Modifying a method for human reliability assessment based on CREAM-BN: A case study in control room of a petrochemical plant

Graphical abstract

As mentioned previously, this method is one of the second-generation HRA methods that was introduced in 1998 by Hollnagel [10] and contains two versions, namely the basic and the extended ones [5]. The basic one provides an initial screening of human interaction where the tasks and its major segments are addressed by calculating the distinct sums of the positive and negative influencing CPCs use. In this regard, the relevant control mode and failure rate probability will be determined [11]. On the other hand, the extended method makes use of the results of the basic CREAM to calculate the probability of each cognitive function failure of tasks that needs more precision and detailed analysis [10]. This method has been derived from Contextual Control Mode (COCOM), which provides a conceptual and practical basis for the enhancement of operator performance [12]. Therefore, COCOM principles clarify and anticipate that human performance is the consequence of the purposive employment of a dynamic balance between human action and the system response. In this view, the essential point is that the working conditions determine human performance in system operation. The model, therefore, describes control modes in four different characteristics in accordance with human cognition and action context [1,10]. The control modes are determined by a set of nine CPCs. The four control modes include scrambled, opportunistic, tactical, and strategic states, which are linked with different failure probability intervals that represent human action failure probabilities. The nine CPCs are listed as adequacy of the organization, working conditions, adequacy of man-machine interface and operational support, availability of procedures and plans, the number of simultaneous goals, available time, time of the day, adequacy of training and experience, and crew collaboration quality [1,2,10]. In this regard, the pre-defined linguistic variables have been chosen to describe the nine CPCs. They are classified into three sets in terms of their influences (i.e., positive, negative, and neutral) on human performance reliability [1,2]. Considering the classification method, introduced by COCOM, CREAM can be used to conduct its bi-directional HRA inference, and retrospective/prospective analysis [10].
Determining the effect of the CPCs on human performance is not an easy task and is dealt with numerous uncertainties. Recently, new quantification approaches have been presented to estimate the CPCs through CREAM method [8,9]. These methods are based on fuzzy logic and provide a systematic procedure to determine the ambiguities during the quantification of CPCs so that the specific numerical values, such as human failure probabilities (HFP) can be calculated. However, they suffer from some pitfalls in practice, some of which can be listed as follows: the ignorance of the logicality of using multiple-input single-output's rule base for modeling the relations between control modes and CPCs, the loss of useful information in fuzzy Max-Min inference operations, and inadequacy of modeling CPC dependencies and of instant estimation of HFP [1]. Accordingly, BN approach has been proposed [9] to deal with CPC dependencies [1]. In this context, BN, as one of the most efficient models, is utilized in the fields with uncertain knowledge and reasoning [13]. BN is a graphical model for reasoning under uncertainty where the nodes represent variables (discrete or continuous) and the arcs represent the direct connections between them. It also represents the conditional dependencies of a set of random variables through a directed acyclic graph [14,15]. Hence, the relationship between the CPCs and control modes can be modeled both realistically and systemically in COCOM by using BN.
There is a wealth of research on the quantification of CPCs' values [1,4,9,15] wherein the systematic procedures have been proposed to account for the ambiguity in the quantification of CPCs' values as outputs for HEP estimation. Most of the proposed approaches were developed and tested in a laboratory context. In addition, it is probable that analysts encounter the incidence of some error in such a process as the assessment of the state of each CPC is often very difficult and time-consuming. Therefore, the authors integrated the two methods proposed by Yang et al. [1,15] and practically implemented the integrated method in a real environment. For example, in the current study, a selfdisigned tool was used to collect data pertinent to the CPCs. This tool, indeed, may facilitate data collection relating to the CPCs. The authors also tried to simplify the mentiond method as far as possible and, thereby, the collection and analysis of information and data pertaining to the CPCs became much easier than those of Yang's methods. Therefore, the differences between the current study and the previous studies lie in the data collection process, the context or environment of the study, and the method simplicity.

