Fighting Human Error in Real-Time Operation: the Experience at the ITAIPU

Binacional Hydroelectric Power Plant

By Marcos A. P. Lefevre, J. M. Sanchez, Ramon A. G. Isasi, Carlos A. Vergara and

Celso V. Torino, ITAIPU Binacional, Brazil and Paraguay

ABSTRACT

This Article describes the experience of the Operation area of the ITAIPU Hydroelectric Power
Plant in fighting human error in real-time operation. This paper presents the actions already
taken, or at present being developed, in the technical-administrative, technological and team
training fields during the 22 years of experience operating the largest hydroelectric power plant
in the world, with a view to preventing the occurrence of human error in the real-time operation.

Key-Words

ITAIPU, hydroelectric power plant, operation, human error.

1- Introduction

It is usual to encounter analyses which classify a vehicle accident where the brakes didn't work
as a "mechanical failure", just as a similar accident where the driver failed to dedicate proper
ability or attention is classified as a "human error" - as if the brake didn't also include the human
component in its processes of design, production or maintenance.

Now, at the other extreme, some people argue that practically all the failures could be classified
as "human errors", i.e., if something turned out wrong it was due to a fault in the project, the
manufacture, the erection, etc. Another frequent statement is that it is impossible to eliminate
human error from production processes since man is by nature subject to error [5].

Another interesting approach correlates

the human error, the complexity of the
task and the experience of the operator,
whereby the probability of human error
Human error

increases when an inexperienced

operator executes complex tasks. This
probability also increases when a very
experienced operator executes tasks of
low complexity, as illustrated by Figure
1 relationship between human error,
operator experience and complexity of
the task.
Operator experience

Complexity of the task

1
After 22 years of operation, the ITAIPU Hydroelectric Power Plant, as is to be expected, suffered
human errors in real-time operation and on the basis of this experience many measures to avoid
them were, and still are, being taken.

Our experience indicates that the continuous and daily treatment of the human error question is
essential to the success of our enterprise. If we believe nowadays that the elimination of human
error is far beyond the scope of our reality, to believe that we can reduce the frequency of its
occurrence, as well as to minimize its consequences for the safety of personnel, the integrity of
the main equipment and the continuity of production constitutes a stimulating challenge.

The reasons that have induced us to write this paper involve the desire to share with utilities and
colleagues interested in the subject the principal measures we have taken throughout these 22
years of operation to prevent the occurrence of human error and of its incidence resulting in
significant impacts.

In the first place, with the intention of apprising the reader of the magnitude and complexity of
the ITAIPU Binacional Hydroelectric Power Plant, we shall give some information on the plant
and the importance of its energy to Brazil and to Paraguay. We shall then present the most
relevant information concerning our history of human errors during real-time operation. Next, we
shall describe the principal measures taken, or in process of implementation, in the technical
administrative and technological fields in addition to the continuous training of the operator team
with the objective of eliminating the occurrence of human error or to prevent such occurrences
from having a harmful impact on the safety of personnel, of the equipment and the continuity of
production. We shall finally present our conclusions.

2- ITAIPU, Brazil and Paraguay

According to data provided by ANELL, the agency regulating the Brazilian electrical sector,
Brazil at present possesses 1,599 electric energy generation plants in operation, with a total
generating capacity of 96,303.090 MW. This complex comprises hydroelectric, Aeolian, solar,
thermoelectric and thermonuclear plants. In spite of the existence of the five energy sources
mentioned above, the Brazilian energy matrix is predominantly hydraulic in which 84% of the
generation capacity pertains to hydro plants.

In the year 2006, Brazil produced 416,343 GWh of electric energy, of which 92% was generated
by hydro plants.

The Brazilian Electrical System is constituted by a single interconnected system, as shown in

Figure 2, with some areas attended by isolated systems.

In Paraguay, in 2006, 99.99% of the electric energy market was attended by energy from hydro
plants. The total installed power of the Paraguayan Electrical System essentially comes from the
Acaray Power Plant and the binational plants of Yaciretá (with Argentina) and ITAIPU (with
Brazil). Considering that Paraguay owns one half of each of these binational plants, the total
present installed power in Paraguay is 8,100 MW.

