Sie sind auf Seite 1von 8

Joint 8th IEEE HFPP / 13th HPRCT

MERMOS : an extended second generation HRA


method

Patrick Meyer , Pierre Le Bot , Helene Pesme


Industrial Risk Management Department, EDF R&D, Clamart, France
patrick-c.meyer@edf.fr, pierre.le-bot@edf.fr, helene.pesme@edf.fr,

Abstract— MERMOS is the reference method used by Electricite Today, because of the use of PSA and the need to assess new
de France (EDF) for Human Reliability Assessment (HRA), to risks, EDF will continue developing HRA methods. So as to
assess the emergency operation of nuclear reactors during take advantage of the concepts put in place for the MERMOS
incidents and accidents for Probabilistic Safety Assessments method, and the advantages it provides for modelling
(PSA). When type N4 reactors were designed, the previous
method used for Human Reliability Evaluation (based on the
applications, and in order to standardise as far as possible the
THERP methodology and on data-gathering using a simulator, HRA methods used in particular contexts and studies, the
known as FH6) required development, as it proved largely process for developing methodologies has consisted in
unworkable for managing incidents and accidents using extending, or where necessary adapting, the MERMOS
computerized procedures. Designing MERMOS has been an reference method in order to meet the new modelling
opportunity to redefine the concepts used in assessing human requirements and possible engineering constraints related to
reliability. EDF is currently extending MERMOS to use for implementation of HRA studies. In this document, we will first
assessing behaviour before an accident and during a fire, as well present a brief summary of the concepts and stages of
as for the assesment of Human Factors missions planned as part implementation of the MERMOS method, and then describe
of the Level 2 Probabilistic Safety Evaluations (that take into
account the release of effluent once the core begins to melt down).
their use and past or future developments in relation to new risk
The objective is to standardize the methods used and to make best assessments that require an evaluation of human performance.
use of the MERMOS method, by adapting it to meet the These new fields also include Probabilistic Event Analysis, fire
engineering constraints associated with the analyses for Human risk modelling, evaluation of human actions related to Level 2
Reliability Evaluation. This paper presents the initial defined PSA (assessment of the frequency of discharge of radioactive
stages of the methodology, and the principles on which this section effluent following the core meltdown) or related to the
of the work is based. maintenance or operation of the plant in normal conditions.

II. THE MERMOS METHOD: SUMMARY OF FAILURE


I. INTRODUCTION CONCEPTS AND MODELLING PROCESS
In addition to deterministic safety studies made to justify the MERMOS, Assessment Method for the Performance of
design and operation dimensioning choices of its nuclear power Safety Operation ("Méthode d'Evaluation de la Réalisation des
plants, Electricité de France (EDF) is developing its own PSA Missions Opérateurs pour la Sûreté "), developed for the HRA
(probabilistic safety assessment) for each type of unit and its in the post-accidental phase, offers a qualitative and
own PHRA methods (Probabilistic Human Reliability quantitative framework for the analysis of failures of Human
Assessment). The first method of human failure evaluation, Factor missions (HF missions) modelled in the PSA. It is based
developed by EDF and named “ FH6”, was based on the on concepts and tools available to HRA analysts which help
THERP method (Technique for Human Error Rate Prediction) them to understand and describe emergency operations and
and data collected on its own simulators. analyse the mechanisms that lead to mission failures.
A level 1 PSA (used for estimate the frequency of the core
meltdown) dedicated to the French unit type named N4, has led A. Concepts applied
EDF to create a new second-generation method called 1) Subject of study and assessment reference
“MERMOS”, assessment Method for the Performance of Safety In a PSA for each initiating event (equivalent to an incidental
Operation (Méthode d'Evaluation et de Réalisation des Missions or accidental situation), a functional analysis is used to
Opérateurs pour la Sûreté) [1]. Developing this method allowed determine the tasks to be carried out in order to bring the reactor
new concepts to be defined for modelling the reliability or back into safe conditions or to prevent any further deterioration
performance of operating teams in a nuclear unit during an of the situation. Some of these – called Human Factor (HF)
accident. The method initially developed for N4 unit type has missions – correspond to safety-critical actions carried out in
been extended to be applied at all French nuclear unit types. In the control room. The aim of the MERMOS method is to model
this way, MERMOS has become the reference HRA method and assess failures of these missions, which are assigned not to
used by EDF for assessing operator tasks in accidental one operator, but to an operating system that includes the
situations.