Context of study
Petrochemical industries are characterized by very high levels of risks due to the nature of work processes and dangerous substances used in these installations. Hence, the incidence of human error in these industries will not only affect the personnel and facilities but it can also result in a catastrophic consequence beyond the boundaries of the plant [16,17]. Statistics demonstrate that human error is a major contributor in over 80% of chemical and petrochemical accidents [18]. In this regard, the olefin unit (due to its risks) of one of the petrochemical industries in south-west of Iran was selected as the target of this study. The number of 62 employees was working in four shifts (the work shift plus the rest shift) in this unit. In fact, each of the employees worked about 8 h a day. The number of the employees per shift and their distribution are presented as follows: head of the unit (1 person), shift control (2 people), shift supervisor (1 person), board-man operators (6 people), and outside operators (8 people). On the other hand, there were three operational shifts with 54 people and a rest shift with 8 people.

Methodology
This study attempts to introduce the application of a method on HRA (based on CREAM BN being derived from the previous studies) in a petrochemical plant. In this study, the basic version of CREAM was modified according to Yang's methods and implemented in a real environment. The research steps and the stages of change made on Yang's methods are presented as follows:

Data collection
The data relating to the CPCs were gathered via a self-designed questionnaire whose questions were developed to cover 9 CPCs (measuring dimensions) (Table 1). Therefore, the questionnaire was Table 1 CPCs and performance reliability [14].  [19,20]. An oral negotiation with the operators revealed that responding to questions through fivepoint scales would be much easier than responding to items through seven-point Likert scales. The reliability and validity of the instrument were also evaluated. For example, some of the questions about the nine CPCs, which were raised to the employees, are separately presented as follows:

CPC
Adequacy of organization. This CPC was evaluated through ten questions, such as "The employees were selected to perform their job according to the individual competence, experience, physical, and mental ability." Working conditions. This CPC was evaluated through eight questions, such as "Noise pollution causes disturbance in the speech communication and work performance of the employees." Adequacy of MMI (man-machine interface) and operational support. This CPC was evaluated through eight questions, such as "Display information are readily and easily available and understandable to the employees in the workplace." Availability of procedures/plans. This CPC was evaluated through sixteen questions, such as "Access to procedures/plans is as easy as possible for the employees in the workplace." Crew collaboration. This CPC was evaluated through six questions, such as "Interaction and collaboration are highly desirable among the employees in the workplace." Available time. This CPC was evaluated through five questions, such as "The available time for task performance leads to the employees' fatigue in the workplace." Time of the day. This CPC was evaluated through four questions, such as "Shift work causes fatigue of the employees and reduces productivity performance in the workplace." Adequacy of training and experience. This CPC was evaluated through ten questions, such as "Need assessment of the training programs is accomplished according to the characteristics of trainees in the workplace." Number of simultaneous goals. This CPC was evaluated through four questions, such as "The employees have to pay attention to many factors to accomplish the tasks in the workplace." The reason for selecting nine CPCs is that the analyst describes the effect of work conditions (context) on human error in the jobs under analysis. Due to working conditions in the mentioned industry and errors occurred, the research team selected 9 CPCs to examine the context effects on human error. Moreover, the base of the CREAM was established on these nine CPCs.
Data collection via this method is much easier than the ones proposed in the previous studies. For example, one of its merits is the collection of complete and accurate information about the CPCs in a short time by a few experts rather than an expert. Therefore, researchers can analyze many jobs or tasks in a short period by this method. Moreover, since the level of each CPC (presented in Table 1) is evaluated by several and different questions in this method; uncertainty and bias will be decreased in the final score of each CPC. Accordingly, we can say that the collected information about each CPC has an acceptable accuracy.
To test the reliability of the CREAM BN method, the specified control modes in Bayesian and basic CREAM were compared in four jobs, i.e., head of control, shift supervisor, Boardman operator, and outside operator.

