GroundedPriyatham Chimmani ↗
Derivation walk-through

Worked example · reactor-startup-nonroutine

Twenty factor levels to one screening band

Every tile on the left is an analyst judgement. Every step on the right is one grounding of one rule, in the order the engine's own fixpoint loop discovered it. Nothing here is summarised: this is the trace python -m ehs_hfo assess --json produces, read back out.

Scenario

Batch reactor restart after an unplanned trip. The assigned operator qualified three weeks ago and has not run this recovery before; the recovery sequence is not covered by an approved procedure; the outage window is fixed by a downstream commitment.

Illustrative worked example written by hand for this repository. It is not a record of a real event at any site and contains no site data.

The scenario

Four IDHEAS-G context categories, twenty factors, one analyst-assigned level each.

The derivation

89 rule firings ran to reach the screening band. Step through them, or press play.

Step 1 of 89
Derived facts so far 0

    The final assessment

    Printed verbatim by python -m ehs_hfo assess against the committed scenario file, including its own trace of the screening-band rule.

    Screening band: stop-and-review 
    EHS human-factors context screening
------------------------------------------------------------------------------
Scenario:    reactor-startup-nonroutine
Description: Batch reactor restart after an unplanned trip. The assigned operator qualified three weeks ago and has not run this recovery before; the recovery sequence is not covered by an approved procedure; the outage window is fixed by a downstream commitment.
Provenance:  Illustrative worked example written by hand for this repository. It is not a record of a real event at any site and contains no site data.

Assessment coverage: 20 of 20 factors assessed

Context dimensions
------------------------------------------------------------------------------
Human context  [IDHEAS-G category: xw:idheas-Personnel]  5/5 assessed
    degraded           Procedures, guidance and instructions
    degraded           Training
Operational context  [IDHEAS-G category: xw:idheas-EnvironmentAndSituation]  5/5 assessed
System context  [IDHEAS-G category: xw:idheas-System]  3/3 assessed
Task context  [IDHEAS-G category: xw:idheas-Task]  7/7 assessed
    severely degraded  Scenario familiarity
    degraded           Time pressure and stress

Macrocognitive functions (IDHEAS-G)
------------------------------------------------------------------------------
  Challenged: action execution
    elevated   failure of action execution  <- Procedures, guidance and instructions
  Challenged: decisionmaking
    aggravated failure of decisionmaking  <- Procedures, guidance and instructions
    aggravated failure of decisionmaking  <- Scenario familiarity
    aggravated failure of decisionmaking  <- Time pressure and stress
    aggravated failure of decisionmaking  <- Training
  Challenged: understanding
    aggravated failure of understanding  <- Scenario familiarity
    aggravated failure of understanding  <- Time pressure and stress
    aggravated failure of understanding  <- Training

Findings
------------------------------------------------------------------------------
  Unsupported control demand: ehs:KnowledgeBasedControl
  Aggravated error mode:      knowledge-based mistake
  Aggravated error mode:      rule-based mistake
  Degraded with no control claimed: Procedures, guidance and instructions, Scenario familiarity, Time pressure and stress, Training

Screening band: stop-and-review
  Ordinal label only. Produced by rules marked 'convention'. Not a probability, not a rate.

Derivation trace: screening band
------------------------------------------------------------------------------
  screeningBand(stop-and-review)  <- R33-band-stop-and-review [convention; no source]
    rule: screeningBand(stop-and-review) :- severelyDegradedFactor(?F), not mitigatedFactor(?F), aggravatedErrorMode(?M).
    because: A severely degraded factor occurring alongside an aggravated error mode puts the scenario in the stop-and-review band. Threshold chosen by the author; no source supports it.
      severelyDegradedFactor(ehs:ScenarioFamiliarity)  <- R02-severely-degraded [literature; nureg2198]
        rule: severelyDegradedFactor(?F) :- factorLevel(?F, ?L), levelSeverelyDegraded(?L).
        because: A factor at the lowest assessed level is severely degraded.
          factorLevel(ehs:ScenarioFamiliarity, ehs:LevelSeverelyDegraded)  [given]
          levelSeverelyDegraded(ehs:LevelSeverelyDegraded)  [given]
      aggravatedErrorMode(ehs:KnowledgeBasedMistake)  <- R22-aggravated-by-second-factor [literature; groth2012]
        rule: aggravatedErrorMode(?M) :- degradedFactor(?F), factorPredisposesTo(?F, ?M), degradedFactor(?G), factorPredisposesTo(?G, ?M), lt(?F, ?G).
        because: An error mode flagged by one degraded factor and flagged again by a second, distinct degraded factor is recorded as aggravated. This says two independent routes to the same failure class are open. It does not say the risk has doubled; nothing here supports a multiplicative claim.
          degradedFactor(ehs:ScenarioFamiliarity)  <- R01-degraded [literature; nureg2198]
            rule: degradedFactor(?F) :- factorLevel(?F, ?L), levelDegraded(?L).
            because: A factor assessed below the nominal condition is a degraded factor. Levels and their ordinal ranks come from the ontology, not from here.
              factorLevel(ehs:ScenarioFamiliarity, ehs:LevelSeverelyDegraded)  [given]
              levelDegraded(ehs:LevelSeverelyDegraded)  [given]
          factorPredisposesTo(ehs:ScenarioFamiliarity, ehs:KnowledgeBasedMistake)  [given]
          degradedFactor(ehs:TimePressureAndStress)  <- R01-degraded [literature; nureg2198]
            rule: degradedFactor(?F) :- factorLevel(?F, ?L), levelDegraded(?L).
            because: A factor assessed below the nominal condition is a degraded factor. Levels and their ordinal ranks come from the ontology, not from here.
              factorLevel(ehs:TimePressureAndStress, ehs:LevelDegraded)  [given]
              levelDegraded(ehs:LevelDegraded)  [given]
          factorPredisposesTo(ehs:TimePressureAndStress, ehs:KnowledgeBasedMistake)  [given]
        (3 further derivations recorded and not expanded here)
    (2 further derivations recorded and not expanded here)