1-4244-0306-5/07/$20.00 ©2007 IEEE. 276


Joint 8th IEEE HFPP / 13th HPRCT
control room team, the procedures they can apply, and the man elements in the situation, just like any other: human errors are
machine interface. MERMOS considers that the performance of not alone responsible for a mission failure.
HF mission is the responsability of a system we call Because they are defined at system level and are extremely
“ emergency operations system ” (EOS). It is therefore intended contextual, CICAS do not need to be represented explicitely in
first of all to assess the performance of the operating system in the mind of the crew’s members. Examples of CICAs are given
comparison with a reference that defines the required functional in Pesme's paper[4].
and safety objectives. Consequently, MERMOS defines
operating system failure, toward the system safety requirement, 4) Failure modelling
and not (as was the case with certain first-generation methods) The task for MERMOS is to:
as a departure from procedure. In particular, this makes it - identify the configurations and orientations (CICA) which, in
possible (whatever the accidental situation under consideration) a particular situation, can cause the system to fail to carry out
to assess system performance relative to the desired safety an HF task,
optimum. - assess their probability of occurrence.
2) Breakdown of failure management into sub-functions To do this, MERMOS analyses the properties of system
To meet the objective, which is to carry out the HF missions, components, and the interactions between these components
the operating system must be able to: and their environment that could cause CICAs to appear, and
- detect whether the situation requires human intervention, does this by identifying “situation features”. It is the
- determine the level of urgency relative to the overall situation interrelations between these elements that provide an
and for current actions, understanding of the internal logic that guides the system and
- select the appropriate response, make it possible to identify the orientations and configurations
- define an action plan and carry it out. that are not suitable for the particular situation in which the
These requirements can be described for three main functions system finds itself. The situation is described by “structural”
applied in carrying out the missions. These are: Action - features (inherent in the design of the plant, the related
Diagnosis - Strategy (referred to as the SAD [2] model for procedures etc.), and “contextual” features, which can vary
accident management): from one situation to another and from one mission to another.
- “Action” is the function that changes an installation from one The HRA analyst applying the MERMOS method has to give
status to another, qualitative and quantitative descriptions of the failure in the
- “Diagnosis” is the function that examines the status of the form of failure scenarios [5] (“little stories”) (see Figure 1).
installation and the situation in general, using the data and
previous knowledge available for the system,
- “Strategy” is the function that selects the target status to be
achieved and the appropriate set of actions in order to obtain it.
To make it easier to describe the HF mission failure, the
required emergency operation is therefore detailed for each
function, and the failure of the EOS related to each one, for
various failure modes.
3) Failure in an emergency operation system that is acting
consistently
The theoretical failure model is the result of retrospective
analyses of real accidents [3], which have led us to consider
that, when managing incidental situations, the actual
functioning of the system might be described as a series of
configurations and orientations in response to the situation to be
managed, and which the EOS adopts and maintains for a certain
period of time. This form of operation is also consistent, and is
in line with the inherent logic of the EOS.
The systemic CICA concept (Configurations Importantes de
la Conduite Accidentelle: important configurations of
emergency operations) has been introduced in order to describe
these configurations and orientations, and is used to define the
type of system operation adopted for a given time in response to
incident or accidental situations. MERMOS is thus based on the
principle that the failure of the EOS occurs when the system
maintains configurations and orientations too long, and these
prevent it from deploying the response required by the situation
and from using the multiple redundancies provided. This
approach does not exclude human errors, but considers these as

277
Joint 8th IEEE HFPP / 13th HPRCT
The qualitative analysis process combines a “top down”
Scenario (deductive) approach, from the required functions (strategy,
action, diagnostics) to failures that can lead to failure of the HF
Requirement Give priority to completion of feed and bleed mission, and a “bottom-up” (inductive) approach from the data
Mission Implementation of Feed an Bleed in available to the analyst concerning emergency operations, to
under 50 minutes. failure scenarios of the HF missions.
The deductive approach:
SAD function Strategy ⊗ starts from the input HF mission,
Failure mode Incorrect strategy ⊗ identifies the corresponding requirement,
⊗ adapts this requirement according to the three SAD
Scenario The system, hoping to recover the AFW, at functions,
times delayed the transition to open feed ⊗ systematically takes into account the failure
for too long. modes for each of these functions,
Non-satisfaction mode Priority to restarting the AFW ⊗ identifies which requirement is not
Probability of non reconfiguration met in each of these modes.