HEP calculation
For HEP calculation, the following steps should be conducted: Identifying the primary effects of the CPCs: As presented in Table 1, each CPC consists of the limited linguistic terms (2, 3 or 4) regarding the expected effects on performance reliability wherein each term is associated with a primary effect on HEP. The positive effects lead to an increase in human reliability but the negative ones do the opposite. The main effects of each CPC are considered as a useful tool for the estimation of HEP in Bayesian network. However, the effect of each CPC on the COCOM s in the basic CREAM is both discrete and deterministic (either 0% or 100%), and the failure rate intervals are too wide; therefore, this study used fuzzy numbers to convert discrete and deterministic values to continuous values ( Table 2). In this way, it was made possible to incorporate various importance levels of the CPCs in HEP estimation and reduce the uncertainty. This step was also pointed to in the existing CREAM BN methods, but we tried to simplify it. In other words, identifying the primary effects of the CPCs is very simple in the current study. For this purpose, the CPCs' information about the discrete and deterministic domains was gathered using the selfdesigned tool and was then converted to continuous values according to Table 2. This process, in contrast to what was presented in the previous studies could reduce the subjectivity to some extent. On the other hand, the studies based on CREAM BN are able to incorporate uncertainty in estimating CPCs and therefore to reduce subjectivity in this step. While the previous studies cannot established a strong correlation between the levels of nine CPCs and four control modes. Therefore, it can be a kind of uncertainty. Adjusting the dependency of the CPCs: Unlike the first-generation HRA methods, the CPCs (in CREAM) due to their effects on human performance reliability may depend on each other. This means that if a CPC has a neutral effect on the context and be dependent upon other CPCs, then the effect of this CPC may undergo some changes towards either a positive or negative direction based on conditions of the other CPCs. Therefore, the rules governing these changes, as defined by Hollanagel [10], were used to determine the degree of dependency among the CPCs. Table 3 reflects such changes. According to Table 3, CPC 2, 5, 6, 9 are adjusted (principal) CPC and CPC 1, 3, 4, 7, 8 are   8 is inadequate (negative), and it does not matter which linguistic variables are utilized to describe the other CPCs, then CPC 9 will be adjusted as deficient (negative) rather than efficient (neutral) ( [10]). New grouping of CPCs: Since three of the CPCs contain 4 levels, five of them include 3 levels, and one of them has 2 levels, 31,104 (4 3 *3 5 *2) conditional probabilities were assessed to build a network. This was an extremely difficult task, but it was feasible in practice. Therefore, there are two ways for reducing conditional probabilities required. One is to use positive and negative effect nodes to model CPCs levels and reduce conditional probabilities in two separate sets. The other is to reduce the number of parent nodes using a divorce approach [15]. The CPCs were classified in three groups based on the second approach: G1: CPC 1 , CPC 2 , CPC 3 G2: CPC 4 , CPC 5 , CPC 6 G3: CPC 7 , CPC 8 , CPC 9 This classification does not have any physical meaning and is used only to reduce the software load. Conditional probabilities were determined according to Yang's et al. [15] study. The kernelof this study is to appropriately transform belief degrees in rule bases into the conditional probabilities in Bayesian network [15]. The rule base with the belief structures is firstly depicted in the form of the conditional probabilities. For this purpose, the discrete functions f Ei, f A ,f Gl , f G and f COCOM should be defined in the first step. f Ei determines the primary effect of the CPC from the level of the CPC. f Ei can be defined as below: E is the set of expected effect (negative, natural, positive) on performance reliability as shown in Table1. Based on Eq. (1), the conditional probability table of primary effect can be determined according to Table 4. Table4. Conditional probability table corresponding to the function f Ei In the second step, the rules presented in Table 5 are used for determining the node adjusted effect or deterministic conditional probability function f A as follows: E h shows the natural effect of a principal CPC; E h,D indicates the positive or negative effect of its dependent CPCs; A h means the adjusted positive or negative effect of the principal CPC. For instance, the conditional probability of CPC 9 (f A#9 ) is presented in Table 5.
In the next step, we should define the discrete functions f Gl and f G by counting the number of the positive/negative effects, respectively. Then, the CPC levels presented in Table 1 are used to develop G l and G as follows: G l = (3 effects, 2 effects, 1effects, 0effects) G = (9 effects, 8 effects, 7 effects, 6 effects, 5 effects, 4 effects, 3 effects, 2 effects, 1 effects, 0 effects) G l and G should be modified because Table1 indicate that CPC#5 and CPC#7 have no positive effect; therefore it can be written: G positive,l = (2 effects, 1effects, 0effects) (l = 2 and 3) G positive = (7 effects, 6 effects, 5 effects, 4 effects, 3 effects, 2 effects, 1 effects, 0 effects) However, the conditional probabilities related to f Gl and f G using positive effects are presented in Table 6 and 7.
Finally, we should define f COCOM using Fig. 1.The conditional probabilities corresponding to COCOM j are presented in Table 8.
The evidential reasoning was used for calculating the conditional probabilities as was introduced by Yang et al. [1]. The core of this study is to establish the fuzzy IF-THEN rule bases with the belief structure. The aim of these rule bases is to recognize suitable significances for each linguistic term in the antecedent and identification of appropriate terms in the outcome. In this context, the effects stem from the membership functions of linguistic terms established by expert can be reasonably took into account [1,2]. Fuzzy rule bases (in CREAM) were modeled using a Bayesian Network technique into ten
Determining control modes: The core concept of calculating HEP in CREAM is the control mode [15]. The probable control modes in the basic CREAM method are determined using the CPCs' values. More specifically, the relationship between the CPCs values and the control modes is obtained from Fig. 1 where the x and y axes represent the sum of the linguistic labels of the antecedents with negative and positive effects on human reliability. In this context, 52 conditional probabilities were directly obtained from Fig. 1 and 28 ones were found to be in need of further analysis based on the inherent logic in the control mode diagram. For example, p (COCOMPosetive effect = 7, Negative effect = 2) is not available in the diagram [15]. In this context, the analyst should ignore the evaluation of the relationships between CPCs and COCOMs using rule bases or estimate the subjectively of them. In the current study (or the studies based on Bayesian Network), this relationship between CPCs and COCOMs were objectively calculated with different effects as input weights. All calculations in this step were performed by non-commercial MSBNx software, which can be downloaded at http://research.microsoft.com/adapt/MSBNx/.    Calculating the human error probability (HEP): Finally, total HEP for the specific actions, head of unit, shift control, shift supervisor, board-man, and outside operator were calculated using the results obtained from the above-mentioned steps. In this context, HEP value for each job can be calculated according to Eq. (5) [15].
Where p (COCOM j Þ represents the probability of the human action reliability belonging to the j th control mode in COCOM node and U COCOM j indicates utility values. Review of the related literature [6,8] indicates that the set of values, {2.24 Â 10 À4 , 0.01, 0.0708 and 0.316} is employed to describe U COCOM j (j = 1, . . . , 4} for a benchmarking purpose. J = 4,3,2,1 (scramble, opportunistic, tactical, strategic)

