INPO’s Approach to Human Performance
in the United States
Commercial Nuclear Power Industry
Tony Muschara, CPT
Institute of Nuclear Power Operations (INPO), Atlanta, Georgia, USA
muscharatm@inpo.org
Abstract—Strategically, INPO’s approach to human
performance in commercial nuclear power stations
encompasses two elements: 1) reduce the frequency of events
triggered by human error, and 2) minimize the severity of
human performance events that still occur. The frequency of
events is primarily reduced by anticipating, preventing, and
catching active errors at the job site during work execution,
which involves three phases: 1) work preparation, 2) work
performance, and 3) work feedback. During work execution,
the human performance objective is to anticipate, prevent, or
catch active errors, especially at critical steps, where error-
free performance is absolutely necessary. The severity of
events is minimized by verifying the integrity and robustness
of defenses. Lines of defense are scrutinized aggressively
through ongoing monitoring, evaluation, and correction.
Defenses against human error and its consequences involve
four primary lines of defense to improve station resilience: 1)
engineered controls, 2) administrative controls, 3) cultural
controls, and 4) oversight controls. This paper describes
INPO’s risk-based approach to human performance—
reducing error during work execution and managing
defense-in-depth.
I. INTRODUCTION
Success means being the best. Excellence means being your
best—matching your practice with your potential. Excellence
also means being better tomorrow than yesterday, which
implies that the standards of excellence continually change. 1
The quality of excelling is an ongoing pursuit, a habit of
thought and action—a daily pursuit of high-performing
stations. Each station’s safety culture and organizational
effectiveness have a direct influence on the quality of human
performance, for good or for bad. Human performance is
defined as a series of behaviors executed to accomplish a
specific result.2 If the value of excellence is embedded in the
station’s culture, the organization will find ways to better
itself. Pursuing excellence, therefore, promotes the highest
levels of safety and reliability.
1
INPO, Long-Range Plan, 2005-2007, p.5.
2
Daniels, A., Bringing out the Best in People, 1994, pp.79-82.
However, human error is normal—a natural part of being
human. But it can also be provoked by conflicting management
and leadership practices and by weaknesses in a station’s
organization, processes, and culture. Understanding human
error helps one recognize that human beings are complex
creatures possessing a wide range of capabilities and
limitations. No matter how efficiently plant equipment
functions; how good the training, supervision, and procedures
are; and how well the best worker, engineer, or manager
perform his or her duties, people cannot perform better than the
organization supporting them.3 Therefore, to preserve and
improve the plant’s resistance to human error and events,
defense-in-depth with respect to human activities is necessary.
II. STRATEGIC HUMAN PERFORMANCE
In the USA, managers take a risk-based approach toward
excellence in human performance. Risk is a function of
probability and consequence. Identifying and minimizing the
risk of human error and its impact on plant equipment,
personnel, and property (assets) is the aim of line
management.4 The principal hazard to these assets is anyone
who can touch and alter the status of the assets, primarily
workers. Regardless of how conscientious and careful people
are, they still err, sometimes at inopportune moments.
Exposure to the hazard of human error is most acute when
people touch the equipment. When assets are exposed to
human error, the risk of a plant event is present. How often
events occur tends to follow how often people err.
Therefore, minimizing the frequency by reducing the
probability of active error and improving the robustness of
defenses to reduce the severity of plant events triggered by
human error will reduce the risk to plant, person, property, and
production. When the risk of human error at the job site is
systematically reduced or eliminated, the frequency of active
errors and related events will drop. Controls that reduce the
chances of error include the use of human performance (error-
prevention) tools as well as engineered, administrative,
3
Maurino, Reason, Johnston, and Lee. Beyond Aviation Human
Factors, 1995.
4
Hillson and Murray-Webster. Understanding and Managing Risk
Attitude. 2005, pp.17-37.
cultural, and oversight controls. Human performance tools errors described in the report reveals that these errors are
include administrative controls such as self-checking, peer- essentially missing or flawed defenses.
checking, three-way communication, and pre-job briefings.