Derivation trace: failureModeAggravated(ehs:Decisionmaking, ehs:FailureOfDecisionmaking)
  failureModeAggravated(ehs:Decisionmaking, ehs:FailureOfDecisionmaking)  <- R12-failure-mode-aggravated [literature; nureg2198]
    rule: failureModeAggravated(?N, ?K) :- failureModeElevated(?N, ?K, ?F), failureModeElevated(?N, ?K, ?G), lt(?F, ?G).
    because: Two distinct degraded factors raising the same failure mode of the same function. Two routes to one failure mode are open; no multiplicative claim is made.
      failureModeElevated(ehs:Decisionmaking, ehs:FailureOfDecisionmaking, ehs:ProceduresGuidanceAndInstructions)  <- R09-failure-mode-elevated [literature; nureg2198]
        rule: failureModeElevated(?N, ?K, ?F) :- degradedFactor(?F), factorAffectsFailureMode(?F, ?K), failureModeOfFunction(?K, ?N).
        because: A degraded factor raises the cognitive failure mode of the function it affects. The function is carried in the conclusion so the trace shows which function and which failure mode the finding belongs to.
          degradedFactor(ehs:ProceduresGuidanceAndInstructions)  <- R01-degraded [literature; nureg2198]
            rule: degradedFactor(?F) :- factorLevel(?F, ?L), levelDegraded(?L).
            because: A factor assessed below the nominal condition is a degraded factor. Levels and their ordinal ranks come from the ontology, not from here.
              factorLevel(ehs:ProceduresGuidanceAndInstructions, ehs:LevelDegraded)  [given]
              levelDegraded(ehs:LevelDegraded)  [given]
          factorAffectsFailureMode(ehs:ProceduresGuidanceAndInstructions, ehs:FailureOfDecisionmaking)  [given]
          failureModeOfFunction(ehs:FailureOfDecisionmaking, ehs:Decisionmaking)  [given]
      failureModeElevated(ehs:Decisionmaking, ehs:FailureOfDecisionmaking, ehs:ScenarioFamiliarity)  <- R09-failure-mode-elevated [literature; nureg2198]
        rule: failureModeElevated(?N, ?K, ?F) :- degradedFactor(?F), factorAffectsFailureMode(?F, ?K), failureModeOfFunction(?K, ?N).
        because: A degraded factor raises the cognitive failure mode of the function it affects. The function is carried in the conclusion so the trace shows which function and which failure mode the finding belongs to.
          degradedFactor(ehs:ScenarioFamiliarity)  <- R01-degraded [literature; nureg2198]
            rule: degradedFactor(?F) :- factorLevel(?F, ?L), levelDegraded(?L).
            because: A factor assessed below the nominal condition is a degraded factor. Levels and their ordinal ranks come from the ontology, not from here.
              factorLevel(ehs:ScenarioFamiliarity, ehs:LevelSeverelyDegraded)  [given]
              levelDegraded(ehs:LevelSeverelyDegraded)  [given]
          factorAffectsFailureMode(ehs:ScenarioFamiliarity, ehs:FailureOfDecisionmaking)  [given]
          failureModeOfFunction(ehs:FailureOfDecisionmaking, ehs:Decisionmaking)  [given]
    (5 further derivations recorded and not expanded here)

