#1"The Fukushima Daiichi Accident" Technical Volume 2.6 A Systemic Analysis of Human and Organizational Factors at the Fukushima Daiichi Accident Kathleen Heppell-Masys CNSC Canada Monica Haage, IAEA IAEA International Atomic Energy Agency#2"The Fukushima Daiichi Accident" Report by the IAEA Director General Five technical volumes • The result of extensive international collaborative effort involving 5 working groups with about 180 experts from 42 Member States IAEA#3FOREWORD -Yukiya Amano, IAEA Director General "This report presents an assessment of the causes and consequences of the accident at the Fukushima Daiichi nuclear power plant in Japan, which began on 11 March 2011. Caused by a huge tsunami that followed a massive earthquake, it was the worst accident at a nuclear power plant since the Chernobyl disaster in 1986. The report considers human, organizational and technical factors, and aims to provide an understanding of what happened, and why, so that the necessary lessons learned can be acted upon by governments, regulators and nuclear power plant operators throughout the world. Measures taken in response to the accident, both in Japan and internationally, are also examined...” "There can be no grounds for complacency about nuclear safety in any country. Some of the factors that contributed to the Fukushima Daiichi accident were not unique to Japan. Continuous questioning and openness to learning from experience are key to safety culture and are essential for everyone involved in nuclear power. Safety must always come first." IAEA#4Human and Organizational Factors Analysis The HOF team of 11 experts: •Kathleen Heppell-Masys, Lead, CNSC •Monica Haage, Coordinator, IAEA •Amanda Donges, INPO •Hanna Kuivalainen, STUK •Sonja Haber, IAEA •Cornelia Ryser, ENSI •Birgitte Skarbø, IAEA •Per Chaikiat, SSM •Luigi Macchi, Dedale (VTT) •Kunito Susumu, TEPCO •Takafumi Ihara, TEPCO IAEA 7 P D#5Human and Organizational Factors Analysis Objective of the HOF team: As a part of the overall IAEA Fukushima Report, address how human and organizational factors and safety culture contributed to the event in a comprehensive manner to address the "whys" of the event • Aim to perform a systemic analysis of the accident capturing the relationship and synergies between the actors involved Develop lessons learned IAEA#6Basis for a Sound Methodology for Analysis The human and organizational analysis was conducted in accordance with social and behavioural science procedures, which comprise four equally important elements: ◆Recognized methodology; Unbiased data; ◆Scientifically recognized theory; Knowledgeable experts contributing with diversified competences. IAEA#7HOF Team Methodology Systemic Analysis Data Collection: ● • • Approx. 30 reports and other written sources identified by HOF team 10 main reports selected for extracting facts relevant to HOF and Safety Culture • Created HOF Cumulative Fact Database Collecting information from experts contributing to Report to determine HOF and Safety Culture factors contributing to the event sequence Collecting information from various other sources • Interview with Professor Hatamura, Former Chairperson of Investigation Committee on the Accident at the Fukushima Nuclear Power Stations Reports from CS in Japan IAEA#8HOF Team Methodology (cont.) Systemic Analysis Data Analysis: Extracted facts on HOF and Safety Culture from 10 selected accident reports • All facts were assigned to a category and one or more attributes • The HOF team jointly developed a list of categories and attributes All facts were inserted to a Cumulative Fact Database in a manner that allowed for sorting for category and attribute IAEA#9Example of Cumulative Database Reading Lis ба Fact Cod Icf21 14 If4 4 T102 4 T72 4 T74 3 D5-91 Fact To the question, "Don't you think it was possible to propose the development of AM based on seismic PSA?" He (Kondo, chairman of the Special Committee on Safety Goals by NSC) answered, "We could have made such a decision. The question was when to make that decision. With regard to seismic PSA, we intended to start it on the occasion of the periodical safety review (PSR). Although the first-round PSR reviewed only internal event PSA, we had no choice about that, I intended to include external event PSA in the second-round PSR 10 years later. (p. 365) "moreover, those additional protective measures were not reviewed and approved by the regulatory authority" (p. 13 and 45) "The legally mandated METI order to continue seawater injection was issued at 10:30 on March 15. This information was shared via teleconferencing at 10:37. The document containing