INPO published two documents describing tried and true A coherent human performance management strategy will
methods individuals can use to reduce their chances of error: reduce the frequency and severity of events by addressing two
INPO 06-002, Human Performance Tools for Workers, and primary challenges:
INPO 05-002 (Revision 1), Human Performance Tools for
Engineers and Other Knowledge Workers. Rigorous and 1) Reduce the frequency of events by anticipating,
thoughtful application of human performance tools primarily preventing, and catching active errors at the job site.
influences the frequency of events, not so much the severity of
2) Minimize the severity of events by identifying and
events. Defenses fulfill this function.
eliminating latent weaknesses that weaken defenses
against active errors and their consequences.
In any U.S. station, defenses comprise the human, technical,
or organizational features—controls and barriers—used to
protect the plant, property, the environment, and personnel Re + Md  0E (1)
against hazards in the plant.5 The primary hazard is human
error. Controls are measures that guide, coordinate, or regulate This strategy is simply illustrated in the above relationship;
performance, such as human performance tools, automation, reducing active errors (Re) and managing defenses (Md) leads
signs, change management, training, coaching, and procedures. to zero significant events (0E). As one nuclear plant manager
Barriers protect against harm by limiting or impeding the free said, “Zero is not a number; it’s a vision.”
movement or flow of information, objects, substances, or
energy; for example personal protective equipment, rate A. Reducing Error, Re
limiters, hand rails, passwords, interlocks, and machine guards
Reducing the error rate tends to minimize the frequency by
are barriers. However, my personal experience reveals that
anticipating and preventing active errors during work on plant
people use great flexibility on the interchangeability of these
equipment. When task performance is imminent, the most
terms. The presence and robustness of defenses determine how
efficient defenses that promote positive control include the use
bad an event will be when error happens.
of human performance tools at the risk-important phases or
steps of an activity, such as critical steps. During work
A 2002 study sponsored by the U.S. Nuclear Regulatory
preparation, supervisors and workers choose appropriate
Commission (U.S. NRC) supports this conclusion. 6 Personnel
human performance tools to apply at critical steps to establish
at the Department of Energy’s Idaho National Laboratory
positive control. Positive control denotes those measures taken
(INL) explored the contributions of human performance to risk
to make sure that what is intended to happen is what happens,
in operating events in the U.S. commercial nuclear power
and that is all that happens. INPO defines critical step as a
industry. Risk was measured by changes in the conditional
procedure step, series of steps, or action that, if performed
core damage frequency, using probabilistic risk analysis
improperly, will cause [immediate], irreversible harm to plant
calculations. The INL analyzed 37 events, selected from
equipment or people, or significantly impact plant operation.
licensee event reports (LERs) and augmented inspection team
The term immediate may or may not be included in a station’s
reports that had occurred over a six-year period. The results
definition, depending on its application. For example, errors
showed that human performance contributed significantly to
by operators and instrumentation technicians typically have
these events. Analysts identified 270 human errors in the
immediate repercussions, while errors by mechanics are
LERs reviewed. Of those errors identified, 81 percent were
delayed, since equipment they are working on is usually out of
latent and 19 percent were active. Latent errors include those
service, isolated by a clearance order (lockout/tagout).
errors, acts, or decisions—disguised to the individual—that
result in a hidden vulnerability until revealed later either by an
An effective error-reduction strategy focuses on work
event, an active error, testing, operating experience, or self-
execution because such occasions present workers with
assessment/audit. Active errors include all errors that
opportunities to harm themselves or key assets or reduce
inadvertently change equipment, system, or plant state
productivity because of human error. Work execution involves
triggering immediate, undesired consequences. The influence
jobs or tasks where workers physically touch plant equipment.
of active errors on the severity of the events was shown to be
Examples of such tasks include control room operations,
negligible, while latent errors had a significant impact on the
preventive and corrective maintenance, and the calculation and
conditional core damage frequency. My review of the latent
addition of chemicals to the feedwater system. As described
above, the objective during work execution is to anticipate,
5
prevent, or catch active errors, especially at critical steps,
Maurino, Reason, Johnston, Lee. Beyond Aviation Human Factors.
