Expectations in NRC Inspection Procedures 95001 and 95002 Frederick J. Forck 4Konsulting, LLC USE A TOOL USE A TOOL TO BUILD CAUSE ANALYSIS TOOLS Fault tree analysis 2. Critical incident techniques 3. Events & causal factors analysis 4. Pareto Analysis 5. Change analysis 6. Barrier analysis 7. Management Oversight & Risk Tree (MORT) analysis 8. Why Staircase 1. NRC IP 95001 USE TOOLS TO RECONSTRUCT Clearly identify problem State assumptions Data Timely collection Verification Preserve evidence Document analysis so • Progression of the problem is clearly understood • Any missing information or inconsistencies are identified • Problem can be easily explained and/or understood by others NRC IP 95001 Determine cause & effect relationships resulting in Identification of root and contributing causes that Consider the following types of issues: • Hardware: design, materials, systems aging, and environmental conditions; • Process: procedures, work practices, operational policies, supervision and oversight, preventive and corrective maintenance programs, and quality control methods; and • Human performance: training, communications, human-system interface, and fitness for duty (which includes managing fatigue). Gather information Reconstruct the incident. Discover causes. Recommend corrective actions Incident Avatar International Inc., 1985 Job/Task Analysis Incident Analyst Manage Information Scope The Problem Investigate The Factors Reconstruct The Story Establish Contributing Factors Validate Underlying Factors Plan Corrective Actions Report Learnings Facilitate Investigation © 2008, 4Konsulting, LLC, 573-645-8854, www.4konsulting.com Derived from 1. INPO 90-004 2. NUREG/CR-5455, NRC HPIP 3. Entergy Root Cause Analysis Process Written Followed Include Acceptance Criteria 10CFR50, App. B Callaway Plant Lead Auditor Training Issues that drove, influenced, or allowed the incident Accurate, factual information Scope The Problem Investigate The Factors Intervention(s) that improve design or change behavior Reconstruct The Story Establish Contributing Factors Validate Underlying Factors Progression of the problem Precise, complete, bounded problem statement Plan Corrective Actions Report Learnings Auditable, defensible record Correctable root and contributing causes Output/Results Scope the Problem Techniques Deviation Statement Difference Mapping Problem Description Extent of Condition Review Methodology Selection Investigate the Factors Techniques Evidence Preservation Interviewing (What & How) Perform Analysis Worksheet Culpability Decision Tree Substitution Test/Survey SORTM questions Establish Contributing Factors Techniques Difference Analysis Defense Analysis Production/Protection Strategy (Defense-In-Depth) Analysis Factor Tree MORT Analysis Exposure Factors Moderating Factor Triggering Factor Incident Aggravating Factors TW Accurate, factual information How? Progression of the problem IN Incident Systems Analysis Steps With Techniques How and Why? Validate Underlying Factors Techniques WHY Factor Staircase A-B-C Analysis HOW-To-WHY Matrix Cause & Effect Tree Root Cause Test Root Cause Evaluation Extent of Cause Review Common Cause Analysis Safety Culture Tree Excellent Human Perform Tree Stream Analysis Why? Plan Corrective Actions Techniques Change Management Action Plan Active Coaching Plan Barriers & Aids Analysis Solution Selection Tree Solution Selection Matrix S.M.A.R.T.E.R. Effectiveness Review Communication Plan Contingency Plan What next? Report Learnings Forms Report Template Grade Cards/Scoresheets © 2010, 4Konsulting, LLC, 573-645-8854, www.4konsulting.com Derived from 1. INPO 90-004 2. NUREG/CR-5455, NRC HPIP 3. Entergy Root Cause Analysis Process A precise, complete, and bounded problem description Who, When, Where? Reconstruct the Story Techniques Fault Tree Task Analysis Critical Activity Charting Actions & Factors Chart Flawed Defense What? The factors that drove, influenced, or allowed the incident Correctable root and contributing causes Intervention(s) that improve design or change behavior An auditable, defensible record Focus on Results Changed, Improved State of the Business Derived from 1. INPO 90-004 2. NUREG/CR-5455, NRC HPIP 3. Entergy Root Cause Analysis Process Incident Scope the Problem Techniques •Deviation Statement •Difference Mapping •Problem Description •Extent of Condition Review •Methodology Selection What? A precise, complete, and bounded problem statement Identify the GAP: What is the Problem? Method 1: Deviation Statement (noun/verb) OBJECT: What is the item that is affected? DEFECT: Identify the “DEVIATION” from the “EXPECTED” or “REQUIRED STANDARD of PERFORMANCE.” Example: Five gallons of oil spilled (defect) on the “B” Emergency Diesel Generator room floor (object) . OR Use: Method 2: Expected vs. Actual Statement Compare “WHAT SHOULD BE”*: Requirement, Standard, Norm, or