Results
Validity and reliability of the questionnaire As it was mentioned earlier, the data pertaining to this section were gathered by a self-designed questionnaire including 70 questions. The questions were constructed to cover 9 CPCs, as presented in Table 1. Content validity of the questionnaire was evaluated based on the Lawshe method. In this line, the questionnaire was submitted to 10 experts to comment on the content. The results were revealed that the content validity ratio (CVR) for all questions exceeded 0.62 (the minimum acceptable value based on the number of experts). Moreover, CVR was obtained equal to 0.72 for the entire questionnaire.
The internal consistency of the responses was measured by the Cronbach's alpha coefficient where the value of 0.78 was obtained for the whole questionnaire. This value is generally regarded as an acceptable reliability level.

Results of CPCs assessment
The results of each action derived from the questionnaire, filled out by 60 employees (two employees were not returned the questionnaire), are presented in Table 9. The values given below for each CPC in Table 9 are the primary scores that are extracted from the questionnaire. These scores are converted to the fuzzy values using the fuzzy numbers (Table 2) in order to overcome the shortcomings existing in the traditional deterministic CREAM method. The CPCs were rated from zero  to hundred [0,100] except for the CPC "Time of day" that is [0,24]. In this context, defuzzification was performed based on two ways: mean of maximum and center of area method, see more in [7].

