 OK, let us continue, because time is short. I still have lots of material to present. And I'm a bit afraid of not being able to fully finalize. That's it. So where we stopped before the coffee break was the human cognitive reliability curves. And these curves are very often used for quantifying the human error probabilities for specific human errors. There is another curve, which is from the ASAP methodology. ASAP is the Accident Sequence Evaluation Program. This is an abbreviation. And it was produced by Dr. Ellen Swain. Does anybody know who Ellen Swain is? No? Interrogated him? OK, so he is the, I would say, he is the father of the human reliability analysis for the probabilistic shift analysis. Before the WASH 1400 study in the US in 1975, he worked for the US Navy. Actually, he's a psychologist, I believe. And he made a lot of investigations of the human behavior on the US Navy's submarines to improve the so-called performance shaping factors. So all his knowledge is coming from that investigation. And he thought that once in the army, in a disciplinary environment, something is describing the human behavior. Then similarly, in a nuclear power plant, where in his opinion, the environment is at least as disciplinary as in the army. Therefore, the same experience can be used. Now, he worked a long time on the nuclear power plant operators' reliability. And he has a book, about 600 pages, that big book describing all kind of human reliability assessment methods. And unfortunately, this book is, well, I don't know if it is available on the net or not. I don't know. If somebody is interested, I can give a PDF copy. But it is something like 30, something megabytes, because all scanned. This is an old book. And since then, in many countries, in most of the probabilistic safety studies, this book is used as a reference. Full stop. All the others are almost neglected. And his book on the different human reliability assessment methods are in place in all probabilistic safety studies. Now what you can see here, according to his experience, the probability of a failure of a post-accident human interaction before 10 minutes, in the 10 minutes frame after the accident, the upper bound value should be taken as equal to 1. So we have to assume that within 10 minutes, the operator cannot do a right decision. Though it is not true, the median or the best estimate probability is lower than 1, definitely. But at the moment of the occurrence, of course, nobody knows what is going on. Sometimes it is needed to figure out what has been occurring. Now there is an interesting behavior of this curve. As you can see here, there is a fast decreasing probability between, let's say, 20 minutes and 30 minutes. So the right duration for making the right decision is about 30 minutes. After that, the decreasing is slowing down. It is explained by the fact that if the operator has a lot of time, he becomes lazy. And OK, I still have, I still have. And then comes the end of the available time. Oops, I still have to do that. And then it is already a stressing situation. So again, his methods are somewhat modeling the real behavior of an average American operator or an average American operator on the nuclear submarine in the army. And this experience is used also in the nuclear power plant. Now how it is applied to other countries that's a different question because in other countries it may happen that with that fast education or fast training like in the submarine for the soldiers in the submarine or in some cases for the American operators where the training for being a reactor operator concentrates mostly on how to follow the procedures. It is much shorter than to put there some engineer who has a master's degree in nuclear engineering. So that's a totally different thing. Now nevertheless, we are using these correlations for modeling the human errors. Now here there is an example actions with several steps and lengthy or local actuations. So those are the time available for the decision and for the total time available for performing the operator. And there is some part for the local manual actions. So these time points are determined by performing deterministic simulations of the process. So after the initiating event we start analyzing what is the available time for the first, well after the initiating event and the alarm we will have some time to perform the action. If this time expires then the process goes to somewhere else. Therefore that time point between the alarm and between this defined time point will determine for me the time window which is available for the operator to do the decision and also to initiate some of the local actions. And so on and so on. If it is successful then we go further, define the other time point and somehow we are getting to the full process. Yes? Now this is a requirement for the new nuclear power plants. And the other nuclear power plants it was not applied for consistently. So in many cases this 30 minutes is not applied. So that's not how to say, but perfectly true that this rule is applied everywhere. So you can have needed or required human interaction within the first 30 minutes in the case if it is feasible to perform it. If it is clear that the operator knows and there is an easy access to the procedure and so on and so on. So in some specific cases this 30 minutes is not applicable. OK, just to go and I mean to accelerate because I want to come to the human factors engineering as well as this is the topic of the second presentation. So let's say what are the dependence levels? Now what is dependence? First of all, let me talk about the dependencies. Dependence of a human action from something else will determine, will modify the probability. So if the initiating event is such that can be confused with something else, then the probability of doing the right action or probability of mistaking the right action will be higher than in the case when it is clear and only one initiating event can be diagnosed. So there is a dependence of the human action probability from the initiating event. Then there is an action one after the other. There is an action after a successful or a failure action failure. There is another human action. Then there is a dependence between the two human actions. So if the human actions are, let's say, close to each other in time, then the failure of the first human action will be a condition to the second