A plant safety designer is expected to conceive all possible scenarios and sequences of probable initiating events including failure of action on the part of humans that may finally lead to a major disaster. This involve considering geographic location of plant and existence environmental conditions and of natural abnormal conditions that are likely to trigger a disaster. In India, in 1975 we had Chasnala mine disaster in which an explosion in mine followed by flooding resulted in 374 miners death. In 1984, we has Bhopal Gas tragedy or disaster in India which is considered as the world's worst industrial disaster in which resulting from an accident, the plant released 42 tonnes of toxic methyl isocyanate (MIC) gas, exposing more than 500,000 people to toxic gases as a consequence of existing local weather conditions. The first official immediate death toll was announced as 2,259.

The nuclear safety has been an important subject and is dealt and covered in depth by all concerned. To avoid conditions leading to possible disaster comprise the identification of worst scenarios of even least possibilities, difficult conditions of work, deteriorated access to the location of action, the assessment of human response under a distress condition etc. must be considered. For example, the European Stress Test of NPPs carried out in the aftermath to the Fukushima disaster; include the need to review Accident Management provisions considering the possible harsh working environment during a catastrophic condition.

Chernobyl nuclear disaster in 1986 is considered as the worst in the history in terms of cost and casualties in recent times and is classified as a level 7 event (the maximum classification) on the International Nuclear Event Scale. Fukushima is another level 7 event that took place on March11, 2011, in which three of the plant's six nuclear reactors had melt down. First commissioned in 1971, the plant consists of six boiling water reactors (BWR). These light water reactors allowed to produce an electrical power of 4.7 GWe, making Fukushima Daiichi one of the 15 largest nuclear power stations in the world. The plant was designed by General Electric (GE) and maintained by the Tokyo Electric Power Company (TEPCO). Units 2 through 6 were BWR-4, while Unit 1 was the slightly older BWR-3 design. At the time of an earthquake that occurred, Reactor 4 had been de-fueled and Reactors 5 and 6 were in cold shutdown for planned maintenance. The failure occurred when the plant was hit by a tsunami triggered by an earthquake of the magnitude 9.0. The plant started releasing substantial amounts of radioactivity on 12 March, becoming the largest nuclear disaster. In August 2013, it was felt that the massive amount of radioactive water is among the most pressing problems affecting the clean-up process, which may even take decades. As of 10 February 2014, some 300,000 people were evacuated from the area. The Fukushima Nuclear Accident Independent Investigation Commission found the nuclear disaster was "manmade" and that its direct causes were all foreseeable.

Tokyo University professor emeritus Kiyoshi Kurokawa, wrote in the inquiry report. "It was a profoundly man-made disaster -- that could and should have been foreseen and prevented. And its effects could have been mitigated by a more effective human response. The report also found that the plant was incapable of withstanding the earthquake and tsunami. TEPCO, regulators Nuclear and Industrial Safety Agency (NISA) and NSC and the government body promoting the nuclear power industry (METI), all failed to meet the most basic safety requirements, such as assessing the probability of damage, preparing for containing collateral damage from such a disaster, and developing evacuation plans. When the earthquake struck, units 1, 2 and 3 were operating, but units 4, 5 and 6 had been shut down for periodic inspection. Reactors 1, 2 and 3 immediately underwent an automatic shutdown called SCRAM.

When the reactors were shut down, the plant stopped generating electricity, cutting off power. One of the two connections to off-site power for units 1–3 also failed, so 13 on-site emergency diesel generators began providing power. The earthquake triggered a 13-to-15-metre maximum height tsunami that arrived approximately 50 minutes later. The waves overtopped the plant's 10 metres seawall, flooding the basements of the turbine buildings and disabling the emergency diesel generators at approximately 15:41. The switching stations that provided power from the three backup generators located higher on the hillside failed when the building that housed them flooded. Multiple unsuccessful attempts were made to connect portable generating equipment to power water pumps. The failure was attributed to flooding at the connection point in the Turbine Hall basement and the absence of suitable cables. In Reactors 1, 2 and 3, overheating caused a reaction between the water and the zircalloy, creating hydrogen gas. On 12 March, an explosion in Unit 1 was caused by the ignition of the hydrogen, destroying the upper part of the building. On 14 March, a similar explosion occurred in the Reactor 3 building, blowing off the roof and injuring eleven people. On the 15th, an explosion in the Reactor 2 building damaged it and part of the Reactor 4 building.

