Every figure on this screen is a row from a published table.
A procedure is treated as an executable object, not as a text. Each step names an action, the cue it depends on, and the plant variables it changes. Reliability comes from three independent methods read against the same model.
A finding is only kept when the ranking of failure modes survives a change of method. The absolute level is never better than order of magnitude. The source documents say so, and pretending otherwise is how a tool like this gets ignored by the engineers who would have to trust it.
The three methods
SPAR-H
NUREG/CR-6883
Nominal rate times the product of the graded shaping factors, floored at 1.0E-05.
nominal 1.0e-3 action, 1.0e-2 diagnosis, floor 1.0e-5
THERP
NUREG/CR-1278, Appendix G Table G-1
Base rate keyed by the type of error, then shaped. The method calls its own values conservative.
general first estimate 0.003 - band factor x10
HEART
HSE RR679; the 1.2-30 factor band from NARA in IAEA PUB2102
Generic error probability times each condition at its assumed impact, capped at 1.0.
condition factors 1.2 to 30 - APOA 0.25 / 0.5 / 0.75 / 1
SPAR-H multiplies the nominal rate by the product of every shaping factor applied. When three or more are negative, the published adjustment replaces that product with NHEP x C / (1 + NHEP x (C - 1)). A badly shaped step lands near 0.8, not at 40.
Not used, deliberately. The reprinted THERP action-class ladder, Ps 0.9999, 0.999 and 0.995, and the PSF multipliers quoted as x10, x20 and x100 appear in a great many secondary papers. They are not in the primary documents.
At most 3 negative factors act on one step. Fatigued, rushed and poor procedure are frequently one situation described three times. The extras are held at nominal and listed as suppressed, here on screen, where an engineer can overrule the call.
SPAR-H performance shaping factors, as published
multiplier on the nominal human error probability, level by level
THERP base rates, Table G-1
keyed by the type of error, which is how a step is written
| 1e-4 | wrong key-protected switch instead of the key switch |
| 1e-3 | incorrect operation of a dissimilar switch |
| 3e-3 | general error of commission, misreading a label |
| 1e-2 | general error of omission where no status display exists |
| 3e-3 | omission of a step inside a documented procedure |
| 1e-2 | omission of a step not cued by the procedure |
| 3e-2 | simple arithmetic with self-checking |
| 1e-1 | failure to note that a device is already positioned |
| 1e-1 | monitor fails to recognise an initial error |
| 1e-1 | different shift fails to check what the previous shift did |
| 5e-1 | failure to detect an incorrect alignment on a walk-around check |
| 1e+0 | first 60 s of extreme stress: action assumed to fail |
| 9e-1 | after five minutes of extreme stress |
| 1e-1 | after thirty minutes under sustained stress |
| 1e-2 | after several hours, performance recovers towards nominal |
| 3e-3 | nominal general HEP for a first estimate |
HEART generic task types
generic error probability, then condition factors
| A | 0.55 | perform an unfamiliar task at speed |
| B | 0.26 | restore a system to service without written procedures |
| C | 0.16 | complex comprehension of a fault condition |
| D | 0.09 | response to a fairly simple or rapid action, situation not anticipated or trained for |
| M | 0.03 | misread or miss-read a digital display / miscellaneous |
| E | 0.02 | routine actions to a well-designed software interface / low skill routine |
| F | 0.003 | restore or shift a system to or from storage/operating mode following recognised procedures with checking |
| G | 0.0004 | fully understood, familiar task, adequately designed for human performance |
| H | 0.00002 | act correctly in response to a system demand |
The maximum factor of a condition is taken from the published 1.2 to 30 band, then scaled by the assumed probabilistic impact on the task. Treating every condition as a x30 one is how a method ends up reporting 100%.