action. Therefore, for the second action, we already assume some dependence. So if he failed at the first moment, then with a high probability he will fail the second moment. So if the time part, how it is dependent from the time available, usually what we say in the first moment, the first minute, we say that no way to perform good diagnosis. If we have one minute, about one minute, and we have several people like ship supervisor and the reactor operator, in one minute there can be some success. But the dependence with the reactor operator will be very high. So the ship supervisor will believe to the reactor operator. Therefore, they are making the same mistake. If it is around five minutes, then we have one reactor operator and experience senior operator. Then there will be a high dependence with the reactor operator. For the ship supervisor, it will be a little bit different. It will be low dependence or medium dependence with the others. So it may happen that he may, so his thinking will be different from those who are watching the indications and trying to find out what happened. Therefore, the dependence of his decision may be lower than in the case when there is only one minute. And if it is around five minutes or 15 minutes, then those dependencies are getting lower and lower. Because we have more time. There is more time for considering independently or reconsidering the situation independently. Therefore, this dependence will be lower. Now, the coupling mechanism of human dependence is why it is important. Because in the model, we'll have at some place this human action or the failure of this human action. And another place we'll have the failure of the human action, let's say, right after the other, which had to be done, or something which should be performed by the same operator. If it is the same person, then definitely if one fails, then the other will fail with a very high probability. If they are different people, then the dependence will depend on where they are sitting. If they are sitting in the same location in the control room, then definitely they will communicate with each other. Therefore, this dependence will again be a coupling mechanism. So this is the same crew. The same procedure. I'm using the same procedure for this and for that. This will create a high dependence. If it is the same procedure, then it is even worse. So I took a wrong procedure or wrong procedure step, and I'm taking the same procedure step for performing the other action. This will definitely be wrong if this was wrong. Then there are similar actions. Similar action means switching a key or doing something similar. I have to switch on this pump, and I have to switch on this pump. So if these two are the same, if I'm making a mistake with one, I very likely will make a mistake with the other. And if they are closing time for the same operator. So these are what we were talking about as human dependencies. Now, levels of dependencies. This is how we consider in the analysis. So if there is a complete dependence, then if action A fails, then action B will fail for sure. There is a high dependency, which doesn't mean that if action A fails, then the other will fail. But B will fail with a high probability. So I cannot use the same, I mean, assess probability for action B, but I have to use a conditional probability given action A fail. And the conditional probability will depend on the level of dependencies. So if there is a high dependency, then the conditional probability will be high. If it is moderate dependency, then the conditional probability will be lower than in the case of high. And so on and so on. And then if we can justify the zero dependency, then we don't consider this conditional probability. But we will consider the independent human error probability, which is assessed using the human error probability quantifying techniques. Now, and the Nurek CR 1278 is the document. What I was talking about, this is the famous Swain handbook of human reliability. So you can search on the internet, or if you are interested, I can give it to you during the lunch break or later today. Now, why it is important to assume these dependencies? Because in the safety analysis, whatever it is, it can be deterministic or probabilistic. We are assuming some human actions. And in case we are assuming some human error in the analysis, then the dependencies will define me whether in the next human action I have to assume or not. And usually the regulatory bodies, if I assume zero dependency, they will ask, why did you assume zero dependency? You have to justify. Because this is the most optimistic case. Therefore, you are not on a conservative side if you are assuming zero dependence. That means the regulator may ask the question, why do you assume so, OK? Now, the example of the dependence is to be considered in the HRA between the pre-initiating event human actions. As I told you, the same crew is going from one train to the other. This is dependence. So if I made a mistake here during the maintenance and go further to make the maintenance on the next train, I will make the same human error or I will make the same mistake with relatively big probability. Yes? Usually there is one operator. Well, one operator and then he has a boss who is the shift supervisor. OK? But if you have the shift supervisor, then this applies. You see? Shift supervisor is here. So of course, the shift supervisor is a kind of backup to the operator. He can override the decision of the operator and then his decision will be applied. Yes? But if there is a short time, definitely they will do the same mistake. So this is what this table wants to talk about. OK? Usually we have one operator, one reactor operator, one binoperator, one electrical operator, but the responsibility for operating one field remains on one person. Yes? And the shift supervisor will have to deal with everybody. Therefore, his attention may not be allocated to just one person. Therefore, his task is more difficult. OK? Now, well, these are the dependencies. I don't want to emphasize it. And then here comes the errors of commission. So this is omission is failure to perform required actions. The commission is performance of inappropriate action that aggravates the scenario. So I'm making the situation worse with something. As I said, we have slips in advance and unintentional align train A instead of train B. OK? Or making a mistake in