According to Naoto Kan, Japan's prime minister during the tsunami, the Japan was unprepared for the disaster, and nuclear power plants should not have been built so close to the ocean. He acknowledged flaws in handling of the crisis by the authorities, including poor communication and coordination between nuclear regulators, utility officials and the government. He said the disaster "laid bare a host of an even bigger man-made vulnerabilities in Japan's nuclear industry and regulation, from inadequate safety guidelines to crisis management, all of which need to be overhauled".

I like to thank the Guest Editors of this issue, Dr. Bernhard Reer, Prof. Oliver Str?ter and Prof. Kazimierz T. Kosmowski, who have worked hard to ensure quality papers. My thanks are also due to reviewers, who helped in maintain timeliness in reviewing process. I would also like to thank the authors whose contributions are included in this issue and for maintaining the dead-lines. It is hoped that this issue of IJPE will provide impetus to research in this important area. Incidentally, this is the last issue of IJPE in 2014 and we will continue to bring various interesting and important aspects of Performability Engineering to our readers as we have been doing for past 10 years.

Nuclear safety has been extensively investigated by all, viz., licensees, authorities and researchers. The subject of assessment involves consideration of abnormal operating conditions including severe accidents beyond the design of the addressed nuclear power plant (NPP). Besides deterministic analysis of selected scenarios of abnormal operation, probabilistic safety analysis (PSA) is applied for a structured assessment of the frequencies of the variety of accident sequences that may develop for a set of initiating events. Both types of analysis address human factors and human reliability analysis (HRA) in the context of PSA. The assessment of human performance, in both deterministic and probabilistic analyses, is known as a critical issue and therefore subject to research in various disciplines.
Historically, the importance of human performance has been emphatically highlighted by the accidents in the NPPs of Three Mile Island (1979) and Chernobyl (1986) and include issues such as emergency operating procedures, operator training, accident management (AM), safety culture, human and organizational factors and undesired human interventions that aggravate the progression of a scenario (briefly denoted as errors of commission, EOC, in the context of PSA). Such issues also played a role in the Fukushima disaster (2011).
The investigations to overcome possible disaster comprise the identification of scenarios with difficult performance conditions (e.g., with deteriorated access to the location of action), the assessment of human reliability under a given condition and the derivations of proposals for improvements.
The papers included in this issue have gone through a rigorous two-stage blind-review process by the guest-editors and reviewers selected from amongst the best experts in safety and performability engineering. Our goal is to bring to the readership of IJPE some key papers that will kick-start a vibrant and fruitful stream of research and industry papers in the area of safety, human and organizational factors, and human reliability.
In the first paper, Accident Management under Extreme Events, by George Vayssier describes an overview of procedures, strategies, guidelines, equipment and organisational issues that are needed to protect a site against extreme events. It is based on lessons learned from large destructive events in the past, such as the 9/11 attacks in the US in 2001 and the Fukushima-Daiichi tsunami in 2011. The author emphasises that the total set of procedures and guidelines including the needed equipment and organisational provisions should be regularly inspected and tested.
In the second paper, A Systemic Approach to Oversee Human and Organizational Factors in Nuclear Facilities, by Claudia Humbel Haag and Bernd Linsenmaier, a view is supported that human and organizational factors (HOF) should be overseen both in their own right as well as in terms of their interactions and interferences. This implies that a nuclear facility ought to be seen as a socio-technical system, consisting of individuals, technology, and organization, all of which are interrelated or interacting and are embedded in an environment. The paper provides an interesting basis for integrating a systemic view and approach to these issues.
