ImptHum Fac

8/7/2019 ImptHum Fac

1/75

1

Impact of Human Factors

in Process Safety Management

Risk Based Process Safety Management

S. K. Hazra

Chairman SHE Expert Committee

Process Safety Centre

Indian Chemical Council5th Dec.2009


2/75

2


3/75

3


4/75


5/75

5


6/75

6


7/75

7

Catastrophic Incidents-Human Errors

In safety critical industries, simple humanmistakes/oversight can cost hundreds of livesand billions of dollars

Top NASA and contractor personnels poortechnical decision making over a period ofseveral years was the Fundamental reason

Challenger Disaster (5 deaths, Loss $ ?Bil.)

A designer error in cabin air pressurisationvalve compounded by Mtc. Engr, allowed itremain partially open during flight

Helios Airline accident in Greece (121 death)


8/75

8

AttentionfailuresSlips Plan of action satisfactory but

action deviated from intentionin some unintentional wayUnintended

actionserrors

MemoryfailuresLapses

Rule-based

Misapplication of good rule orapplication of a bad rule

Mistakes

Knowledge-based

No situation tackled bythinking out answer from

scratch ready-made solution,new

Unsafeacts

RoutineHabitual deviation from

regular practices

ExceptionalNon-routine infringementdictated by extreme local

circumstancesIntendedactions

Violations

Situational Non-routine infringement

dictated by local

circumstancesActs of

sabotage

Types of human error


9/75

9

Human Factors

It is imperative that preventive measures focus onunderstanding

Whywell-intentioned and correctly trainedprofessionalssometimes make serious mistakes

Whichcircumvent the considerable defences of asafety system

This question transitions into a broad field labelledHuman Factors (or HF for short).

Considerable organisational effort need put into multi-layered, preventive measures aimed at reducing oreliminating all known risks arising out of HF

Prevention needs understanding reasons of Human failures


10/75

10

uman Factors are about people in their living and workin

situations; about their relationship with machines, withprocedures and with the environment about them;and also their relationships with other people

.


11/75

11

HF encompasses aspects of design (latent errors);

ergonomics (human-machine interfaces);

cognitive research (stimulus, memory, informationretrieval and processing);

bio-medical research (drugs, alcohol and the

circadian effects of shi working) and

systems engineering (processes and processcompliance in socio-technical systems in particular).

Human Factors


12/75

12

HF approach

A method of accelerating the acquisitionand application of operational lessonslearned across an organisation to avoid

their reoccurrence

Seek out information about Hazards fromthe peoples errors who work inside the

systemTo design a process for them to share their

learning with others before any unwantedevents happen


13/75


14/75

14

HF error reduction methods

Customer and product safety are declared asstrategic goals

Probabilistic risk assessments are used to

focus efforts on key hazards Risk management and risk mitigation risks

techniques are applied

Elimination of the opportunity for error, byfoolproof design.

Application of decision support systemsand/or clear safety policies.

Use of checklists, models and other visiblememory aids.


15/75

15


Leaders model a culture of trust, reporting,and openness

Multi-format, communication channels areused for error reporting and feedback.

Prompt action is taken by leaders to addressall reported hazards and errors.

O.D. and Learning interventions are used atdifferent organisational levels

Education for all on the underpinning HFtheory, principles and concepts. Training for competence in the actual tasks

being performed.


16/75

16


Training in hazard awareness and risksof specific errors.

Simulation of scenarios that could befaced in high-risk industries.

Behavioural training including surveysof group cultural norms

Leadership training to reinforcepersonal responsibility for safety.

Executive education on safety ethicsand decision making models


17/75

17


18/75

18

Most of BPs five U.S. refineries have hadhighturnover of refinery plant managers, and process safety

leadershipappears to have sufferedas a result

BP has notadequately ensuredthat its U.S. refinery

personnel and contractors havesufficient

process safety knowledge and competence

ISOM operatorswere likely fatiguedfromworking

12-hour shifts for 29 or more consecutive days


19/75

19

A poorly designed computerized control systemthat

hindered the ability of operations personneltodetermine if the tower was overfilling

BP managementallowed operators and supervisors

to alter, edit, add, and remove procedural steps

Supervisors and operatorspoorly communicated criticalinformationregarding the startup during the shift turnover.