inappropriate decisions. The evidence suggests slips are easier to recover, detect and correct than the other. Mistake is mistake. So once I push the wrong button to initiate a wrong train instead of my new train, it seems to be easier to understand that I made a mistake. Therefore, it will be very likely possible to recover the situation if I realize that I made a mistake in time. OK? Then the error of commission modeling is still an issue to be resolved. As I told you, it is so complex. And it can lead to several different scenarios. So to model it, it is very difficult. But we have to take into account definitely in the safety assessment. And also, when we are trying to define the human factor engineering tasks to lower the possibility or to lower the probability of the errors of commissions, this is one of the ongoing development areas in HRA. Other ongoing development areas are the analysis of decision performance and data and quantification. Let me tell you that the modeling and analysis of the decision performance is not finalized. So we somewhat seem to understand what is influencing the decision of the person. But there are performance shaping factors externally and internally. And also, the stress or performance shaping factors which are definitely influencing significantly the decision making process. Therefore, it is still an issue to be further developed. What we know now is what are those performance shaping factors which are influencing the decision making process. And knowing what are those performance shaping factors, we already can use this information for the human factor engineering to lower the influence of these factors. The data and quantification, data is a difficult issue. We tried to collect the information for, I was responsible back in the late 80s to establish so-called component reliability data collection system. And there was one field in the database that it was the component failure or unavailability was due to human error. And believe me, during the data collection process, we could never identify any component failures due to human error. Everything was hidden. So it was something which we don't know or we know that there's something rupture inside but no human error. So it is difficult. As soon as something comes to the human error, then it leads to the question of the responsibility. And if it leads to the question of the responsibility, everybody is protecting. No, no, no, it is not mine. It is not mine. So it is very, very difficult to define. However, it is clear that most of the equipment failures are due to human failures or human errors done during the maintenance. It is clear. Everybody knows it. But to identify it is almost impossible. So to collect data for human error, we're good luck to the person who wants to try. I give up, let me say so. I give up and turn to something else. Later, the data collection continued by different people. And they had a similar experience. So this is difficult. And there are some computer-based displays, soft interfaces, which are influencing now. So there are nice screens in the modern control rooms, even in all the control rooms which were refurbished or reconstructed. And Alec can tell how useful these new computer-based systems can be. But they will also bring their own risk, which is difficult to assess. And there are some organizational factors, also, which has to be, how to say, introduced in this analysis, though it is very difficult to assess. Therefore, the development on assessing the organizational factors, how they are influencing the human performance, is a difficult issue, again. Why it is so? Because you are attacking, seemingly you are attacking when analyzing the organizational factors, the management. And to attack the management with an assessment is also very dangerous. So you can end up with an unsuccessful project if you start to analyze it. So it is difficult. It is also an area where lots of development is needed. OK, so this was the human reliability analysis. And I guess it was not a complete presentation of the human reliability analysis. I tried to condense this presentation only to support the next presentation, where we are talking about what is this, the human factors and human factors engineering. Do you have any questions to the human reliability analysis? Of course, there are some areas which are very interesting, how incorporate to the PSA, and then what are the influence in the models, and so on and so on. But we don't want to go in these details. Sorry. OK? Yes? You can find out when he started to start in this position from time and support, from 1 PM to 7 PM. All the decisions were done by him at that time. So he didn't do a lot for himself. He can find all the words he has made, he would state his comments, all the words he completed rather than just data mining. OK, I understand you, yes. Yes, I understand you. The story is more difficult than that. So the database is handled by the operator. So mostly the electronic log books and the flow of the processes during the shift are to be entered by the operators. Therefore, the information in the database will be dependent on the operator. It's of who made the mistake, possibly. So it is very difficult, and very detailed analysis is needed of the database and the data to identify where are the possible human errors in the system. OK, OK, OK, OK, just wait a second. So first of all, what you are talking about is normal operation. When the normal operation and hopefully a normal operation, no initiating events are occurring. In most of the cases, the shift is going with a very boring activity because nothing is happening. So those human errors, what you are talking about can be measured mostly during the simulator training exercises. This is a better place to record that. And sorry to forget about it, but I promise you to tell you. So it is the right time to tell the story about the pox experiments. Back in the early 90s, there was a decision to re-evaluate the whole safety of the plant because the original suppliers of the plant or original vendor of the plant become a bit farer. So the Soviet Union collapsed. It was in Russia partly, the other part in Ukraine, and so on and so on. So it was difficult to find the right organization who can answer our questions. And the regulatory body required to perform the full safety assessment of the plant on our own. And it included the human reliability