Expectation with “WHAT IS”: The existing, as-found condition” *Sometimes the “What Should Be” is implied. Kepner-Tregoe, The New Rational Manager BPI Problem Solving-Decision Making-Planning Evaluate ONLY from Problem Description Perspective Deviation Statement: Object Application Object (Person, Place, Thing) Defect Application (Activity, Form, Fit, Function) Defect (Flaw, Failing, Deficiency) Deviation Statement Then evaluate various combinations • • • • • Same Same Same Same Same Similar Similar Same Same Similar Similar Same etc. Document the basis for bounding with the associated risk and consequence Lewis Allen , STP, 15th Annual HPRCT Same-Same-Same An Identical Object in an Equivalent Application with a Matching Defect Same-Same-Similar An Identical Object in an Equivalent Application with a Related Defect Similar-Same-Same A Comparable Object in an Equivalent Application with a Matching Defect 1 Does potential exist for this problem to cause further impact to this SSC* or Process? YES Human Performance Tool Peer Check NO 1. Describe why this is an isolated problem/issue. 2. Verify, using OE**, that this is not an industry issue. Describe where, when, and how it will be impacted Recommend corrective actions NO 2 Does potential exist for this problem to impact other SSC*s or Processes? YES *SSC-Structure, System, Component **OE-Operating Experience Adapted from information provided by Duke Power personnel A precise, complete, and bounded problem statement Derived from 1. INPO 90-004 2. NUREG/CR-5455, NRC HPIP 3. Entergy Root Cause Analysis Process Investigate the Factors Techniques •Evidence Preservation •Interviewing (What & How) •Performance Analysis Worksheet •Culpability Decision Tree •Substitution Test/Survey •SORTM questions Who, When, Where? Accurate, factual information 1. Determine how best to fill your information needs. (Information you have vs. Information you still need) • • • • 2. review of logsheets, charts, drawings, etc. area walkdowns interviews Decide who to interview and what you hope to learn from them. Determine which information to pursue first. Considerations: • Focus on issues that appear to be key. • Management Sponsor may need certain information first (e.g. restart issues). • Interviewee availability may pose an impact. 3. Determine who will obtain the information. • Divide responsibilities among team members • If no team, you can still seek assistance from cognizant parties e.g. system engineer can research material history Adapted from Incident Investigation Training, Callaway Plant Prepare Open Question Close IAEA-TECDOC-1600 Reduced Severity of Incidents Successful Results Reduced Frequency of Incidents AND Error Free Incident Free Practices Rigorously Use Error-Prevention Tools Processes Aggressively Control Defense-In-Depth Human Factors Prong System Factors Prong AND AND Engineered Defenses 1st Line Administrative Defenses 2nd Line Work Preparation Oversight Defenses 3rd Line Work Performance Work Feedback Cultural Defenses 4th Line Adapted from INPO 06-003 Flawed Defense Exposure Factors Moderating Factor Triggering Factor Incident Aggravating Factors TW IN Phoenix Handbook, Corcoran Dana Cooley Derived from 1. INPO 90-004 2. NUREG/CR-5455, NRC HPIP 3. Entergy Root Cause Analysis Process Accurate, factual information Reconstruct the Story Techniques •Fault Tree •Task Analysis •Critical Activity Charting •Actions & Factors Chart How? Progression of the problem INCIDENT FAILURE MECHANISM: SPECIFIC EQUIPMENT FAULT THAT RESULTED IN THE LOSS OF CAPABILITY OR FUNCTION DEGRADATION MECHANISM: PHYSICAL PHENOMENA INVOLVED IN THE FAILURE EXAMPLES: FAILED TO; OPEN, CLOSE, START, ACTUATE, ENERGIZE LOSS OF; INDICATION, COOLING, HEATING, PRESSURE TRIPPED, OVER PRESSURIZED, OVERHEATED OUTCOME OR CONSEQUENCE FAILURE MODE: LOSS OF CAPABILITY OR FUNCTION FORM FIT DEFORMATION MATERIAL CHANGE FRACTURE REACTIVE ENVIRONMENT FORCE DEGRADATION INFLUENCES: PROCESS OR PROGRAM DEFICIENCIES THAT EXIST IN SUFFICIENT MAGNITUDE OR DURATION TO INDUCE THE FAILURE DISPLACEMENT ALIGNMENT SEPARATING TIME TEMPERATURE ASSEMBLY/ INSTALLATION DEFECTS MATERIAL DEFECTS DESIGN CONCERN FUNCTION FABRICATION/ MANUFACTURING ERRORS EXAMPLES: BROKEN VALVE STEM, TORN DIAPHRAGM, BLOWN FUSE, SEAT LEAKAGE, SCORED FLANGE, LOOSE VALVE PACKING, LOOSE FITTING, LOW VOLTAGE, GROUND FAULT, SHORT CIRCUIT, ODOR... EXAMPLES: BLOCKAGE, STICKING, CORROSION, CRACKING, WEAR, PITTING, EROSION, FRACTURE, MELTING, CAVITATION... MAINTENANCE DEFICIENCY IMPROPER OPERATION Adapted from Callaway Plant “Fault Tree Analysis” Training Step 1: Identify the Undesirable Incident Step 2: Identify 1st Level Inputs Step 3: Link Using Logic Gates Step 4: Identify 2nd Level Inputs Step 8: Determine Contributing Factors “Physical Roots” Step 7: Investigate Remaining Inputs Step 6: Develop Remaining Inputs Step 5: Evaluate Inputs Fault Tree