PROBABILITIES The inductive approach:


OF CICAS
∅ starts from existing data (observations on simulator, expert
1. CICAS judgements, etc.),
∅ identifies the characteristics of the situation (structural
1. Suspension of the transition to and contextual) that lead to CICAs,
Feed and Bleed as the AFW ∅ project or build failure scenarios where CICAs are
appears recoverable implemented and remain in place, leading to emergency
2. Focus on AFW restoration operation other than the one required.
The two approaches are complementary, and are used to
PROBABILITIES guide and ‘automate’ the search for failure scenarios, CICAs,
OF PROPERTIES and the associated situation features.
2. Situation features For the purposes of application, the qualitative analysis is
assisted by a data base containing the results of analyses already
1. The information originating locally, or completed. This data base allows the analyst to apply the
the team troubleshooting, instil a belief “delta” approach between the particular mission to be studied
that the AFW might be recovered soon and the mission analyses present in the data base.
2) Quantification principles
2. The shift supervisor is assumed from
Quantification takes account of all elements identified by the
the organizational point of view to
qualitative analysis. The total probability of failure of the HF
monitor restoration actions closely
mission is defined as the sum of all probabilities of
3. The shift supervisor is involved occurrence of all failure scenarios identified, plus the residual
heavily in restoration actions probability Pr , representing possible unforeseen scenarios:
Total failure probability of an HF mission:
4. The Safety engineer arriving late does
P(HF mission failure) =
not prejudice the team strategy and
neither does it accelerate ∑ scenarios identified
P(scenario i) + Pr
Figure 1 : Qualitative example of a failure scenario for the feed and bleed
mission after the lost of the Auxiliary Feed Water system The full detailed quantification proceeds, failure scenario by
B. Process for modelling and assessment of EOS failure failure scenario, for each of the failure modes of each of the
SAD functions. The probability of a failure scenario is the
1) Qualitative approach product of:
MERMOS qualitative analysis is systematic and structured: It - probability of simultaneous occurrence of the situation
is largely supported by the SAD model, and the CICA and features associated with the scenario,
situation concepts already described. It is intended to: - probability of occurrence of the CICA(s) identified, when it
- explain the possible reason for failure of the HF mission, is known that the situation features are present,
- search the possible failure scenarios (a scenario consists of - probability of non-reconfiguration of the emergency
the path that could lead to mission failure), operation system, when it is known that the CICAs are present
- take account of all scenarios that may lead to failure of the (i.e. probability that CICAs will be maintained too long).
mission, Each probability is justified, and the data used[3] for
- track all the above elements. quantifying the elements (situation features, CICAs, and