assessment as well. And the decision was to apply such methodology which uses experiments in the simulator training exercises. So we designed such scenarios which are outside the design-based accidents or design-based accidents with some equipment failure. And we predetermined those human actions which will be needed to cope with the scenario. And then one crew came. And we asked them if they agree with video directions. And also we measured the time required for the human action. So one scenario consisted of four or five human actions needed. And all the 24 crew went through five such scenarios. So altogether we had something like 600 data points with required time for the operator actions. And we could build up similar curves what you could see the human cognitive correlation or whatever it was with these three curves. And also we interviewed after that the instructor and interviewed the operators. And this interview showed us what was the reason of the delay for some operator or what was the cause of a very fast action. Because we realized that, of course, two different crews doing the same scenario, their behavior was different. We could see that in one crew there is a nice communication between the crew members. In other crew everybody is doing silently what his task is. So we also had information on the performance shaping factors like this. From the interview we had answers like, I forget. I don't remember. I didn't remember at the beginning what operating instruction I have to take. That was the cause. Or the other. The guy said, oh, well, it was yesterday something similar. So I remembered what has happened. So these are the things which we collected and analyzed. And out of it we had human error probabilities for many of the human actions needed for the probabilistic safety analysis. We also had information for the control room reconstruction arguments for the control room reconstruction. And also we identified those weaknesses of the event-oriented procedures which were eliminated by the symptom-oriented procedures. Do you know what is the difference between event-oriented and symptom-oriented procedures? Yes? Of course you do because you developed them quite recently. So I'm asking the others. So event-oriented procedure is when the operator has to find out what has happened. Let's say a small loco in the primary circuit and go and take the procedure which is called small loco in the primary circuit. And based on this, he has to go through all the steps which is written down there. The symptom-oriented procedure is when the operator sees some deviation from the normal operation and starts the process with the deviation. If something parameter is decreasing that fast, then the procedure will tell to which procedure you have to go. And then based on this procedure, you are trying to keep the plant in a safe condition. All the rest doesn't matter. So you don't need to deal with the diagnosis. You don't need to deal with many things. So it is a more detailed procedure than the step-by-step event-based procedure. Now, after developing the symptom-based procedure, we repeated this experiment. And it appeared that the plant become much safer just because there were no, during this 600 points which were needed, regardless on event sequence or event-oriented or symptom-oriented procedure you have to do, no mistakes were done by the operators. While in the other, we had some delays which caused, in some cases, problems with the successful execution of the exercise. So this helped us to understand how useful the, I mean this demonstrated the usefulness of the symptom-oriented procedures. And this was only the symptom-oriented procedures. Of course, there were also some changes in the displays by the time and so on and so on. And there are further developments in the man-machine interface design which will go on in the near future at the plant to replace some of the indicators to other types of indicators which are more visible for the operator. So that experiment, that set of experiments helped us very much to understand those performing factors which are influencing the human behavior in the control room and affecting with the reconstructions or modifications on these performing factors with some new human factor engineering. We could lead to a much safer plant. Therefore, this is a clear indication that there is a huge influence of the human factor engineering on the safety of the plant, OK? Now, other questions? Yes? Next question? No. In the accident tasks, there is a system design to start automatic action. And then there is a project where the operator can analyze and then he can take action after 13 minutes. I think within these 13 minutes, whether he can take some manual action or it is better to analyze And then where for, where to act after that? Well, this depends on the plan design and the decision. So in some cases, it is not even allowed to interfere with the automatic processes. Only in case something goes wrong. So if you have to do backup operation, like pump doesn't start, but I can try to start with, only this, only this. But that's what I'm saying, that it depends very much on the design and very much on the decision. So in most of the cases, it is not allowed to interfere. You don't have to interfere with the automatic if you are not needed there, because you may make, introduce a mistake, okay? Unless it is clearly written down that in such case where the clear indication shows what is the situation and it is clear what you have to do. Then without any thinking, you have to follow that and then do it. So basically that's the answer to that. So the thing is that they will need to stop your phone that took 15 minutes. They don't put it in the supervisor, so they are no more in the problem or in the problem and they are also diagnosed. So 15 minutes, they have some kind of solution. That's correct. So you may have the solution in the very first moment because you know. But let's give time to the automatic actions to go on because in, how to say, lucky situation, the automatic actions will do their work and then we'll go to a moment when you already can start your normal operational tasks. Okay, we probably will have some time at the end of the day for further discussions. I believe this is an interesting topic and we can spend a long time with discussion it. So let's go to the other presentation, okay? And then we'll decide later at the