In 2006, the energy generated by the ITAIPU Hydroelectric Power Plant with 12,600 MW of
installed power, supplied around 20% of the Brazilian market and 93% of the Paraguayan. It is
also important to note that in the year 2000, the ITAIPU Plant established the world record in
energy production in a single development by attaining the mark of 93,400 GWh. At present, the

2
installed power in ITAIPU is being increased to 14,000 MW with the addition of two new 700 MW
generator units.

Figure 2 The Brazilian Interconnected Electrical System

3- Human Error in Real-Time Operation in ITAIPU

Since 1984, when the ITAIPU Hydroelectric Power Plant commenced operation, until 2005, we
had a total of 66 occurrences classified as being caused by "human error" [4, 7].

The Figure 3 illustrates the percentage of human errors resulting in impacts to personnel safety,
to the equipment and to production. Since 1984 we have had a total of 980 occurrences, 6.7% of
which were caused by human error.

3
 50
Exclusively afected the prodution
41 Didn't affecte people or equipment or production
40
Exclusivy affected the equipment
Affected equipment and production

980 ocurrences 30 Affected human safety

66 ocurrences
22
6,70% 20

10
4
1 0
0

Figure 3: Total occurrences of human error and their type of impact

4- Principal Actions against Human Error in Real-Time Operation

“Principal” was the word chosen to most appropriately represent the actions to be presented in
the following topics. We chose this word due to our perception that it would be impossible to
describe in only one article all the actions that can contribute positively or negatively to the fight
against human error in real-time operation.

Administrative actions, such as prompt payment of salaries, transportation logistics and even the
availability of snacks can, to some extent, contribute to the subject of human error. In the
technical process area, the quality of communication, of a text re-addressed in an instruction and
of the professional relationship between a Supervisor and an Operator executor can be of prime
importance to the "human error" question. The use of IPEs and CPEs (individual and collective
Protection Equipment) and the appropriate tools for executing tasks can be the deciding factor in
the occurrence or in the consequence resulting from a human error.

Faced by this enormous quantity of factors that can contribute to the "human error" question, we
have selected as the "principal" ones those that have not only proven to be concrete sources of
our experiences of error or "near error", but also have been effectively studied and addressed
throughout these 22 years of operation in the Technical-Administrative, Technological and Team
Training areas. Some of these factors and their remedies have already appeared in articles as
the subjects of a profound and specific approach. In these cases, the articles are cited in the
bibliographic references.

4
 Continuity of the Production
Human Safety
Preservation of the Assets

Fight against Human Error

Techinical-
Training of the
Administrative Techonology
Team
Processes

Figure 4 Structure of the relationship between PTT, (process,

Training and Technology) human error and the effects on production,
the equipment and the people

4.1- Technical-Administrative Processes

Plan, plan and execute

The majority of human errors in the operation of power plants and substations are associated
with the actions for normalizing the operational conditions after disturbances or the actions of
switching for isolation or normal operation of equipment and systems to permit preventive or
corrective maintenance work. Between the two actions described, the programmed actions form
the largest volume and, fortunately, are those permitting the largest investment in planning,
having less value the more complex the manoeuvre and giving greater prominence to the
consequences of a mistaken manoeuvre. To exhaustively analyse the switching actions before
executing them is crucial for success, both by the Operator and by the Maintenance engineers.
There are, typically, three moments for analysis: 1- the analysis while still in the phase of
approving the maintenance job when the necessary switching manoeuvres are defined; 2- The
analysis by the Maintenance engineer, not only regarding the adequacy of the isolations defined,
but also regarding the technical and logistic requirements for carrying out the task; and 3- the
release for the switching manoeuvres which, despite occurring in real-time, in the majority of
cases still allows analyzing their adequacy prior to the execution. The quality with which these
phases are addressed will be crucial to the successful execution, and in this context, to the
fulfilment of the minimum time limits established for the analyses, the rejection of the execution
in the case of identifying anomalies and the systematization of this process. These are the
decisive components in the mission of avoiding human error during real-time operation.
Unfortunately, it is not unusual to identify unfulfilled time limits in the planning phase; generally
with good justifications, but nevertheless, unfulfilled [6].

