

age

Qua

lity

Wor

ker K

now

ledg

e,Sk

ill, &

Pro

ficie

ncy

Fitn

ess-

for-

Dut

y

Une

asy

Attit

ude

Equi

pmen

t Erg

onom

ics

& H

uman

Fac

tors To

ol Q

ualit

y&

Ava

ilabi

lity

Rol

es &

Res

pons

ibili

ties

Hou

seke

epin

gEn

viro

nmen

tal

Con

ditio

ns

Fore

ign

Mat

eria

lEx

clus

ion

Lock

out /

Tago

utPe

rson

alM

otiv

esIn

tole

ranc

e fo

rEr

ror T

raps

Mor

ale

RW

PsWor

k-ar

ound

s &

Inco

nven

ienc

es

Valu

es &

Bel

iefs

Com

mun

icat

ion

Prac

tices

& P

lan

Rev

iew

s &

Appr

oval

s

Cha

nge

Mgm

t.

Prob

lem

-So

lvin

g

Sche

dulin

g /

Sequ

enci

ngCle

arEx

pect

atio

ns

Rol

eM

odel

sSa

fety

Cul

ture

Task

Allo

catio

n

Mee

tings

Rew

ards

&R

einf

orce

men

t

Tren

d An

alys

is

Op

Ex

Trai

ning

Han

doffs

Acco

unta

bilit

y

Sim

ple

/ Effe

ctiv

ePr

oces

ses

Proc

edur

eR

evis

ions

Wor

kM

gmt

Cor

rect

ive

Actio

nPr

ogra

m

Self-

Asse

ssm

ent

Ben

chm

arki

ng

Com

patib

leG

oals

& P

riorit

ies

Stra

tegi

cH

U P

lans M

anag

emen

t Ove

rsig

ht

Staf

fing

Labo

rR

elat

ions

Soci

aliz

atio

n

Des

ign

& C

onfig

urat

ion

Con

trol

Lead

ersh

ip

PLA

NT

RES

ULT

S

JOB

-SIT

EC

ON

DIT

ION

S

OR

GA

NIZ

ATI

ON

AL

FAC

TOR

S

WO

RK

ERB

EHA

VIO

R

Prej

obB

riefin

gJu

st-in

-tim

eO

pera

ting

Expe

rienc

eTa

sk P

revi

ew

Turn

over

Cle

aran

ce W

alkd

own

Wal

kdow

ns

Perf

orm

ance

Feed

back

Task

Ass

ignm

ent

HP

Surv

eys

Task

Qua

lific

atio

n

Post

job

Rev

iew Pr

oble

mR

epor

ting

Cau

sal

Anal

ysis Pe

rfor

man

ceIn

dica

tors

Inde

pend

ent O

vers

ight

QC

Hol

d Po

ints

Inde

pend

ent

Verif

icat

ion

Inte

rlock

sPe

rson

alPr

otec

tive

Equi

pmen

tAl

arm

sForc

ing

Func

tions

Fore

ign

Mat

eria

lEx

clus

ions

Prop

erR

eact

ions

Hig

hSt

anda

rds

Rei

nfor

cem

ent

Coa

chin

g

Situ

atio

n Aw

aren

ess

Res

pect

for O

ther

s

Ope

n &

Hon

est

Com

mun

icat

ion

Com

pelli

ngVi

sion

Hea

lthy

Rel

atio

nshi

ps

Cou

rage

&In

tegr

ityM

otiv

atio

n

Sets

Exam

ple

Self-

Che

ckin

gPl

ace-

Kee

ping

Effe

ctiv

e C

omm

unic

atio

n

Con

curr

ent

Verif

icat

ion

Proc

edur

e U

se&

Adh

eren

ce

Supe

rvis

ion

Man

agem

ent

Mon

itorin

g

Stop

Whe

nU

nsur

e

Crit

ical

Par

amet

ers

Prob

lem

-sol

ving

Met

hodo

logy

Con

serv

ativ

eD

ecis

ion-

Mak

ing

Team

Skill

s

Peer

-Che

ckin

g

Rec

ogni

zing

Erro

r Tra

ps

Rig

or

Flag

ging

Que

stio

ning

Atti

tude

Job-

site

Rev

iew

Safe

guar

dsEq

uipm

ent

Rea

ctor

Prot

ectio

nSy

stem

s

Con

tain

men

t

Equi

pmen

tR

elia

bilit

y

Equi

pmen

t Lab

elin

g&

Equ

ipm

ent C

ondi

tion

Proc

edur

e / W

ork

Pack

age

Qua

lity

Wor

ker K

now

ledg

e,Sk

ill, &

Pro

ficie

ncy

Fitn

ess-

for-

Dut

y

Une

asy

Attit

ude

Equi

pmen

t Erg

onom

ics

& H

uman

Fac

tors To

ol Q

ualit

y&

Ava

ilabi

lity

Rol

es &

Res

pons

ibili

ties

Hou

seke

epin

gEn

viro

nmen

tal

Con

ditio

ns

Fore

ign

Mat

eria

lEx

clus

ion

Lock

out /

Tago

utPe

rson

alM

otiv

esIn

tole

ranc

e fo

rEr

ror T

raps

Mor

ale

RW

PsWor

k-ar

ound

s &

Inco

nven

ienc

es

Valu

es &

Bel

iefs

Com

mun

icat

ion

Prac

tices

& P

lan

Rev

iew

s &

Appr

oval

s

Cha

nge

Mgm

t.