the METI order stated that "reactor injection is to be performed as early as possible, with D/W venting performed as needed."""" (p.219) "The station and head office response HQs were notified that the TEPCO government attaché decision was "the Prime Minister has not approved seawater injection" at 19:25. After deliberation between the head office and station, it was decided that seawater injection would be halted." (p. 183) "However, due to the decision by the Site Superintendent that continuing reactor injection was vital in preventing accident progression, seawater injection was continued in actuality." (p. 184) "We heard a big impact noise between 6:00 and 6:10. We will make the necessary arrangements and move our Emergency Response office to the Fukushima Daini Nuclear Power Plant to ensure the safety of our staff." [139] On the other hand, the following was the press released published to report the status as of 13:00. "Around 6:00, we heard a big noise around the suppression chamber and its pressure rapidly lowered. We have been injecting seawat reactor at full throttle and have be employees Category T Regulatory culture Attribute/Qualifier ▾ Description Regulatory practice Timeline (B,D,A▾ B Organization NSC, Government Regulatory Framework Roles & Responsibilities B Regulator Organizational Interfaces D IF, TEPCO, METI Roles & Responsibilities Roles & Responsibilities Roles & Responsibilities Organizational Structure (Hierarchy) D 1F, TEPCO, PM Changing the rules of the game Constrained Thinking and Actions Control mode Delaying release of information to the pub 4900 facts classified into 26 categories, 96 attributes covered issues page 44 Excerpt from Statements TEPCO) D 1F TEPCO mered to Procedures or Requirements Corporate Culture TEPCO, other regulators and the Kantei IAEA#10All about the facts Example of fact extraction & categorization: The department responsible for safety design believed that rational explanations could be given for facility measures requiring huge expenditure unless reliable PRA methods were perfected and it would be difficult to obtain consent within the company. Category: TEPCO March 2013 report, Pg.13 Decision-Making Attributes: Business Impact, Methodology, Monetary, Safety Culture IAEA#11Categories & Attributes Categories Accident Management Adaptation Communications Competence Constrained thinking and actions/not thinking out of boundaries Control of Information Decision-making Design Emergency Preparedness Emergency Response Human performance Initiative Legal Framework Management Systems Nuclear Infrastructure Regulatory Culture Regulatory Framework Risk management Roles & Responsibilities Situational awareness Staffing Taking Ownership Training Transparent Culture Unavailability of Information Work Environment Attributes Accident Management Accountability Adaptation Expertise Emergency Preparedness Adhered to procedures or requirements Assumption of human error Availability of Information Business Impact Changing the rules of the game Fear of the Unknown Communication following core meltdown Design Communications external Communications internal External Support Formality Fatigue Configuration Documentation External Conflicting priorities Facility Layout Coordination of dissemination of information Coordination with Others Decision-making ...and 70 more IAEA#12Analysis: Application of Cumulative Database (1) • Sorted facts by category or attribute for the team to review them together Reading Fact Fact List Code Number 7 7 3 3. Ad15 Particularly in March, it was confirmed that six people exceeded 250 mSv, which is the dose limit for an emergency worker. All these were TEPCO employees who were operators and engineers in electricity and instrumentation engaged in monitori of instruments in the main control rooms immediately after the occurrence of the accident. TEPCO has made it a rule not to allow workers who have exceeded 200 mSv to work at the Fukushima Dai-ichi NPS. p. 15 summary Ad7 Although cooling by isolation condenser (IC) (two lines) was begun after the automatic shutdown of the nuclear rector, it manually stopped by following the operation procedure documents because of a rapid decrease in the temperature of the RPV. Summary D102 The secretariat of the NERHQ, which should have played a active role in the decision-making on evacuation zones, was able to make a proposal of any kind to the fifth floor of the Kantei. They accepted the evacuation orders that had been unilaterally decided upon at the fifth floor of the Kantei, with understanding of the grounds for such orders. (C3 pg 63) D103 Questions also remain over whether