CRIOP analysis

A CRIOP analysis is typically conducted in a workshop with experts on the system to be reviewed and a facilitator who leads the workshop. CRIOP consists of three... 

A CRIOP analysis is initiated by preparation and organization phase, in order to identify stakeholders, decide the scope and size of the analysis, identity relevant questions and scenarios to be elaborated and decide when the CRIOP should be performed. After the initial phase, CRIOP consists of the following two main phases ... 

One of the key issues in initiating the CRIOP analysis has been to select the relevant checklist items and scenarios during the planning and preparation phase. The identified issues should be further explored in the subsequent CRIOP analysis. The scenario analysis is an important arena for exploring challenging situations. Experienced CCR operators should be involved to identify scenarios to be explored. Given the limited time available for a CRIOP analysis, it is important not to include too many questions or too many scenarios. The CRIOP analysis must not be performed as a defence, or... 

The results of CRIOP analyses have been explored and used further in design projects. A good CRIOP analysis does result in recommendations that are implemented. The CRIOP method has been used by StatoilHydro on Oseberg C, Troll B, Njord, Visund, Troll C, Oseberg S0r, Crane and many other installations. 

When the CRIOP analysis is planned, experienced personnel must be involved in order to identify relevant issues to be explored in the subsequent CRIOP analysis. It is important to focus both on key questions to be explored and to identify key scenarios. 

A process description should outline a step by step procedure on how to assess the relevance of each point in a checklist to match the CC design maturity and CC type, the basic assessment of when to exclude a checklist item and when to keep an item. Typically, some of the points will be easy to exclude, clearly irrelevant at a given stage in the design process, while others will be less obvious. The rationale for exclusion should be included in the CRIOP analysis documentation. 

A CRIOP analysis consists of two parts. Part I is a standard design review of the plant s control centre. It employs checklists, covering applicable codes, standards and regulations. The following areas are checked ... 

Johnsen S.O., Bjorkli C., Steiro T, Fartum H., Haukenes H., Ramberg X, Skriver X. (2008) CRIOP -A scenario method for Crisis Intervention and Operability analysis . SINTEF (2008) ISBN 9788214042962. Retrieved from www.criop.sintef.no at 1/1-2009. 

CRIOP is performed to avoid accidents, based on risk analysis, and to build and support resilience (i.e. where resilience is considered as the ability to handle surprises and continue operations). 

Phases 0-2 of the CRIOP main phases are covered in the validation (0) Preparation and organisation, (1) General analysis including checklists, (2) Scenario analysis, (3) Actions and (4) implementation and follow up. 

The initial validation process aims to achieve the same analysis of real world ISS (International Space Station) operations anomalies by using the SPACE-CRIOP method. The CRIOP method should be able to identify weak points related to safety in advance of a real time operation. 

Model errors and recoveries through scenario analysis and practice as described in the CRIOP method... 

The results from the analysis performed by CRIOP, OCCO and SPAR-H may influence human dependability. We suggest that further work in the space domain perform several pilot projects exploring CRIOP, OCCO and SPAR-H. 

Johnsen, S.O. Stene, T.M. 2014. Improving human resilience in space and distributed environments by CRIOP. Safety, Reliability and Risk Analysis Beyond the Horizon, (Eds) Steenbergen et al. Taylor Francis Group, London, pp 293-302. 

During 2006 we interviewed 21 persons regarding their use of CRIOP. A detailed description of this study can be found in Aas and Johnsen [14]. We prepared and used an interview guide and we applied the constant comparison method to analyze the interview results. In our analysis we have focused on positive and negative opinions among the interviewees, as well as their comments and suggestions. See Fig. 2 for an overview of the stakeholders. 

We constructed the CRIOP survey questionnaire based on the research question Are existing supporting tools for CC design and V V suitable for use with ISO 110641 Our objective was to map how the opinion of this tool among the stakeholders. We used a balanced seven level Likert scale in our survey and we used visual analysis and simple statistical methods to analyze the survey results. 

Almost one third (29%) of the interviewees answered that CRIOP scenario analysis is a good method. It was also pointed out by one quarter (24%) that scenarios were good validation or at least better than checklists. On the other hand, 18% pointed out... 

Table 2. Overview of CRIOP scenario analysis survey results based on the percentage agreeing to given statements (n=20)...

Twenty of the respondents had participated in CRIOP scenario analyses. The most significant results (Table 2) were similar to the results for the CRIOP checklists. The results showed that four out of five (80%) agreed that the CRIOP scenario analysis is an effective tool to verify a CC design and three out of four (75%) agreed that they are an effective tool to validate a CC design. 