Prob

lem

-So

lvin

g

Sche

dulin

g /

Sequ

enci

ngCle

arEx

pect

atio

ns

Rol

eM

odel

sSa

fety

Cul

ture

Task

Allo

catio

n

Mee

tings

Rew

ards

&R

einf

orce

men

t

Tren

d An

alys

is

Op

Ex

Trai

ning

Han

doffs

Acco

unta

bilit

y

Sim

ple

/ Effe

ctiv

ePr

oces

ses

Proc

edur

eR

evis

ions

Wor

kM

gmt

Cor

rect

ive

Actio

nPr

ogra

m

Self-

Asse

ssm

ent

Ben

chm

arki

ng

Com

patib

leG

oals

& P

riorit

ies

Stra

tegi

cH

U P

lans M

anag

emen

t Ove

rsig

ht

Staf

fing

Labo

rR

elat

ions

Soci

aliz

atio

n

Des

ign

& C

onfig

urat

ion

Con

trol

Lead

ersh

ip

PLA

NT

RES

ULT

S

JOB

-SIT

EC

ON

DIT

ION

S

OR

GA

NIZ

ATI

ON

AL

FAC

TOR

S

WO

RK

ERB

EHA

VIO

R

Prej

obB

riefin

gJu

st-in

-tim

eO

pera

ting

Expe

rienc

eTa

sk P

revi

ew

Turn

over

Cle

aran

ce W

alkd

own

Wal

kdow

ns

Perf

orm

ance

Feed

back

Task

Ass

ignm

ent

HP

Surv

eys

Task

Qua

lific

atio

n

Post

job

Rev

iew Pr

oble

mR

epor

ting

Cau

sal

Anal

ysis Pe

rfor

man

ceIn

dica

tors

Inde

pend

ent O

vers

ight

QC

Hol

d Po

ints

Inde

pend

ent

Verif

icat

ion

Inte

rlock

sPe

rson

alPr

otec

tive

Equi

pmen

tAl

arm

sForc

ing

Func

tions

Fore

ign

Mat

eria

lEx

clus

ions

Self-

Che

ckin

gPl

ace-

Kee

ping

Effe

ctiv

e C

omm

unic

atio

n

Con

curr

ent

Verif

icat

ion

Proc

edur

e U

se&

Adh

eren

ce

Supe

rvis

ion

Man

agem

ent

Mon

itorin

g

Stop

Whe

nU

nsur

e

Crit

ical

Par

amet

ers

Prob

lem

-sol

ving

Met

hodo

logy

Con

serv

ativ

eD

ecis

ion-

Mak

ing

Team

Skill

s

Peer

-Che

ckin

g

Rec

ogni

zing

Erro

r Tra

ps

Rig

or

Flag

ging

Que

stio

ning

Atti

tude

Job-

site

Rev

iew

Self-

Che

ckin

gPl

ace-

Kee

ping

Effe

ctiv

e C

omm

unic

atio

n

Con

curr

ent

Verif

icat

ion

Proc

edur

e U

se&

Adh

eren

ce

Supe

rvis

ion

Man

agem

ent

Mon

itorin

g

Stop

Whe

nU

nsur

e

Crit

ical

Par

amet

ers

Prob

lem

-sol

ving

Met

hodo

logy

Con

serv

ativ

eD

ecis

ion-

Mak

ing

Team

Skill

s

Peer

-Che

ckin

g

Rec

ogni

zing

Erro

r Tra

ps

Rig

or

Flag

ging

Que

stio

ning

Atti

tude

Job-

site

Rev

iew

Self-

Che

ckin

gPl

ace-

Kee

ping

Effe

ctiv

e C

omm

unic

atio

n

Con

curr

ent

Verif

icat

ion

Proc

edur

e U

se&

Adh

eren

ce

Supe

rvis

ion

Man

agem

ent

Mon

itorin

g

Stop

Whe

nU

nsur

e

Crit

ical

Par

amet

ers

Prob

lem

-sol

ving

Met

hodo

logy

Con

serv

ativ

eD

ecis

ion-

Mak

ing

Team

Skill

s

Peer

-Che

ckin

g

Rec

ogni

zing

Erro

r Tra

ps

Rig

or

Flag

ging

Que

stio

ning

Atti

tude

Job-

site

Rev

iew

Safe

guar

dsEq

uipm

ent

Rea

ctor

Prot

ectio

nSy

stem

s

Con

tain

men

t

Equi

pmen

tR

elia

bilit

ySa

fegu

ards

Equi

pmen

t

Rea

ctor

Prot

ectio

nSy

stem

s

Con

tain

men

t

Equi

pmen

tR

elia

bilit

y

Equi

pmen

t Lab

elin

g&

Equ

ipm

ent C

ondi

tion

Proc

edur

e / W

ork

Pack

age

Qua

lity

Wor

ker K

now

ledg

e,Sk

ill, &

Pro

ficie

ncy

Fitn

ess-

for-

Dut

y

Une

asy

Attit

ude

Equi

pmen

t Erg

onom

ics

& H

uman

Fac

tors To

ol Q

ualit

y&

Ava

ilabi

lity

Rol

es &

Res

pons

ibili

ties

Hou

seke

epin

gEn

viro

nmen

tal

Con

ditio

ns

Fore

ign

Mat

eria

lEx

clus

ion

Lock

out /

Tago

utPe

rson

alM

otiv

esIn

tole

ranc

e fo

rEr

ror T

raps

Mor

ale

RW

PsWor

k-ar

ound

s &

Inco

nven

ienc

es

Valu

es &

Bel

iefs

Equi

pmen

t Lab

elin

g&

Equ

ipm

ent C

ondi

tion

Proc

edur

e / W

ork

Pack

age

Qua

lity

Wor

ker K

now

ledg

e,Sk

ill, &

Pro

ficie

ncy

Fitn

ess-

for-

Dut

y

Une

asy

Attit

ude

Equi

pmen

t Erg

onom

ics

& H

uman

Fac

tors To

ol Q

ualit

y&

Ava

ilabi

lity

Rol

es &

Res

pons

ibili

ties

Hou

seke

epin

gEn

viro

nmen

tal

Con

ditio

ns

Fore

ign

Mat

eria

lEx

clus

ion

Lock

out /

Tago

utPe

rson

alM

otiv

esIn

tole

ranc

e fo

rEr

ror T

raps

Mor

ale

RW

PsWor

k-ar

ound

s &

Inco

nven

ienc

es

Valu

es &

Bel

iefs

Equi

pmen

t Lab

elin

g&

Equ

ipm

ent C

ondi

tion

Proc

edur

e / W

ork

Pack

age

Qua

lity

Wor

ker K

now

ledg

e,Sk

ill, &

Pro

ficie

ncy

Fitn

ess-

for-

Dut

y

Une

asy

Attit

ude

Equi

pmen

t Erg

onom

ics

& H

uman

Fac

tors To

ol Q

ualit

y&

Ava

ilabi

lity

Rol

es &

Res

pons

ibili

ties

Hou

seke

epin

gEn

viro

nmen

tal

Con

ditio

ns

Fore

ign

Mat

eria

lEx

clus

ion

Lock

out /

Tago

utPe

rson

alM

otiv

esIn

tole

ranc

e fo

rEr

ror T

raps

Mor

ale

RW

PsWor

k-ar

ound

s &

Inco

nven

ienc

es

Valu

es &

Bel

iefs

Com

mun

icat

ion

Prac

tices

& P

lan

Rev

iew

s &

Appr

oval

s

Cha

nge

Mgm

t.

Prob

lem

-So

lvin

g

Sche

dulin

g /

Sequ

enci

ngCle

arEx

pect

atio

ns

Rol

eM

odel

sSa

fety

Cul

ture

Task

Allo

catio

n

Mee

tings

Rew

ards

&R

einf

orce

men

t

Tren

d An

alys

is

Op

Ex

Trai

ning

Han

doffs

Acco

unta

bilit

y

Sim

ple

/ Effe

ctiv

ePr

oces

ses

Proc

edur

eR

evis

ions

Wor

kM

gmt

Cor

rect

ive

Actio

nPr

ogra

m

Self-

Asse

ssm

ent

Ben

chm

arki

ng

Com

patib

leG

oals

& P

riorit

ies

Stra

tegi

cH

U P

lans M

anag

emen

t Ove

rsig

ht

Staf

fing

Labo

rR

elat

ions

Soci

aliz

atio

n

Des

ign

& C

onfig

urat

ion

Con

trol

Com

mun

icat

ion

Prac

tices

& P

lan

Rev

iew

s &

Appr

oval

s

Cha

nge

Mgm

t.

Prob

lem

-So

lvin

g

Sche

dulin

g /

Sequ

enci

ngCle

arEx

pect

atio

ns

Rol

eM

odel

sSa

fety

Cul

ture

Task

Allo

catio

n

Mee

tings

Rew

ards

&R

einf

orce

men

t

Tren

d An

alys

is

Op

Ex

Trai

ning

Han

doffs

Acco

unta

bilit

y

Sim

ple

/ Effe

ctiv

ePr

oces

ses

Proc

edur

eR

evis

ions

Wor

kM

gmt

Cor

rect

ive

Actio

nPr

ogra

m

Self-

Asse

ssm

ent

Ben

chm

arki

ng

Com

patib

leG

oals

& P

riorit

ies

Stra

tegi

cH

U P

lans M

anag

emen

t Ove

rsig

ht

Staf

fing

Labo

rR

elat

ions

Soci

aliz

atio

n

Des

ign

& C

onfig

urat

ion

Con

trol

Com

mun

icat

ion

Prac

tices

& P

lan

Rev

iew

s &

Appr

oval

s

Cha

nge

Mgm

t.