or not they possessed th required know-how for allocating human resources to the emergency response. (C1 pg68) 3. D140 At the time of the accident, however, TEPCO had not comple the seismic backchecks, and the final report was scheduled for submission in January 2016. This is approximately one decade after the 2006 seismic backcheck instructions and 21 years after the Great Hanshin-Awaji Earthquake that became the catalyst for revising the Guideline. (Ch.5 p.2) Category Attribute/Qualifier Decision-Making Provided Margin Decision-Making Adhered to Procedures or Requirements Review of facts 5 Decision-Making cations sorted by category "Decision- making" Decision-Making cident management Decision-Making ailed to take actions IAEA#13• Report Methodology (cont.) Sorted facts by category or attribute for the team to review Performed a two-fold mapping exercise identifying relationships, concepts and trends resulting in mini- themes and overarching themes • Text on mini themes & overarching themes produced by team members based on the mapping exercises • • Reviewed by whole team and discussed during meetings. Concluded by . Lessons learned . Identification of areas where further needed (Phase 2) Panasonic x Safety Myth Id Nuclear Defonstratore Risk Awes $100 File Relationsh Sile Risk Managemat •Independence Contal Make BIST Mindset birs キッコー Sa 121 •Ownership for Safely 122 I of super Regulatory Body wes Last decantly fentement -What is role of gulate Tifia •Who is The later? • "What motivates regulater? E TAIN •Image Control •Retinalization Insulation ·Phantranton off さく THE 2 英語 316 -Roles & Resumestalities 21% 37-17 "Constraints 14 •Lack of transp •Failure to act A THE May Fes nhalers Tests -Safety th MILA Constant BIFE Shi to 16 Frantw E (s). Athony (Reg Approach) a Regula 36 2 1-12913 •Regulatory 31629 Completely IAEA#14Analysis: Mapping exercises • Performing a two-fold mapping exercise identifying relationships, concepts and trends resulting in mini-themes and overarching themes Insdatio fly tye y Panasonic x Safe Myth Idi Ich to nullify ·Nuclear Defrostrifere •Risk Awes Age RelArms -Risk Management Mindset •In de Control Hade CIST Cast of accent genrement merstopfer Regulatory Body -Whatok flate JNES •Who is The mater "what mutate egulater? -Non-learning ·Pratimaton 742 器材 •Computatales th nisse If •Image Cont •Roles +Respires •Constraints Brze sais habes Constant legalment 10-be •Arthirty (Reg Approach) 0 •Regards dory Append THE 71423 Cristal THAN • Lack of trampamay •Failure to act WH P I T Fum IAEA "Hard filt Mindset Compartmentatze Thinking Insufficit Asph Neh Stragic Regulatory Approach Agendas Rationalization Prontization Prorustration Superficiality Changs my Inconsistent Roles Rapsites Convenient regulati Inge Control Lack of Вампучие Lick of accountability for She Make Rish huercus Ruk Lake of enforcement Construits Pulme to act Readery chatury Integ Complexity Regulatory Relationships#15Methodology - overview Producing conclusions, lessons learned and identify areas for further research (Phase 2) Text produced and reviewed Analysis; information is systematically grouped and overarching themes are identified. Human and organizational factors and safety culture mini themes Human and organizational factors and safety culture mini themes Human and organizational factors and safety culture mini themes Human and organizational factors and safety culture facts Human and organizational factors and safety culture facts Human and organizational factors and safety culture facts Collection of data on human and organizational factors and safety culture from Fukushima reports Collection of data on human and organizational factors and safety culture from other WG experts Collection of data on human and organizational factors and safety culture from other sources IAEA#16. Comments from WG2 co-chair Challenge to communicate "soft aspects" to a technical audience Comments from the co-chairs of WG 2 (covering Safety Assessment) of the Fukushima Report: "Results are aligned with the results from the rest of chapter 2 and provided further explanations to the current understanding. The methodology used is sound and its validate the rest of the working groups conclusions" IAEA#17The hindsight bias Action Identification Planning Identification Observation Observation Planning Action IAEA Identification Action Identification Planning Observation Action Observation Planning Identification Planning Action Identification Action Looking Looking Observation Action back ahead#18Distancing through differencing An accident provides an opportunity to learn, not only for the organizations