278
Joint 8th IEEE HFPP / 13th HPRCT
scenarios) can be taken from observations on the simulator, In general, after taking account of a different accident context,
objective data on the equipment, expert evaluations, sites... The the analyst may decide to:
method guides the analyst in searching and processing the data, θ modify (or adapt) the requirement for the HF mission
and suggests a process for quantification by expert judgements
This stage in the process of taking account of the context of
[7].
an event can be attached to the “deductive” approach described
III. APPLICATION OF THE MERMOS METHOD TO PARTICULAR previously. Starting from the event, this involves:
SITUATIONS OR STUDIES
• determining the way in which the event affects
adaptation of the requirement selected for the reference
A. Probabilistic event analysis
mission (in the case of an alignment error, this would
1) Objectives involve local recovery of the latent error, then
This type of analysis is based on the use of PSA to identify performing the system start-up)
scenarios that might lead to unacceptable consequences starting
from real events: • identifying the new requirements to be created, or
- how could the event have degenerated into an modifications to those already modelled.
accident with much more serious consequences? • creating/justifying the new failure scenarios (or the
- is it possible to create a measurement of the gap absence of new failure scenarios) as a result of
between the end of the incident and a potential accident with modification or variation of the requirement.
unacceptable consequences?
One of the particular objectives of the process is to obtain an θ add new contextual or ‘behavioural’ elements 1
assessment of the seriousness of an event starting from an
This stage in the process of taking account of the context of
evaluation of the potential consequences given in PSA, and thus
an event can be attached to the “inductive” approach described
arrange events in a hierarchy. This type of analysis also allows
previously. For the analyst, this means identifying new
the various lines of defence to be examined in the light of the
contextual or behavioural elements relative to the event, which
event, as well as providing an assisted decision-making tool for
will allow him to model new failure scenarios using the
processing experience feedback.
MERMOS method, or to justify removal of existing scenarios.
2) Probabilistic Event Analysis and PHRA
For these studies the purpose of the probabilistic event θ impact/modify the justifications used for reference
analysis is to provide, in relation to the PHRA, tools and quantification.
methods that can be used to refine existing HRA analyses and
After taking account of the event context, the analyst may
so produce a more accurately related context based on an event
decide to revise the justifications given for quantification of the
taken from experience feedback (REX). For example, an
reference mission.
evaluation of the potential impact of an event on the risk of core
meltdown could, for HRA purposes, consist in assessing the
B. Fire situation
impact of the latent unavailability of a technical system that
would be necessary in order to mitigate an accident, in HF A fire PSA requires a specific process based on Level 1 PSA,
missions, or the potential impact of an initiating event (if the which models the impact of internal event, to assess the
causes are known) on accident mitigation. consequences of a fire in plant buildings. The first phase of
3) Inputs from the MERMOS method to the Probabilistic PHRA consists in assessing the reliability of fire-specific
Event Analysis management in the control room (for example, creation of a cut-
By providing a qualitative description of the failure, and in off plan) and in re-assessing the emergency operations to take
particular by modelling the accident context in which it is account of possible situations accumulating subsequent to a fire.
liable to occur, MERMOS makes it easy to compare a 1) HRA modelling and specificities
particular context and assess its potential impact on the In principle, because of the underlying structure of the
performance of the EOS. This can be done using the delta analyses and concepts, the MERMOS method can be adapted to
approach described previously. Starting from an existing HRA all incidental/accidental contexts in a nuclear plant. For the
analysis, which is often based on a general context, the analyst purpose of HRA modelling, therefore, fire-specific operations
can take into account a more accurate context and then refine from control room are assessed using the reference MERMOS
or modify the existing analysis. method, and the existing missions are adapted to the degraded
For example, if the mission consists in starting up a system situations accumulating a fire by taking account of the specific
from the control room, and if one wishes to take account of the context (as indicated in the previous paragraph) and using the
fact that the operating system has to perform local recovery of delta approach.
a latent alignment error before starting up, the delta approach Thus, HRA modelling of control room fire management is
through the MERMOS method can be used to model this based on application of the reference MERMOS method, and its
situation precisely and explicitly, in order to assess its impact
1
on failure of the mission. In relation to the principles of MERMOS, these are
knowledge elements related to the operating system (team-
procedure-interface)