1995, p.10.
where error-free performance is absolutely necessary. There
are three phases to work execution, as follows:
6
U.S. Nuclear Regulatory Commission. “Review of Findings for Human
Performance Contribution to Risk in Operating Events” (NUREG/CR-
6753), March 2002.
  Work Preparation – planning – identifying what is to
be accomplished and what is to be avoided, including
critical steps; walkdowns – identifying potential job-site
challenges to error-free performance; task assignment –
putting the right people on the job in light of the job’s
task demands; and pre-job briefings – anticipating
possible active errors and their consequences, and
incorporating appropriate defenses at critical steps
 Work Performance – performing work with a sense of
uneasiness and wariness, especially at critical steps;
maintaining situation awareness; rigorously using
human performance tools for important human actions;
avoiding unsafe or at-risk work practices; supported
with quality supervision and teamwork
 Work Feedback – reporting – conveying information
on the quality of work preparation, related resources,
and workplace conditions to supervision and
management; behavior observations – workers
receiving coaching and reinforcement on their
performance in the field by managers and supervisors
Anticipating, preventing, and catching active errors during
work execution is primarily the responsibility of first-line
supervision and front-line workers.
Traditionally, managers have simply reinforced the use of
human performance tools—to pay attention and to focus on the
task at hand. This is a viable short-term strategy, but an Re
strategy alone has a noteworthy shortcoming. Even if
opportunities to err are systematically identified and prevented,
people still err, although at a lower rate. This phenomenon is
illustrated below in Figure 1. Consequently, additional means
to protect assets from residual active errors have to be
introduced. Defense-in-depth—defenses, barriers, controls,
and safeguards arranged in a layered, overlapping fashion—
strengthens the assurance such that if one fails, the remaining
defenses will reduce the impact on plant assets.
Error Rate
Before
Systemic
Causes
After
Random
Causes
Time
Figure 1. Systemic and random causes of observed
human error rate before and after interventions to
reduce error rate7
7 8
Whittingham, R. The Blame Machine. 2004, pp.9-10.
The word systemic characterizes those factors that are
system-induced, typically related to organizational weaknesses
that hinder human performance in the field. There will always
be some level of error that is unpredictable because of human
fallibility. This residual is referred to as random error. Above
the residual level of random error there is a level of systemic
error that is controllable if pursued aggressively.
B. Managing Defenses, Md
Defense-in-depth applied to human performance is the
overlapping capacity of various defenses to protect plant
personnel, plant equipment, and productivity from human error.
If a failure occurs with one defense, another should compensate
for that failure, thereby preventing harm. Events always
involve breaches in defenses;8 controls, which are preventive in
nature, and barriers, which are protective in nature. Defense-
in-depth against human error involves four primary lines of
defense—controls and barriers—all oriented to improve
resilience to human error and related events:
 Engineered Controls – These provide the plant with
the physical ability—typically barriers—to protect itself
from people’s errors. To optimize this set of defenses,
equipment is reliable and is kept in a configuration that
is resistant to simple human error and that allows plant
systems and components to perform their intended
functions when required. Plants with high equipment
reliability, effective configuration control, and
minimum human-machine vulnerabilities tend to
experience fewer and less severe plant events than those
that struggle with these issues. The integrity of this line
of defense depends on how carefully plant equipment is
designed, operated, and maintained (using human-
centered approaches).
 Administrative Controls – Procedures, training, work
processes, signs and symbols, and various policies and
expectations direct people’s activities so that they are
predictable and safe, especially for work performed in
and on the plant. Together, such controls help people
anticipate and prepare for problems. Written
instructions specify what, when, where, and how work
is to be done. The integrity of this line of defense
depends on how rigorously people at all levels follow
and perform work activities according to procedures,
expectations, and standards.
 Cultural Controls – These are the assumptions, values,
beliefs, and attitudes and related leadership practices
that encourage either high standards of performance or
mediocrity, open or closed communication, and high or
low standards of performance. Personnel at excellent
plants practice error prevention rigorously, regardless of
their perception of a task’s risk and simplicity, how
routine it is, and how competent the performer. The
integrity of this line of defense depends on people’s
Hollnagel, E. Barriers and Accident Prevention. 2004, p.68.
 appreciation of the human hazard to safety, the respect
they have for each other, and their pride in the
organization and plant.
