This document provides an overview of advanced HRA studies for Station Blackout (SBO) and Extended SBO scenarios at Indian nuclear power plants. It discusses the objectives to extensively analyze emergency operating procedures for both scenarios using techniques like CBDTM and ATHEANA to identify human interactions and calculate HEPs. Literature on human error, performance shaping factors, human reliability analysis methods like CBDTM and ATHEANA are also summarized to support the advanced HRA studies.

1. Advanced HRA of SBO & Extended SBO
scenarios of Nuclear Power Plants
Presented by
Wng Cdr Anish Kumar
Anand Kumar
Under Guidance of Prof. N K Goyal
RELIABILITY ENGINEERING CENTRE IIT KHARAGPU

2. Contents
Introduction to Nuclear Power Plants
Background & Past experiences
Introduction to Indian Nuclear Power Plants
Objectives
Brief of Power Supply, SBO & extended SBO
scenario
Literature Survey
THERP & HCR ORE
ATHEANA
CBDTM

3. Introduction to Indian Nuclear Power
Plants
 A total 20 operational nuclear power
plants(NPPs) with capacity of 4780 are present in
India.
 Tarapur Atomic Power Station(TAPS) was first to
be setup in1969.
 Nuclear energy is the answer to ever growing
power needs of the future generation and
depleting natural resources.
 Our study concerns the TAPS-3&4 (540 MWe)
PHWR.
 TAPS-3&4 became operational in 2006 & 2005
are model which are being replicated as 700

4. Introduction to Indian PHWR
design
 Horizontal reactor vessel – Calandria
 Pressure tube concept (306/392 channels)
 Natural Uranium fuelled (Fuel pins; Bundles)
 Heavy water cooled and moderated
 Calandria surrounded by water enclosed in a
concrete structure – Calandria Vault
 On-power refueling
 Double containment
 Suppression Pool (540 MWe)

5. Schematic diagram of Indian PHWR
design

6. Primary Heat Transfer System
features
 Different feeder sizes & orificing
 Controlled pressure at ROH
 Over pressure relief to PHT pressure boundary
 Feed & Bleed / Pressuriser
 Assist natural circulation – Layout
 Small leak handling capability
 Online purification & filtration
 Accessibility during shutdown
 Header level control for maintenance of SGs,
PCPs etc.
 Variable / constant pressure program for SG
pressure control

7. PHWR Simplified Flow Diagram
In 540 MWe
PHWR, a
pressurizer has
been introduced
for pressure
control, while
feed and bleed is
retained for
inventory control

8. Reactor Shutdown System
 For 540 MWe PHWRs, each of the two shut
down systems have adequate worth for long-
term shutdown. These systems are :
 SDS#1 : Cadmium rods that fall under gravity
 SDS#2 : Direct injection of poison in moderator
inside Calandria
 In 540 MWe PHWR, the high pressure injection
is from light water accumulators. A simple
scheme of injecting light water into all reactor
headers followed by low pressure long term
recirculation has been adopted.

9. Background & Past
Experiences
 Post Fukushima Nuclear accident, nuclear
power generating entities felt the need for
analyzing SBO and Extended SBO scenarios in
detailed manner.
 Fukushima accident was a classic example for
Extended SBO scenario which caused lot of
damage.
 Past experiences for Indian NPPs : Fire Incident
at NAPS-3&4 rendering total loss of power(both
on and off site) for several hours.
 Taking all this into consideration, this advanced

10. Objectives
 To perform studies on SBO & Extended SBO
scenarios for TAPS-3&4.
 To extensively perform analysis for the Emergency
Operating procedures for both the scenarios.
 To find various human interactions and various
contexts generated out of scenarios.
 Use CBDTM and ATHEANA for event analysis and
calculation of HEPs for Human actions.