BP did not have a shift turnover communicationrequirement for its operations staff result


20/75

20

BPs safety management systemdoes not ensure

adequate identificationandrigorous analysisofprocess hazardsat its five U.S. refineries

An extra operatorwas not assigned to assist,

despite a staffing assessment thatrecommended

an additional operatorfor all ISOM Start up

Thesesafety system deficienciescreated a

workplaceripe for human error to occur


21/75

21

Thesesafety system deficienciescreated aworkplaceripe for human error to occur

BP managementhas not ensuredtheimplementation ofanintegrated, comprehensive, andeffectiveprocesssafety management systemfor BPs five U.S. refineries


22/75

22

Culture & working environment

National, local & workplace cultures, social & community values

Job:

Task, workload,

environment,

display & controls,procedures

Individual:Competence,

skills, personality,attitudes, riskperception

Organisation:

Culture, leadership,resources, workpatterns,

communications


23/75

23

uman factors refer toenvironmental,organisationalandjob factors, and

umanandindividualcharacteristicshich influence behaviourat work in aay which can affect health and safet


24/75

24

Interrelated aspects of Human Factors

The Job

nature of the task

workload

the working environment the design of displays and controls

the role of procedures

The Task

match the physical limitation in accordance with ergonomic principles

match the mental capability As per peceptual,attentional and decision

making needs


25/75

25


The Individual

Competence

can be enhanced

Skills can be enhanced

Personality

fixed

Attitude can be changed

Risk perception

can be improved


26/75

26


The Organisation

Work pattern

Culture of workplace

Resources

Communication

Leadership


27/75


28/75

28

Managing human failures

Common Pitfalls Stating that operators are highly motivated and thus not

prone to unintentional failures or deliberate violations

Ignoring the human component completely, failing to

discuss human performance at all in risk assessments,leading to the impression that the site is unmanned

Inappropriate application of techniques, such as detailingevery task on site and therefore losing sight of targetingresources where they will be most effective

Producing grand motherhood statements that human erroris completely managed (without stating exactly how).


29/75

29

Managing human failures

Three Serious ConcernConcern 1: An imbalance between

hardware and human issues and focusingonly on engineering ones

Concern 2: Focusing on the humancontribution to personal safety rather thanto the initiation and control of major

accident hazards andConcern 3: Focussing on operator error

at the expense of system and

management failures.


30/75

30

Concern 1:Hardware vs human issues

and the focus on engineering


31/75

31

Despite the growing awareness ofthe significance of human factors insafety, particularly major accidentsafety, the focus of many sites isalmost exclusively on engineeringand hardware aspects, at the

expense of people issues.

Concern 1:Hardware vs human issues and the focus on

engineering


32/75

32

MAH Site

Due to the ironies of automation, it is notpossible to engineer-out humanperformance issues

All automated systems are still designed,built and maintained by human beings.

An increased reliance on automation mayreduce day-to-day human involvement

Maintenance is Critical, as performanceproblems have been shown to be asignificant contributor to major accidents


33/75

33

MAH Site

May have determined that an alarm system is safety-critical

May have examined the assurance of their electro-mechanical reliability

But they may fail to address the reliability of theoperator in the control room who must respond to thealarm

If the operator does not respond in a timely and

effective manner then this safety critical system willfail

Therefore it is essential that the site addressesand manages this operator performance.


34/75

34

MAH Site

Operator moves from direct involvement to amonitoring and supervisory role in a complexprocess control system

Operator will be less prepared to take timelyand correct action in the event of a processabnormality

In these infrequent events the operator, often

under stress, may not have situationalawareness or an accurate mental model ofthe system state and the actions required


35/75

35

Concern 2:

Focus on personal safety


36/75

36

There needs to be a

distinct focus in themanagement system onmajor hazard issues

Concern 2:Focus on personal safety


37/75

37

The majority of major hazard sites still tend to focuson occupational safety rather than on process safety

Those sites that do consider human factors issues

rarely focus on those aspects that are relevant tothe control of major hazards.