end of the day what discussion we'll perform, okay? Human factors. This is something shorter which allows me to finish it by lunchtime, hopefully. So human factors. We'll have some introduction, human performance and human factors, human factors engineering, human factors in the IAEA publications and one slide about the future plans of the IAEA on the human factors. It will be interesting to see. So let's see some statistics. From the IRS system. Do you know what IRS system is at the IAEA? This is the incident reporting system, widely used in the world and in the incident reporting system, about 48% of the events are affected by human errors. About 63 of these events are reported in the IRS and having significant human contributions happened during operation and 37 during shutdown. So shutdown is also a topic which has to be analyzed and the shutdown human actions. There are interesting topics to be identified like lots of contractors are coming in. In many plans, the so-called refueling and the maintenance work is done by external organizations, external to the plant organizations. It may be utility organization, but external to the plant. Therefore, the influence of the external people to, I mean, the external, the knowledge of the external people on the human errors done during shutdown might be significant. And also the analysis of the events reported in the IRS shows that in the last 20 years, there has been a slight increase in the contribution of human errors to the events. From about 45 in the 80s, approximately 55 in the recent years. Now, it is an interesting question. Why is it so? Is it because we are doing more mistakes? Yes? Okay. Okay, let's hope it is so. Yes, so the improvements in the technology reduces the number of events due to technological reasons, but the humans are the same. So the number of human errors may remain the same, but as a contribution is higher because the contribution of the other is decreasing. That's very likely the situation. And I would say with good willing that this is the case and not because we are more, how to say, not careful or something. It is, well, wow. Slight or not, it depends on the definition, okay? So I don't want to go into this detail. There is more. Let's guess it for yourself and then you will decide what is the cause. It is a question of opinion at the moment because we don't have the facts, okay? I don't have the facts. How many from harmony? I have only the contributions. So we can talk about it and then we will not convince each other. So let's hope that this is due to the fact what he said with the improvement of the technology, okay? Now, human performance, what is human performance? I would like to show what are the, so we were talking about human performance in the human reliability analysis. We try to analyze the human performance which is mental and physical capability of the person, the reliability of the person, the effectiveness of the person, plus the same for the team. So if we are talking about the team performance, then, I mean, as a control room crew, then we consider the team as well. There are many factors influencing the human performance in a complex system. Where the environment where the person works, yes, that's definitely, it is an influencing factor. The equipment interface and functionality, the design of processes and procedures and the organization of the work. So there should be a program at the plant to minimize the potential for human error by addressing and managing factors that may influence the human performance. And this is the objective of the human factor engineering, basically. We are doing it to reduce the potential for human errors. Now, let's have some definitions. Human factors in the nuclear facility are factors that influence human performance as it relates to the safety of a nuclear facility or activity through the life cycle of the facility. Sometimes interpreted together with organizational factors. So human factors and organizational factors, they are treated in many literature together. The human factors engineering is engineering in which factors that could influence human performance are taken into account. So these are relatively simple. Definitions and we have this IAEA safety guide, format and content of the safety analysis report for nuclear power plants requires some section to be devoted to the human factor engineering. So, which means this section on human factor engineering should demonstrate that human factors engineering and human machine interface issues have been adequately taken into consideration in the development of the design in order to facilitate the interaction between the operating personnel and the plant. This should be valid for all operational states and accident conditions and for all plant locations where such interactions are anticipated. So, there has to be a section in the safety analysis report which demonstrates that the human factors were taken into account in order to reuse the probability of the human errors in whichever areas of the plant operation. Further on, it says that this section should include the description of the principles of human factors engineering used for taking into account for all factors shaping human performance or factors shaping human performance that may have an impact on the reliability of the operator's performance. The design specific design features of systems and equipment are intended to promote successful operator actions should be considered in the chapter of the safety analysis report on the plant system description and design conformance. So, I guess you know the structure of the safety analysis report. There must be, I will probably touch it during the presentation on the periodic safety review, but I want to say that human factors engineering has a special section, but all the technical areas, the description of the technical areas has to contain some subsection on the human factor engineering related to the specific design features of the specific system or specific technological element, okay? So, other human factor engineering requirements are specified at the discussion of the specific safety analysis report requirements. So, these two what I mentioned are explicitly requiring a discussion on the human factor engineering and on the top of it, there are others which are related to specific description of the specific systems. What are the elements of the human factor