 Oversight Controls – Accountability helps verify
margins, the integrity of defenses and processes, as well
as the quality of performance. Performance
improvement activities facilitate the accountability of
line managers through structured and ongoing
assessments of human performance, trending, field
observations, and use of the corrective action program,
among others. The integrity of this line of defense
depends on management’s commitment to high levels
of human performance and consistent follow-through to
correct problems and vulnerabilities.
As stated earlier, some residual errors still occur even if the
opportunities to err are systematically identified and
eliminated. That is why an aggressive approach is needed to
find and correct vulnerabilities with defenses. The most
important aspect of this dual strategy (Re+Md) is an aggressive
and ongoing verification and validation of the health of
defenses. Missing and vulnerable defenses are identified
through aggressive use of continuous improvement processes;
such as, self-assessments, maintenance, audits, operating
experience, benchmarking, trend analyses, and causal analyses.
Once identified, the vulnerabilities are repaired using the
corrective action program.
Managing defenses is primarily the responsibility of line
management. The integrity of defenses-in-depth depends
primarily on the management team’s organizational
effectiveness. Managing defenses involves three fundamental
management tasks:9
 monitoring – identifying missing or vulnerable
controls and barriers
 evaluation – determining the causes of these
vulnerabilities and their extent of condition
 correcting – eliminating the vulnerabilities
III. PRINCIPLES OF HUMAN PERFORMANCE
Several authorities in human error believe that excellence in
human performance is more likely if front-line workers,
support staff, and managers embrace the following underlying
truths, or principles.10 Integrating these principles into
management and leadership practices, worker practices, and
the organization’s processes and values will help guide the
development of a philosophy and strategy for improving
9
Jop Groeneweg, Controlling the Controllable, Preventing Business
Upsets. 2002, p.247.
10
Drs. James Reason, Aubrey Daniels, and Terrence Lee all subscribed
to these principles when Excellence in Human Performance was
published by INPO in 1997.
human performance, as well as providing guidance for the
planning and conduct of work in the plant.
1) People are fallible, and even the best people make
mistakes. Human fallibility is a permanent feature of
human nature. We recognize that human beings
possess a wide range of capabilities as well as
corresponding limitations. One shortcoming is our
tendency to be imprecise—to err. Error happens. No
amount of counseling, training, or motivation can alter
a person's fallibility. Human performance should not
be the only defense during activities critical to safety.
Other, more reliable, defenses should be in place to
back up the individual.
2) Error-likely situations are predictable,
manageable, and preventable. Despite the certainty
of human error in the long term, specific errors for
particular tasks are preventable.11 Just as we can
predict that a person writing a personal check at the
beginning of a new year stands a good chance of
incorrectly recording the previous year on the check, a
similar prediction can be made in the context of work
at the job site. Recognizing error traps and actively
communicating these hazards to others permits us to
manage situations proactively and prevent errors and
events. By changing the work situation to prevent,
remove, or accommodate the presence of conditions
that provoke error, job-site conditions can be managed
to prevent, or at least minimize, the chance for error.
3) Individual behavior is influenced by organizational
processes and values. Organizations are
characterized by goal-directed behavior, and
producing electricity is the central business goal of
any nuclear power plant. Consequently, managers
develop processes and promote values that direct
desired behavior of employees and contractors. The
organization is simply the sum of the ways work is
divided into distinct jobs and then coordinated to
produce electricity safely and reliably. Essentially,
management is in the business of directing people's
behavior. Traditionally, management of human
performance has focused on the “individual error-
prone or apathetic worker.”12 However, work is done
within the context of the organization and the
management planning and control systems, which
contribute most of the causes of human performance
problems and resulting plant events.13.
11
Center for Chemical Process Safety. Guidelines for Preventing
Human Error in Process Safety. American Institute of Chemical
Engineers, 1994, pp.12-17, 103-107.
12
Reason. Managing the Risks of Organizational Accidents. 1998,
p.127.