The third paper, Nuclear Plant Control Room Operator Modeling Within the ADS-IDAC, Version 2, Dynamic PRA Environment: Part 1 - General Description and Cognitive Foundations, by Kevin Coyne and Ali Mosleh, addresses the Accident Dynamics Simulator paired with the Information, Decision, and Action cognitive model in a Crew context (ADS-IDAC). By linking a realistic nuclear plant thermal-hydraulic model with a crew behavior model, ADS-IDAC creates a rich simulation environment.
The fourth paper is a continuation of previous one, viz., Nuclear Plant Control Room Operator Modeling within the ADS-IDAC, Version 2, Dynamic PRA Environment and presents: Part 2 - Modeling Capabilities and Application Examples, again by Kevin Coyne and Ali Mosleh and in this paper, the authors emphasize that the recent implementation of dynamic performance influencing factors (PIFs) reinforces the man-machine feedback loop and strengthens the transient modeling capabilities of ADS-IDAC. The recent implementation of a plant functional decomposition and diagnostic engine strengthens the ability to model knowledge based actions and procedure step skipping in ADS-IDAC.
The fifth paper, Case Study on Addressing the Error Forcing Context in Human Reliability Analysis, by Bernhard Reer and Oliver Str?ter, addresses the error-forcing context (EFC) quantitatively for a misdiagnosis in a decision-making process guided by an emergency operating procedure (EOP). Two approaches are proposed for the EFC-specific assessment of the human error probability (HEP). Some parameters of the probabilistic models are iteratively determined under the boundary condition to provide the best fit of the results from the ECF-specific HEP assessment.
In the sixth paper, A Guideline to HRA Data Collection from Simulations, by Jinkyun Park et al., provides a detailed data collection guideline that allows distinguishing the collectable HRA data items with the associated fact-based measurements (i.e., direct observables and objective surrogates). A couple of worksheets that are helpful for collecting HRA data from simulations in a systematic way are proposed, based on simulation records gathered from the requalification training sessions of domestic NPPs. It is justified to expect that fact-based HRA data can be secured from simulations, which will be useful for HRA practitioners to reduce the uncertainty of HRA results.
The seventh paper, Human Factors in Designing the Instrumentation and Control Systems Important to Safety, by Kazimierz Kosmowski, addresses some aspects of human factors in designing of the instrumentation and control (I&C) systems important to safety of hazardous plants and nuclear power plants, where the concept of "defence in depth” (D-in-D) is employed. It was emphasised that the functional safety analysis framework offers additional possibilities for more comprehensive dealing with the human factors and contextual human reliability analysis (HRA), in particular in cases of dangerous failures of the programmable control and protection systems.
The eighth paper, Benefits and Limitations of the New Consolidated PWROG Severe Accident Management Guidance (SAMG) – A Review of Some Critical Issues, by George Vayssier addresses a new approach that has been presented during the PSA 2013 conference in Columbia, South Carolina, USA, in September 2013. The article is an interesting reaction on a publication by the Pressurised Water Reactor Owners Group (PWROG) about its new SAMG.
Overall the special issue shows the importance of improving the Assessment of Human Reliability of Accident Management actions with less explicit procedural guidance and showed ways to better modeling of instrumentation performance, to lower limits for human error probabilities (in particular for human reactions to stress) and the inclusion of this issue into the development and improvement of Severe Accident Management Guidance (SAMG) or the organizational ability to cope with such events.
The Guest Editors would like to thank all the authors for their contributions and the reviewers for their dedication and the timely feedback provided to contributing authors of this special issue. The Guest Editors would also like to thank Prof. Krishna B. Misra, the Editor-In-Chief of IJPE, who was very helpful in the editing process as well as being a great and continuing supporter of performability knowledge dissemination.

Disclaimer: The views expressed in this special issue are solely those of the authors and do not necessarily represent the views of the editors.