engineering? First of all, this list of human factor engineering elements are taken from the USNRC requirements on, I guess it is Nuregg 0800 or something like that. I don't exactly remember, which specifies all the requirements regarding the human factors engineering and to be included in the safety analysis report. And finally, these elements are going to be repeated by the upcoming safety guide in 2018 in the IAEA safety guide, but I will tell you later. So, first the human factor engineering program objectives and scope, which will discuss the general program objectives and scope, the team and the organization. There must be a team and the organization who deals with or responsibilities distributed regarding the human factor engineering. Then the human factor engineering process and procedures and issue tracking. This is an important topic, issue tracking. How do I identify human factor engineering issues and how do I solve it and how the results of the solution can be shown? So, this is issue tracking, that's it. And the technical program itself. So, this is the first element. Second, the review of nuclear power plant operating experience. The operating experience always gives very positive influence on the safety. Whatever area we are talking about and this is the same with the human factors engineering. So, operating experience review to identify human factor engineering related safety issues. Well, something happened at the other plant, not in my plant, but it was due to wrong indication in the control room. Of course, I'm checking if the same indication is the same or not in my plant. So, I will use this information, the operating experience information from the other participants in the industry. Then the functional requirement analysis and functional location, where we are allocating functions to human and system resources to take advantage of human strengths and avoiding human limitations. What does it mean? There are functions which has to be performed by the human and there are functions that has to be performed by the technological systems. So, I have clearly defined what are those functions and when I'm designing the system, I'm trying to design on a way which will help me to take advantage from the smartness of the human, okay? And which will not disable the human to do something, okay? So, there are lots of aspects to be taken into account, but the functional requirements will define those. Okay, task analysis. The task analysis is to identify specific tasks that are needed for human accomplishment and their information, control and task support requirements. To select the representative and important operations, maintenance and test and inspection and surveillance task specific to a range of operating modes. These are already the functions which I allocated to human. Now I'm trying to analyze those tasks which I allocated to human in order to identify those issues which may influence the human errors during execution of these tasks. And to identify the risk important human actions including the monitoring and backup of automatic actions using the probabilistic safety analysis or human reliability analysis. So, if I'm lucky, I have the human reliability analysis. I have the results of the human reliability analysis. Therefore, this can be included in the task analysis. The results can be included in the task analysis. Now staffing and qualifications. Yes, staffing and qualifications. First of all, staffing, yeah? How many people do I want to work at my nuclear power plant? Yes? Well, of course, that many as many needed. So, definitely, but it is so sensitive to many factors that I don't know, I don't know. So, in a country where the labor costs are very high, definitely the trial of the management is to reduce the stuff, yes? And they are trying to reduce to the minimum required, minimum required number. So, in some cases, they fail because they reach the point where a person cannot be replaceable. And if he is ill, then something is not good at the plant because he is missing. So, I'm not saying that for every post there must be two persons or so, but one has to understand, the management has to understand that this is not just a game, it is influencing the safety. So, the operating staff with the operating crews, there must definitely be reserve control room staff or people who can be called from their home to replace somebody if it is needed. It is an extremely important issue in the plant management. So, staffing, the qualification, of course, it is already related to this because we may need highly qualified people. Sometimes the higher management, technical management at the plant have the license for shift supervisor post or for reactor operator post and they can replace the missing people. So, we have to analyze the requirements for the number and the qualifications of the person a satisfying task requirement and the applicable regulatory requirement. The number and qualifications of personnel for the full range of plant conditions and tasks including operational, normal, abnormal and emergency operational regions and maintenance and testing, including survey and testing. And if you come back to the refueling period, the utility may decide that if they have several nuclear power plants, they are keeping only one organization which serves for the maintenance task of the different nuclear power plants. In cases when the nuclear power plants are remote, in a remote distance from each other, several hundred kilometers or even more, there might be a decision to keep that personnel on the site permanently. Also, in the case we made a decision at Pauqs that to produce the spare parts, we established manufacturing capabilities at the plant. They were sitting at the site, highly qualified people with very good tools and waiting for the moment when they had to manufacture a spare part because manufacturing the spare part, the qualified spare part was shorter in time than to order it from, I don't know, which supplier somewhere else in Russia or elsewhere in the world because it takes maybe several months and if this equipment is immediately needed or not immediately, but doesn't allow the unavailability, it doesn't allow the continued operation, then you have to shut down the unit till the spare part doesn't come. After the first time, we realized that it can be a problem. We decided to keep this stuff on the plant site. It was expensive. Yes, it