involved in the accident, but also for the other organizations within and outside the industry concerned. After an accident a 'learning window' opens where it is possible to ask questions that are usually not asked during non- accident times. However, learning after an accident is far from easy. One must not focus on just trying to learn the 'obvious', but must also capture more subtle, important lessons as they emerge over time. Learning after an accident is subject to barriers. One of these barriers is a mechanism called 'distancing through differencing', exemplified by the statement "this can't happen here". Such a response is likely to occur particularly in organizations that are distant enough from the ones directly involved in the accident; for example, operators and regulators in other countries. One example of this is the missed opportunity to address the operating experience gained from the 1999 flooding event at the Le Blayais NPP in France. IAEA#192.6. HUMAN AND ORGANIZATIONAL FACTORS - Observations and Lessons (1) Observation: Over time, the stakeholders of the Japanese nuclear industry developed a shared basic assumption that that plants were safe • Led stakeholders to believe that a nuclear accident would not happen; Thwarted their ability to anticipate, prevent and mitigate the consequences of the earthquake triggering the Fukushima Daiichi Accident; IAEA#20IAEA Levels of culture Behaviour, Artefacts Shared Values, Norms ↑↓ Shared Basic Assumptions#21Shared basic assumption across stakeholders Licensee Public/government Regulatory Body Behaviour, Artefacts Behaviour, Artefacts Behaviour, Artefacts Shared Values, Norms Shared Values, Norms Shared Values, Norms 888 Shared Basic Assumptions Shared Basic Assumptions Shared Basic Assumptions "We are safe" IAEA#222.6. HUMAN AND ORGANIZATIONAL FACTORS - Observations and Lessons (1) Observation: Over time, the stakeholders of the Japanese nuclear industry developed a shared basic assumption that that plants were safe • Led stakeholders to believe that a nuclear accident would not happen; Thwarted their ability to anticipate, prevent and mitigate the consequences of the earthquake triggering the Fukushima Daiichi Accident; Lessons Learned: The possibility of the unexpected needs to be integrated into the existing worldwide approach to nuclear safety - including considerations for emergency preparedness Individuals and organizations need to consciously and continuously question their own basic assumption and their implications on actions that impact nuclear safety. IAEA#23The boundaries of our basic assumptions Unknown unknowns Known unknowns Known knowns Surprise Unknown unknowns E.g. combined effect of earthquake and tsunami on multiple units at nuclear power plants Known unknowns E.g. we know that we do not know when an earthquake will occur and how devastating it will be Known knowns E.g. that earthquakes and tsunamis occur Surprise Surprise occuring outside boundaries of one's basic assumptions#242.6. HUMAN AND ORGANIZATIONAL FACTORS - Observations and Lessons (2) Observation: While the stakeholders involved in the accident at the Fukushima Daiichi NPP were aware of the possibility of the single safety issues related to the accident in advance they were not able to anticipate, prevent or successfully mitigate the outcome of the complex and dynamic combination of these issues within the sociotechnical system. Lesson Learned: • To proactively deal with the complexity of nuclear operations, the results of research on complex sociotechnical systems for safety need to be taken into account by all stakeholders involved. A systemic approach to safety needs to be taken in event and accident analysis, considering all stakeholders and their interactions over time. IAEA#25Topic Seismic event Tsunami Loss of off-site power |(LOOP) SBO Emergency Diesel Generators (EDGs) Switchgear Procedure for notification of a nuclear emergency Known knowns Known unknowns Within the boundaries of the shared assumptions of main stakeholders Design basis of the Fukushima Daiichi NPP and prediction of its design basis seismic performance Tsunamis are a co-related event to seismic events. The Fukushima Daiichi NPP was designed for a loss of off-site power, with the expectation that the grid would be restored quickly. Should SBO occur, the DC (batteries) would last for about 4-6 hours. If AC was not restored in that time, core damage was to be expected. Expected to function on LOOP to provide AC power. Endurance based on diesel stock replenishment capability Interconnections allow cross feeding of power from one unit to its neighbour. After