279
Joint 8th IEEE HFPP / 13th HPRCT
main specificities are found in the data and knowledge bases to base derived from the generic missions available. One of the
be acquired into the operating system and its environment. aims is that these missions should always correspond to an
Certain specificities have already been registered and will soon accidental context more serious than the one examined by the
be integrated: analyst in his study; and this might help limit the number of
• Particular organisational structure of the operating specific studies required.
system 1) Modelling principles
• Incorporation of new operating procedures θ Systemic approach
• Possible presence of parameters that could hamper To determine the contribution of the National Crisis
operations (unavailability due to fire), and presence of Organisation and decision-making and technical personnel
spurious alarms located outside the control room we have enlarged the
• Relations with operatives external to the control room emergency operation system for the purpose of analysis from
(fire fighters) the point of view of reliability. The purpose is then to analyse
• … the reliability of an operating system which includes:
2) Continuing development
Beyond the control room operations, overall management of Control room operating team – Local decision-making
a nuclear unit affected by a fire involves carrying out certain teams – National technical support teams - Procedures –
fire management actions such as: Interfaces
• fire detection and immediate responses (alarm, The enlargement of the system is based on a trade-off
confirmation, fire containment), between the reasons for taking account of the response and
• fire-fighting after confirmation of the fire, possibly decision ‘centres’ involved in operations (with the response or
involving the use of human and technical resources decision-making resources etc.), and the difficulty of integrating
external to the site. all the operatives involved in managing a Severe Accident.
Research work is now in progress at EDF for the purpose of
developing HRA methodologies for modelling these aspects of θ Functional breakdown
fire management. The initial research has been mainly The SAD model used by MERMOS has been modified. The
concerned with setting up data and knowledge bases on the functional breakdown is used particularly to provide a
nuclear sites regarding the management of these situations. simplified view of system functioning. In particular, the
‘mission’ of the new EOS is to analyse and assess the situation
relative to plant operation, and determine the possible
IV. NEW DEVELOPMENTS: SEVERE ACCIDENT MANAGEMENT
developments. We are thus considering that a mission failure
As part of the modelling of the risk of radioactive discharge could be compared with a failure in the Prognosis function. The
following the core meltdown, HRA methods have to be Prognosis function is defined as the function that shows the
developed in order to determine, within a Level 2 PSA, the status of the installation at a set time (calculated or not, and with
contribution from the National Crisis Organisation and systems + barriers), and the safety functions, taking into account
decision-making or technical support personnel located outside a possible aggravating factor.
the control room, for the purpose of ensuring containment. With ⇒ PSAD Model
the initial developments completed, the first applications are Therefore, it is the No Prognosis and Erroneous Prognosis
now being made in order to extend the process and validate it failure modes that are to be taken into account for the EPFH
for use in all associated Level 2 PSA and HF missions. analysis in the same way as the other existing failure modes for
A. Proposed modelling process the Strategy, Action and status Diagnostics functions.
The process for Severe Accident HRA studies is based on the 2) Process detail and specificity
principles of the MERMOS method. The specificities of the Figure 2 shows a model of the initial process to be carried out
Level 2 PSA from a “HRA point of view” (few missions to when the study of an HF mission in a Severe Accidental
analyse compared with Level 1 PSA) make it possible to take situation makes no reference to any existing generic mission.
account of the fact that the process is based on the adapting of When analysis of the generic mission is complete, its variations
generic mission models to a specific context. are decided by the analyst according to the different accidental
The Level 2 PSA attempts to assess the frequency of contexts (particular contexts are taken into account). In
radioactive discharge resulting from the degraded fuel situations principle, the generic mission very often corresponds to the
identified in the Level 1 PSA. To do this, the Level 2 PSA most unfavourable context (transient dynamics, resources
creates a group of degraded situations so that it can also include available, etc.).
their particular initiating events (PDS, Plant Damage State).
This group is then used to define a degraded envelope situation
(which is very often conservative) for all of the situations in the
group.
The HRA analysts then have to create a process based on the
delta approach of the MERMOS method, using a knowledge