11. Need for Advanced HRA Study
 Advanced HRA study can reveal weak links in
system.
 It enables us to consider human interaction with
the system which plays an important part in
mitigation of serious mishaps.
 It helps counter unrealistic emotional responses
to perceived danger.
 It helps in better preparedness for worse
situation which may lead to chaotic situation
otherwise.
 It leads to increase in system effectiveness and

12. Brief about Power Supply to TAPS
3&4
 Three main sources of power supply:
 Dedicated supply from external grid.
 Off take of the power generated within NPP.
 Onsite stand-by power supplies from Diesel Generator
(DG) set. The DGs are redundant which ensures
maximum availability of the same.
 The electrical power supply at TAPS (3&4) is
subdivided into classes depending up on their
source.
 Class IV power supply (Offsite power supply):
• 400 kV and
• 220 kV switchyards,
• 400kV and 220kV grids.

13. Brief about Power Supply to
TAPS-3&4
 On-site power supply (Station Auxiliary Power Supply
System)
 Class III power supply
 Class II power supply
 Class I power supply
 These Power Supplies feed all the safety / safety related
system loads of the unit and also some of the non-safety
system loads.
 Operating Mode considered: Hot shutdown state
of the reactor with primary coolant temperature
(inlet to reactor) and pressure close to normal
operating condition and the primary coolant pumps

14. A brief about SBO & Extended
SBO
 Station Black Out :
• condition wherein total loss of power happens, i.e. failure of
both off site and onsite stand-by power sources.
• simultaneous unavailability of both Class IV and Class III
power supplies beyond six minutes.
• All equipments connected to Cl-IV & Cl-III buses stops
running.
 Extended Station Black Out:
• If the SBO scenario becomes uncontrollable and extends
beyond
2hrs, then becomes extended scenario
• Loss of Class-II & Class-I power happens due to which all
MCR lighting, indications and annunciations are lost.
• Complete black out and visibility provided by emergency

15. LITERATURE SURVEY

16. An introduction to Human
Error
 Human Error : an action that is not intended or desired
by the human or a failure on the part of the human to
perform a prescribed action within specified limits of
accuracy, sequence, or time such that the action or
inaction fails to produce the expected result, and has led
or has the potential to lead to an unwanted
consequence to people, equipment and systems risk
 Seven major human error types of interest
 Slips and lapses (action execution errors)
 Cognitive errors: diagnostic & decision-making
 Maintenance errors and latent failures
 Errors of commission
 Rule violations
 Idiosyncratic errors
 Software programming errors

17. Performance Shaping Factors
(PSFs)
 Any factor that influences performance
 depend on task and domain
 Three classes of PSFs
 External, i.e. environment, task
characteristics, procedures
 Internal, i.e. training, experience, stress
 Stressors : factors producing mental and physical
stress, e.g. task speed and
load, fatigue, vibration
 Combinations of PSFs determine the reliability

18. Types of Human Actions
 Type A : Pre-initiating Event Actions
 Type B : Actions That Cause An Initiating Event
 Type C : Post-initiating Event Actions
 Type CP: Procedure-based Actions
 Type CR: Recovery Actions

19. Cause-Based Decision Tree
Method (CBDTM)

20. Cause-Based Decision Tree Method
(CBDTM)
 CBDTM is used to find HEPs for various
situations
 Based on a Decision Tree decomposition
 Specific failure mechanisms,
 Associated PSFs
 Possible recovery modes.
 Interaction is decomposed into two high-level
failure modes (EPRI TR-100259)
 Mode 1: Failures of the Plant Information-Operator
Interface
 Mode 2: Failure in the Procedure-Crew Interface
 Broken down into four failure mechanisms.

21. Mode 1: Failures of the Plant Information-Operator
Interface
 The required data are physically not available to
the control room operators.
 The data are available, but are not attended to.
 The data are available, but are misread or mis-
communicated.
 The available information is misleading.

22. Mode 2: Failure in the Procedure-Crew
Interface
 The relevant step in the procedure is skipped.
 An error is made in interpreting the instructions.
 An error is made in interpreting the diagnostic
logic.
 The crew decides to deliberately violate the
procedure.