NPP Site Superintendent is notified or discovers the specific event defined in Article 10 (1) of the Nuclear Emergency Preparedness Act of Japan, he/she shall, within a targeted time frame of 15 minutes, simultaneously notify all relevant entities by fax. Response of the Fukushima Daiichi NPP to a seismic event exceeding its design margin The prediction of tsunami heights The extent of grid damage and infrastructure disruption for a very large earthquake and tsunami Diesels can fail to start and duration of service may be unpredictable. Availability of equipment and/or staff to effect interconnection in a severe accident Site superintendent perception of severity of event, communication infrastructure available. Unknown unknowns Outside the boundaries of the shared assumptions of main stakeholders Staffing on site Capability of staff for accident response Minimum number of staff available on site at the beginning of an accident is known Formal competences of staff to respond to an anticipated type of accident is known (training, experience) Capability to relieve staff if severe condition persists over prolonged period in case of damage to outside infrastructure Psychological and physical condition and ability of staff to respond to an event under severe conditions in a given moment Etc. Sum Combination of all elements above = Unknown unknown#26The systemic approach to safety - HTO . • Work to comprehend the whole systems of interplay between humans, technology and organization (HTO) As the whole system is far to complex for one individual to comprehend, an integrated approach is needed, which invites different competencies and thinking Understanding the dynamics of the HTO interactions helps us to evaluate their ability to produce safety outcomes more effectively A systemic approach to safety offers a complementary safety perspective to Defence in Depth IAEA#27Examples of Human, Organizational and Technical Factors Organizational Factors (OF): Vision and objectives • Strategies • Integrated Management System Technical Factors (TF): . Existing technology • Sciences . Design TECHNICAL Continuous improvements Priorities Knowledge management Communication Contracting Work environment Culture etc FACTORS ORGANIZATIONAL IAEA HUMAN FACTORS FACTORS • · PSA/DSA I/C Technical Specification Quality of material Equipment etc . Human Factors (HF): Human capabilities Human constraints Perceived work environme Motivation Individuals understanding Emotions etc#282.6. HUMAN AND ORGANIZATIONAL FACTORS - Observations and Lessons (3) Lessons Learned: The regulatory body needs to acknowledge its role within the national nuclear system and the potential for its impact on the nuclear industry's safety culture. ● RB has the challenging role of questioning the nuclear industry's approach to safety → Needs a critical, profound self-reflecting and questioning ability. May include institutionalizing an ongoing dialogue within the organization and with other stakeholders on the regulatory body's safety culture and its impact on nuclear safety. Licensees, regulators and governments need to conduct a transparent and informed dialogue with the public on an ongoing basis. This may include explanation of the risks that the use of nuclear technology for energy production entails. IAEA#29Suppliers Systemic View of Interactions between Organiz Legal Bodies TECHNICAL Governmental Ministries APACY HUMAN FACTORS TECHNICAL Regulatory Body TECHNICAL Media TECHNICAL HUMAN HUM FACTORS HUMAN FACTORS Licensee Lobby Groups TECHNICAL TECHNICAL HUMAN FACTORS HUMAN FACTORS, Work Unions TECHNIC FACTORS TECHNICAL HUMAN FACTOR Universities TECHNICAL HUMAN FACTOR Professional Associations TICHNICA HUMAN FACTORS Standards Organizations Competing Energy Providers TECHNICAL TECHNICAL HUMAN FACTORS HUMAN FACTORS, Interest Groups Energy Markets TECHNICAL TECHNICA HUMAN FACTORS International Bodies TECHNICAL TECHNICAL HUMAN FACTORS Technical Suppe A HUMAN FACTORS Vendors TECHNICA HUMAN FACTORS HUMAN FACTORS TECHNICAL HUMAN FACTORS Waste Management Organizations#30The bigger, bigger picture FACTORS TECHNICAL HUMAN FACTORS IAEA FACTORS Governmental Ministries Legal Bodies Media Suppliers Regulatory Body Professional Associations Universities Licensee Standards Organizations Lobby Groups Competing Energy Providers Work Unions Interest Groups Energy Markets Vendors International Bodies Technical Support Organizations Waste Management Organizations#31The relation with safety culture: Self reinforcing dynamics HTO-embraces the Strong safety culture systemic interactions IAEA TECHNICA#32Personal Reflection Suprise that the critical