280
Joint 8th IEEE HFPP / 13th HPRCT
by indicating as far as possible the Level 2 expert 2 assessments
and assumptions used to identify and quantify the failure
A. Stage 1 scenarios. The identified knowledge elements can be re-used,
adapted or modified in future stages or studies. The analyst can
then use this general level of analysis and adapt it according to
a) Identification and definition of the requirements of the study.
the generic mission using the MERMOS This stage can also be linked with the HRA data collection
method phase, particularly for the purpose of technical validation or
collection of the associated evaluation data. To assess
Generic variation of the requirement emergency operation during Severe Accident, the analyst has
according to functions of the Severe less HRA data available than for the HRA studies for the Level
Accident model
1 PSA (no real cases observed, and few simulations related to
the existing method for accidental/incidental situations, etc.).
The main data source for assessing human reliability analyses is
therefore the expert evaluation data base, which can be adapted
or identified within the generic missions.
This aspect is specific to Severe Accidents, and since the
A. Stage 2 analyst has no simulations available (for example, training on a
full-scale simulator), this evaluation made or validated by
experts forms an important part of the human reliability data.
b) Qualitative analysis and 3) Advantages of the proposed process
quantification of generic missions Till now, HF missions in the Severe Accident context were
evaluated where necessary by assigning fixed discrete values,
Qualitative analysis – identification of failure
scenarios (inductive and deductive process)
which depended particularly on the time available after the
Quantification of scenarios by the MERMOS accident occurred. As a result, assessments could be affected by
method and using existing numerical data or the threshold effects on variations when the available times
interviews with experts in Severe Accident were short. Quantification by assigning an expert evaluation as
management recommended by the MERMOS method is less susceptible to
threshold effects due to variations in time. It also makes it
possible, depending on the situation, to evaluate more
accurately the availability of technical or decision-making
resources (particularly by applying a situation feature indicating
that they are absent or unavailable).
no Finally, the proposed process allows:
Adaptation of the • a more detailed definition of specificities related to the
End of analysis - accident context, by providing a qualitative description
generic mission to
Conservative of this context within the failure scenarios
accident contexts?
model • where necessary, concurrent or tacit objectives to be
taken into account by the emergency teams, in order to
yes perform the necessary action identified by the PSA
(consistent and systematic modelling of Severe Accident
Delta approach operations by using CICAs and having the operating
system take account of national or local technical support
resources).
Figure 2. Initial process
V. REQUIREMENTS AND INITIAL DEVELOPMENT WORK ON
Stage 2 aims to be as exhaustive or conservative as possible LATENT ERROR MODELS
when defining the mission, adapting the requirement, and The need for HRA development work on ‘pre-accident’
identifying the scenarios in order to assist the analyst as far as failure modelling (i.e. latent failures, or failures that occur prior
possible in the following stage. The “delta” approach in Level 2 to an accident) is due both to the need for R&D, to make the
is therefore intended as a context describing process, rather than existing pre-accident method (the “FH7”) more consistent with
an adaptation or transposition process. the post-accident MERMOS method, and the need for
Another Stage 2 objective is to form the basis for future HRA
studies on the mission concerned. It is therefore intended to
provide ‘technical’ validation of the analysis and failure model, 2
In particular, these include Severe Accident experts (accident
management and physical analysis), emergency operations
experts, PSA experts, members of the crisis organisation, etc.

281
Joint 8th IEEE HFPP / 13th HPRCT
operational units to be able to go beyond the limitations of the sufficient for evaluating the organisation structure of a nuclear
existing FH7 method, and particularly so they can evaluate the unit. Therefore, field surveys have been conducted, where the
existing organisational barriers and use the available experience occurrence of an event has caused the unavailability of a
feedback. system, in order to determine whether the concepts produced by
MERMOS could be extended, for example, to maintenance
A. Limitations of the FH7 method
activities. These surveys must be continued, but initial
FH7 is a ‘consensus’ method: it uses numerical values based conclusions have allowed us to establish that certain concepts
on a consensus of experts from the EDF and the Safety could be extended to the pre-accident area:
Authority (SA). The method, the ‘data’, and the numerical • Not focussed on individual human error
failure probability values are not separated. Also, FH7 is based
on the principle of evaluating the probability of non-recovered • ‘Systemic’ reasoning: performance is evaluated at the
individual human error (i.e. a second individual human error), design process level to ensure safety, and not
as was the FH6 method, which preceded MERMOS for post- specifically at human level. The subject of evaluation is
accident situations. It is limited to errors of omission or therefore the system, including the general personnel
incorrect execution of basic actions, as are the first-generation structure and its interactions with its environment and
HRA methods, which were focussed on individual human error. tools.
It is therefore out of alignment with MERMOS a second-
generation method. Finally, the elementary nature of FH7 does • Importance of the situation: system behaviours that lead
not allow evaluation of the organisational arrangements that to failures are consistent, but not adapted to the
EDF believes are important for certain situations pointed out in requirement because of particular situations. 3
some of the safety analyses. • Failure probability is determined by qualitative analysis
B. Possible future developments of failure scenarios quantified individually using plant
data or expert appraisals. Failure probability is therefore
1) Use of experience feedback
the sum of all the failure scenarios foreseen by the
When preparing the FH7 method, EDF did not have
analyst.
sufficient experience feedback information to allow it to apply a
statistical approach, for example in order to estimate the • The overall failure mechanism is based on the non-
probability of latent unavailability of a system due to human reconfiguration of the active system, along with a certain
error, all the more the equipment taken into account in the PSA inertia of the configuration and an orientation 4 that leads
is safety-related and very often requires special attention. A to choices not adapted to the situation.
forward study based on experience feedback has demonstrated
the feasibility of using experience feedback for a pre-accident The aim of the further research will be to define an HRA
HRA method, on several conditions: method that can be used to assess the impact of organisational
• Select a suitably representative level of sampling: choices on safety [6] during the pre-accident and post-accident
equipment or equipment group if relevant (for example, phases, and which will meet the requirements of operational
manual valves); the grouping level must be given units that wish to evaluate specific safety-related arrangements
special attention and be validated retrospectively by where necessary.
experience feedback;
• Choose a period that is as large as possible (for VI. CONCLUSION
examining the feedback), but which represents an
organisation structure that is comparatively stable Originally designed to meet HRA requirements related to the
relative to the function being examined: this should be modelling of nuclear reactor operations during an incident or
determined by expert appraisal, on a case-by-case basis; accident situation for theN4 unit type, and go beyond the
concepts of the first-generation methods, the MERMOS method
• Extrapolate the time ratio (cumulative) for when there is
has since been applied to Probabilistic Safety Assessments for
incorrect configuration of the equipment (due to human
all types of nuclear units. The ‘industrial’ application of a
error and making the function concerned unavailable),
second-generation HRA method has made it possible both to
with the required operating time, representing the
test the concepts of the method from this point of view, and to
probable unavailability of the equipment.
• Check that the data collected allow a satisfactory
3
confidence interval to be defined. As stated in ATHEANA (NUREG-1624, page 1-9):
2) Absence of relevant experience feedback “ Previous HRA methods have implicitly focused on
If it is necessary to use the available experience feedback, addressing the question, “What is the chance of random
using this alone for making certain estimates means that several operator error (e.g. operator fails to…) under nominal accident
conditions must be set, including in particular the availability of conditions ?” …. On the basis of review of the operating
sufficient homogeneous data. In certain cases, the analyst does experience in several industries, a more appropriate question to
not have this data available, for example to take account of a pursue is, “What is the chance of an error-forcing-context
new organisation structure or a new equipment maintenance occurring so that operator error is very likely?”
4
strategy. Consequently, experience feedback will not always be In MERMOS, defined by the CICAs