Worked example, computed on this page
OP-TRF-014 rev 7 - step d8 - Day shift, competent operator - Two weeks after bench testing LT-101 and LSHH-101
"Confirm the tank vent valve V4 is open." The instruction the operator reads is:
Confirm the tank vent valve V4 is open. The vent line was isolated for the roof inspection work; if in doubt, ask the control room to confirm on the roof camera.
action kind actuate - cue physical - 2 confusable devices - nominal duration 180 s - error modes 3
error producing conditions active for this performance
post_maintenance_state - severity 2
absent_cue - severity 1
incomplete_function_test - severity 1
distraction - severity 1
time_pressure - severity 1
ambiguous_wording - severity 3
the worksheet all three methods read
| Factor | Level applied | x | Why |
|---|---|---|---|
| AVL Available time | time required or less than nominal | 1 | baseline - nominal: the step is scheduled with time to perform it |
| STR Stress / stressors | low to nominal | 1 | baseline - nominal working conditions |
| CX Complexity | easy | 1 | baseline - single well-defined device action |
| E-T Experience and training | expert | 0.5 | baseline - 11 years, 180 previous runs of this procedure |
| PRU Procedures | incomplete | 20 | wording admits two readings - the wording admits more than one reading |
| HCI Ergonomics / HMI | adequate | 2 | plant not in the assumed state - nothing at the point of action shows the true isolation state |
| FFD Fitness for duty | average | 1 | baseline - rested and fit for duty |
| WMP Work processes | inadequate or poor | 5 | plant not in the assumed state - return to service is not reconciled before energy is introduced |
One worksheet, three published methods
SPAR-H
9.1%
band 3.0% to 27.3%
nominal 1.0e-3 - C 100.00 - adjustment applied
SPAR-H nominal action HEP 1.0E-03 (CR-6883); SPAR-H adjustment factor applied (three or more negative PSFs)
THERP
16.7%
band 1.7% to 99.0%
nominal 2.0e-3 - C 100.00 - adjustment applied
THERP Table G-1 dissimilar switch 1E-03 scaled for 2 confusable devices; SPAR-H adjustment factor applied (three or more negative PSFs)
HEART
98.0%
band 19.6% to 99.0%
nominal 2.6e-1 - C 4.50
HEART generic task type B: restore a system to service without written procedures; the EPC product of x4.5 carries this step past the method's ceiling, so it is reported at 0.98 rather than as a certainty (HEART caps at 1 and would call the step unachievable); 1 condition already inside the generic task type and not charged again
Where a method reaches its limit, the card says so. HEART caps at 1.0, as RR679 instructs, so a saturated step carries no information except its place in the order. The saturating adjustment is published for SPAR-H; this code applies the same saturation to THERP, so neither method can return a probability above one.
Does the ranking survive a change of method?
This is the only test the three-method interface can honestly pass. Every step of OP-TRF-014 is quantified under all three methods for the same crew and the same plant state. Rank is the position in that method's own ordering of the steps, highest probability first.
| Step | Action | SPAR-H | rank | THERP | rank | HEART | rank |
|---|---|---|---|---|---|---|---|
| d1 Confirm a valid transfer permit fo | authorise | 0.99% | 11 | 9.2% | 13 | 6.0% | 7 |
| d2 Reconcile the instrument isolation | verify | 9.2% | 3 | 90.9% | 3 | 0.90% | 13 |
| d3 Confirm the vehicle is bonded, ear | verify | 4.8% | 6 | 83.3% | 5 | 1.1% | 11 |
| d4 Open the tank inlet valve V1 | actuate | 1.3% | 9 | 3.3% | 14 | 0.12% | 14 |
| d5 Confirm the tank draw-off valve V2 | verify | 20.2% | 1 | 96.2% | 1 | 5.0% | 8 |
| d6 Confirm the cross-connect valve V3 | verify | 20.2% | 2 | 96.2% | 2 | 5.0% | 9 |
| d7 Walk the line from the tanker to t | verify | 4.8% | 7 | 83.3% | 6 | 1.1% | 12 |
| d8 Confirm the tank vent valve V4 is | actuate | 9.1% | 5 | 16.7% | 12 | 98.0% | 1 |
| d9 Check the hose and clear the drip | verify | 9.2% | 4 | 90.9% | 4 | 1.4% | 10 |
| d10 Start pump P-201 | actuate | 0.25% | 17 | 0.50% | 17 | 0.12% | 15 |
| d11 Record the start level on the perm | communicate | 0.99% | 12 | 23.6% | 10 | 9.0% | 5 |
| d12 Watch the level and stop the pump | monitor | 2.4% | 8 | 73.5% | 7 | 98.0% | 2 |
| d14 Stop the pump when the meter reads | monitor | 0.50% | 16 | 35.7% | 9 | 40.5% | 4 |
| d15 Close V1 and isolate the pump | actuate | 1.3% | 10 | 3.3% | 15 | 0.12% | 16 |
| d16 Drain and disconnect the hose | actuate | 0.50% | 15 | 1.5% | 16 | 0.12% | 17 |
| d17 Complete the log and update the st | communicate | 0.99% | 13 | 23.6% | 11 | 9.0% | 6 |
| e1 Emergency: stop on a release | recover | 0.99% | 14 | 52.6% | 8 | 72.0% | 3 |
SPAR-H and THERP put the same stations near the top: the two valve confirmations, the line walkdown and the isolation register. HEART saturates on the monitoring and recovery steps, where its generic task types are already high, and its cap compresses the order. A finding that only one method ranks highly is a weaker finding, and the interface names the method that produced it.