Analysis of Bayesian network for HEP calculation
The fuzzy values (Table 2) were processed by MSBNx software to determine the control modes and HEP. Figs. 2-5 show the results of Bayesian analysis for determining the control mode. The conditional probability table is used for the node effects, the node adjusted effects, CPC scores and control modes in Figs. 2-5. In simple terms, the Figs. show the relation and dependency among CPCs and their effects on the COCOM. The results pertaining to CPCs, control modes, and HEP values are presented in Table 10. The data presented in this table are composed of two parts. The first part refers to the deterministic CPCs level, control modes, and the HEP associated values, which were determined based on the basic CREAM. The second part is, however, related to the semi-deterministic CPCs levels based on the fuzzy logic, control modes, and the HEP values, which were determined based on Bayesian CREAM. A blunt difference is obvious between information in part 1 and 2. On the other hand, the calculations based on Bayesian CREAM are much more varied than what can be derived from the basic CREAM. The values belonging to CPCs levels are qualitative and deterministic in the basic CREAM, while these values are quantitative and semi-deterministic in Bayesian CREAM.
Finally, Table 10 shows the values of CPCs, control modes and HEP in the basic and Bayesian CREAM among different jobs. These values can be used to evaluate the reliability of the method. As shown in Table 10, the dominant control mode among the different jobs is the same in two basic and Bayesian CREAM. For example, the dominant control mode in the both basic and Bayesian CREAM is "Tactical". In addition, the produced result of HEP in this job is almost equal with the basic and Bayesian CREAM.