Prob

lem

-So

lvin

g

Sche

dulin

g /

Sequ

enci

ngCle

arEx

pect

atio

ns

Rol

eM

odel

sSa

fety

Cul

ture

Task

Allo

catio

n

Mee

tings

Rew

ards

&R

einf

orce

men

t

Tren

d An

alys

is

Op

Ex

Trai

ning

Han

doffs

Acco

unta

bilit

y

Sim

ple

/ Effe

ctiv

ePr

oces

ses

Proc

edur

eR

evis

ions

Wor

kM

gmt

Cor

rect

ive

Actio

nPr

ogra

m

Self-

Asse

ssm

ent

Ben

chm

arki

ng

Com

patib

leG

oals

& P

riorit

ies

Stra

tegi

cH

U P

lans M

anag

emen

t Ove

rsig

ht

Staf

fing

Labo

rR

elat

ions

Soci

aliz

atio

n

Des

ign

& C

onfig

urat

ion

Con

trol

Lead

ersh

ip

PLA

NT

RES

ULT

SPL

AN

TR

ESU

LTS

PLA

NT

RES

ULT

S

JOB

-SIT

EC

ON

DIT

ION

SJO

B-S

ITE

CO

ND

ITIO

NS

JOB

-SIT

EC

ON

DIT

ION

S

OR

GA

NIZ

ATI

ON

AL

FAC

TOR

S

WO

RK

ERB

EHA

VIO

RW

OR

KER

BEH

AVI

OR

WO

RK

ERB

EHA

VIO

R

Prej

obB

riefin

gJu

st-in

-tim

eO

pera

ting

Expe

rienc

eTa

sk P

revi

ew

Turn

over

Cle

aran

ce W

alkd

own

Prej

obB

riefin

gJu

st-in

-tim

eO

pera

ting

Expe

rienc

eTa

sk P

revi

ew

Turn

over

Cle

aran

ce W

alkd

own

Prej

obB

riefin

gJu

st-in

-tim

eO

pera

ting

Expe

rienc

eTa

sk P

revi

ew

Turn

over

Prej

obB

riefin

gJu

st-in

-tim

eO

pera

ting

Expe

rienc

eTa

sk P

revi

ew

Turn

over

Cle

aran

ce W

alkd

own

Wal

kdow

ns

Perf

orm

ance

Feed

back

Task

Ass

ignm

ent

HP

Surv

eys

Task

Qua

lific

atio

n

Wal

kdow

ns

Perf

orm

ance

Feed

back

Task

Ass

ignm

ent

HP

Surv

eys

Task

Qua

lific

atio

n

Wal

kdow

ns

Perf

orm

ance

Feed

back

Task

Ass

ignm

ent

HP

Surv

eys

Task

Qua

lific

atio

n

Post

job

Rev

iew Pr

oble

mR

epor

ting

Cau

sal

Anal

ysis Pe

rfor

man

ceIn

dica

tors

Inde

pend

ent O

vers

ight

Post

job

Rev

iew Pr

oble

mR

epor

ting

Cau

sal

Anal

ysis Pe

rfor

man

ceIn

dica

tors

Inde

pend

ent O

vers

ight

QC

Hol

d Po

ints

Inde

pend

ent

Verif

icat

ion

Inte

rlock

sPe

rson

alPr

otec

tive

Equi

pmen

tAl

arm

sForc

ing

Func

tions

Fore

ign

Mat

eria

lEx

clus

ions

QC

Hol

d Po

ints

Inde

pend

ent

Verif

icat

ion

Inte

rlock

sPe

rson

alPr

otec

tive

Equi

pmen

tAl

arm

sForc

ing

Func

tions

Fore

ign

Mat

eria

lEx

clus

ions

Prop

erR

eact

ions

Hig

hSt

anda

rds

Rei

nfor

cem

ent

Coa

chin

g

Situ

atio

n Aw

aren

ess

Res

pect

for O

ther

s

Ope

n &

Hon

est

Com

mun

icat

ion

Com

pelli

ngVi

sion

Hea

lthy

Rel

atio

nshi

ps

Cou

rage

&In

tegr

ityM

otiv

atio

n

Sets

Exam

ple

Prop

erR

eact

ions

Hig

hSt

anda

rds

Rei

nfor

cem

ent

Coa

chin

g

Situ

atio

n Aw

aren

ess

Res

pect

for O

ther

s

Ope

n &

Hon

est

Com

mun

icat

ion

Com

pelli

ngVi

sion

Hea

lthy

Rel

atio

nshi

ps

Cou

rage

&In

tegr

ityM

otiv

atio

n

Sets

Exam

ple


108

REFERENCES 1 Maurino, Reason, Johnston, Lee. Beyond Aviation Human Factors. 1995, p.10. 2 Maurino, Reason, Johnston, Lee. Beyond Aviation Human Factors. 1995, p.11-13. 3 Bird. Practical Loss Control Leadership, Det Norske Veritas (formerly International Loss

Control Institute), 1969. 4 Schein. Organizational Culture and Leadership. 3rd edition, 2004, p.246. 5 International Society for Performance Improvement. Handbook of Human Performance

Technology: Improving Individual and Organizational Performance Worldwide. 1999, p.338.

6 Porras. Stream Analysis, A Powerful Way to Diagnose and Manage Organizational Change. 1987, p.57.

7 Porras. Stream Analysis, A Powerful Way to Diagnose and Manage Organizational Change. 1987, p.57.

8 Reason. Managing the Risks of Organizational Accidents. 1998, pp.127-129. 9 Walton. The Deming Management Method. 1986, pp.86-88. 10 Porras. Stream Analysis, A Powerful Way to Diagnose and Manage Organizational

Change. 1987, pp.35-40. 11 United Kingdom Health and Safety Executive. Reducing Error and Influencing Behaviour.

1999, p.44. 12 Gilbert. Human Competence, Engineering Worthy Performance. ISPI, 1996, pp. 82-85.

Reprinted with permission of the International Society for Performance Improvement, www.ispi.org.

13 Rummler and Brache. Improving Performance. 1995. 14 ISPI. “Online HPT Institute, Principles and Practices of Human Performance Technology.”

2000-2001, p.72. Reprinted with permission of the International Society for Performance Improvement, www.ispi.org.

15 Gilbert. Human Competence, Engineering Worthy Performance. ISPI, 1996, pp. 82-97, 163-169. Reprinted with permission of the International Society for Performance Improvement, www.ispi.org.

16 Rummler and Brache. Improving Performance, How to Manage the White Space on the Organization Chart. 1995, p.45.

17 EPRI. Guidelines for Trial Use of Leading Indicators of Human Performance: The Human Performance Assistance Package, 1000647. 2000, p.A-1.

18 Robbins. Essentials of Organizational Behavior. 1997, p.54. 19 Exelon Scorecards and Entergy Coaching Cards. 2001. 20 Geller. The Psychology of Safety. 1998, pp.194-212. 21 After Entergy implemented its management observation program, which emphasized

coaching time, it experienced a significant reduction in problem reports related to human error. 2000.

22 Maurino, Reason, Johnston, Lee. Beyond Aviation Human Factors. 1995, p.34. 23 Dekker. The Field Guide to Human Error Investigations. 2002, pp.77-99. 24 Maurino, Reason, Johnston, Lee. Beyond Aviation Human Factors. 1995, p.66. 25 Rothwell, Sullivan, & McLean. Practicing Organization Development. 1995, pp.149-152. 26 Interaction Associates, Facilitative Leadership (course notebook). 1990. 27 Kotter. Leading Change. 1996, p.20.


109

4 CULTURE AND LEADERSHIP

SAFETY CULTURE .........................................................................................111

LEADERSHIP....................................................................................................113 Leader’s Role .................................................................................................114 Competing Purposes: Production and Prevention..........................................114

KEY LEADERSHIP PRACTICES....................................................................115 Facilitate Open Communication ....................................................................115 Promote Teamwork........................................................................................117 Reinforce Expectations ..................................................................................118 Eliminate Latent Organizational Weaknesses................................................120 Value the Prevention of Error ........................................................................121

ATTACHMENT A PERFORMANCE GAP ANALYSIS ................................122


110



111

SAFETY CULTURE

When people encounter a situation without specific guidance, they will do what they believe is the right thing to do. Because of ever-present deficient procedures and flaws with equipment, plant personnel consistently make tradeoffs between productivity and thoroughness/care. People tend to default to getting the job done rather than taking the time to do the job safely, especially if their supervisors and peers have repeatedly accepted such practices. Safety tends to be assumed. This is normal human behavior. Therefore, managers must explicitly lead the organization such that nuclear safety is preserved as a core value among the staff. Managing the culture requires conscious, careful consideration. Otherwise, managers will unconsciously reinforce getting the job done, with production becoming the default core value.1 Organizational culture is best defined by the shared basic assumptions that have developed in an organization over time as it learns from and copes with problems. Culture is the sum total of a group’s—the organization’s—learning. Because of the special characteristics and unique hazards of nuclear technology—radioactive byproducts, concentration of energy in the reactor core, and decay heat—each nuclear station needs to nurture a strong safety culture. Nuclear safety is a collective responsibility. No one in the organization is exempt from the obligation to ensure that safety comes first.