The process twin
Tanker to TK-101 transfer - Inland bulk terminal, rack 3. Mass balance sets the level: pump flow in through the inlet, draw-off out, plus a cross-connect off its seat still feeding the tank from the header. Discharge pressure seeks the running value when the line is open and the dead-head value when it is not.
Time above the sustained rating fails the line. With the vent shut, incoming volume compresses the vapour space until the roof seam gives. Every release fills the bund first, and whatever exceeds the remaining headroom escapes to drainage.
The second twin is a reheat furnace light-off: purge time against the required duration, unburnt gas inventory, water drive-out from a fresh lining, spalling when the ramp outruns it, and shell temperature as the visible sign.
Only + - * /, comparisons and clamping appear in a state update. The physics holds no randomness and makes no transcendental call, so a browser, a CPU and a GPU return the same trajectory for the same scenario index.
response budget, reported by the twin itself
start level 4.90 m - end level 9.27 m - 0.73 m of freeboard left under the 10 m overflow height
These are model parameters, not measurements. The finding is the comparison. A procedure whose safety rests on a human action inside this window fails when freeboard shrinks, when the crew is new, or when the batch runs late.
Each step id hashes to a stable slot in the random stream. Scenario 41 sees the same crew, the same equipment state and the same draws in the baseline and in the candidate. That is what makes a before-and-after comparison paired, and what lets a shift you click on be recomputed rather than stored.
How a proposed control is accepted
- A control is a typed mutation of the procedure or the configuration, tagged with its tier in the hierarchy of controls.
- The same scenario indices run again against it, and a paired bootstrap differences the two arms.
- The one-sided risk of a false positive must be under 2.5% on the failure rate, and expected loss must fall as well.
- The net annual gain must exceed the control's own annualised cost - EUR 19,000 for an independent automatic stop, EUR 9,000 for a pre-job walkdown that reconciles isolations.
- Benjamini-Hochberg correction runs across the whole candidate set, because twelve attempts will surface one winner by luck.
- The survivors are stacked into one revised procedure and re-tested together, since controls interact.
Outcomes are classed normal, upset or incident before anyone prices them. An aborted batch and a loss of containment are not the same event, and a plant reports them to different people. Rejections stay on screen with their reasons, because most ideas do not work.
Limitations
Human reliability data are order-of-magnitude screening values. Every result carries a band, and the band is wide on purpose. A modelled 0.4% and a modelled 1.2% are the same quantity.
A simulated crew is a hypothesis about a crew. It is built from years of experience, hours into a shift, prior runs of this procedure and a working language. It is not a person's record, and it does not replace watching the people who actually do the job.
The process twins are engineered surrogates. They were checked against the mechanics published in incident investigations, not against computational fluid dynamics. Use them to compare procedures with each other, not to size a relief valve.
A change order only becomes real when a competent person signs it. These statistics decide whether an edit is worth proposing. Management of change, a field walkdown and a signature still carry the weight, and this replaces none of them.