Analysis, Clemens Callaway Plant “Fault Tree Analysis” Training © 4Konsulting, LLC 2009 Frederick J. Forck, CPT 2320 Knight Valley Drive Jefferson City, Mo 65101-2253 Phone: 573-645-8854 Fax: 573-636-7734 Email: [email protected] www.4konsulting.com Equipment Runs Incident And Equipment Form Function Fit Physical Roots Human-Machine Interface And Design Response Materials Assembly Installation Operation Maintenance Storage Human Succeeds Think (Operation) And Stimulus Human Roots Skill Knowledge Mindset Personal Accountability Personal Choice Organizational Processes Communication Practices Defense-In-Depth Latent Organizational Weaknesses And Latent Roots Human Factors Independent Verification Written Instruction Supervision Oversight Learning Environ Step 1: Obtain Preliminary Information Step 2: Select Task(s) of Interest Step 3: Obtain Background Information Step 4: Prepare a Task Performance Guide Step 8: Evaluate & Integrate Findings Step 7: Reenact Task Performance Step 6: Select Personnel Step 5: Get Familiar With the Guide Step 7A: Interview Personnel (Alternate Method) DOE-NE-STD-1004-92 Note: Not all steps of a work activity are equally important. Critical Human Actions (steps) include: • Actions aimed at changing the state of facility structures, systems, or components • Steps that are irrecoverable or actions that cannot be reversed • Steps where the outcome of an error is intolerable for personnel or facility safety www.hanover.gov NRC NUREG/CR-5455, NRC HPIP A step in the activity that caused or could have made the incident less severe. It is a CHA if the step: Might cause an incident if the step is not done Might cause an incident if an error is made Might cause an incident if done some other way Makes incident less severe if done the right way. Could be a “Critical Step” related to the incident NRC NUREG/CR-5455, NRC HPIP 1. Identify the human actions to be analyzed. (This may be all the human actions in the incident, or it may be those that are believed to have been responsible for the event's occurrence.) 2. Decide which human actions caused the incident or, if they had been performed correctly, could have prevented the incident or made the incident less severe (Critical Human Actions or CHAs). 3. Collect and record information about the CHAs. Derived from: 1. NRC NUREG/CR-5455, NRC HPIP 2. UE QIP Action Action Action How did the factors originate? Action Incident Factor Factor Why did this Incident happen? What systems allowed The Conditions to exist? Adapted from DOE Accident Investigation Program Contributing Factor Work Activity Causes Contributing Factor Process Causes Contributing Factor Institutional Causes Actions Who did what? What equipment did what? Action 1 Incident that Occurred (Reason for the Investigation) Action 2 Incident (Action 4) Action 3 CF CF Factor 1.1 Factor 1.1.1 Factor 2.1 Factor 1.1.2 Factor 3.1 Factor 2.2 Factors or Contributing Factors Flawed Defense Action 5 Progression of the problem Derived from 1. INPO 90-004 2. NUREG/CR-5455, NRC HPIP 3. Entergy Root Cause Analysis Process Establish Contributing Factors Techniques •Change Analysis •Barrier Analysis •Production/Protection Strategy (Defense-In-Depth) Analysis •Factor Tree How and Why? Issues that drove, influenced, or allowed the incident The Six Steps of Change Analysis Incident situation COMPARE Comparable incident-free situation Some Factors to Consider: - Who - What - Where - When - Work Conditions - Task - Triggering Events - Management Controls - Procedures - Resources Set down differences Evaluate differences for effect on incident Integrate into investigation process Evaluate by asking these questions: • What was different about this time from all the other times the same hardware operated without a problem or the same task or activity was carried out without error? • Why now and not before? • Why here and not there? Guidelines for Preventing Human Error in Process Safety. Center for Chemical Process Safety of the American Institute of Chemical Engineers, Ferry © 1988 Root Cause Analysis Training Course CAP-02, Palo Verde Nuclear Generating Station Ammerman, The Root Cause Analysis Handbook Local Factor Control Engineered Barriers Admin Controls Oversight Controls Cultural Controls Eliminate task. Prevent error. Catch error. Detect defect. Mitigate harm. Accept risk. “Carelessness and overconfidence are more dangerous than deliberately accepted risk.” Wilbur Wright, 1901 (www.faa.gov) Muschara, Managing Critical Steps, HPRCT 2009 Muschara, Managing Defenses, HPRCT 2008 Identify each Target of hazards/threats. Identify each Hazard (adverse effect/consequence) Identify Barriers that should have controlled Hazard • Prevented contact between Hazard and Target OR • Mitigated consequences of Hazard/Target contact Assign a Safety Precedence Sequence # to each Barrier Assess HOW Barrier failed • not provided/missing (not in place) • not used/circumvented (but were in place) • ineffective Determine WHY Barrier failed (Step 5) Validate analysis results Integrate this information in E & CF Chart Ammerman, The Root Cause Analysis Handbook ASQ MOST EFFECTIVE LOW HUMAN INTERFACE 1. Eliminate hazards through design selection 2. Incorporate Safety Devices 3. Provide Warning Devices $ 4. Use Procedures & Administrative Controls 5. Select, train, supervise, and motivate to work safely 6. Accept risks at appropriate management level LEAST EFFECTIVE MIL-STD-882D HIGH HUMAN INTERFACE EFFECT/ CONSEQUENCES (What Happened) List one at timesequential order not required Ineffective SPS # No Yes Not Used Target Hazard/ Threat Defense Missing Failed? HOW Defense Failed BARRIER/CONTROL THAT SHOULD HAVE PRECLUDED THE INCIDENT list all applicable physical and administrative defenses for each consequence Corrective WHY Action to Defense Restore Failed Defense to Effectiveness Ammerman, The Root Cause Analysis Handbook ASQ 1977 Company installed fixed ladder on building. Employee climbed ladder. Employee slipped on ladder rung. Ladder was not compliant with OSHA requirements. Carrying tools Rungs were wet. Hand not available to stop fall Rungs not slip-resistant Hazard/ Threat Defense No Yes SPS # Employee Employee Slip on rungs Falling from heights Slip-resistant rungs (provide traction) 2 Proper climbing technique 5 Yes Yes Missing Target X X Ineffective Failed? HOW Defense Failed Not Used Defense Not Used Employee fell from ladder. Defense Missing Employee broke back. Employee transported to hospital. www.sandia.gov Corrective WHY Action to Defense Restore Failed Defense to Effectiveness Did not exist; so did not provide traction Carrying tools; so 2nd hand not available to stop fall www.sandia.gov Evaluate factors (ovals) and flawed defense (broken barriers) on the Actions & Factors Chart by asking: • • If this factor had not existed, could this incident have occurred? If the answer is no, then you’re on your way toward finding a “Contributing Factor”! (NRC) Causal factors are those actions, conditions, or events which directly or indirectly influence the outcome of a situation or problem. Find Root Cause(s) Directly Actions, Conditions, or Events CF Directly or Indirectly influence the outcome of a situation or problem? (NRC) causes that by themselves would not create the problem, but are important enough to be recognized as needing corrective action. Contributing causes are sometimes referred to as causal factors. (INPO) A causal factor that did not produce the event but did shape the outcome or exacerbate the consequences. (Entergy) facilitates the occurrence of a condition or event, increases its severity, or lengthens the time to discovery. Indirectly Contributing Factor Construct Root Cause(s) The actions or conditions that set the stage for a human performance problem to occur, but, alone, were not sufficient to cause it...may be a long-standing condition or a series of prior events and problems that, while unimportant in themselves, increased the probability of error. Develop action plan to prevent recurrence (CAPR) OR Justify why action will not be taken to address this cause. OR Justify only developing corrective action (CA) © 2008, 4Konsulting, LLC, 573-645-8854, www.4konsulting.com NRC Inspection Procedure 95001 Issues that drove, influenced, or allowed the incident Techniques •WHY Factor Staircase •A-B-C Analysis •HOW-To-WHY Matrix •Cause & Effect Tree •Root Cause Test •Root Cause Evaluation •Extent of Cause Review •Common Factor Analysis •Stream Analysis Derived from 1. INPO 90-004 2. NUREG/CR-5455, NRC HPIP 3. Entergy Root Cause Analysis Process Validate Underlying Factors Why? Correctable root and contributing causes Symptom WHY 1 Practices Incident Execution Preparation Feedback WHY 2 Conditions WHY 3 Process Program Plan/Do/Check/Act Vision Beliefs Values WHY 5 Culture Phoenix Handbook, Corcoran Root Cause, Martin, HPRCT 2006 Outcomes Methods Resources WHY 4 Capabilities/Limitations Task Demands/Environment Thoughts Culture Anticipate Job-Site Conditions Task Demands TWEnvironment IN Work Analysis Individual Capabilities Human Nature’s Limits Foresee Results Manage Potential Consequences List critical human actions Modify task or work environ Predict error-likely situations Task Evaluate defenses for flaws Preview Change Job Performers Review previous lessons learned Plan contingency measures Pre-Job Modify orBrief add defenses Job Performer Behavior Use Worker and Supervisor Feedback Goals & Values Eliminate causes of Post-Job error precursors Eliminate causes of Review flawed defenses Strengthen defense-in-depth Business Incident Results INPO Human Performance Fundamentals Course Desired behavior: Wear safety glasses • • • • • A B Safety policy Safety signs Safety procedure Safety briefing Just-in-time training • Wear