13
Demming. Out of the Crisis. 1986, p.315.
 4) People achieve high levels of performance largely
because of the encouragement and reinforcement
received from leaders, peers, and subordinates.
The organization is perfectly tuned to get the
performance it achieves. The level of safety and
reliability of a plant is directly dependent on the
behavior of people. All behavior, good and bad, is
reinforced, whether by immediate consequences or by
past experience. Most behavior is reinforced by the
consequences the individual experiences when the
behavior occurs.14 Because behavior is influenced by
its consequences, what happens to workers when they
exhibit certain behaviors is an important factor in
improving human performance.
5) Events can be avoided through an understanding
of the reasons mistakes occur and the application
of the lessons learned from past events (or errors).
In the past, improvement in human performance has
been the outcome of corrective actions derived from
an analysis of plant events and problem reports—
reactive methods. Today, because there are fewer
events to learn from, proactive approaches to
organizational learning are needed as well. Events
can be avoided reactively and proactively. Learning
from our mistakes and the mistakes of others is
reactive—it’s after the fact, but important for
continuous improvement. Anticipating how an event
or error can be prevented is proactive, and proactive
methods provide a more cost-effective means of
preventing events and problems.
IV. INPO PERFORMANCE OBJECTIVES AND CRITERIA
In a practical sense, certain elements important for reliable
human performance become evident when the principles are
put into practice. These elements, included below, were
incorporated into INPO 05-003, Performance Objectives and
Criteria, published in May 2005, which are used to evaluate
commercial nuclear power stations against standards of
excellence. The performance objective on human performance
focuses on elements that cross organizational boundaries.
Performance objective OR.3 describes the expected result of an
effective human performance program and its related activities
from a systems perspective. Supporting criteria provide
breadth and depth to the objective (see following sections).
The criteria were developed from previous work, including the
documents Excellence in Human Performance (1997), “Human
Performance Leadership Framework” (2000), and
NEI/INPO/EPRI Human Performance Process Benchmarking
Report (2001), as well as industry human performance
experience and best practices.
The structure of OR.3 is based on the Performance Model
illustrated below.15 To promote event-free operation, these
14
Daniels. Bringing Out the Best in People, 1994, pp.8-9.
15
INPO 06-003, Human Performance Reference Manual, 2006,
pp.89-91.
elements form a practical foundation for reliable human
performance with respect to individual behaviors, job-site
conditions, related organizational factors and leadership
practices that influence human performance in the field. INPO
encourages managers to focus on the performance objective,
rather than on the supporting criteria, because approaches or
methods different than those described in the criteria may be
used to accomplish the objective.
2. 3.
JOB-SITE INDIVIDUAL
CONDITIONS BEHAVIOR
Leadership
4.
1.
ORGANIZATIONAL PLANT
FACTORS RESULTS
Figure 2. INPO’s Human Performance Model
Culture, leadership, and management are addressed
separately in other performance objectives in INPO’s
Performance Objectives and Criteria. Performance objective
OR.1, Foundation for Nuclear Safety, and OR.2, Leadership
and Management, address the criteria associated with these
important aspects of human performance.
A. Performance Objective, OR.3 – Human Performance
“Station personnel select and apply appropriate human error-
prevention techniques commensurate with the importance of
assigned tasks to minimize the frequency and consequences
[severity] of events.”16
B. Criteria – Organizational Factors
1. Expectations for the use and reinforcement of error-
prevention tools in all work and instructional settings are
clearly established and communicated to workers and
managers, including supplemental station personnel.
2. Managers establish expectations for procedure use that
take into account the complexity of the task, the skill and
training of the worker, the extent of supervisory
involvement, and the potential consequences of improper
performance.
3. Procedures and other work documents are usable,
technically accurate, and controlled and are maintained up
to date.
4. Changes in outage and on-line work plans and schedules
are critically reviewed for conditions that could lead to
16
INPO 05-003, Performance Objectives and Criteria, May 2005.
 human error or result in an undesirable impact on the
plant.
5. Feedback processes, including postjob reviews and
management observations, are used to improve human
performance.