Management of Holidays, Replacements and Dismissals

The demand for operational actions, unfortunately, doesn't permit long term planning and, on
many occasions, a long term here may only extend to several weeks. The programming of the
releases for maintenance work doesn't allow an exclusive management of either operation nor of
maintenance. These schedules may be altered against the wishes of both areas. Occurrences

5
that demand corrective action, the energy situation of the connected Electrical Systems are
merely some examples that can turn the planning horizon of a few weeks into something very
distant from reality.

On the other hand, the engineer operators need to enjoy their well-earned holidays and this
demands planning and a minimum adequate foresight for the personal and family planning.
Despite admitting the seasonal character of the annual work demand, assertions that holidays of
operational personnel can be planned in accordance with the forecast of future work are
unreasonable, since the terms in forecasts of future work and the personal holiday planning are
effectively incompatible in some cases, and can contribute to understaffed operating conditions
that may increase the risk of human error.

A systematic process of holidays' management that takes into consideration questions, such as,
the maximum number of personnel simultaneously on holiday according to professional function,
the management of the maximum legally permissible terms between successive holidays, the
utilization of less experienced or insufficiently trained engineers for replacing the personnel on
holiday constitute fundamental aspects of the management of human error.

Similar precautions are expected in the processes of substitutions and eventual dismissals of
engineers from operation. If on the one hand it must be admitted that the existence of flexibility
in substitutions and dismissals also contributes to avoiding human error, on the other hand, it is
unquestionable that this process shall be carried out under previously established criteria, which
take into consideration the same questions presented here concerning the management of
holidays [11].

8
7
6
5
4
3
2
1
0

Limit to operation simultaneous holidays Operator simultaneous holidays taken

Figure 5: management of simultaneous operator holidays by function

Entry into Operation of Equipment and Instructions

The importance of the entry into operation of an equipment unit or system is the same as that of
the entry into effect of a new or revised instruction. At least, this should be the aim of a good
management from the viewpoint of human error.

It is common to hear phrases of the type "act locally seeking global results"; however, in practice
the various areas involved in the placement in operation of an equipment unit, system or
instruction have their requirements and their commitments pressured by the deadlines. It is not
unusual that the effort to address the local objectives results in the lack of adequate deadlines in
the final stretch and, as we know, the final stretch is the operation in real-time.

6
The participation of engineers from the Operation area from the birth of a new project,
specification, erection, commissioning and finally the entry into operation can make the
difference. The precautions prior to the beginning of operation of an equipment unit in relation to
the training of personnel, identification and operational diagrams in the field, preparation of
operating instructions, systematic discussion between the creator and the executor of the
instruction according to the executive feasibility and the clarity of interpretation are some
examples of the actions that can be anticipated prior to the occurrence, or not, of a human error.

Analyses of Occurrences and Measures to be taken

To talk of the need to analyse an occurrence can appear to be "emphasizing the obvious",
however, it is of crucial importance in fighting human error, particularly when making a post-
operative analysis, not only from the viewpoint of disturbances, but also from the viewpoint of
operational procedures. Just as important for the analysis are the technical debates with the
participation of the operators involved in the occurrence, the operators of the other operational
duty shifts and, finally, the establishment of the measures and provisions for solving or
eliminating the anomalies identified. In addition, the use of recording telephones, the recording
of events by the system of supervision and command, digital fault recorders, alarm lists are
extremely important for the accuracy and success of the analysis of the occurrence and,
consequently, for confronting the incidence of human error in the real-time operation.

In addition to the case by case analysis of each occurrence, the periodic revaluation of the
failure records is also very important, since it permits identifying the principal factors that are
causing them.