safety glasses C • • • • Ears hurt Can’t see clearly Uncomfortable Feel odd Consequences for current or past behaviors have the strongest influence on our future behavior. Foundations of Behavioral Accident Prevention: Eagles Management Support Course, BST, Inc. Performance Management, Daniels Desired behavior: Wear safety glasses A B • Peers don’t wear • Supervisors occasionally don’t wear • Leave at home • Embarrassed to ask for spare pair • Work w/o safety glasses C • Ears don’t hurt • Can see clearly • Less bother Consequences for current or past behaviors have the strongest influence on our future behavior. Foundations of Behavioral Accident Prevention: Eagles Management Support Course, BST, Inc. Performance Management, Daniels Uneasy Attitude Morale Written Instruction Quality Job Performer Skill, Knowledge, Proficiency Housekeeping Equipment Labeling & Condition Work-Arounds & Burdens Tool Quality & Availability Equipment Ergonomics Lockout-Tagout Fitness-For-Duty Walk-downs Task Preview Pre-Job Brief Turnover Processes/ Practices Questioning Attitude Procedure Use Procedure Adherence Self-Check Place-keeping Observations Conservative Decision-Making 3 Part Communication Stop…When Unsure Tasks/ Behaviors Walk-downs Task qualifications Performance Feedback Task assignment Interlocks Independent Verification Personal Protective Equipment Alarms Goals/ Values Staffing Continuous Learning Clear Expectations Change Management Benchmarking Problem-Solving Reviews & Approvals Communication Practices Simple, Effective Processes Management Practices Accountability Rewards & Reinforcement Handoffs Peer Check Results/ Incident Consequences Post-Job Critiques Root Cause Analysis Independent Oversight Performance Indicators Task assignment Berms Redundant trains Equipment Reliability Containment Equipment Protection Systems Safeguards Equipment INPO Human Performance Fundamentals Course In order to understand why people do what they do, beyond asking, "Why did they do that?" ask, "What happens to them when they do that?" When you understand the consequences, you are able to understand the behavior. Daniels, Aubrey C., Ph.D.; Performance Management, Performance Management Publications, Tucker, GA, 1989, pp. 23-24. Safety Culture Areas (4) Safety (13) Components Culture Aspects AND Human Performance (H) Problem Identification & Resolution (P) Safety Conscious Work Environment (S) Other Issues (O) NRC IM Chapter 0305 Areas Do Last!!! Components Within Cross-Cutting Area Human Performance 1. 2. 3. 4. Decision Making Resources Work Control Work Practices Any weaknesses within component? Yes Yes No Yes No Yes No Yes No No Problem Identification & Resolution 1. Corrective Action Program 2. Operating Experience 3. Self and Independent Assessments Yes Yes No Yes No Yes No Safety Conscious Work Environment 1. Willingness to Raise Concerns 2. Preventing and Detecting Retaliation Yes Yes No Yes No Other Safety Culture Components Accountability Continuous Learning Environment Organizational Change Management Safety Policies Yes Yes No Yes No Yes No Yes No 1. 2. 3. 4. Corrective Action Needed Tasks/ Behaviors No Processes/ Practices No No Goals/ Values NRC IMC 0305 Made the Incident Happen? Action or Factor Made the Consequences Worse? No Yes No Is NOT “Causal” Yes Is “Causal” Root Cause No Caused* by a More Important Underlying Factor? Yes NOT Root Cause *Caused-driven, permitted, influenced, triggered, released Adapted from work of Dr. William R. Corcoran, NSRC Corp. 1 Does potential exist for the causes of this problem to impact other SSC*s or Processes? YES Describe where, when, and how it will be impacted NO 1, Describe why this is an isolated cause/condition. 2. Verify, using OE**, that this is not an industry issue. Recommend corrective actions Human Performance Tool NO 2 Peer Check Does potential exist for the conditions Describe triggering conditions YES that triggered behaviors in this and where they are likely to problem to trigger similar trigger similar behaviors behaviors in other processes? *SSC-Structure, System, Component **OE-Operating Experience Adapted from information provided by Duke Power personnel Step 1 Determine the Scope of the CFA Step 2 Gather Data Step 3 Determine Which Information to Evaluate Step 4 Categorize the Data Step 5 Identify Areas for Further Analyses Step 9 Report Learnings Step 8 Plan Corrective Actions Step 7 Develop and Validate Causal Theories Step 6 Analyze Areas of Interest Adapted from Incident Investigation Training, Callaway Plant Correctable root and contributing causes Derived from 1. INPO 90-004 2. NUREG/CR-5455, NRC HPIP 3. Entergy Root Cause Analysis Process Plan Techniques Corrective •Action Plan Actions •Solution Selection Tree •Solution Selection Matrix •Change Management •Active Coaching Plan •S.M.A.R.T.E.R. •Effectiveness Review •Contingency Plan •Communication Plan