issues where also identified often in the experts own working experience " .I recognize this, a similiar matter happen in..." Not many people know what really happened, the have drawn conclusion on what has been communicated in media Some experts tend to isolate the accident something that happened in Japan, we dont have the same situation here e.g. Tsumani, different, technology, national context The human aspect of the accident is often forgotten. Example: TABLE II-1. AFTERSHOCKS OF THE GREAT EAST JAPAN EARTHQUAKE (JAPAN METEOROLOGICAL AGENCY) Number of aftershocks on 11 March 2011 - 180 >M 5.0; 38 >M 6.0; 3 >7.0 Total aftershocks the first week 463 times > 5.0 IAEA#33TABLE II-2. IMPACTS OF DIFFERENT SEISMIC INTENSITIES (JAPAN METEOROLOGICAL AGENCY) [II-3]. Human perception and reaction Seismic intensity 4 Most people are startled. Felt by most people walking. Most people are awoken. 5 Lower 5 Upper 6 Lower 6 Upper 7 Many people are frightened and feel the need to hold onto something stable Many people find it hard to move, walking is difficult without holding onto something stable. It is difficult to remain standing. It is impossible to remain standing or move without crawling. People may be thrown through the air. Indoors situation Hanging objects such as lamps swing significantly and dishes in cupboards rattle. Unstable ornaments may fall Hanging objects such as lamps swing violently, dishes in cupboards and items on bookshelves may fall. Many unstable ornaments fall. Unsecured furniture may move and unstable and unstable furniture may topple over, Dishes in cupboards and items on bookshelves are more likely to fall. TVs may fall from their stands, and unsecured furniture may topple over. Many unsecured furniture moves and may topple over. Doors may become wedged shut. Most unsecured furniture moves, and it is more likely to topple over. Most unsecured furniture moves and topples over, or may even be thrown through the air. Outdoors situation Electric wires swing significantly. Those driving vehicles may notice the tremor. In some cases, windows may break and fall. People notice electricity poles moving. Roads may sustain damage. Windows may break and fall, unreinforced concrete-block walls may collapse, poorly installed vending machines may topple over, automobiles may stop due to the difficulty of continued movement. Wall tiles and windows may sustain damage and fall. Will tiles and windows are more likely to break and fall. Most unreinforced concrete-block walls collapse. Wall tiles and windows are even more likely to break and fall. Reinforced concrete-block walls may collapse.#34IAEA ...Thank you for your attention#35The Complex Perspective Examples of external factors which influence the ongoing interactions between HF, OF and TF Societal context Peoples understanding Political climate Public opinion Culture Generational shift Implementation and reinforcement of Law - Regulations New management trends IAEA Financial climate International Standards Media#36M#37Safety Culture Over-confidence in the ability of the technical features of the plant can be problematic Assumptions about the safety case need to be challenged by: the operating organizations the regulatory body and government Regulatory oversight must be robust including: regulatory framework and legal powers ● • independence Over-confidence impact on organizational learning . impact on decision making OPEX quality IAEA#38Response Under Extreme Circumstances Operators who directly responded in the early stages of the accident did so under extreme circumstance Extremely adverse working environment both physically and psychologically . • • anxiety and stress uncertainty about their family and home inadequate provisions for rest, sleep, hygiene, food and water ⚫ tasks conducted in darkness while wearing personal protective equipment IAEA#39• • Accident Management Provisions & Implementation Analytical support for accident management Procedures and guidelines for accident management Hardware provisions plant status information means for water injection etc. Organization and arrangement • training, exercises and drills under extreme/degraded plant conditions Interfaces with off-site emergency arrangements IAEA#40Organizational Resilience A complementary strategy to ensure flexibility within a system learning from successful normal operations paradigm shift away from the traditional approach understand strengths as well as vulnerabilities complexity, uncertainty, and unpredictability capitalize on behaviours and processes that resulted in positive outcomes • better prepared to deal with the unexpected IAEA