4.2- Technology

The Operation of the ITAIPU Hydroelectric Power Plant began using the SCADA system in
2000. With the advent of the SCADA system, various actions became possible including actions
with the specific objective of preventing the occurrence of human error in real-time operation or
of preventing said occurrence from resulting in any impact to the safety of people, equipment
and to the continuity of production.

The analysis of the failure records of the period prior to SCADA operation identified that 40% of
the human error could have been avoided merely with the traditional SCADA resources [4]. With
a view to further reinforce the benefits provided by the SCADA in the reduction of human error,
the following additional applications have been developed by ITAIPU:

SARTRE (System of Activation of Rules in Real-Time)

Area of actuation: safety of people, of equipment and of the production.

This is a program with the objective of avoiding three types of anomalies: 1- inform the Operator
that an operational real-time condition exists in the power plant or substations that violates the
operational conditions established in the Instructions for Operation, 2- inform the Operator that
an operational real-time condition exists that although not violating the instructions in effect, is
not the condition established in the Instructions as the preferential option; 3- inform the Operator
that the manoeuvre or command he has just "attempted", if continued, will violate an operational

7
Instruction established in the Instructions in effect, or the conditions established as a risk of
human error. In any of the three cases, the SARTRE always informs additionally the reason why
it is issuing an alert and, when applicable, what the Operator should do to eliminate or avoid the
anomaly.

Please note that two first cases address situations that are already established and, therefore,
the assistance of SARTRE is restricted to supporting the Operator in the detection of the
anomaly and in its elimination as soon as possible. Now in the third and last case, the SARTRE
goes beyond the warning and takes action "before" the action is executed, thus avoiding a
possible human error.

As a concrete example of this function, we can mention that if at exactly this moment, the
Operator in real-time of the ITAIPU Power Plant, for any reason attempts to disconnect the
generator unit # 10 which is already at zero MW and if due to any distraction executes the
command to shut down unit # 11, the SARTRE will automatically display a yellow screen (colour
exclusively used by SARTRE displays in the ITAIPU SCADA system) informing him that he is
trying to disconnect a generator unit generating 700 MW and immediately inquires if he intends
to continue. It also informs that the decisions contrary to the SARTRE recommendations are
possible, although they require the agreement of the Shift Supervisor. Our Operators obviously
already know that the appearance of the yellow SARTRE display during the attempt to execute a
command indicates an imminent risk of human failure and, therefore, it is essential to re-
evaluate the decision [1, 2, 12].

ALERT
then
Attempted Command
Violation of Instructions Automatic Alert
E
Window
Operating Conditions

Figure 6: Functional logic of the SARTRE System

SAMOP (System of Support to Operational Manoeuvres)

Area of actuation: safety of personnel and equipment.

One of the activities demanding most attention and coordination in the operation of the power
plant is that of isolating and normalizing various units of equipment, often simultaneously,
pertaining to a generator unit when it is undergoing preventive maintenance. The coordination of
the diverse isolations and manoeuvres for different services and work fronts has to be precise
with the risk of it resulting in serious damage to the equipment, leakages of liquids such as oil
into the riverbed and even serious accidents with the maintenance teams. The work fronts of the
mechanical area, for example, have to be duly coordinated with the releases of work fronts for
the electrical or electronics areas so that the mechanics don’t receive electric shocks and the
electrical and electronics technicians don't face unexpected start-ups of ventilator fans and other
rotary parts.

The complexity increases when we have to consider that the various manoeuvres (closing
valves, opening circuit breakers, etc.) are distributed through various elevations and galleries of

8
the power plant restricting the capacity of the coordinator for supervising the actions taken by his
team. There is one sector almost exclusively dedicated to confirming manoeuvres by restricted
mobile telephony or even by radio. In spite of the investments made in improving the quality of
this communication, black areas of low communication quality still exist.

The SAMOP has precisely the objective of increasing the safety of personnel and equipment of
the generator units. Utilizing displays of the supervisory system specifically developed for each
sequence of manoeuvres associated with each type of work to be executed by the maintenance
area, the coordinator can effectively supervise in real-time, each step of the manoeuvring
sequence.