What next? Intervention(s) that improve design or change behavior Develop alternative actions which address the underlying factors [i.e. the root cause(s)]. Evaluate alternative courses of action. Ensure corrective actions address the underlying factors [i.e. the root cause(s)]. Decide which alternatives will be recommended to management. Map out implementation of interventions/actions that will prevent or mitigate recurrence. Plan for contingencies. Institutionalizing Corrective Actions* Do it (implementation & use) Check Monitor (management & peers) Write it down (Procedure) Feedback (observation & mentoring) Agree Check Adjust Start Here Agree Agree Communicate it (Training) Vision, Values, & Beliefs Mental Model (Expectation = Standard) Ownership of Expectation (Organization; incl. management & peers) Vision, Values, & Beliefs © 2009 4Konsulting, LLC Adjust * Could be called -Alignment Model -Behavior Anchoring Model -Accountability* Model for Organizations -Gap Closure Plan Institutionalization Plan Factor/Cause Being Addressed © 2009 4Konsulting, LLC Corrective Action Step 1. Right Picture 2. Communicate 3. Monitor 4. Feedback Who When Owner Due Date Specific • What exactly needs to be done? Focus on results. • WHO does WHAT by WHEN Measurable • Describes desired behaviors so an observer can compare observed behavior to a desired behavior Attainable • Doable? Feasible? Realistic? Cost/Benefit? • Agreed to by Stakeholder? Good business? Related • Logical tie between the problem and cause(s) • Logical tie between cause(s) and corrective actions Time-sensitive • Should be completed before next “shot on goal” • If not, interim corrective actions are needed Effective • Degree of Dependability/Reliability • Leveraged solution w. Behavior Engineering Model Reviewed • By Stakeholders? By Subject Matter Experts? • For Unintended Consequences? www.hanford.gov Institutionalization Plan Cause/Factor Being Addressed Corrective Action Plan To Prevent Recurrence 1. Right Picture 2. Communicate 3. Monitor 4. Feedback S.M.A.R.T.E.R. Specific Measurable Attainable Related Timely WHO Effective Reviewed Owner WHEN Due Date Design Activity Risk at acceptable level? NO Document any relative policies or guidelines to ensure management strategy Redesign to reduce risk Risk at acceptable level? NO Incorporate safety devices MIL-STD-882D SAFETY DEVICES: YES YES Risk at acceptable level? Provide risk analysis package to management YES YES YES www.safeoutside.org/risk/Proceedings/Inc_Accpresentation.ppt NO Risk at acceptable level? Provide warning devices NO WARNING DEVICES: Develop special procedures and training Risk at acceptable level? NO SPECIAL PROCEDURES Document policy or guideline excluding activity Repair activity 1 Develop corrective actions DEVELOP an Effectiveness Review Plan Implement intervention(s) that improve design or change behavior UPDATE management 2 PERFORM Effectiveness Review (Assessor Actions) 3 DOCUMENT Effectiveness Review (Assessor Actions) 4 APPROVE Effectiveness Review (QRB actions) METHOD • Describe the means that will be used to verify that the actions taken had the desired outcome. ATTRIBUTES • Describe the process characteristics to be monitored or evaluated. SUCCESS • Establish the acceptance criteria for the attributes to be monitored or evaluated. TIMELINESS • Define the optimum time to perform the effectiveness review. Grand Gulf Nuclear Station General Performance Measure Development The following table is useful when developing Performance Indicators. Organizational Outcome/Output: Step 1 Process Outcome/Output: Step 2 Process Purpose: Step 3 Operational Excellence Critical Outcome/Output Dimensions Step 4 Step 5 Measures Standards (Goals) Annunciator Definitions Step 6 Step 7 Step 8 Improving Performance: How to Manage the White Space on the Organization Chart, Rummler & Brache Intervention(s) that improve design or change behavior Derived from 1. INPO 90-004 2. NUREG/CR-5455, NRC HPIP 3. Entergy Root Cause Analysis Process Report Learning Forms •Report Template •Grade Cards/Scoresheets An auditable, defensible record The investigation will have determined the following: What was expected (anticipated consequences); What has happened (real consequences); What could have happened (potential consequences); Cause-effect relations; Faulty/failed technical elements (structures, systems, or components); Inappropriate actions (human, management, organizational); Failed or missing defenses (barriers, controls). IAEA-TECDOC-1600 What was the Job Performer focused on? Could they do the Job if their lives depended on it? Equally qualified person likely to make same error? What were the factors that directly resulted in the nature, the magnitude, the location, and the timing of the key consequences? What happens to them when they do what they do? Mager & Pipe, Analyzing Performance Problems Corcoran , Phoenix Handbook Daniels, Performance Management Who identified issue (licensee? regulator? self-revealing?) under what conditions? How long did issue exist? prior opportunities to identify? Plant-specific risk consequences? individual & collective compliance concerns? Systematic method used to identify underlying factors? Evaluation detail commensurate with significance of the problem? Evaluation considered prior occurrences? operating experience? Extent of condition addressed? extent of cause? Corrective actions for each underlying factor? or adequate evaluation why no corrective actions are necessary? Corrective action priority considers risk significance & regulatory compliance? Schedule established for implementing and completing corrective actions? Quantitative/qualitative effectiveness measures of actions to prevent recurrence? Corrective actions adequately address Notice of Violation, if applicable? NRC IP 95001 NRC IP 95002 Later Frederick J. Forck, CPT* 4Konsulting, LLC 2320 Knight Valley Drive Jefferson City, Mo 65101-2253 Phone: 573-645-8854 Fax: 573-636-7734 Email: [email protected] www.4konsulting.com *International Society for Performance Improvement (ISPI) Certified Performance Technologist (CPT) Extent of Condition Review Criteria Deviation Statement Same-Same-Same An Identical Object in an Equivalent Application with a Matching Defect. Same-Same-Similar An Identical Object in an Equivalent Application with a Related Defect. Similar-Same-Same A Comparable Object in an Equivalent Application with a Matching Defect. Similar-Same-Similar A Comparable Object in an Equivalent Application with a Related Defect. Same-Similar-Same An Identical Object in a Corresponding Application with a Matching Defect. Similar-Similar-Same A Comparable Object in a Corresponding Application with a Matching Defect. Same-Similar-Similar An Identical Object in a Corresponding Application with a Related Defect. Object (Person, Place, Thing) Application (Activity, Form, Fit, Function) Defect (Flaw, Failing, Deficiency) Driver’s side front tire of rental car parked in my driveway is flat Object Extent of Condition (Person, Place, Thing) Review Criteria Deviation Statement Driver’s Side Front Tire on Same-Same-Same An Identical Object in an Equivalent Application with a Matching Defect. Same-Same-Similar An Identical Object in an Equivalent Application with a Related Defect. Similar-Same-Same A Comparable Object in an Equivalent Application with a Matching Defect. Similar-Same-Similar A Comparable Object in an Equivalent Application with a Related Defect. Same-Similar-Same An Identical Object in a Corresponding Application with a Matching Defect. Similar-Similar-Same A Comparable Object in a Corresponding Application with a Matching Defect. Same-Similar-Similar An Identical Object in a Corresponding Application with a Related Defect. Application (Activity, Form, Fit, Function) Defect (Flaw, Failing, Deficiency) Parked in My Driveway Flat Rental Car 1. Other Tires on Rental Car 2. Tires on Pickup Truck 1. Parked in My Driveway 2. Parked in My Driveway 1. Flat 2. Flat 1. Other Tires on Rental Car 2. Tires on Pickup Truck 1. Parked in My Driveway 2. Parked in My Driveway 1. Low on Air 2. Low on Air 1. Tires on Boat Trailer 2. Tires on Bicycle 1. Parked in My Driveway 2. Parked in My Driveway 1. Flat 2. Flat 1. Tires on Boat Trailer 2. Tires on Bicycle 1. Parked in My Driveway 2. Parked in My Driveway 1. Low on Air 2. Low on Air 1. 2. 3. 1. 1. 2. 3. 1. 1. 2. 3. 1. Car Spare Tire Tires on Son’s Vehicle Tires on Spouse’s Vehicle Garden Tractor 1. Car Spare Tire 2. Tires on Son’s Vehicle 3. Tires on Spouse’s Vehicle In Trunk as a Spare Parked on the Street Parked in the Garage Parked Behind My House 1. In Trunk as a Spare 2. Parked on Street 3. Parked in the Garage Flat Flat Flat Flat 1. Low on Air 2. Low on Air 3. Low on Air OR OR OR OR OR Adapted from Callaway Plant “Fault Tree Analysis” Training (1) Paper & Pencil Input Steps in Procedure or Practice (2) Walk Through by Analyst or trained individual. (3) Questions/ Conclusions about how task was/should be performed. (1) Paper & Pencil Input Steps in Procedure or Practice 1. Locate proper “pig trap”. 2. De-pressurize line pressure. 3. Verify that the line has been de-pressurized. 