Derivation trace: failureModeAggravated(ehs:Understanding, ehs:FailureOfUnderstanding)
  failureModeAggravated(ehs:Understanding, ehs:FailureOfUnderstanding)  <- R12-failure-mode-aggravated [literature; nureg2198]
    rule: failureModeAggravated(?N, ?K) :- failureModeElevated(?N, ?K, ?F), failureModeElevated(?N, ?K, ?G), lt(?F, ?G).
    because: Two distinct degraded factors raising the same failure mode of the same function. Two routes to one failure mode are open; no multiplicative claim is made.
      failureModeElevated(ehs:Understanding, ehs:FailureOfUnderstanding, ehs:ScenarioFamiliarity)  <- R09-failure-mode-elevated [literature; nureg2198]
        rule: failureModeElevated(?N, ?K, ?F) :- degradedFactor(?F), factorAffectsFailureMode(?F, ?K), failureModeOfFunction(?K, ?N).
        because: A degraded factor raises the cognitive failure mode of the function it affects. The function is carried in the conclusion so the trace shows which function and which failure mode the finding belongs to.
          degradedFactor(ehs:ScenarioFamiliarity)  <- R01-degraded [literature; nureg2198]
            rule: degradedFactor(?F) :- factorLevel(?F, ?L), levelDegraded(?L).
            because: A factor assessed below the nominal condition is a degraded factor. Levels and their ordinal ranks come from the ontology, not from here.
              factorLevel(ehs:ScenarioFamiliarity, ehs:LevelSeverelyDegraded)  [given]
              levelDegraded(ehs:LevelSeverelyDegraded)  [given]
          factorAffectsFailureMode(ehs:ScenarioFamiliarity, ehs:FailureOfUnderstanding)  [given]
          failureModeOfFunction(ehs:FailureOfUnderstanding, ehs:Understanding)  [given]
      failureModeElevated(ehs:Understanding, ehs:FailureOfUnderstanding, ehs:TimePressureAndStress)  <- R09-failure-mode-elevated [literature; nureg2198]
        rule: failureModeElevated(?N, ?K, ?F) :- degradedFactor(?F), factorAffectsFailureMode(?F, ?K), failureModeOfFunction(?K, ?N).
        because: A degraded factor raises the cognitive failure mode of the function it affects. The function is carried in the conclusion so the trace shows which function and which failure mode the finding belongs to.
          degradedFactor(ehs:TimePressureAndStress)  <- R01-degraded [literature; nureg2198]
            rule: degradedFactor(?F) :- factorLevel(?F, ?L), levelDegraded(?L).
            because: A factor assessed below the nominal condition is a degraded factor. Levels and their ordinal ranks come from the ontology, not from here.
              factorLevel(ehs:TimePressureAndStress, ehs:LevelDegraded)  [given]
              levelDegraded(ehs:LevelDegraded)  [given]
          factorAffectsFailureMode(ehs:TimePressureAndStress, ehs:FailureOfUnderstanding)  [given]
          failureModeOfFunction(ehs:FailureOfUnderstanding, ehs:Understanding)  [given]
    (2 further derivations recorded and not expanded here)

Derivation trace: aggravatedErrorMode(ehs:KnowledgeBasedMistake)
------------------------------------------------------------------------------
  aggravatedErrorMode(ehs:KnowledgeBasedMistake)  <- R22-aggravated-by-second-factor [literature; groth2012]
    rule: aggravatedErrorMode(?M) :- degradedFactor(?F), factorPredisposesTo(?F, ?M), degradedFactor(?G), factorPredisposesTo(?G, ?M), lt(?F, ?G).
    because: An error mode flagged by one degraded factor and flagged again by a second, distinct degraded factor is recorded as aggravated. This says two independent routes to the same failure class are open. It does not say the risk has doubled; nothing here supports a multiplicative claim.
      degradedFactor(ehs:ScenarioFamiliarity)  <- R01-degraded [literature; nureg2198]
        rule: degradedFactor(?F) :- factorLevel(?F, ?L), levelDegraded(?L).
        because: A factor assessed below the nominal condition is a degraded factor. Levels and their ordinal ranks come from the ontology, not from here.
          factorLevel(ehs:ScenarioFamiliarity, ehs:LevelSeverelyDegraded)  [given]
          levelDegraded(ehs:LevelSeverelyDegraded)  [given]
      factorPredisposesTo(ehs:ScenarioFamiliarity, ehs:KnowledgeBasedMistake)  [given]
      degradedFactor(ehs:TimePressureAndStress)  <- R01-degraded [literature; nureg2198]
        rule: degradedFactor(?F) :- factorLevel(?F, ?L), levelDegraded(?L).
        because: A factor assessed below the nominal condition is a degraded factor. Levels and their ordinal ranks come from the ontology, not from here.
          factorLevel(ehs:TimePressureAndStress, ehs:LevelDegraded)  [given]
          levelDegraded(ehs:LevelDegraded)  [given]
      factorPredisposesTo(ehs:TimePressureAndStress, ehs:KnowledgeBasedMistake)  [given]
    (3 further derivations recorded and not expanded here)