Bernhard Reer(Ph.D.) started 1986 his professional career in field of HRA and PSA at the Jülich Research Center, Germany. He joined the Swiss Paul Scherrer Institute (PSI) in 1997 and since 2007, he is with the Swiss Federal Nuclear Safety Inspectorate (ENSI). At PSI he led the development of the CESA HRA method for the HRA of errors of commission. At ENSI, he works as a senior expert in various safety assessment areas including HRA and accident management (AM). In the post-Fukushima EU Stress Test of NPPs (2012), he was a leading author of country-specific AM review reports. Email: Email:bernhard.reer@ensi.ch

Oliver Str?ter (Prof. Dr. habil.) holds the Chair for Human Engineering and Organizational Psychology at the University of Kassel. His research is focused on safety and ergonomics with an additional focus on the aspects for achieving resilience in the organizational and inter-organizational contexts. His activities cover all sorts of high reliability organizations like nuclear, aviation, maritime or rail. From 2001, he worked for EUROCONTROL, the European Organization for the Safety of Air Navigation in Brussels, where he was amongst others responsible for the long term safety strategy of Air Traffic Management and headed the Safety Regulation work-package in the definition phase of the Single European Sky, SESAR. From 1992 until 2002 he worked for GRS (Gesellschaft für Anlagen- und Reaktorsicherheit), part of the German Nuclear Regulatory Body and developed methods for incident investigation and reliability assessment regarding the human impact on the safety of nuclear installations. Email: straeter@uni-kassel.de

Kazimierz T. Kosmowski Ph.D., Sc.D.) is an Associate Professor of the Department of Electrical and Control Engineering at the Gdansk University of Technology in Gdansk, Poland. He has taught at this university since July 1981. He holds a Ph.D. in Control Engineering and a Sc.D. in Electrical Engineering from Gdansk University of Technology.

His research interests include mathematical modeling of reliability and risk assessment of technical systems, functional safety of the programmable control and protection systems, and human reliability analysis. He has published in journals such as the International Journal of Occupational Safety and Ergonomics, Risk Decision and Policy, Journal of Loss Prevention in the Process Industries, the International Journal of Performability Engineering, and Springer-Verlag Book/Volume of Advances in Intelligent Systems and Computing.

His current research has been focused on functional safety and reliability of hazardous plants, layer of protection analysis, optimising reliability and safety, safety and security management, human factors engineering, cognitive human reliability, industrial automation safety and security, and human machine/system interfaces. He organises courses within a certification programme for specialists responsible for functional safety in industry. He is a member of the Polish Safety and Reliability Association. Email: k.kosmowski@ely.pg.gda.pl

Most nuclear power plants have extensive sets of Emergency Operating Procedures and Severe Accident Management Guidelines. These offer protection for a large series of events, both inside and outside the licensed design basis of the plant. For Extreme Events, which are characterised by a large destruction on-site and may include loss of command and control, damage to multiple units on-site, loss of communication both on-site and to off-site centres, staff members wounded or killed, such protection may not be enough. Examples of extreme events are air plane crash, site flooding, large earthquake plus possible tsunamis, etc. This paper describes what additional procedures, guidelines, hardware and organisational issues are needed to protect a site against such events. It is based on lessons learned from large destructive events in the past, such as the 9/11 attacks in the USA in 2001 and the tsunami at the Fukushima-Daiichi plants in 2011.

In nuclear facilities, in addition to technical aspects, human and organizational factors (HOF) also influence the plant safety. However, a common understanding of what is meant by the term, HOF, has not yet been reached here. Existing concepts of oversight differ in how humans interact with their environment and how humans are integrated in conditions and processes affecting nuclear safety.
To understand and oversight the humans’ role in nuclear safety, HOF are often considered separately. The view supported here is that HOF should be overseen both in their own right as well as in terms of their interactions and interferences. This implies that a nuclear facility ought to be seen as a socio-technical system, consisting of individuals, technology, and organization, all of which are interrelated or interacting and are embedded in an environment. This paper provides a basis for integrating a systemic view and approach to this.