Sites consider the personal safety of those carryingout maintenance

But what is important is how human errors in

maintenance operations could be an initiator ofmajor accidents

This imbalance runs throughout the safetymanagement system, as displayed in priorities, goals,the allocation of resources and safety indicators.

Major accident vs personnel safety


38/75

38

Reliance on lost-time injury datain major hazard industries is

itself a major hazard.An airline would not make themistake of measuring air safety

by looking at the number of

routine injuries occurring to itsstaff.

\


39/75

39


Safety is measured by lost-time injuries, or LTIs.

The causes of personal injuries and ill-health are notthe same as the precursors to major accidents

LITs are not an accurate predictor of majoraccident hazards, which may result in sites beingunduly complacent.

Notably, several sites that have suffered majoraccidents demonstrated good management of

personal safety, based on measures such as LTIs. Therefore, the management of human factors issues

in major accidents is different to traditional safetymanagement.


40/75

40


A safety management system need tomanage the right aspects to be effective incontrolling major accidents

Performance indicators closely related tomajor accidents may include the movementof a critical operating parameter out of thenormal operating envelope.

The definition of a parameter could be quitewide and include process parameters,staffing levels or the availability ofcontrol/mitigation systems.:


41/75

41

Performance Indicators

Effectiveness of the training program;

Number of accidental leakages of hazardoussubstances

Environmental releases;

Process disturbances;

Activations of protective devices;

Time taken to detect and respond toreleases;

Response times for process alarms;

Process component malfunctions;

if there is frequentoperation of a

pressure relief valvethen cause of the

pressure rise needs tobe established and action

taken


42/75

42

Performance Indicators

Number of inspections/audits;

Number of outstanding maintenance activities;

Maintenance delays (hours);

Frequency of checks of critical components; Number of inspections/audits;

Emergency drills;

Procedures reviews;

Compliance with safety critical procedures; Staffing levels falling below minimum targets

Non-compliance with company policy on workinghours.

is the maintenance ofsafety critical equipment

being undertaken as

planned and if not what isdone about it.

are the right drills beingcarried out in the rightplaces, do they cover

suitable scenarios, are allshifts involved, etc.


43/75


44/75

44

Concern 3:Focus on the front-line operator


45/75

45

In general, most safety activities in complexsystems are focussed on the actions and behavioursof individual operators those at the sharp end.

However, operators are often set up to fail by

management and organisational failures, Rather than being the main instigators of an accident,

operators tend to be the inheritors of system defectscreated by poor design, incorrect installation, faultymaintenance and bad management decisions.

Their part is usually that of adding the final garnish toa lethal brew whose ingredients have already beenlong in the cooking

Concern 3:Focus on the front-line operator


46/75


47/75

47

Management and Safety Culture

Feedback from audits carried out by the HumanFactors Team on major hazard sites often revealsareas that require attention in the managementsystem which have not been identified (or reported)in previous audits.

Audits of management systems frequently fail toreport bad news. Following the Piper Alpha offshore platform fire it is

reported that numerous defects in the safetymanagement system were not picked up bycompany auditing.

There had been plenty of auditing, but the inquiryreported that: It was not the right quality, as otherwise it would

have picked up beforehand many of the deficiencieswhich emerged in the inquiry . (B Appleton, PiperAlpha, 1994)


48/75

48

Management and Safety Culture

If culture, understood here as mindset, is to be thekey to preventing major accidents, it ismanagement culturerather than the culture of theworkforce in general which is most relevant. What is

required is a management mindset that every majorhazard will be identified and controlled and amanagement commitment to make availablewhatever resources are necessary to ensure that theworkplace is safe. (Hopkins, Lessons from

Longford, reference 2)


49/75


50/75

50


51/75

51


52/75

52

The incident involved threeinterconnected process

vessels.A loss of feed to vessel 1

caused the valve A to close

to prevent the vessel beingemptied.


53/75


54/75

54

As vessel 2 emptied, valve Bclosed, trapping in the remainingliquid.

As heat was still being applied, thisliquid vaporised, and the vesselvented into the flare system,through the flare stack knock-outdrum, which catches liquid toprevent it going to flare


55/75

55


56/75

56

Meanwhile, the feed to vessel 1 had been

restored, and valve A was opened. This should have caused valve B to open,

but this did not occur.