23. Data not Available

24. Availability of Information: (Plant
Information-Operator Interface)
 Indicator Available in CR - Is the indicator in the
Control Room?
 CR Indicator Accurate - Are the indications
available accurate?
 Warn/Alt. Procedure - Is displayed information is
perceived to be unreliable, or warn the operator
the indication might be inaccurate?
 Training on Indicator - Has the crew received
training in interpreting or obtaining the required
information under conditions similar to those

25. Failure of Attention

26. Failure of Attention
 Low v. High Workload - Do to the cues critical to
the HI occur at a time of high workload or
distraction?
 Check v. Monitor - Is the operator required to
perform a one-time check of a parameter, or is he
required to monitor it until some specified value?
"Monitor" leads to a greater failure probability
than "check“ (does not check the parameter
frequently enough)
 Front v. Back Panel - Is the indicator displayed
on the front or back panel of the main control

27. Misread/Mis communicated
Data
 Indicator Easy to Locate - Is layout,
demarcation, and labeling of the control boards
such that it is easy to locate the required
indicator?
 Good/Bad Indicator - Is it conducive to errors in
reading the display?
 Formal Communication - Is a formal or semi-
formal communication protocol (i.e., 3-way
communication) used for transmitting values

28. Information Misleading
 All Cues as Stated - Are cues/parameter values as
stated in the procedure?
 Warning of Differences - Does the procedure itself
provide a warning that a cue may not be as
expected, or provide instructions on how to proceed
if the cue states are not as anticipated?
 Specific Training - Have operators received specific
training in which the correct interpretation of the
procedure for the degraded cue state was
emphasized?
 General Training - Have the operators received
general training that should allow them to recognize
that the cue information is not correct in the

29. Skip a Step in the Procedure :
(Procedure-Crew Interface )
 Obvious v. Hidden - Is the relevant instruction a
separate, stand-alone numbered step or is it easily
overlooked? A "hidden" instruction might be on of several
steps in a paragraph, in a note or caution, on the back of
page, etc.
 Single v. Multiple - At the time of the HI, is the procedure
reader using more than one flowchart procedure?
 Graphically Distinct - Does the step stand out on the page?
This effect is diluted if there are several things on the page
which stand out.
 Place keeping Aid - Are place keeping aids, such as checking
off completed steps, used by all crews?

30. Misinterpret Instruction
 Standard Wording - Does the step use unfamiliar
or ambiguous nomenclature or grammatical
structure? Does it require any explanation?
 All Required Information - Does the step present
all information required to identify the actions
directed and their objectives?
 Training on Step - Has the crew received training
on the correct interpretation of this step under
conditions similar to those in the given HI?

31. Misinterpret the Decision
Logic :
 "NOT" Statement - does the step has word
"not"?
 AND or OR Statement - diagnostic logic in
which more than one condition is combined to
determine the outcome?
 Both AND & OR - Complex logic involving a
combination of ANDed and ORed terms?
 Practiced Scenarios - Has the crew practiced
executing this step in a scenario similar to this
one in a simulator?

32. Deliberate Violation
 Belief in Adequacy of Instruction - Do they have
confidence in the effectiveness of the procedure for
dealing with the current situation:- have they tried it in the
simulator and found that it worked?
 Adverse Consequences if Comply - Will literal
compliance produce undesirable effects, such as release
of radioactivity, damage to the plant, unavailability of
needed systems or violation of standing orders?
 Reasonable Alternatives - Are there any fairly obvious
alternatives, such as partial compliance or use of different
systems, that appear to accomplish some or all of the
goals of the step without the adverse consequences?
 Policy of "Verbatim " Compliance - Does the utility have
and enforce a strict policy of verbatim compliance with
EOPs and other procedures

33. Calculating the HEP
 To calculate the HEP, all of the applicable failure
mechanisms need to be included.
 The total HEP is then calculated according to the
following equation:
Pc = ∑i=1,2 ∑ j P ij P ji nr
where pj is the probability of mechanism j of mode
i occurring, and P ji nr is the associated non-
recovery probability for that mechanism.