In this manner the SAMOP makes it feasible for the Coordinator to effectively supervise the
actions of his team, thus contributing in a more robust manner to the fight against the typical
risks of human error in real-time operation.

Due to its dependence on the existence of data to be acquired (positions of valves, circuit
breakers, etc.) by the supervision system, up to the present time the implementation of the
SAMOP has only been possible on the two new generator units, although the upgrading project
of the 18 older units is in the specification phase, which will include the requirements of the
SAMOP.

Close Valve Open Circuit Close Equipment Isolated

Breaker Grouding Released for
Switch Maintenance
Team

Figure 7: Functional logic of the SAMOP System

SADET (Support System for Taking Decisions on Disconnections of Equipment in Real-

Time)

Area of actuation: safety of equipment and of production.

The quantity of the equipment that every day is subject to manoeuvres of isolation and normal
operation for preventive maintenance and the significant commitments of our production with
respect to our two client countries, Brazil and Paraguay, led the Operation area to define specific
areas for developing activities of pre-operation and the execution of manoeuvres for the
scheduled activities, thus permitting the rotating duty shifts to keep their attention focused
primarily on the production.

On the other hand, in real-time occurrences, and particularly during time periods outside of
normal working hours, it is essential for the duty shift to have the ability and training to carry out,
exceptionally, the activities routinely developed in the specialized areas dedicated to the
definition and execution of the isolation and normal operation manoeuvres.

9
In addition to the constant rotation of the operators between these sectors, the SADET was
developed precisely to support the operator in real-time by transmitting to the control room the
knowledge available in the sector dedicated to the analyses for the approval of the requests for
disconnections issued by the maintenance area and the definition of the corresponding isolation
and normal operation manoeuvres.

The SADET can be used in real-life situations or in training simulations. In these situations the
operator has the option either to simulate the disconnection of a particular equipment unit in the
scheduled manner, or else in an urgent or forced manner. The reply lists the diverse actions to
be taken for each situation including the possibility of disapproval of the disconnection in the
case of it being a scheduled disconnection. The knowledge base was prepared with the effective
participation of the operators whose daily work comprises activities of this type, some of whom
have more than 20 years of experience.

At present, the SADET is already available for some panels, while the knowledge bases are
being developed for all the equipment units and relevant panels of the power plant.

Forced

Need for Knowledge Support for

Urgent
Disconnections Base Decision
in the Plant Scheduled Making

Figure 8: Functional logic of the SADET System

4.3- Qualification of the Team: Training, training and training

One of our Supervisors is apt to employ a fairly interesting concept concerning Operators and
Training: The Operator can be compared to an Olympic athlete who trains for 4 years in order to
compete for a few seconds. The truth of the matter is that training is indisputably the key to
success. If on the one hand, training is not, unfortunately, a guarantee of zero human errors, on
the other hand, the absence of training is a certain and direct route into the world of human
errors. We list, as follows, the three principal actions we have taken in the training area as
additional components of this "action network" in the daily battle against human error in real-time
operation [9].

Annual Training Plan

Since the beginning of the Operation in the Power Plant, the investment in training has been a
priority for our firm; however, a few years back it was decided that it was necessary to focus on
the "training" theme in the manner employed for new projects: with enthusiasm.

Problems such as the failure to control effective participation, or of verifying the amount of
learning retained, justifications of absence from training due to the press of work, the lack of
recognition of good performance as a trainer or a trainee in the various courses offered were all

10
pervasive features of the training routine of the Power Plant Operation. It was necessary to
revive the project with new doses of enthusiasm and prioritization.

The Operation area created the PAT (Annual Training Plan) among whose mottos and phrases
were "The workload no longer justifies the employee or the firm not to train". At the beginning it
was not at all easy to tell our employees and even Supervisors: "OK, if necessary, we shall stop
our work; we shall say no to our customers; we are going to shut down the sector because today
we shall train!