“Safety culture is the organization’s values and behaviors—modeled by its leaders and internalized by its members—that serve to make nuclear safety the overriding priority.”

--Principles for a Strong Nuclear Safety Culture For comparison purposes, the International Atomic Energy Agency (IAEA) in Vienna, Austria issued a report on safety culture a few years after the accident at Chernobyl. The IAEA expresses safety culture as the following:

“that assembly of characteristics and attitudes in organizations and individuals, which establishes that, as an overriding priority, nuclear plant safety issues receive the attention warranted by their significance.”2

The strength of a facility’s safety culture depends on the degree to which the employees internalize the attributes of safety. Even though the concept of safety


112

culture is somewhat intangible, it is possible to reveal station safety culture tendencies by observing practices and behaviors.3 The following principles, when embraced, influence the organization’s shared assumptions, values, beliefs, behaviors, and group norms that describe how things are done around here:

1. Everyone is personally responsible for nuclear safety. Responsibility and authority for nuclear safety are well defined and clearly understood. Reporting relationships, positional authority, staffing, and financial resources support nuclear safety responsibilities. Corporate policies emphasize the overriding importance of nuclear safety.

2. Leaders demonstrate a commitment to safety. Executive and senior

managers are the leading advocates of nuclear safety and demonstrate their commitment both in word and action. The nuclear safety message is communicated frequently and consistently, occasionally as a stand-alone theme. Leaders throughout the nuclear organization set an example for safety.

3. Trust permeates the organization. A high level of trust permeates the

organization, fostered, in part, through timely and accurate communication. There is a free flow of information in which issues are raised and addressed. Employees are informed of steps taken in response to their concerns.

4. Decision-making reflects safety first. Personnel are systematic and

rigorous in making decisions that support safe, reliable plant operation. Operators possess the authority and understand the expectation to place the plant in a safe condition when faced with unexpected or uncertain conditions. Senior leaders support and reinforce conservative decisions.

5. Nuclear technology is recognized as special and unique. All decisions

and actions take into account the special characteristics of nuclear technology. Reactivity control, core cooling continuity, and fission product barrier integrity are valued as essential, distinguishing attributes of the nuclear station work environment.

6. A questioning attitude is cultivated. Individuals demonstrate a

questioning attitude by challenging assumptions, investigating anomalies, and considering potential adverse consequences of planned


113

actions. This attitude is shaped by an understanding that accidents often result from a series of decisions and actions that reflect flaws in the shared assumptions, values, and beliefs of the organization. All employees are watchful for conditions or activities that can have an undesirable effect on plant safety.

7. Organizational learning is embraced. Operating experience is highly

valued, and the capacity to learn from experience is well developed. Training, self-assessments, corrective actions, and benchmarking are used to stimulate learning and improve performance.

8. Nuclear safety undergoes constant examination. Oversight is used to

strengthen safety and improve performance. Nuclear safety is kept under constant scrutiny through a variety of monitoring techniques, some of which provide an independent perspective.

Specific attributes of the above principles can be found in the INPO document, Principles for a Strong Nuclear Safety Culture, which can be downloaded from INPO Member Web site. Creating and nurturing a strong safety culture is the responsibility of line management. External agencies, consultants, or advisory groups can be influential in supporting this, but line leadership has the sole obligation and accountability for safety culture. Hence, leadership.

LEADERSHIP

Fostering the principles listed above is one of the most challenging tasks for the station management team. Leadership that achieves a strong nuclear safety culture will most likely move a station to the next level of human performance.4

A leader is any individual who takes personal responsibility for his or her performance as well as the plant’s performance and attempts to influence the improvement of the organization that supports that performance.

A strong culture promotes long-term success of the station. Workers, supervisors, and managers must believe they can prevent human error and its consequences. The assumptions, values, and beliefs people cling to strongly influence the choices they make when they encounter unanticipated situations or


114

when procedure direction is vague or absent. Influencing and managing these factors to encourage people to internalize the above principles is the central theme of leadership in human performance improvement. Focusing on the station’s shared assumptions, values, beliefs, and practices—the culture—is, perhaps, the most effective way to maximize the organization’s resistance to events.5

Leader’s Role The organization is the engine that drives the performance system (see the Performance Model in Chapter 3), directing and influencing human performance insulating the job site and performer with layers of defenses, barriers, controls, and safeguards. In the past, human performance was simply workers paying attention and doing the job right the first time. However, a significant event presents unmistakable evidence of an organizational failure, not simple individual failure, because multiple defenses typically fail contributing to the event’s severity. Because it takes teamwork to suffer a significant event, it follows that managers, staff, supervisors, and workers have to work together to generate electricity event-free. Balancing the competition for resources between production and prevention/safety presents a constant challenge to management. Therefore, the leader’s role is to align organizational processes and values to optimize both production and safety at the job site.

Competing Purposes: Production and Prevention Production and prevention practices always compete. Leaders (not simply managers) have to work hard to keep the plant, environment, and personnel safe. Well-informed leadership at all levels of a station organization will ensure that the vision, values, and beliefs do not conflict with the station mission, goals, and processes. Consistency and alignment promote both production and prevention behaviors—together generating the desired long-term results. Production behaviors are those actions or activities aimed toward generating electricity. Management-centered structures (mission, goals, work processes, schedules, and procedures) accomplish production goals. On the other hand, prevention behaviors, such as self-checking, peer-checking, reviews and approvals, and procedure use, avoid errors and events.


115

Leadership

Mission Vision

Goals Beliefs

Processes Values

ResultsBehavior

(Production)Behavior

(Prevention)

Leadership

Mission Vision

Goals Beliefs

Processes Values

ResultsBehavior


(Prevention)

Mission VisionMission Vision

Goals BeliefsGoals Beliefs

Processes ValuesProcesses Values

ResultsBehavior


(Prevention)Results

Behavior(Production)

Behavior(Prevention)

Production behaviors naturally take precedence over prevention behaviors unless there is a strong safety culture—nurtured by strong leadership. Both production and prevention behaviors are necessary for long-term success. But sometimes managers err when they assume people will be safe. Safety and prevention behaviors do not just happen. They are value-driven, and people may not choose the conservative approach because of the stronger production focus of their immediate supervision or work group. Therefore, leadership is a defense. A robust safety culture requires aggressive leadership that emphasizes the principles and attributes of a strong nuclear safety culture.6 Leadership is not optional.

