Procedure Use When the Step Does Not Fit the Plant State
An emergency operating procedure instructs the operator to reset a specific signal and then verify a valve lineup. During a transient, the operator finds the signal already reset by an automatic action and the valve in a position the procedure does not describe. The procedure was validated on the plant simulator two years ago, but a modification last year changed the automatic logic. The operator, under time pressure, skips the reset step (reasonable) but then also skips the valve verification, reasoning that 'the automatic system already handled it.' The shift supervisor is managing two other evolutions and does not review the procedure steps in progress. Later review shows the valve was in a position that reduced cooling margin but did not cause damage. The operator is experienced and well regarded.
1. Diagnose why the operator's adaptation was partly correct and partly dangerous, and identify the procedural and design contributors.
Read the worked answer
The first deviation-skipping a reset already performed automatically-is a legitimate, even desirable, adaptation; rigid compliance would waste time. The second deviation-skipping the valve verification-is not equivalent. The operator generalized from 'this step is redundant' to 'the downstream verification is redundant,' a classic overgeneralization under time pressure. The verification step existed precisely because valve position is not guaranteed by signal state. Procedural contributors: the procedure was not revalidated after the logic modification, so it no longer matches the plant; this is a configuration-control failure that places the operator in an impossible position. The procedure offered no branch for 'signal already reset,' forcing improvisation. Design contributors: the automatic action is not annunciated in a way that tells the operator what was done, so the operator inferred rather than knew. Supervisory contributor: no in-progress procedure review during a multi-evolution period. The operator's competence is not the issue; a well-regarded operator following a stale procedure under time pressure will adapt, and the system must make safe adaptation easy and unsafe adaptation visible.
2. Recommend corrective actions covering procedure governance, human-factors review, and supervision.
Read the worked answer
Procedure governance: require revalidation of affected procedures whenever a modification changes automatic logic, and add a formal change-impact screening question-'does this alter any step's expected plant response?' Add explicit conditional branches for 'already performed by automatic action' with a mandatory verification of the downstream physical state. Human-factors review: walk through the procedure with operators who did not write it, in the simulator configured to the modified logic, and record every point where they improvise; those are latent defects. Make automatic actions annunciated so the operator knows rather than infers. Supervision: establish a rule that during concurrent evolutions, the supervisor reviews procedure steps at defined hold points, and that any skipped step is verbally declared and justified to the supervisor-skipping is allowed but must be explicit, not silent. Finally, treat the near-miss as a learning event: the operator's reasoning should be captured without blame so the procedure defect surfaces, and the reporting culture should reward declaring adaptations rather than punishing them.