The methodology is simple. The relevant points are to:

• Annually conduct training courses addressing the subjects: Operational Procedures,

Functioning of Equipment, Labour Safety and Corporate Matters;
• request suggestions on training to be attended by the entire Operation team;
• know the projects under development and that might enter operation the following year,
identifying potential training needs;
• carry out an efficient and agile
control over the participation of 100% 100
the trainees;
92%
• acknowledge the participation 90%
70
and deal promptly with
56
percentage

unjustified absences;

hours
• perform checks on the amount 58% 39
of knowledge retained;
• stimulate and valorise
performance initiatives by
trainers;
0% 0
• work cannot justify not training. 2004 2005 2006 2004 2005 2006

Index of participation Hours training per em ployee

Figure 9: Results of the PAT

Certification of Operators in Operation via SCADA

Within the Annual Training Program of 2004 and 2005, the training in the utilization of the
system of supervision and command (SCADA), was strategic as well as a priority, requiring the
preparation of a strategy that went beyond the training. We created a certification. The SCADA
training program and its 12 applications, including the SARTRE, comprised basic and advanced
modules, certification exams with theoretical tests, practical exercises and trials contending with
the faults created on the digital simulator.

The training program was also chronologically linked to the gradual evolution of the transition of
the operation of power plant and substations from the conventional operating system to
operation via the digital system for which the certification of operators in real-time was a
prerequisite, as well as the presence of specialist operators in the operation via SCADA
temporarily participating in the duty shifts in the SCADA assisted operation. The results were the
best possible: no human error occurred to affect production during the difficult and complex
transition between the (conventional) old tools and the (digital) new ones [3, 10].

11
 A B 30 days

Stages in the Method of Operation

Time Tables
Stage 1 Stage 2 Stage 3 Stage 4
Commercial
Digital and Assisted Digital and Assisted Digital and Assisted Digital Unassisted
7-12h & 14-18h
Lunch
Conventional Digital and Assisted Digital and Assisted Digital Unassisted
12-14h
Peak Load
Conventional Conventional Digital and Assisted Digital Unassisted
19-22h
Night / Dawn
Conventional Conventional Digital and Assisted Digital Unassisted
22-7h
Figure 10: Relationship between the evolution of the training and the gradual entry into
operation of the SCADA

Training Software and Certification of Operators (COP)

This refers to another important tool in our "action network" against human error. The COP is
composed of three modules: 1- informal training, 2- formal training and 3- certification.

All three modules employ the same data base which, in turn, is actually composed of 400
questions of the multiple choice variety, prepared on the basis of the technical operating
procedures.

The informal training can be taken by the operator at any moment, using any available computer
in the operational environment, including the control room, as a self-training method, i.e., only he
will know the result of the evolution of his training. Now the formal training is given to all the
operators in a systematic and periodical manner with results that are known to the firm and can
be considered as the evaluation of his performance.

As a form of incentive to the "informal" training, despite the results of this training being only
known to the operator, all the informal training undertaken by the operator and resulting in the
knowledge retained surpassing 50% will be computed as a kind of bonus, raising the general
average resulting from the formal training.

Although the objective is for the COP to contain all the relevant questions concerning operational
procedures and the functioning of the equipment, at this time the question base still comprises
only questions relating to operational procedures.

The mode of use of the COP certification is still pending decisions by the firm.

5- Simulation of Results: The SARTRE since the Beginning of Operation

Among the principal actions in the technological area, the SARTRE system is certainly the one
showing greatest promise of contributing at present, and in the future, towards the fight against
human error. Based on our belief in this statement, we ran a simulation using data from our past,
seeking replies to the following questions:

12
Which and how many of the 66 occurrences of human error would be avoided with the
SARTRE?

Of the 66 occurrences of human error, 53 would be avoided with the SARTRE; that is 80% of the
occurrences. It should be noted that the benefit accruing from the traditional SCADA, although
significant, was 40%, i.e., one half of that attained with the SARTRE.

Observation: although all of the above-mentioned 53 occurrences are susceptible to the

implementation of the SARTRE rule, at present in the ITAIPU Power Plant, it would already be
possible to implement the SARTRE to attend 18 of them, since the remaining 35 occurrences
depend on the implementation of data acquisition devices.