KEY LEADERSHIP PRACTICES

Drawing on the work of a panel of experts, industry workers, and managers, five leader behaviors that promote excellence in human performance were identified. (See the list of contributors in the attachments of the INPO document Excellence in Human Performance.) Leaders act to influence both individual and organizational performance in order to achieve high levels of plant safety and performance through the following practices:7

1. Facilitate open

2. Promote

3. Reinforce desired

4. Eliminate latent

5. Value prevention of

1. Facilitate open communication.

2. Promote teamwork.

3. Reinforce desired behaviors.

4. Eliminate latent organizational weaknesses.

5. Value prevention of errors.

Facilitate Open Communication Communication is perhaps the most effective defense against significant events. Effective leaders root out obstacles to communication aggressively. The organizational atmosphere must promote open, candid conversations about


116

BlameCycle

HumanError

Lesscommunication

Management lessaware of jobsiteconditions

Reduced trustLatent organizationalweaknesses persist

Individual counseled and/or disciplined

More flawed defenses& error precursors

BlameCycle

HumanError

Lesscommunication





HumanError

Lesscommunication








safety. Leaders, no matter what positions they hold, actively encourage others to identify error-likely situations and respective organizational weaknesses. A safe atmosphere is cultivated when people treat each other with honesty, fairness, and respect—that is, when they establish healthy relationships. An atmosphere of teamwork and collaboration motivates individuals to improve the effectiveness of the organization. Eventually, people become more willing to be held accountable and seek assistance by admitting to and learning from mistakes. If an individual believes his or her errors will be punished, then information related to those errors will likely remain obscure. In a just environment, the likelihood that a problem will be reported increases. High-performing organizations do not punish employees who make mistakes while trying to do the right thing.8 Healthy organizations view error as an opportunity to learn. The “blame cycle” is urged on by the belief that human error occurs because people are not properly motivated.9 In reality, no matter how motivated an individual is, active errors will continue to occur, occasionally. Events will continue as long as event investigations stop prematurely at the active human error. The true causes (typically organizational weaknesses) will not be discovered (will remain latent or hidden), and errors and events will persist. The logic diagram below is a tool intended primarily for use by supervisors to help determine the culpability level of an individual in response to events or near misses triggered by human error.10 Although the purpose is to determine culpability, the tool helps an analyst isolate the likely organizational factors that caused or contributed to the event. Some stations use the logic chart during investigations of human performance events. When used in conjunction with the station accountability policy, the tool supports the fair and consistent application of disciplinary outcomes across all departments and work groups. The above tool is an adaptation of Dr. James Reason’s culpability decision tree in his book Managing the Risks of Organizational Accidents, which provides an in-depth description of the chart.


117

Increasingorganizational

culpability

Increasingindividualculpability

No

Intentional actto cause harm

Possiblenegligent

error

Organizationally-induced

error


error, with remediation


error

Possiblerecklessviolation

Organizationally-inducedviolation

Yes

Yes

Yes

Yes No

No

Deficiencieswith training,

selection, assignment, or experience?

History ofperformanceproblems?

Performanceproblem was

self-reported?

Passes thesubstitution

test?

Wereexpectations

available, intelligible, workable, and

correct?

Knowinglyviolate

expectations?

Wereconsequences

intended?

No

Wereactions

intended?

No

No Yes

Yes

Yes

No

Yes

No

Evaluate relevant organizational processes and related management

and supervisory practices.

Adapted with permission from Dr. James Reason’s Managing the Risks of Organizational Accidents, Ashgate Publishing Limited, 1997.

Promote Teamwork People have difficulty seeing their own errors, especially when they are working alone. Teamwork improves the ability of individual team members to collectively prevent human performance problems. Because people are fallible, teamwork should make individual thinking and reasoning visible to the other members of the team. Dialogue between members of a team gives each one the opportunity to challenge assumptions and to detect team errors. An individual can catch most of his or her own errors, but not consistently enough for safety. The U.S. aviation industry has conducted extensive studies on cockpit resource management, which is essentially a study of commercial aircraft teamwork. The commercial nuclear industry adopted a version of this approach to teamwork in the early 1990’s when the Control Room Teamwork Development (CRTD) Course was developed. The following characteristics that were particularly important to the success of pilot performance on the flight deck can be applied at the station:


118

• Ask Questions – asking a series of questions to understand what is happening with the plant

• Advocate – expressing a concern, position, or solution and making certain others understand what the individual knows

• Take Initiative – taking the initiative to influence the behavior of others, especially when it comes to the condition of the physical plant

• Manage Conflict – resolving differences of opinion and getting all information on the table to reach the best solution; maintaining open communication channels among team members

• Critique Performance – learning from experience, identifying what works well, and pinpointing what areas need improvement

Reinforce Expectations There is a direct cause-and-effect relationship between a manager’s actions and an employee's behavior, because behavior is motivated by its consequences.11 Consequences⎯not training, directives, or threats⎯reinforce behavior. People tend to seek/do things they like and avoid things they do not like.12 This is a fundamental principle of human behavior. Positive consequences must be associated with job-site behaviors if people are to make a habit of applying human performance tools. Managers and leaders positively reinforce individuals who obtain value-added results through safe behaviors. Personnel who cut corners to get jobs done on schedule and under budget at the expense of quality and safety need to be corrected, coached, or, perhaps, counseled. Consequences either keep the behavior going or stop it in the long term. Leaders should take time to understand and learn how to use reinforcement—consequences—to promote targeted behaviors. All behavior that is occurring in the station right now is the result of consequences that are also occurring right now. In a manner of speaking, the organization is perfectly attuned to get the performance it is getting, right now. All behavior is reinforced. If at-risk behavior is common, it is because management has not made a difference with appropriate negative consequences. Behavior has four basic consequences.13 The following model describes the effect consequences have on behavior:


119

Behavior

Consequences that DecreaseBehavior

BEHAVIOR DECREASES

1. GET SOMETHING YOU DON’T WANT2 . DON’T GET SOMETHING YOU WANT

Consequences that IncreaseBehavior BEHAVIOR

INCREASES

1. GET SOMETHING YOU WANT

2. AVOID SOMETHING YOU DON’T WANT

Source: Daniels (1989).

Behavior


BEHAVIOR DECREASES



INCREASES



Behavior


BEHAVIOR DECREASES



INCREASES



Behavior


BEHAVIOR DECREASES



INCREASES




BEHAVIOR DECREASES



BEHAVIOR DECREASES


BEHAVIOR DECREASES



INCREASES




INCREASES



BEHAVIOR INCREASES



Source: Daniels (1989). Used with permission from Aubrey Daniels, International.

The following consequences can be used to get the desired performance by targeting specific behaviors:

• Positive Reinforcement – ”Get something you want” enhances the probability the preferred behavior will recur and maximizes performance. This optimizes use of discretionary effort by the individual.

• Negative Reinforcement – “Avoid something you don’t want” enhances the probability the preferred behavior will recur, but only to meet the minimum standard. Note: Consequences that cause behavior to either increase or continue at a high standard are known as “reinforcers.”

• Punishment – “Get something you don’t want” reduces the probability undesired behavior will recur if unwanted consequences are consistently coupled with the behavior. Punishment may also involve “losing something you don’t want to lose,” a penalty. Sometimes this is necessary to get the new expectation started for an individual. However, it should not be used for the long term.

• Extinction – “Don’t get something you want” reduces the probability undesired behavior recurs, since nothing happens when that behavior occurs. Usually, the behavior eventually disappears after several repeated attempts.

Antecedents take the form of procedure steps, training, incentives, reminders from supervisors or peers, administrative policies, and expectations. Antecedents


120

are stronger if they a) specify the behavior, b) specify whom, c) occur at the point of attack, and d) imply the consequences.14 Similarly, consequences in terms of reinforcers and incentives need to be determined for desired behavior. Expectations need positive reinforcers, while unacceptable behaviors need penalties—disincentives—or the elimination of positive reinforcers that motivate unsafe or at-risk practices. Positive reinforcers are more effective if they are positive for the individual, immediate with respect to when the behavior occurs, and certain. Penalties are stronger if the consequence is negative, immediate, and certain for the individual concerned.15 In summary, positive reinforcement sustains the habitual use of human performance tools, and appropriate sanctions or disincentives discourage unsafe and at-risk practices.