Discussion
Human error in HRA and its quantification with respect to the qualification of the contextual scenario in which the human action is performed are among the crucial problematic issues in this domain. Due to the intrinsic difficulty of performing this evaluation and the lack of collected data, the choice of a CPC level (basic method) is affected by uncertainty. In this study, the contextual evaluation was fulfilled using CREAM BN to capture this uncertainty in a real-world setting. However, a more detailed discussion about the obtained results is presented here. The results of Table 10 show that two CPCs out of the nine CPCs, i.e., CPC 5 and CPC 6 have a negative effect on performance reliability of the head control operator. On the other hand, as previously mentioned in Table 3, since CPC 2, 3, 4 are dependent on CPC 5 , and CPC 2, 3, 4, 5, 7 are dependent upon CPC 6 ; the negative effect of independent CPC 5,6 will be influenced. Reviewing job descriptions and having conversations with the operators, the researchers identified that the operators in some cases (e.g. emergencies) have to do several simultaneous tasks (CPC 5 ) in a short time (CPC 6 ). Performing several simultaneous tasks in an inadequate amount of time can affect other CPCs, such as "working conditions", "adequacy of MMI and operational support", and "availability procedures", as well. In such a context, the probability of the occurrence of the operator error can experience an increase and the system may be faced with a serious challenge. However, the probability distribution of the control mode is varied for the head control operator so that scramble (0.01), opportunistic (0.37), and tactical variations (0.62) were put in this category (Table 9). Accordingly, the total HEP value was obtained equal to 0.037 for this operator according to Eq. (5).
The CPCs analysis pertaining to the supervisor control shows that CPC 4 and CPC 8 have a negative effect on performance reliability. The results of negotiation with the operators showed that there were some problems in utilizing the procedures/plans at play. These problems can be referred to as (a) the lack of any procedures/plans for some special cases, and (b) difficulty in having access to some procedures/plans (CPC 4 ) in some cases. It was also found that "adequacy of training and experience" (CPC 8 ) has some shortcomings in practice. For example, the training programs do not suit the operator's working needs. In addition, some of the operators lack sufficient experience to perform their assigned job. In this light, the probability distribution of the control mode is varied for this operator so that scramble (0.01), opportunistic (0.38), and tactical variations (0.60) were placed in this category (Table 9). Accordingly, the total HEP value was calculated to be 0.03 for this operator based on Eq. (5). The CPCs analysis relating to Boardman operator shows that CPC 5 , CPC 6 , and CPC 9 have had a negative effect on performance reliability. Since CPC 2, 3, 4 are dependent on CPC 6 , reduction of the available time (CPC 6 ) can be affected by these CPCs. "The crew collaboration" (CPC 9 ) is also inefficient here, which can be attributed to the competitiveness and job insecurity, the overlap between the official and unofficial structure, the level of distrust, etc. The poor collaboration among the operators, in turn, would put the working conditions in an incompatible mode, and might make MMI and operational support, and the availability of procedures inappropriate. Therefore, the probability distribution of the control mode in these conditions is varied for this operator so that scramble (0.04), opportunistic (0.59), and tactical variations (0.36) could be put in this category (Table 9). In view of that, the total HEP value was calculated to be 0.08 for this operator as per Eq. (5).
The CPCs analysis pertaining to the outside operator shows that CPC 4 , CPC 5 , CPC 8 , and CPC 9 have a negative effect on performance reliability. The CPC 2, 3, 4, are dependent on CPC 5 , and CPCs 1, 8 are dependent on CPC 9 . Similarly, in the analysis of the tasks relating to the outside operator, it was found that "the availability of the procedures/plans" (CPC 4 ) was inappropriate, "the number of simultaneous goals" (CPC 5 ) was beyond his actual capacity, "the adequacy of training and experience" (CPC 8 ) was inadequate, and "the crew collaboration" (CPC 9 ) was insufficient. As mentioned earlier, the requirement for the conduct of several simultaneous tasks would put "the conditions of working" (CPC 2 ) in an incompatible fashion, and could bring "the adequacy of MMI and operational support" (CPC 3 ) and "the availability of procedures" (CPC 4 ) to an inappropriate state. Therefore, the probability distribution of the control mode in these conditions is varied for this operator so that scramble (0.11), opportunistic (0.76), and tactical variations (0.13) could be put in this category ( Table 9). The total HEP value was obtained as equal to 0.09 for this operator based on Eq. (5).
The results of this study are, to a large degree, consistent with those of Yang et al.'s [1] study. They conducted a study on a motor tanker that was discharging crude oil at Karachi oil terminal. The identified CPCs that were involved in the accident consisted of the incompatible working conditions, inappropriate availability of procedures/plans, inappropriate adequacy of manmachine interface and operational support, the number of simultaneous goals beyond the actual capacity, continuously inadequate availability time, inadequate adequacy of training and experience, and deficient crew collaboration quality. Therefore, the results of this study are consistent with those reported by Yang et al. [1] while the current study's structure is easier than that of Yang's study. The reason for this is that collecting information about CPCs, converting the discrete data (Table 9) to the continuous date and analyzing them based on Bayesian approach using MSBNx software is easy in the current study. Table 10 also compares the information associated with the basic and Bayesian CREAM methodstogether. As it can be observed, the CPCs level and control modes are discrete and deterministic (either 0% or 100%) in the basic CREAM. On the other hand, the number of the CPCs with positive and negative effects will be counted and used to determine the control modes. However, the data pertaining to the CPCs level and control modes are semi-deterministic and very diverse in Bayesian CREAM. The CPCs level is determined considering the dependency of the CPCs. In this context, COCOM is also calculated in a continuous nature. However, the probability of the human error calculated by Bayesian network is slightly higher than what was obtained for basic CREAM. This means that there is a consistency between basic and Bayesian CREAM and thus the validation of the current study is partially confirmed. Moreover, the reliability of the CREAM BN was previously tested by Kim et al. [9].

Conclusion
Statistics show that human error is a key factor contributing to the occurrence of more than 80% of chemical and petrochemical accidents [18]. Therefore, human error analysis with the aim of the quantitative estimation of human error probability is a crucial undertaking in these industries. For this purpose, CREAM was utilized as one of the second-generation HRA techniques that is widely used in various industries, including the petrochemical industry. There are, however, significant shortcomings in traditional CREAM pertain to specifications of CPCs and the estimation of control modes, which are at play as two core concepts in HEP calculation. Therefore, it is recommended that other researchers also attempt to explore more detailed parameters associated with each CPC and identify the rate of dependency among them (especially, the CPCs with neutral effects) in various case studies in order to overcome the mentioned shortcomings. Then, the effect of the CPCs with new parameters should be evaluated on the HEP. In addition, it is suggested that managers improve the CPCs with the negative effects in order to reduce HEP and increase human performance reliability. Reduced HEP, in turn, can lead to a significant reduction in the occurrence of accidents. This motive can convince enough the managers to focus their attention on such recommendations.