Dynamic simulation-based approaches for probabilistic risk assessment (PRA) offer several key advantages over traditional “static” techniques such as traditional event tree-fault tree based methods. For example, dynamic simulation approaches can more realistically represent event sequence and timing, provide a better representation of thermal hydraulic success criteria, and permit more detailed modeling of operator response. Version 2.0 of the Accident Dynamics Simulator paired with the Information, Decision, and Action cognitive model in a Crew context (ADS-IDAC) is one such dynamic method that shows promise for supporting nuclear power plant PRAs and other risk-informed applications. By linking a realistic nuclear plant thermal-hydraulic model with a crew behavior model, ADS-IDAC creates a rich simulation environment. The crew behavior model describes the operators’ preferences and tendencies, knowledge, and situation-response rules.
ADS-IDAC generates a discrete dynamic event tree (DDET) by applying simple branching rules that reflect variations in crew responses to plant events and system status changes. Branches can be generated to simulate a variety of operator behaviors, including procedure execution speed and adherence, evolving situational assessments, and variations in plant control preferences. This of the first of two papers in this volume and provides an overview of the ADS-IDAC Version 2.0 simulation platform and a description the cognitive foundations underpinning the operator human performance model.

Dynamic simulation-based approaches for probabilistic risk assessment (PRA) offer several key advantages over traditional “static” techniques such as traditional event tree-fault tree based methods. For example, dynamic simulation approaches can more realistically represent event sequence and timing, provide a better representation of thermal hydraulic success criteria, and permit more detailed modeling of operator response. Version 2.0 of the Accident Dynamics Simulator paired with the Information, Decision, and Action cognitive model in a Crew context (ADS-IDAC) is one such dynamic method that shows promise for supporting nuclear power plant PRAs and other risk-informed applications. By linking a realistic nuclear plant thermal-hydraulic model with a crew behavior model, ADS-IDAC creates a rich simulation environment. The crew behavior model describes the operators’ preferences and tendencies, knowledge, and situation-response rules. ADS-IDAC generates a discrete dynamic event tree (DDET) by applying simple branching rules that reflect variations in crew responses to plant events and system status changes. Branches can be generated to simulate a variety of operator behaviors, including procedure execution speed and adherence, evolving situational assessments, and variations in plant control preferences. This is the second of two papers in this volume and describes the dynamic modeling capabilities supported by the ADS-IDAC Version 2.0 simulation platform and provides examples of their application.

This paper presents a case study on approaches of addressing the error-forcing context (EFC) quantitatively for a misdiagnosis in a decision-making process guided by an emergency operating procedure (EOP). Two approaches are presented for the EFC-specific assessment of the human error probability (HEP). In the first approach this HEP is determined by expert judgement supported by a scale of both description of reference contexts with respect to the cognitive impact of information available for the operators and conditional HEPs for a subset of these contexts. Based on a description of the way the task is cognitively understood and processed by the human, the second approach derives the HEP from query to a database of human failures and successes observed from operating experience. The approaches are illustrated in a simple case study of an excerpt of a human reliability analysis (HRA) carried out for a loss of service water scenario postulated for the concept of a medium-sized gas-cooled reactor.

The objective is to estimate the probability of a specific misdiagnosis of the status of the heat sink of the emergency decay heat removal (EDHR) system. The analysis is supposed to account for the possibility of a partial failure of this heat sink as an EFC. Furthermore options are discussed to integrate the result of context-specific quantification in the process of assessment of the total HEP (i.e., over all contexts). The results show that a systematic compilation of cognitive demand contexts supports the assessment of a context-specific error probability. The discussion on total HEP modelling identified that the results rely on the adequacy of assumptions, concerning the degree of coverage of the HEP assigned to nominal scenario and the type of HEP distribution, which may deserve further investigation.