282
Joint 8th IEEE HFPP / 13th HPRCT
create a related knowledge base and data base to assist future Conference on Probabilistic Safety Assessment and Management,
Springer Verlag London Limited, 1998.
model updates, and to be used for new human reliability
analyses [3]. We are now in the process of extending the [2] E. Desmares, F. Cara, P. Le Bot, C. Bieder, J-L. Bonnet,
“MERMOS : New Issues on Human Failure in Emergency
method to meet other tasks, such as probabilistic event analysis, Operations of Nuclear Power Plants”, Probabilistic Safety
and fire or Severe Accident management. Initial developments Assessment and Management, Springer Verlag London Limited,
and test cases have shown us that the principles of the method, 1998.
[3] P. Le Bot Human reliability data, human error and accident
such as systemic reasoning, importance of the situation, failure models—illustration through the Three Mile Island accident
modelling, and analysis structuring, were able to contribute to analysis
an evaluation of the performance of safety processes where Reliability Engineering & System Safety, Volume 83, Issue
there is human involvement, beyond the situations analysed by 2, February 2004, Pages 153-167
[4] H.Pesme, P. Le Bot, P. Meyer, EDF R&D “Little stories to explain
the Level 1 PSA. If the methodologies developed using the Human Reliability Assessment : a practical approach of the
MERMOS method are possible, their uses must also be based MERMOS ”, IEEE/HPRCT 2007, Monterey CA.
on knowledge and data that do not form an integral part of the [5] C. Bieder, « What does a MERMOS analysis consists of ? », Proc.
method. To ensure that relevant use is made of human reliability PSA ’99, Washington, DC, August 22-25, 1999, American Nuclear
assessments in order to meet the various requirements, it is also Society, La Grange park, Illinois (1999).
[6] A. Voicu, P. Le Bot “Exploratory study of the impact of
important to set up data or knowledge bases for the various organisational factors on safety using Probabilistic Safety
processes being examined. Assessments”, Proc. International Topical Meeting on Probabilistic
Safety Analysis, PSA'05, September 11-15, 2005 , San Francisco
[7] H.Pesme, P.Meyer “Guide for the application of human reliability
REFERENCES assessment method MERMOS” EDF R&D 2002, HT-54/02/20/A
(to be published in english).
[1] Bieder C., Le Bot P., Desmares E., Cara F, Bonnet J-L,
“MERMOS: EDF’s New Advanced HRA Method, International

283