4. Open line. 5. Insert pig. 6. Close line. 7. Re-pressurize line. (2) Walk Through by Analyst or trained individual. Pig trap is not labeled. Nearest pressure gauge is up 2 flights of stairs about 50’ away. Other pig traps all have pressure gauges near opening. (3) Questions/ Conclusions about how task was/should be performed. Is there a requirement to label? Why is the location without a pressure gauge? Has it been modified? Steps are all very general. How does the operator know how to do them? Chlorine Plant Explosion Kills 3, Injures 1 Prepare tanker for filling Verify tanker is empty Check weight of tanker Enter tanker target weight Prepare fill line Connect main fill line Error Type: Wrong Information Obtained Error Description: Wrong Weight Entered Consequence: Alarm does not sound before tanker overfills Monitor tanker filling operation Remain within earshot while tanker is fillin Check road tanker Attend tanker during last 2-3 ton filling Error Type: Check Omitted Error Description: Tanker not monitored while filling Consequence: Leaks not detected early Guidelines for Preventing Human Error in Process Safety, Center for Chemical Process Safety of the American Institute of Chemical Engineers 1977 Company installed fixed ladder on building. Ladder was not compliant with OSHA requirements. Employee climbed ladder. Employee slipped on ladder rung. Employee fell from ladder. Rungs were wet. Employee broke back. Employee transported to hospital. www.sandia.gov A. B. C. D. E. Factors that Influence Performance Failed Performance Past Successful Performance Difference or Change Contributing Factor? (Yes/No) When Supervision Job Performer Job Performer came in early to started day the avoid the heat. same time as coworkers. Employee did not meet with supervisor the morning of the accident. Employee met with supervisor to discuss the day’s work activities. No co-workers Yes. Worker were available to came to work help with the job. early, so was working alone, carrying tools. Work activities Yes. Because were not worker came to discussed. work early, job hazards were not discussed. CF 1977 Company installed fixed ladder on building. Ladder not compliant with OSHA requirements. Employee came to work early Employee climbed ladder. Working alone Carrying tools Job hazards not discussed Employee slipped on ladder rung. Employee fell from ladder. Employee broke back. Employee transported to hospital. CF 2nd hand not available to stop fall Rungs were wet. Rungs not slip-resistant CF Defense Not Used Defense Missing www.sandia.gov Develop corrective actions IMPLEMENT interim actions to prevent a repeat event pending comprehensive corrective actions. COMPLETE the investigation IDENTIFY steps to address the cause(s). ESTABLISH action plan for each identified cause or document the basis for no corrective action. INCLUDE actions to address Extent of Condition findings. INCLUDE actions to address Extent of Cause findings. ASSURE actions have addressed Safety Culture weaknesses FOR root causes, PLAN an intervention that is sustainable and that will be institutionalized. DETERMINE an appropriate date for completion of Corrective Action. EVALUATE the potential effectiveness of proposed corrective actions VERIFY the corrective action plan meets Change Management policy requirements. DEVELOP a contingency plan WRITE a Communication Plan. (with Lessons To Be Learned) DEVELOP an Effectiveness Review Plan UPDATE management Implement intervention(s) that improve design or change behavior 1 DEVELOP an Effectiveness Review Plan 2 PERFORM Effectiveness Review (Assessor Actions) SEARCH for examples of conditions/incidents that demonstrate the actions taken were ineffective at preventing recurrence. GENERATE a trackable activity with acceptance criteria to evaluate long-term effectiveness DOCUMENT the Effectiveness Review plan and Effectiveness Review criteria. REVIEW the document(s) that originated the corrective actions. FOLLOW the Effectiveness Review Plan in filling out the Effectiveness Review ChecklistIII Attachment SEARCH for precursor incidents/conditions that may indicate the actions taken have not been effective. 3 DOCUMENT Effectiveness Review (Assessor Actions) Effectiveness Criteria met? Yes No Detailed Effectiveness Review Flowchart LIST Causes/ Root Causes that were identified: DETERMINE whether the issue(s) or condition(s) identified in the Problem Report have been eliminated and whether the measures taken to correct the issue(s) or condition(s) are being managed. GENERATE a new Problem Report ATTACH a new Effectiveness Review Plan DETERMINE whether the actual corrective action(s) address each cause or root cause documented in the Problem Report. LIST Corrective Actions that were planned: DETERMINE whether a repeat occurrence or condition took place. DOCUMENT what was performed to validate findings. 4 DETERMINE whether all the corrective action assignments are implemented AND remain active as stated in the corrective action plan. IF the actions to prevent recurrence were not effective, IDENTIFY any additional corrective actions needed to resolve the issue. APPROVE Effectiveness Review (QRB actions) DETERMINE whether the corrective actions have been in place long enough to successfully challenge the effectiveness of the actions. DISCUSS corrective actions with cognizant personnel to identify any noteworthy weaknesses in the corrective actions. ENSURE corrective action taken did NOT result in a negative impact.