34. A Technique for Human Event
Analysis (ATHEANA)

35. A Technique For Human Event Analysis
(ATHEANA)
 ATHEANA is…
 A Technique for Human Event Analysis
 A second-generation HRA method
 A development of NRC/RES and its contractors
 An input to NRC’s Good Practices for Implementing
Human
Reliability Analysis (HRA), April 2005
 ATHEANA is documented in:
 NUREG-1624, Rev. 1, Technical Basis and
Implementation
Guidelines for A Technique for Human Event
Analysis

36. ATHEANA
 Provides an HRA process, an approach for
identifying and defining HFEs (especially for
EOCs), an HRA quantification method, and a
knowledge-base (including analyzed events
and psychological literature)
 Provides a structured search for problem
scenarios and unsafe actions
 Focuses on the error-forcing context
 Uses the knowledge of domain experts
(e.g., operators, pilots, operator trainers)

37. ATHEANA
 Links plant conditions, performance shaping
factors (PSFs) and human error mechanisms
 Consideration of dependencies across
scenarios
 Attempts to address PSFs holistically (considers
potential interactions)
 Structured search for problem scenarios and
unsafe actions

38. Insights into ATHEANA
 Human influences on system operation includes:
 Normal operation : control actions
 Maintenance actions : service, inspection, test, etc.
 Control of small disturbances in “abnormal” operation
 Termination of the development of a disturbance : reach a safe state
 Mitigation of consequences of a disturbance
 Types of human actions:
 Planned human actions
• procedures
• training
 Unplanned actions
• usually not credited in a PSA
• develop a plan based on PSA insights

39. Multidisciplinary Framework of
ATHEANA

40. ATHEANA characteristics
 Focuses on the error-forcing context (i.e., the context that sets up
operators), but also addressed the nominal context
 Uses a structured search for problem scenarios (i.e., error-forcing
contexts) and associated unsafe actions (i.e., operator failures)
 Links plant conditions, performance shaping factors (PSFs) and
human
error mechanisms through the context
 Is experience-based, both in its development and application (e.g.,
uses
knowledge of domain experts such as operators, pilots, trainers)
 Uses multidisciplinary approach and underlying cognitive model of
operator behavior
 Explicitly considers operator dependencies (including recovery
actions)

41. Steps involved in ATHEANA
 Step 1: Define and interpret issue of concern
 Step 2: Define scope of analysis
 Step 3: Describe base case scenarios
 Step 4: Define HFEs and unsafe actions (UAs)
 Step 5: Identify potential vulnerabilities
 Step 6: Search for deviations from base case
 Step 7: Evaluate recovery potential
 Step 8: Quantification
 Step 9: Incorporation into PRA

42. Formulation for Quantification
Process
P (HFE|S) = Σ P(EFCi|S) x P(UAj|EFCi,S)
ij
 HFEs are human failure events modeled in PRA
 Modeled for a given PRA scenario (S)
 Can include multiple unsafe actions (UAs) and error-
forcing
contexts (EFCs)
 First determine probability of the EFC (plant
conditions
and PSFs) being addressed
 Determine probability of UA given the identified
EFC

43. Steps for Quantification of
HEPs
1. Discuss HFE and possible influences / contexts
using a
factor “checklist” as an aid
2. Identify “driving” influencing factors and thus most
important contexts to consider
3. Compare these contexts to other familiar contexts
and
each expert independently provide the initial
probability
distribution for the HEP considering:
 “Likely” to fail ~ 0.5 (5 out of 10 would fail)
 “Infrequently” fails ~ 0.1 (1 out of 10 would fail)
 “Unlikely” to fail ~ 0.01(1 out of 100 would fail)

44. Steps for Quantification of
HEPs
4. Each expert discusses and justifies his/her
HEP estimate
5. Openly discuss opinions and refine the HFE,
associated contexts, and/or HEPs (if needed)
– each expert independently provides HEP
(may be the same as the initial judgment or
may be modified)
6. Arrive at a consensus HEP for use in the
PRA

45. Project Findings