During the workshops it was also mentioned that the checklist contained many questions and that the questions were somewhat academic or theoretical. Some of the questions were difficult to answer by a clear Yes or No. But even participants who initially were sceptical to CRIOP were positively surprised by the discussions and the results of the analysis. 

Several interviewees stated that the CRIOP scenario analysis was a better V V tool than the CRIOP checklists. One reason for this can be that scenarios tend to be more specific about the system with a clear scope and thus are easier to relate to. But several of the interviewees also pointed out that the scenario analysis was only a validation of the scenarios, and not necessarily a validation of the entire system. Thus, the selection of scenarios is crucial for the success of such analyses. 

IEEE IEEE standard for software verification and validation. IEEE Std 1012-1998 (1998) Johnsen, S.O., Bjprkli, C., Steiro, T., Fartum, H., Haukenes, H., Ramberg, J., Skriver, J. CRIOP A scenario method for Crisis Intervention and Operability analysis (accessed February 2, 2008), http //www. criop. sintef. no/The%20CRIOP%20report/ CRIOPReport.pdf... 

This Part reviews different risk-analysis methods. Risk analysis is a planned activity involving an identification and evaluation of accident risks in the workplace. We will start in Chapter 21 by establishing some common principles of the different risk-analysis methods. We will then in Chapters 22 to 25 go through four different methods that primarily are used in the analysis of the risk of occupational accidents energy analysis, job-safety analysis and comparison analysis. One chapter is dedicated to the risk assessment of machinery. Finally, we will in Chapter 26 review the CRIOP method, where the interaction between the operators and the technical system are analysed when the system is in a disturbed state. The aim is here to prevent major accidents. 

Figure 21.2 illustrates how the starting point, the directions and the scope of each method fit into the accident-analysis framework of Chapter 6. Two of the methods. Fault tree analysis and Comparison analysis are deductive in that they start with the unwanted event. They proceed by analysing the underlying incidents and deviations (Fault tree analysis) or contributing factors (Comparison analysis). Several of the methods are mainly inductive in that they start with a deviation and proceed by studying the effects of this deviation. This applies to HAZOP, Failure mode and effect analysis. Event tree analysis and CRIOP, although they also have a component of causal analysis. Coarse analysis and Job-safety analysis start with the hazard and use a combination of inductive and deductive analyses. 

We will here focus on four different methods Coarse or energy analysis. Job-safety analysis. Comparison analysis and CRIOP. They all involve analyses of the effects of human performance on the risk of accidents. Use of experience of earlier accidents and incidents through discussions in problem-solving groups is another common denominator. We have earlier shown how group processes support in the identification and solving of SHE-related... 

CRIOP Evaluate the contributions from human actions to the failures in barriers against major accidents Process plant Establish potentia accident scenarios Identify critical human actions Human-factor analysis of the actions Consequences of human errors ... 

Action error analysis Fault tree analysis Event tree analysis Comparlsan analysis CRIOP... 

We will also look into a fourth method, CRIOP. In this analysis, the man-machine interface is in focus. The aim is to reduce the risk of major accidents by identifying a need to improve the conditions for a safe handling of disturbances by the operators. In CRIOP, we will apply an information ergonomics model of the interactions between the human operators and the environment in a disturbed system. 

CRIOP Part II helps us in analysing new accidents that may happen in the future in detail rather than at the summary level of the traditional technical risk analyses. The possibilities of transgressing barriers and the operators contributions are analysed successively, compare Figure 7.3 for the case of risks of fires and explosions. It starts by looking into the operators interventions in the process to control disturbances that, if not properly handled, may cause major accidents. In cases where there is a reasonable probability that the situation may deteriorate, the analysis proceeds by looking into the operators handling of the emergency situation. 

A problem encountered in CRIOP analyses is that the operators participating in the analysis lack the necessary imagination to envisage rare events. They base their experiences on events occurring with a frequency of up to 0.1 per year. Failures of technical barriers (e.g. a deluge skid on an offshore platform) or severe operator errors are usually much less frequent. 

Table 26.1 Record sheet for documentation of the CRIOP scenario analysis. Extracts of the results from the supply-boat scenario of Figure 26.2 are shown... 

In CRIOP, the team does not make any probability assessments. It is thus not possible to evaluate the effectiveness of remedial actions in terms of risk reduction. CRIOP may be combined with other risk analysis methods such as event tree analysis, which is suited for calculations of probabilities. A probability assessment requires access to human reliability data. 

---