was expensive. Someone can say that this is some luxury expensive attitude. It may be so, but it could be shown by the experience of the operation that if this organization did not exist, then we have been losing that many production or that much production, which probably would be much larger losses than what we lost with keeping such organization at the plant. Again, management of the stuff, yes. Very important and from the point of view of the reliability of the operations, I mean reliability of the production and reliability of the safety systems of the plant, it is very important. Now, Hema Reliability Analysis, I was talking about it almost two hours, so I'm not touching it. It just wants to say that we have to use the results in the human factor engineering process and we are using it. And then human system interface design, HSI design, this is how it calls. This process and the scope should be included, including the translation of functions and task requirements into the detailed design of alarms, displays, controls, and other aspects of the human system interface through the systematic application of human factors engineering principles and criteria, which was mentioned by Alec. Yes, this is what we are talking about. So, procedure development. I told you the procedures, especially the emergency procedures, the structure and the type of the emergency procedures will be a very significant contributor to safety. If something is wrong in the procedures, just imagine, something is wrong in the procedures, then it introduces a systematic error, systematic human error in the execution of some procedure and it may cause lots of problems at the end. So, unfortunately, there are no perfect procedures, but the usage of the procedures will show me where to improve. I have nice opportunity to test those procedures and to improve the procedures based on the results of my simulated training exercises, because that is the place where the staff has to practice the exercises using the actual procedures. So, development of the procedures that are technically accurate, procedures should be comprehensive, explicit, easy to use and validated. Now, how to validate? That's a different story. Again, validating, we can use the simulator for validating the procedures. We can use the deterministic safety analysis to validate the procedures and we can use the probabilistic safety analysis to validate the procedures. Now, we are validating a procedure using an analysis. It's interesting, not using real cases. Real cases, fortunately, don't happen very frequently. Therefore, very, I mean, hopefully, there will not be need for real usage of those procedures, but in case it is needed, we have to be sure that the procedure is good enough to have the operators to handle the situation. So, we have to develop generic technical guidelines for the emergency operating procedures, plant and system operations, including startup, power and shutdown operations. Usually, we have. Those are operating instructions, yes, or I don't know in different plants, the structure of these procedures is different. There are procedures which are obligatory and there are procedures which act like guidelines, rather guidelines, not necessary obligatory procedures. In the old plants, the so-called severe accident management guidelines, the severe accident management guidelines, these SMGs, they are guidelines, they are not procedures. Legally, they are guidelines. While the emergency operating procedure is a procedure which is obligatory to be followed by the operator. So, these two should be somehow distinguished. Mostly, all the other procedures which are called procedures or instructions are obligatory to the operating staff. Legally obligatory, which means this is their responsibility to follow exactly what is written down. Test and maintenance procedures. Definitely, there must be a prescribed flow of the test and maintenance. Abnormal and emergency operations. Abnormal is something new. Sometimes, well, in the early times, there was no abnormal operating procedures. Those which are handling the abnormal events. These are not operational events, but not incidents. So, something in between. Some deviation from the normal operation. We have normal operational, abnormal operational, and then comes the incident, which is the emergency operating procedures. So, and then comes later, during the severe accident, we have the severe accident management guidelines. And accident management guidelines and alarm response. How do I react on an alarm? This must be also controlled by procedure. So, what shall I do when that alarm switches on? Yeah. So, procedures, as I said, clearly demonstrated the good effect of the symptom-oriented procedures. Therefore, the good effect is clearly demonstrated by our experiments. Therefore, it is clear that the quality of these procedures are very much influencing the safety. Okay. Now, training program, similar to the operating, I mean for the procedures. The training program is something which we had to, develop a systematic approach for the development of the personal training. Well, this is to understand and to identify which level of organization and which posts need what kind of training. And on the other hand, we have to know what is required by the regulatory body, what is not required, what post and what training is license-related training and what is not non-licensed related training. Then a full range of plant conditions should be trained, definitely, specific operational activities full range of plant functions and systems, including those that may be different from those in the predecessor plants or those which are new at the plant because there are modifications at the plant. Therefore, the new systems operation should also be trained, full range of relevant human system interfaces and so on and so on. Now, the best place for this is again the simulator training. The full scope control room simulator is already a requirement for the new nuclear power plants. For when we were building a new nuclear power plants, definitely on the site, there must be full scope control room simulator to help this training program. And verification and validation of the human factory engineering results, the activities to confirm that the human system interface design conforms to the human factory engineering design principles and that it enables plant personnel to successfully perform