The operators were aware that vessel 2 was

still overfilling, so they opened valve C toprovide another route out of that vessel.

This resulted in a high liquid level in the flarestack knock out drum.

Due to a previous modification, there was nofacility to pump out the knock-out drumquickly


57/75

57


58/75

58

By this time, the operators wereconcentrating on the screens

that showed the problems invessels 1 and 2, and were notbeing helped by the flood of

alarms being generated.


59/75

59


60/75

60

The combination of a high liquid levelin the knock-out drum, and vessel 2venting into the flare system again,caused a slug of liquid to be carriedthrough the knock-out drum and intothe flare line,

Pipeline collapsed at a weak point.


61/75

61

Texaco Refinery, UK

Twenty tonnes of hydrocarbon were releasedand exploded when a slug of liquid was sentthrough the flare system pipeline, which failed.

The site suffered severe damage, and UKrefinery capacity was significantly affected.Only luck prevented multiple deaths. It was aSunday, and some people had left the area

just before the explosion.


62/75

62


63/75

63

Key Findings on Alarm System

The control displays and alarms did notaid operators to act in time.

The alarms appeared faster than theycould be responded to

87% of the 2040 alarms displayed as"high" priority, despite many being

informative onlyKey alarms were missed in the flood


64/75

64

Safety critical alarms were notdistinguishable from the rest

A Human Factor review wouldhave helped diagnosis-.

H F t C t l R t


65/75

65

Human Factor-Control Room operators

Action recommended by HSE

Removal of 'alarms' which in fact were statusindicators only or which were not intended for actionby the control room operators i.e. alarms do notrequire a defined operator response?

Elimination of alarm list flooding with repeatingalarms - introduction of single line annunciation.

The previous requirement to both accept all alarmsand accept their later clearance to be removed

(except in some carefully-defined special cases) sothat clearance no longer routinely required anoperator response


66/75

66

Human Factor-Control Room operators


67/75

67

The designers set out with the best intentionsseeking to alarm virtually any parameter that moved inthe Process,

But may not consider the operators' needs in controlroom that is best met by providing them An effective control system with alarms only for Critical

Parameter in simplest possible form

The Project and commissioning engineers may notrealise this problem because of their familiarity withthe system from first design onwards

If operators HF is not considered in the design,theirspecific needs will not be adequately taken intoaccount.

Then operators being human (hence inventive) willeffect shortcuts by routinely 'shelving', or 'fixing',alarms so that they could focus better on ones theythink are the key ones.


68/75

68

Collect Data

Basic data collectioAn-ControlRm Determine Mitigation Strategies

Management of Safety

Critical Staff

Alarm Audit andReorganisation

Alarm and Interlock Schedule Recruitment & Selection Proof testing of Alartms

Training & competenceLogic diagrams Critical Alarm Report

Procedures

Planning for upsetconditionsHealth management

Data

driven,

continuousFatigue management Assess the existing

SchemeCommunications

improvement Interact and freeze theOptimum Scheme

Analyse Data Briefings & education

Prioritise Alarms SimulatorsDevelop and Implementrevised Alarm schemeTable top exercise/Mock DrillOperator Response to Alarms

Human Failures/Risk Factors

Operational Risk Factors

Piping Instrumentation Diagram

Managing Human Factor-Control Room operators


69/75

69


70/75

70

Ignorance Iceberg

4% of senior managersare aware of errors(above the waterline)

6% of managers are

aware of errors (abovethe waterline)

75% of first linesupervisors are awareof errors below the

waterline) 100% of employees are

aware of errors (belowthe waterline)


71/75

71

The further one moves from the

Plant floor, the less knowledge ofthe organisations errors are known to him


72/75

72

Importance of HF in MAH Industries

Major accidents Causes: Insufficient staffing levels

Increased workload

Reduction in supervision

Team-working deficiencies

Loss of competence /experience

Unclear roles & responsibilities

Conflicting priorities Poor communications

Reduced morale /motivation


73/75

73

1: Accept humans can and will

fail

2: Get better at

explaining failures predicting failures 3: Apply the hierarchy of

controls

1.

Accept

thefacts

of life


74/75

74


75/75

75

ImptHum Fac

Documents

Transcript of ImptHum Fac