Eliminate Latent Organizational Weaknesses Organizational weaknesses show up as vulnerabilities, flaws, and defects in controls and defenses (engineered, administrative, cultural, and oversight controls). Methodically searching for and eliminating latent organizational weaknesses eliminates factors that contribute to significant events. Chapter 3 describes several methods of finding latent organizational weaknesses, which are listed here for reference:

• self-assessments • performance indicators • trending • benchmarking • operating experience • independent oversight • behavior observations

• problem reporting • causal analysis • management oversight,

involvement, and reinforcement • surveys and questionnaires • corrective action program

INPO 05-005, Guidelines for Performance Improvement at Nuclear Power Stations, provides detailed insights and methods for identifying and correcting problems. The use of a systematic diagnostic approach to recurring individual or work group performance problems provides another means of identifying organizational weaknesses. Managers and supervisors need a tool that helps them develop a clear understanding of a performance discrepancy and why it is happening. With the aid of the Behavior Engineering Model – Nuclear


121

(BEM -N), performance analysis helps define the performance gap by contrasting current performance with desired performance and systematically identifying the factors that contribute to the performance gap. Once valid reasons for the performance gap are understood, the manager or supervisor can develop more effective and efficient corrective actions. To help diagnose human performance problems, a Performance Gap Analysis form is provided at the end of this chapter.

Value the Prevention of Error People’s beliefs and attitudes toward hazards and error traps affect their adherence to high standards. If error-free performance (avoiding active errors) is not held up as an important value or is not expected for daily work, then people may adopt unsafe practices to get their work done, possibly placing themselves, others, or the plant at risk of an event. Consistently maintaining high standards communicates the value of error prevention. By clinging to high standards regardless of the perceived risk, adherence to expectations will become the norm. Positive attitudes about safety and error prevention depend greatly on what is rewarded and which behaviors are reinforced. It is easier to change behavior when positive attitudes exist. Positive values and attitudes follow behaviors that consistently result in success for the individual. It is not necessary for values and attitudes to precede behavior, but it is preferable. The most effective way to communicate values is to act in accordance with them while reinforcing people when they apply them.16 According to extensive research by Dr. Edgar Schein, professor emeritus at Massachusetts Institute of Technology and an expert in organizational culture and leadership, the following leader behaviors convey the values of the organization, in order of influence:17

• what managers pay attention to, measure, and control • reactions to critical incidents or crisis • allocation of resources • deliberate attempts to coach or role model • criteria for allocation of rewards and punishment • criteria for selection, advancement, and termination

If those in positions of responsibility and influence react appropriately, with integrity, and consistent with stated values, people will adopt safe behaviors.


122

ATTACHMENT A PERFORMANCE GAP ANALYSIS♠

1. What is the performance problem?

a. What is currently happening?

b. What should be happening (desired performance)?

2. Is the problem

worth solving? a. Does the problem affect plant performance or personnel safety? Yes No

b. What is the potential cost or consequence of doing nothing?

3. Is there clear direction

to perform as desired? a. Are expectations, standards, priorities, roles, and responsibilities clear and

understood by the performer(s)? Yes No

b. Are resources, tools, equipment, and other assistance available and adequate? Yes No c. Are work documents accurate, do they contain sufficient detail, and are they

usable for the performer(s)? Yes No

d. Does the individual(s) get visible, objective feedback on the quality of work? Yes No e. Is the risk significance of the job/task clearly stated? Yes No f. Are there conflicts in direction and standards (between procedures, supervisors

and managers, departments, and so forth)? Yes No

4. Are there appropriate

consequences for performance (behavior)?

a. Is the desired performance punishing to the performer (more work, delays, anxiety, ridicule, fatigue, and so forth)?

Yes No

b. Is current performance rewarding to the performer? Yes No c. Does the performer experience positive consequences for good performance?

(If yes, are they immediate and certain?) Yes No

5. Do they already know how?

(Could they do it if their lives depended on it?)

a. Is the performer(s) qualified and has he/she done it properly before? (If yes, knowledge and skills are probably satisfactory.)

Yes No

b. Are the tasks performed often enough to maintain proficiency? (If yes, see 3.D. If no, then provide opportunities to practice.)

Yes No

6. Are there other obstacles

to desired performance? a. Are there personal problems beyond the performer’s control that hinder desired

performance (such as FFD, medical, family issues, physical limitations)? Yes No

b. Are ergonomic challenges present in the workplace for example, workarounds and problems with labeling, habitability, equipment accessibility, clothing, PPE, and human-machine interface)?

Yes No

d. Are there inappropriate distractions or interruptions in the workplace? Yes No e. Is the task or process too complex? Yes No f. Are there obstacles to communication between the performer(s) and

supervision? Yes No

g. Are job/task performance requirements beyond the performer’s capabilities (such as fatigue, sleep decrement, strength, dexterity, and color blindness)?

Yes No

h. Does desired performance matter to the performer(s) (for example, unsafe attitudes, morale, work ethic, self-esteem, and peer pressure)?

Yes No

7. Identify valid reasons for performance discrepancy.

Reasons:

8. Select potential corrective actions.

Solutions:

♠ Adapted with permission from Analyzing Performance Problems, by Dr. Robert F. Mager and Peter Pipe © 1997, The Center for Effective Performance, Inc. 1100 Johnson Ferry Road, Suite 150, Atlanta, GA 30342. www.cepworldwide.com 800-558-4237, p.5.


123

REFERENCES 1 Adapted from a quote by Dr. Erik Hollnagel, Professor of Psychology at, CSELAB,

Department of Computer and Information Science, University of Linköping, Sweden, during his presentation, “Understanding Accidents,” at the 2002 IEEE Seventh Conference on Human Factors and Power Plants in Scottsdale, Arizona.

2 International Nuclear Safety Advisory Group. Safety Culture. Basic Safety Principles for Nuclear Power Plants, Safety Series No. 75-INSAG-4. IAEA, Vienna, 1991, p.1.

3 INPO. Principles for a Strong Nuclear Safety Culture. November 2004, pp.iii-iv. 4 Ramsey & Modarres. Commercial Nuclear Power, Assuring Safety for the Future. 1998,

pp.220-221. 5 Helmreich & Merritt. Culture at Work in Aviation and Medicine. 1998; p.133-139. 6 Kotter. Leading Change. 1996, pp.25-30. 7 INPO. Excellence in Human Performance. 1997. 8 Pool. “When Failure is Not an Option,” Technology Review Magazine, July 1997, p.45. 9 Reason, Managing the Risks of Organizational Accidents. 1998, p.127-129. 10 Reason. Managing the Risks of Organizational Accidents. 1998, p.208-212. 11 Fournies. Why Employees Don’t Do What They’re Supposed to Do, and What to Do About

It. 1999, p.xv. 12 Daniels. Bringing Out the Best in People. 1994, p.25. 13 Daniels. Performance Management. 1989; p.29 14 Geller. The Psychology of Safety. 1998; p.133. 15 Daniels, Bringing Out the Best in People. 1994; pp.65-66. 16 Larkin and Larkin. “Reaching and Changing Frontline Employees,” Harvard Business

Review on Effective Communication. 1999, p.147. 17 Schein. Organizational Culture and Leadership. 1992 p.231.


124



Glossary

DESCRIPTIONS OF COMMON HUMAN PERFORMANCE TERMS AND PHRASES

125



126


This glossary describes the terms and phrases used in the Human Performance Reference Manual and promotes consistency of understanding of and communication for effective human performance.

Term or Phrase Description

Accountability The expectation that an individual or an organization is answerable for results; to explain its actions, or be subject to the consequences judged appropriate by others; the degree to which individuals accept responsibility for the consequences of their actions, including the rewards or sanctions

Action Externally observable, physical behavior (bodily movements or speech). (See also behavior.)

Active Error Action (behavior) that changes equipment, system, or plant state triggering immediate undesired consequences

Administrative Control

Direction that informs people about what to do, when to do it, where to do it, and how well to do it, and are usually documented in various written policies, programs, and plans

Alignment The extent to which the values, processes, management, and existing factors within an organization influence human performance in a complementary and non-contradictory way; facilitating organizational processes and values to support desired safe behavior

Anatomy of an Event A cause-and-effect illustration of the active and latent origins (linkages) of plant events initiated by human action

Assumption A condition taken for granted or accepted as true without verification of the facts. (See also belief, mental model and unsafe attitudes.)