Derivation trace: aggravatedErrorMode(ehs:RuleBasedMistake)
------------------------------------------------------------------------------
  aggravatedErrorMode(ehs:RuleBasedMistake)  <- R22-aggravated-by-second-factor [literature; groth2012]
    rule: aggravatedErrorMode(?M) :- degradedFactor(?F), factorPredisposesTo(?F, ?M), degradedFactor(?G), factorPredisposesTo(?G, ?M), lt(?F, ?G).
    because: An error mode flagged by one degraded factor and flagged again by a second, distinct degraded factor is recorded as aggravated. This says two independent routes to the same failure class are open. It does not say the risk has doubled; nothing here supports a multiplicative claim.
      degradedFactor(ehs:ProceduresGuidanceAndInstructions)  <- R01-degraded [literature; nureg2198]
        rule: degradedFactor(?F) :- factorLevel(?F, ?L), levelDegraded(?L).
        because: A factor assessed below the nominal condition is a degraded factor. Levels and their ordinal ranks come from the ontology, not from here.
          factorLevel(ehs:ProceduresGuidanceAndInstructions, ehs:LevelDegraded)  [given]
          levelDegraded(ehs:LevelDegraded)  [given]
      factorPredisposesTo(ehs:ProceduresGuidanceAndInstructions, ehs:RuleBasedMistake)  [given]
      degradedFactor(ehs:Training)  <- R01-degraded [literature; nureg2198]
        rule: degradedFactor(?F) :- factorLevel(?F, ?L), levelDegraded(?L).
        because: A factor assessed below the nominal condition is a degraded factor. Levels and their ordinal ranks come from the ontology, not from here.
          factorLevel(ehs:Training, ehs:LevelDegraded)  [given]
          levelDegraded(ehs:LevelDegraded)  [given]
      factorPredisposesTo(ehs:Training, ehs:RuleBasedMistake)  [given]

Rules that fired
------------------------------------------------------------------------------
  R01-degraded  [literature; nureg2198]
  R02-severely-degraded  [literature; nureg2198]
  R06-unmitigated  [literature; hse_pifs]
  R07-degraded-for-function  [literature; nureg2198]
  R08-function-challenged  [literature; nureg2198]
  R09-failure-mode-elevated  [literature; nureg2198]
  R10-control-demand  [literature; rasmussen1983]
  R11-unsupported-demand  [literature; rasmussen1983, reason1990]
  R12-failure-mode-aggravated  [literature; nureg2198]
  R13-multi-function  [literature; nureg2198]
  R20-elevated-from-factor  [literature; reason1990]
  R21-elevated-from-unsupported-demand  [literature; rasmussen1983, reason1990]
  R22-aggravated-by-second-factor  [literature; groth2012]
  R23-time-pressure-on-knowledge-based  [literature; rasmussen1983, reason1990]
  R24-procedure-substitution  [literature; rasmussen1983, hollnagel1998]
  R30-band-review  [convention; no source]
  R31-band-elevated-multi-function  [convention; no source]
  R32-band-elevated-aggravated  [convention; no source]
  R33-band-stop-and-review  [convention; no source]
  R34-band-stop-and-review-no-fallback  [convention; no source]
  R35-band-elevated-failure-mode-aggravated  [convention; no source]

Standing caveats
------------------------------------------------------------------------------
 - The four context dimensions are the four PIF context categories of IDHEAS-G (NUREG-2198, 2021), relabelled. They are not original to this tool.
 - No human error probability is computed. The screening band is an ordinal label produced by rules marked 'convention', not a rate and not a probability.
 - Factor levels are analyst judgements supplied as input. This tool does not derive them from data and does not check them.
 - The links from factors to error modes are theoretical propositions taken from the cited literature. No effect size is attached to any of them, and none has been validated against injury or incident outcomes.
 - SPAR-H multipliers are not used. They were estimated for at-power nuclear power plant operations, and NUREG-2198 states that existing methods are not necessarily adequate outside that context.

    What a level is

    “Factor levels are analyst-assigned ordinals. The observable proxies suggested for deriving them from operational data are proposed, not validated.” — README, Honest limits.

    Load your own scenario

    Not offered here. The engine is a stratified Datalog evaluator with unification, negation-as-failure and built-ins (lt, not) over twenty-one rules and roughly ninety firings for this one scenario — porting it exactly to JavaScript, rather than approximating it, is a second implementation of the reasoner, not a page. See src/ehs_hfo/engine.py. Run the CLI on a new scenario file instead: python -m ehs_hfo assess --json your_scenario.json.