6. Human performance events and trends are closely
monitored, thoroughly evaluated for causes and
contributors, and communicated to station personnel to
increase their understanding and awareness.
7. Station processes are used effectively to reduce error-
likely conditions at the job site.
C. Criteria – Job-Site Conditions
8. Goals, roles, and responsibilities for the assigned task are
discussed and understood before work begins.
9. Assigned personnel are technically qualified for the task
and are physically and mentally ready to perform the
work.
10. Job-site conditions are properly established to enable
qualified personnel to accomplish work assignments
successfully.
11. Job-site conditions and potential consequences are
carefully evaluated to reinforce desired work behaviors, to
reduce the potential for human error.
12. Work preparation and prejob briefings are conducted
commensurate with the risk of the work activity.
13. A variety of defense-in-depth measures are used at the job
site, commensurate with the risk of the work activity, to
reduce the probability of error, as well as to mitigate the
effects of and provide for recovery from error.
D. Criteria – Individual
14. Individuals demonstrate a great respect for the reactor
corefor reactor safetyin their decisions and actions
and seek additional support when faced with uncertain
conditions or situations not addressed by approved
procedures and policies.
15. Individuals demonstrate personal integrity, have a
questioning attitude, challenge assumptions, and consider
potential consequences prior to taking actions.
16. Individuals accept responsibility for their shortfalls and
hold themselves and others accountable to high standards
of performance.
17. Individuals understand the error-prevention techniques, as
well as the management expectations and bases for
applying each technique to avoid plant events.
18. Individuals adhere to safety standards, follow procedures,
and correct procedure deficiencies before continuing with
tasks.
19. Individuals recommend improvements and willingly report
problems, near misses, error-likely situations, and safety
hazards.
20. Individuals communicate freely, openly, and accurately to
support each other to accomplish assigned work.
21. Individuals identify and eliminate conditions that might
lead to human error. They reinforce the use of defenses
that mitigate the consequences of errors.
22. Individuals are receptive to feedback and continuously
strive to improve their knowledge, skills, and performance.
They coach and provide feedback to others.
Line managers are in the best position to determine how to
incorporate these elements into plant operations, in light of the
principles of human performance. Because of differences in
culture, customs, leadership, technology, and resources,
managers are cautioned that what works well at one station
may or may not work as well at their station or even within
departments of the same station.
ACKNOWLEDGMENT
The time and effort devoted by Ms. Karen Hutchings,
Mr. Tom Kriesel, and Mr. Brian Baskette to prepare this paper
are deeply appreciated.
REFERENCES
[1] Center for Chemical Process Safety. Guidelines for Preventing Human
Error in Process Safety. New York: American Institute of Chemical
Engineers (1994).
[2] A. Daniels, Bringing Out the Best in People, McGraw-Hill, 1994.
[3] W. Demming, Out of the Crisis, Cambridge: Massachusetts Institute of
Technology, 1986.
[4] J. Groeneweg, Controlling the Controllable, Preventing Business Upsets,
Global Safety Group, 2002.
[5] D. Hillson and R. Murray-Webster, Understanding and Managing Risk
Attitude, Aldershot: Gower Publishing, Ltd, 2005.
[6] E. Hollnagel, Barriers and Accident Prevention, Aldershot: Ashgate
Publishing, Ltd., 2004.
[7] INPO, Long-Range Plan 2005-2007, Atlanta, 2005.
[8] INPO, Performance Objectives and Criteria (INPO 05-003), Atlanta,
2005.
[9] D. Maurino, J. Reason, N. Johnston, and R. Lee, Beyond Aviation Human
Factors, Aldershot: Ashgate Publishing, Ltd., 1995.
[10] J. Reason, Managing the Risks of Organizational Accidents, Aldershot:
Ashgate Publishing, Ltd., 1998.
[11] U.S. Nuclear Regulatory Commission. “Review of Findings for Human
Performance Contribution to Risk in Operating Events” (NUREG/CR-
6753), March 2002.
[12] R. Whittingham, The Blame Machine, Why Human Error Causes
Accidents. Oxford: Elsevier, 2004.