At-Risk Practice A behavior or habit that increases the chance for error during an action, usually adopted for expedience, comfort, or convenience

Attitude An unobservable state of mind, or feeling, toward an object or subject

Barrier Anything that keeps operations or processes within safe limits or protects a system or person from a hazard. (See also controls and defense.)

Behavior The mental and physical efforts to perform a task; observable (movement, speech) and nonobservable (thought, decisions, emotional response, and so forth) activity by an individual—Generally, the nuclear industry treats observable behavior as measurable and controllable

Behavior Engineering Model

An organized structure for identifying potential environmental and individual factors that impact performance at the job site, and for analyzing the organizational contributors to those factors

Belief Acceptance of and conviction in the truth, existence, or validity of something, including assumptions about what will be successful

Benchmarking A process of comparing products, processes, and practices against the best in class, the toughest competitors or those companies recognized as industry leaders; discovering innovative thinking or approaches

127

Bill

According to this defintion their could never be an ineffective barrier.



Change Management

A methodical planning process to establish the direction of change, align people and resources, and implement the selected modifications throughout an organization, large or small

Coaching The process of facilitating changes in behavior of another person through direct interaction, feedback, collaboration, and positive relationships. (See also feedback.)

Cognitive (cognition)

Descriptive of mental activity related to sensing and thinking phases of information processing; perception, awareness, problem-solving, decision-making, and judgment

Complacency Self-satisfaction accompanied by unawareness of actual dangers, hazards, or deficiencies; being unconcerned in a hazardous environment

Conservative Decision-Making

Reaching conclusions by placing greater value on reactor safety above the production goals of the station—decisions demonstrate recognition and avoidance of activities that unnecessarily reduce nuclear safety margins

Controls Devices, methods, or practices that make an activity or process go safely, effectively, efficiently, predictably, and according to high standards to protect key assets from human error—usually taking an engineered, administrative, cultural, or oversight form. (See also defenses, barrier, and positive control.)

Critical Component

Any equipment whose failure results in a plant shutdown, a loss of generation, loss of an important safety function, or otherwise degrades the ability to monitor or control safety or generation functions. (See INPO AP-913, Equipment Reliability Process Description.)

Critical Step A procedure step, series of steps, or action that, if performed improperly, will cause irreversible harm to plant equipment, or people, or significantly impact plant operation

Culture An organization’s system of commonly held values and beliefs that influence the attitudes, choices and behaviors of the individuals of the organization. (See also safety culture.)

Cultural Control Leadership practices that teach (consciously or unconsciously) their organizations how to perceive, think, feel, and behave

Defense Means or measures taken to prevent or catch human error, to protect people, plant, or property against the results of human error, and to mitigate the consequences of an error. (See also barrier and controls.)

Defense-in-Depth The overlapping capacity of redundant defenses, barriers, controls, or safeguards to protect plant personnel and plant equipment from human error, such that a failure with one defense would be compensated for by another defensive mechanism avoiding harm

Dependency The increased likelihood of human error due to the person’s unsafe reliance on or relationship with other seemingly independent defense mechanisms. (See also team error.)

128



Engineered Controls Those items (hardware, software, and equipment) in the physical working environment that mold people’s behavior and choices, and are the result of engineering design. (See also controls.)

Error An action that unintentionally departs from an expected behavior

Error of Commission

An error that involves execution of an action other than the preferred action

Error of Omission

An error that involves an absence of preferred action

Error Precursors Unfavorable factors embedded in the job site that increases the chances of error during the performance of a specific task by a particular individual. (See also human nature, individual capabilities, task demands, and work environment.)

Error-likely Situation

A work situation in which there is greater opportunity for error when performing a specific action or task due to error precursors (also known as “error trap”)

Error Rate The number of errors over time usually normalized to the number of hours worked

Event 1) Human performance sense: An undesirable change in the state of structures, systems, or components or human/ organizational conditions (health, behavior, controls, and so forth) triggered by human error that exceed established significance criteria

2) General engineering sense: An undesirable change in the state of structures, systems, or components of the physical plant that may involve serious degradation or termination of its ability to perform its required function

Expectations Established, explicit descriptions of acceptable plant outcomes, business goals, process performance, safety performance, or individual behavior

Factor An existing condition that positively or adversely influences behavior. (See also organizational factors.)

Fallibility A fundamental, internal characteristic of human nature to be imprecise

Feedback Information about past or present behavior and results that gives an individual or an organization the opportunity to change

Flawed Defenses Defects with engineered, administrative, cultural, or oversight controls that, under the right circumstances, fail to:

• Protect plant equipment or people against hazards

• Prevent the occurrence of active errors

• Mitigate the consequences of error

(See also anatomy of an event and defense-in-depth.)

129



Function Allocation

The distribution of actions (functions) among human or machine elements of a plant system to achieve a particular outcome

Gap Analysis The process of comparison of actual results or behavior with desired results or behavior, followed by an exploration of why the gap exists

Human Error A phrase that generally means the slips, lapses, and mistakes of humankind

Human Factors The study of how human beings function within various work environments as they interact with equipment in the performance of various roles and tasks (at the human-machine interface):

• U.S. perspective: ergonomics, human engineering and sometimes human performance

• European perspective: human performance usually including training and human resources

Human-Machine Interface

The point of contact or interaction between the human and the machine. (See also human factors.)

Human Nature The innate characteristics of being human; generic human limitations or capabilities that may incline individuals to err or succeed under certain conditions as they interact with their physical and social environments. (See also job site.)

Human Performance

A series of behaviors executed to accomplish specific results

Human Reliability The probability of successful performance of human activities, whether for a specific act or in general

Individual An employee in any position in the organization; that is, worker, supervisor, staff, manager, and executive

Individual Capabilities

Unique mental, physical, and emotional abilities of a particular person that fail to match the demands of the specific task

Infrequently Performed Task

Activities seldom performed usually even though covered by existing normal or abnormal procedures

Initiating Action A human action, either correct, in error, or a violation, that results in a plant event. (See also Anatomy of an Event.)

Job A combination of tasks and duties that define a particular position within the organization usually related to the functions required to achieve the organization’s mission, such as control room operator

Job Site The physical location where people touch and alter the plant. (See also worker.)

130



Job-Site Conditions

The unique factors associated with a specific task and a particular individual; factors embedded in the immediate work environment that influences the behavior of the individual during work. (See also error precursors and organizational factors.)

Knowledge & Skill

The understanding, recall of facts, and abilities a person possesses with respect to a particular job position or for a specific task

Knowledge-based Performance

Behavior in response to a totally unfamiliar situation (no skill, rule or pattern recognizable to the individual); a classic problem-solving situation that relies on personal understanding and knowledge of the system, the system's present state, and the scientific principles and fundamental theory related to the system

Knowledge Worker An individual who works primarily with information, or one who develops and uses knowledge in the workplace. (Compare with worker.)

Lapse An error due to a failure of memory or recall. (See also slip and mistake.)

Latent Condition The undetected situations or circumstances created by past latent errors that are embedded in the organization or production system lying dormant for long periods of time doing no apparent harm. (See also latent organizational weakness.)

Latent Error An error, act, or decision disguised to the individual that results in a latent condition until revealed later either by an event, active errors, testing, or self-assessments. (See also latent condition.)

Latent Organizational Weakness

Undetected deficiencies in organizational processes or values that create job-site conditions that either provoke error or degrade the integrity of defenses. (See also Anatomy of an Event and latent error.)

Leader An individual who takes personal responsibility for his or her performance and the plant's performance and attempts to influence the organization’s processes and/or the values of others

Leadership 1) The behavior of an individual attempting to influence the behaviors, values, and beliefs of others

2) That group of employees given the positional responsibility for guiding the direction and values of the organization. (See also management.)

Leadership Practices

Techniques, methods, or behaviors used by leaders to guide, align, motivate, and inspire individuals relative to the organization’s vision. (See also practices.)