Including the Fukushima disaster, most accidents that have occurred for several decades in nuclear power plants (NPPs) commonly pointed out the criticality of an inappropriate human performance to their operational safety. Consequently, a huge amount of effort has been spent to reduce the possibility of critical human errors that probably contribute to the safety of NPPs, and one of the most disseminated approaches is to conduct an HRA (Human Reliability Analysis). Unfortunately, although HRA practitioners generally require a lot of information pertaining to the comprehension of contexts being exposed to human operators, one of the frequently raised problems is a lack of available information.
For this reason, KAERI (Korea Atomic Energy Research Institute) issued a standardized guideline that can be applied to clarify how to systematically collect HRA data in the full-scope simulator of NPPs. To this end, through the review of existing documents that specify (or suggest) required data items for supporting HRA practitioners, a total 89 generic HRA data items are identified. After that, a detailed data collection guideline that allows us to distinguish collectable HRA data items with the associated fact-based measurements (i.e., direct observables and objective surrogates) is proposed. In addition, in order to demonstrate the role of the proposed guideline, a couple of worksheets that are helpful for collecting HRA data from simulations in a systematic way are designed based on simulation records gathered from the requalification training sessions of domestic NPPs. As a result, although several pending problems still exist, it is possible to expect that fact-based HRA data can be secured from simulations, which will be useful for HRA practitioners to reduce the uncertainty (or subjectivity) of HRA results.

This work addresses selected aspects of human factors in designing the instrumentation and control (I&C) systems important to safety as a part of the functional safety management of industrial hazardous plants, in particular nuclear power plants. As it is known in such plants a concept of “defence in depth” (D-in-D) is widely applied and some layers of protection are designed with regard to functional safety (FS) concept given in the international standards: IEC 61508 (FS generic standard), IEC 61511 (FS in process industry sector) and IEC61513 (FS in nuclear power plants). These standards indicate generally the importance of human factors, as the human-operators can contribute significantly to performing of safety functions, however, there is no detailed guidelines how to deal with such issues. The aim of research undertaken and outlined in this article is to develop methodology for supporting the design of I&C systems important to safety that might include evaluation of human factors and human reliability analysis (HRA). It is of prime importance for correct verification of the safety integrity level (SIL) of defined safety functions being implemented using the I&C systems.

After Fukushima, it was decided by the Pressurised Water Reactor Owners Group (PWROG) to merge the various approaches in Severe Accident Management Guidance (SAMG) in existence and use one single type of SAMG, which departs from the Westinghouse Owners Group approach.
There are a number of apparent positive features of this development, but the author believes there are also matters which may need further consideration, if not improvement.
This paper discusses the elements of the new approach, as have been presented during the PSA 2013 conference in Columbia, South Carolina, USA, in September 2013. This presentation was limited to the state of development of the PWROG at that time – which is also a limitation of this review.

The recent paper published in IJPE by Tripathy et al. [1] presented a new method based on self-generating, non-redundant and disjoint cutsets to evaluate the three important reliability measures, viz., two-terminal, all-terminal and k-terminal. Authors claim that their algorithm is much more efficient as it saves the overhead of disjointing process and redundant terms removal than the existing Sum-of-Disjoint-Product (SDP) form based algorithms available in the literature. However, we observe several discrepancies in the results generated by their proposed algorithm on the considered benchmark networks and even on the illustrative example taken to describe the algorithm.

Inspections are common activities in most preventive maintenance (PM) programs. The models for optimizing the inspection interval using the two-stage delay time have been presented by many researchers. However, the three-stage failure process introduced by Wang is closer to reality corresponding to the actual industrial applications. When the minor defective stage is identified at an inspection, the inspection interval is halved. However, whether this measure is optimal is not explained. In order to solve this problem, an inspection optimization model is proposed to minimize the expected cost per unit time with the inspection interval and shortening proportion of the inspection interval after identifying the minor defective stage as the decision variables. A numerical example is presented to illustrate the applicability of the proposed model.