their task to achieve plant safety and other operational goals. So we have to check if it works and we have to demonstrate that the human factory engineering principles are fulfilled and the operational and other goals are supported by the human factory engineering. So basically, oh no, there are some others. Human performance monitoring. We have to develop a human performance monitoring strategy for determining that no significant safety degradation occurs because of any changes that are made in the plant. So if I made some change or some modification to the plant, it should not affect the human performance such that would degrade the safety. Criteria to be considered. Design can be effectively used by personnel, including within the control room and between the control room and local control systems and local support centers. Change is made to the human system interfaces. Procedures and training do not have adverse effect on the personal performance. So I'm not installing something in the control room which will mislead the operator decision. So he used to that kind of indicator or that kind of instrument and then I put a digital instrumentation, a digital instrument there, which writes down the value. It may have a good effect. It may have adverse effect which is unfortunately, it is not avoidable. We try to modernize the control room and try to introduce some new type of measurement instruments in the control room. Unfortunately, at least half of the crews don't like the idea. Everybody knows that the present is not perfect. They would like to have something better but when you appear with something new, then they say, no, no, no, we are happy with the old. Immediately, it will be said. So this is difficult to assess what will have a positive effect or what will have overall negative effect. Then human action can be accomplished within the established time and performance criteria. So this is also a criteria. The acceptable level of performance established during the integrated system validation is maintained and so on and so on. So there are lots of things which to be considered when we are monitoring the human performance and we want to make some change in the existing. It is very sensitive to any changes. Therefore, it is worth like to analyze it in details. Now, the management systems and elements of human factors program. We have quality assurance and management system requirements which covers organizational aspects, training, safety culture, human performance, communication, management and organizational changes. And, of course, the regulations usually contain references to specific QA management systems like ISO or the GSR3 IAE standard, national and industry quality assurance guide and so on and so on. The human factor program elements are contained in the regulations in more general terms. Usually these are somewhat spread all over the regulations. So it is difficult to get all the human factor engineering requirements to one place because they are contained by many parts of the regulation. So, like the sufficient number of qualified personnel or fitness for duty and so on, they are somewhere discussed in the regulation but not at the one place in where we are discussing the human factor engineering questions. Now, human factors in the IAE publications, we are getting close to the end. So I will go through very quickly. Consideration of human factors program elements are included in the legally binding instruments like the conventional nuclear safety. Then the IAE safety standards and other IAE publications. Requirements are specific to the stage of the lifetime of the facility. So some of them are discussing the requirements during the construction and commissioning time. The others are for the operation. All others are for decommissioning and so on and so on. The safety of nuclear power plants, the design, the SSR 2 slash 1, it was discussed many times, but has the requirement 32, design for optimal operator performance which says systematic consideration of human factors, including the human machine interface, shall be included at an early stage in the design process for a nuclear power plant and shall be continued through the entire design process. So, well, this is easy to understand but how to perform that's a different question. Okay, now it requires the minimum number of operating personnel required to perform all the simultaneous operations necessary to bring the plant into safe state. Involvement of the operating personnel in the design process conducted by the design organization. That's a good requirement, but how to do it? It is difficult because in the design process, especially for a new nuclear power plant where we don't have operating personnel, that's something difficult, okay? So, whatever it says, I simply cannot fully imagine how it can be performed. The plant layout and the equipment layout and procedures and the human machine interface. So, these are the elements, then the necessary information to personnel, available time for useful human actions, and so on and so on. And at the end, it says verification and validation using the simulator. So, this is what the SSR 2.1 contains regarding the human factor engineering. Now, about the future plans. Don't ask me because you could see all of these elements. Yes, we were discussing all of these elements and this is the topics of the later coming safety guide on the human factors engineering in nuclear power plants. This is the title and there is a document on the internet you can look for which describes what are those elements which will be discussed in this safety guide. It is an upcoming safety guide in 2018 and actually these elements are identical to those which we were discussing earlier which are coming from the Nureg guide on the content of safety analysis reports. Okay, so basically this was the human factors what are influencing the human performance and the human factor engineering as you can see has a lot of different requirements which are mostly spread and mostly distributed to those design functions to specific safety-related system and safety-related aspects design. Yeah, okay, so now if you have any questions or we can wait till the later discussion. You are hungry, I believe, so and we are already five minutes in the lunch time though that watch I guess is a bit ahead and we must be at time, okay. Then thank you for the attention, we'll meet at two o'clock.