Among the 53 occurrences that would be avoided with the SARTRE, what is their
importance according to the general data of the impact on the safety of personnel, of the
equipment and of the production?

15 Affect the production

1

2 0
Affect the equipment

Affect the equipment and the production

Do not affect the production, or the equipment, or the

personnel

Affect people
35

Figure 11: number of occurrences with SARTRE actuation according to their type of impact

Among the 35 occurrences that would be avoided by the SARTRE and that had an impact
on production, how much would have been economized in relation to the energy not
supplied and the costs involved?

Considering all the 40 occurrences with impact on production and caused by "human error",
independently from the applicability of the SARTRE system, they represent a total of unavailable
energy and a potentially compromised financial value of 25,124 MWh and US$ 774,600.00
respectively.

Now considering only the 35 occurrences with impact on production and caused by "human
error" where the SARTRE would be effective, the unavailable energy and the potentially
compromised financial value would be 20,480 MWh and US$ 631,426.00, that is, the SARTRE
would simply eliminate a total 81.5% of the potentially compromised financial values with an
amount slightly above 0.5 million dollars.

Obviously, this financial calculation only represents the tip of the iceberg, since it merely
considers the value of the energy not supplied by ITAIPU and not the economic and social value
of the energy not supplied to the customers, such as the risks entailed by the malfunctioning of
transportation systems, hospital attention, public illumination, etc. Nor does it quantify other

13
costs, such as the harm to the public image of the utility, at the national level due to the
dimension of ITAIPU, and the damage to the morale of the team.

6- Conclusions

The human error index in real-time operation at the ITAIPU Hydroelectric Power Plant during
2005 was zero. This was reason for satisfaction and celebration in the team, although it is true
that we wouldn't be able to reply effectively and exactly which are the actions taken, or not
taken, to obtain this index; such is the complexity of the "human error" theme.

The truth is that the daily study of this theme and the permanent investment in the "action
network" in the continual fight against human error at present seems to offer the best route.

We believe that to organize the action network with measures in the technical-administrative,
technological and team training areas, offers a viable and promising form of blocking the
occurrence of human error, or in the worst of cases, preventing the harmful effects of human
error on the safety of people, equipment and production.

In the technological area, we highlight the SARTRE system as one of the most promising
resources implemented recently, and that over the years, we hope, will exert an indisputable
positive effect upon the occurrence and the consequences of human error in real-time operation.

References

(1) Lefevre A. P. Marcos, Armindo A. Villasanti L., Camargo J. Ricardo, Torino V. Celso, ITAIPU
Binacional Power Plant, Brazil and Paraguay, Measures for operational improvement at the
ITAIPU Binacional Power Plant, 2003, Hydro;

(2) Torino V. Celso, Silva M. Fernando, Barreto T. Douglas, Isasi A.G. Ramon, Soares, D. C.
Paulo, Martinez C. L. Davalos, Soto S. Heriberto and Santos A. Missias, ITAIPU Binacional
Power Plant, Brazil and Paraguay, Activation of Rules System in Real Time (SARTRE) at the
ITAIPU Binacional Power Plant: A Contribution to Operation Quality, 2003, Waterpower;

(3) Torino V. Celso, Silva M. Fernando, Ribeiro G. Henrique, ITAIPU Binacional Power Plant,
Brazil and Paraguay, Empower Staff While in Flight – The ITAIPU Power
Plant Experience in Training Operators to Work With Digital Systems, 2005, Waterpower;
(4) Nascimento J. Pereira, Baliza A. José, Martins B. Marcelo, Usina Hidrelétrica de ITAIPU
Binacional, Brasil e Paraguai, Tratamento das Falhas Humanas na Operação de ITAIPU, 1996, I
SETAP;

(5) Barata O. Guilherme, Borges A. Luiz, Usina Hidrelétrica de ITAIPU Binacional, Brasil e
Paraguai, Impacto dos Sistemas Digitais na Redução de Falhas Humanas na Operação da
Central Hidrelétrica de ITAIPU, 2000, II SEPOCH;