Management (manager)

That group of employees given the positional responsibility and accountability for the performance of the organization. (See also leadership.)

131



Management Practices

Techniques, methods, or behaviors used by managers to set goals, plan, organize, monitor, assess, and control relative to the organization’s mission. (See also practices.)

Mental Model Structured organization of knowledge a person has about how something works (usually in terms of generalizations, assumptions, pictures, or key words); a mental picture of the underlying way in which a system functions, helping to describe causes, effects, and interdependencies of key inputs, factors, activities, and outcomes

Mistake Errors committed because the intent of the act was incorrect for the work situation, typically defined by the condition of the physical plant; incorrect decision or interpretation. (See also error and compare with slip.)

Motives Those personal (internal) goals, needs, interests, or purposes that tend to stimulate an individual to action in order to achieve or meet them (motivation)

Near Miss Any occurrence that could have resulted in undesirable consequences but did not; ranging from minor breaches in defenses to incidents in which all the available safeguards were defeated, but no actual losses were sustained

Norm A pattern or trait observed as typical behavior for a group of people

Organization A group of individuals with a shared mission, set of processes, and values to apply resources and to direct people's behavior toward safe and reliable operation

Organizational Factors

1) Task-specific sense: an existing job-site condition that influences behavior and is the result of an organizational process, culture, and other environmental factors

2) General sense: the aggregate of all management and leadership practices, processes, values, culture, corporate structures, technology, resources, and controls that that affect behavior of individuals at the job site

Oversight Control Methods to monitor, identify, and close gaps in performance

Performance Any activity that has some effect on the environment; the accomplishment of work. (See also human performance.)

Performance Gap

The difference between desired performance and actual performance, whether in terms of results or behavior

Performance Improvement

A systematic process of identifying and analyzing gaps in human performance, followed by developing and implementing interventions or corrective actions to close the gaps

Performance Indicator

A measure of performance (after the fact) using quantitative parameters that provide information on the condition or direction of key result areas (also known as “metric”)

132



Performance Mode

One of three modes a person uses to process information related to one's level of familiarity and attention given to a specific task. (See also skill-based performance, rule-based performance, and knowledge-based performance.)

Performance Model

A systems perspective of the context of individual human performance, showing how plant results and individual behavior are interrelated with organizational processes and values through job-site conditions


Review and comparison of performance against expectations and standards using problem reporting, feedback, reinforcement, coaching, observation data, event data, trend data, and so on. (See also performance indicator, performance gap, and gap analysis.)

Performance Problem

A discrepancy in performance with respect to expectations or operating experience, or an opportunity to improve performance created by changes in technology, procedures, or expectations. (See also performance gap.)

Physical Plant Systems, structures, and components of the nuclear generating station

Plant Results The outcomes of the generating station in terms of generation, events, personnel safety, WANO performance indicators, configuration, and so on

Population Stereotype

The way members of a group of people expect things to behave; for example, in the U.S., up, right (direction), or red implies on or energized.

Positive Control Active measure(s) to ensure that what is intended to happen is what happens, and that is all that happens

Practices Behaviors usually associated with a role that can be applied to a variety of goals in a variety of settings. (See also work practices.)

Prevention Behaviors

Behaviors or practices oriented toward the prevention of errors or events. (See also production behaviors.)

Principles A set of underlying truths that can be used to guide both individual performance and the management of human performance

Proactive Preemptive measures to prevent events or avoid error by identifying and eliminating organizational and job-site contributors to performance problems before they occur; preventing the next event

Process A series of actions organized to produce a product or service; tangible structures established to direct the behavior of individuals in a predictable, repeatable fashion as they perform various tasks

Production Behaviors

Behaviors oriented toward creating the organization’s product from the resources provided, such as electricity. (See also prevention behaviors.)

Reactive Taking corrective action in response to an event, error, or near miss; after the fact

Readiness An individual’s mental, physical, and emotional preparedness to perform a job as planned

133



Reinforcement The consequences one encounters when a specific behavior occurs increasing the probability the behavior will occur again

Rigor Completeness and accuracy in a behavior or process; cautiously accurate, meticulous, exhibiting strict precision during the performance of an action

Root Cause A cause that, if corrected, will prevent recurrence of an event

Rule-Based Performance

Behavior based on selection of stored rules derived from one's recognition of the situation; follows an IF (symptom X), THEN (situation Y) logic

Safety Culture An organization’s values and behaviors—modeled by its leaders and internalized by its members—that serve to make nuclear safety the overriding priority. (See also values and culture.)

Self-Assessment Formal or informal processes of identifying one’s own opportunities for improvement by comparing present practices and results with desired goals, policies, expectations, and standards. (See also benchmarking and performance monitoring.)

Shortcut An action, perceived as more efficient by an individual, that is intended to accomplish the intent of actions other than that directed by procedure, policy, expectation, or training. (See also violation.)

Situation Awareness

The accuracy of a person’s current knowledge and understanding of working conditions compared to actual conditions at a given time

Skill-Based Performance

Behavior associated with highly practiced actions in a familiar situation usually executed from memory without significant conscious thought

Skill of the Craft Activities related to certain aspects of a task or job that an individual knows without needing written instructions

Slip A physical action different than intended. (See also error, lapse, and compare with mistake.)

Standdown A period of time devoted by an organization toward the education, training, and sensitization of station personnel on issues associated with excellent human performance

Supervisor That member of first-line management who directs and monitors the performance of individual contributors (front-line workers) in the conduct of assigned work activities

System A network of elements that function together to produce repeatable outcomes; the managed transformation of inputs (resources) into outputs (results) supported with monitoring and feedback

Systems Thinking Consideration of the multiple, diverse, and interrelated variables and their patterns that come to bear on a worker at the job site; knowledge of the interdependencies of station processes and leadership dynamics on performance—the organizational nature of human performance. (See also Performance Model.)

134



Task An activity with a distinct start and stop made up of a series of behaviors of one or more people; sometimes a discrete action

Task Demands Specific mental, physical, and team requirements that may either exceed the capabilities or challenge the limitations of human nature of the individual assigned to perform the task. (See also error precursor.)

Team Error A breakdown of one or more members of a work group that allows other members of the same group to err due to either a mistaken perception of another’s abilities or a lack of accountability within the individual’s group

Uneasiness An attitude of apprehension and wariness regarding the capacity to err when performing specific human actions on plant components

Unsafe Attitudes Unhealthy beliefs and assumptions about workplace hazards that blind people to the precursors to human error, personal injury, or physical damage to equipment

Values The central principles held in high esteem by the members of the organization around which decisions are made and actions occur, such as reactor safety. (See also culture and safety culture.)

Violation A deliberate, intentional act to evade a known policy or procedure requirement for personal advantage usually adopted for comfort, expedience, or convenience. (See also shortcut.)

Vision A picture of the key aspects of an organization’s future that is both desirable and feasible—to be the kind of organization people would aspire to—that guide employee’s choices without explicit direction, but vague enough to encourage initiative

Vulnerability Susceptibility to external conditions that either aggravate or exceed the limitations of human nature, enhancing the potential to err; also the weakness, incapacity, or difficulty to avoid or resist error in the presence of error precursors. (See also error precursor.)

Work Environment

General influences of the work place, organizational, and cultural conditions that affect individual behavior at the job site. (See also error precursors.)

Work Execution

Those activities related to the preparation for, performance of, and feedback on planned work activities

Worker An individual who performs physical work on plant equipment, having direct contact (touching) with equipment, and is capable of altering its condition. (Compare with knowledge worker.)

Work Practices Methods an individual uses to perform a task correctly, safely, and efficiently including equipment/material use, procedure use, and error detection and prevention. (See also practices.)

135



136

Documents

Human Performance Reference Manual - Nuclear Safety Info · * INPO’s Professionalism Series is a set of industry documents that convey general principles on specific topics related