(6) Mitre A. F. Miguel, CHESF, Brasil, Análise do Desempenho Humano na Operação de

Sistemas Elétricos, 2002, III SEPOCH;

(7) Faria L. A. Telmo, CESP, Brasil, Prevenção de Falhas Operativas de Natureza Humana,
1998, I SEPOCH;

14
(8) Berni F. Carlos, Mir,T. G. Rafael, Usina Hidrelétrica da ITAIPU Binacional, Brasil e Paraguai,
Falhas Humanas na Operação de ITAIPU, 1998, I SEPOCH;

(9) Nascimento R.L. Antônio, Araújo, L. A. M. Bernadete, Silva C. F. S. Carlos, CHESF, Brasil,
Prevenção de Falhas Operacionais, Humanas e de Processos, 2002, II SEPOCH;

(10) Torino V. Celso, Borges Luiz, D´ippollito Marcos, Medeiros Elizete, Usina Hidrelétrica
ITAIPU Binacional, Brasil e Paraguai, Programa de Trainees Nível técnico, 2002, III SEPOCH;

(11) Torino V. Celso, Isasi A.G. Ramon, Silva M. Fernando, Ribeiro G. Henrique, Barreto T.
Douglas, Gonzalez V. A. Alvarez, Martins A. J. Miguel, Martinez G. Francisco, Miranda F.
Sanchez, Usina Hidrelétrica ITAIPU Binacional, Brasil e Paraguai, Capacitação de Profissionais
da Operação da Usina de ITAIPU no Uso de Sistemas Digitais de Supervisão e Controle, 2002,
VIII EDAO;

(12) Torino V, Celso, Isasi A.G. Ramon, Dupont Irno, Vergara B. C. Antonio, Usina Hidrelétrica
de ITAIPU Binacional, Brasil e Paraguai, Gerenciamento das Férias na Operação da Usina
Hidrelétrica da ITAIPU;

(13) Torino V. Celso, Barreto T.Douglas, Soares D. C. Paulo, Martinez L. C. Davalos, Isasi A. G.
Ramon, Soto S. Heriberto, Santos A. Missias, Usina Hidrelétrica ITAIPU Binacional, Brasil e
Paraguai, Sistema de Ativação de Regra em Tempo Real (SATRE): Uma Contribuição para a
Qualidade Operativa, 2002, SIMPASE;

Authors

Marcos A. P. Lefevre, Master's degree from the Faculdade Federal de Engenharia de Itajubá in
1975, is the Superintendent of Operation of ITAIPU Binacional. Since graduation as an electrical
engineer from the Universidade Católica do Rio de Janeiro in 1973, he has worked in the
Operation area of Hydroelectric Power Plants and Power Systems.

José M. Sanchez, Post-graduate from the Faculdade Federal de Engenharia de Itajubá in 1992
is the Associate Superintendent of Operation at ITAIPU Binacional. Since graduation as an
Electrical Engineer from Universidade Católica do Rio Grande do Sul in 1984, he works in the
Operation area of Hydroelectric Power Plants and Power Systems.

Ramon A G. Isasi, is Manager of the Department of Operation of the Power Plant and
Substations of ITAIPU Binacional. Since graduation as an Electrical Engineer from the
Universidade de Taubaté in 1988, he has worked in the Operation area of Hydroelectric Power
Plants.

Carlos A. Vergara B, is Manager of the Division of Operation Studies and Standards at ITAIPU
Binacional. Since graduation from the Universidad de Corrientes in Argentina in 1983, he has
worked in the Operation area of Hydroelectric Power Plants and Maintenance of Thermoelectric
Power Plants.

Celso V. Torino, is Manager of the Division of Operation of the Plant and Substations of ITAIPU
Binacional. Has degrees as an Electronics Technician from the CTI/UNESP, an Electrical
Engineer for the Universidade Estadual do Rio de Janeiro in 1988 and Post-graduation in
Automation of Electrical Power Systems from Eletrobrás/UFBA in 1996. Since 1989, has worked
in the area of Operation of Power Systems and of Hydroelectric Power Plants.

15