Human faults

Viewed in this context, the Three-Mile Island (TMI) accident was the coup de grace for an already foundering industry. In spite of the fact that the hydrogen gas bubble that accumulated in Reactor 2 did not explode, although some contaminated gas escaped and that the commissions who investigated the accident faulted human error rather than equipment failure, TMI caused (as the New York Times... 

X-rays may be detected either photographically or with an ionization counter. They have great penetrating power which increases with their frequency, and owing to this are used to photograph the interior of many solid objects, notably the human body and in monitoring for faults in construction. 

Early failures may occur almost immediately, and the failure rate is determined by manufacturing faults or poor repairs. Random failures are due to mechanical or human failure, while wear failure occurs mainly due to mechanical faults as the equipment becomes old. One of the techniques used by maintenance engineers is to record the mean time to failure (MTF) of equipment items to find out in which period a piece of equipment is likely to fail. This provides some of the information required to determine an appropriate maintenance strategy tor each equipment item. 

Process Hazards Analysis. Analysis of processes for unrecogni2ed or inadequately controUed ha2ards (see Hazard analysis and risk assessment) is required by OSHA (36). The principal methods of analysis, in an approximate ascending order of intensity, are what-if checklist failure modes and effects ha2ard and operabiHty (HAZOP) and fault-tree analysis. Other complementary methods include human error prediction and cost/benefit analysis. The HAZOP method is the most popular as of 1995 because it can be used to identify ha2ards, pinpoint their causes and consequences, and disclose the need for protective systems. Fault-tree analysis is the method to be used if a quantitative evaluation of operational safety is needed to justify the implementation of process improvements. 

ETA breaks down an accident iato its contributing equipment failures and human errors (70). The method therefore is a reverse-thinking technique, ie, the analyst begias with an accident or undesirable event that is to be avoided and identifies the immediate cause of that event. Each of the immediate causes is examined ia turn until the analyst has identified the basic causes of each event. The fault tree is a diagram that displays the logical iaterrelationships between these basic causes and the accident. 

Figure 21.1 as in lEC 60479-1 illustrates the various zones of ground leakage current versus duration of fault and its effect on a human body. 

We discussed in Section 21.1.1 the maximum tolerable currents through a human body and their duration. The potential difference in a ground conductor at any point where a human body may come into contact with it during the course of a ground fault should be such that the resultant current through the human body will remain within these tolerable limits. 

Exposure of a human body to touch and step voltages and methods to deal with these are also covered. Grounding and ground fault protection schemes are described in detail with illustrations to help an engineer to select the most appropriate grounding method and ground fault protection scheme for a machine or system. 

Frequency Phase 3 Use Branch Point Estimates to Develop a Ere-quency Estimate for the Accident Scenarios. The analysis team may choose to assign frequency values for initiating events and probability values for the branch points of the event trees without drawing fault tree models. These estimates are based on discussions with operating personnel, review of industrial equipment failure databases, and review of human reliability studies. This allows the team to provide initial estimates of scenario frequency and avoids the effort of the detailed analysis (Frequency Phase 4). In many cases, characterizing a few dominant accident scenarios in a layer of protection analysis will provide adequate frequency information. 

Bad laboratory analyses are not always the fault of the laboratory.. Sampling plays a big role. One plant superintendent investigated every instance of suspect analyses in his plant using elaborate around-the-clock methods over a considerable period. His results revealed that over one half of the bad analyses were not the fault of the laboratory. We are all human and bad analyses will result from time to time. Rather than resubmit samples, it may be well to spend a few minutes using the following methods as referees to evaluate the reasonableness of the results. 

Human factors, discussed in Section 4.2, enter a fault tree in the same manner as a component failure. The failure of manual actions, that prevent or mitigate an accident, are treated the same as hardware failures. The human error failure probability is conditioned by performance sluiping factors imposed by stress, training and the environment. 

Some PSAs (e.g., RSS) put human actions in the fault trees. 

In any given situation, there may be different levels of dependence between an operator s performance on one task and on another because of the characteristics of the tasks theraseb e.s. or because of the manner in which the operator was cued to perform the tasks. Dependence levels between the performances of two (or more) operators also may differ. The analyses should account for dependency in human-error probabilities. In addition, each sequence may have a set of human recovery actions that if successfully performed will terminate or reduce the consequences of the sequence. This information, coupled with a knowledge of the system success criteria leads to the development of human success and failure probabilities which are input to the quantification of the fault iices or event trees. With this last step, the HRA is integrated into the PSA, and Pl. ise 4 is complete. 

Equipment Failures Safety system Ignition Sources Furnaces, Flares, Incinerators, Vehicles, Electrical switches. Static electricity, Hot surfaces. Cigarettes Human Failures Omission, Commission, Fault diagnosis. Decisions Domino Effects Other containment failures. Other material release External Conditions Meteorology, Visibility... 

The ESDs were then translated into associated event trees. A generic event tree was developed for all initiators not involving LOCA. The generic transient event tree for each category of the transient initiators and loss of offsite power were specialized by the impact of the initiators on the safety and support systems, from the success criteria of the mitigating systems, and the initiator-specific human actions which were modeled in the fault trees. 

The accident sequence frequencies are quantified by linking the system fault tree models together as indicated by the event trees for the accident sequence and quantified with plant-specific data to estimate initiator frequencies and component/human failure rates. The SETS code solves the fault trees for their minimal cutsets the TEMAC code quantitatively evaluates ihe cm sols and provides best estimates of component/event probabilities and frequencies. 

Typical events that are considered are fire, explosion, ship collision, and the failure of pressurized storage vessels for which historical data established the failure frequencies. Assessment of consequences was based partly on conservative treatment of past experience. For example ilic assessment of the number of casualties from the release of a toxic material was based on past histoiy conditioned by knowledge of the toxicology and the prevailing weather conditions. An altemati. e used fault trees to estimate probabilities and identify the consequences. Credit is taken in this process for preventative measures in design, operation, and maintenance procedures. Historical data provide reliability expected from plant components and humans. 

This incident is typical of those that would at one time have been blamed on human failing—the operator was at fault, and there was nothing anyone else eould have done. In faet investigation showed that ... 

This factor refers to the spatial organization of the information displays. In general, instruments displaying process parameters that are functionally related should also be physically close. In this way, it is likely that a given fault will lead to a symptom pattern that is easier to interpret than a random distribution of information. Although violation of this principle may not induce errors in a direct manner, it may hinder human performance. The following example illustrates this point. 

From a human reliability perspective, a number of interesting points arise from this example. A simple calculation shows that the frequency of a major release (3.2 x lO"" per year) is dominated by human errors. The major contribution to this frequency is the frequency of a spill during truck unloading (3 X10" per year). An examination of the fault tree for this event shows that this frequency is dominated by event B15 Insufficient volume in tank to imload truck, and B16 Failure of, or ignoring LIA-1. Of these events, B15 could be due to a prior human error, and B16 would be a combination of instrument failure and human error. (Note however, that we are not necessarily assigning the causes of the errors solely to the operator. The role of management influences on error will be discussed later.) Apart from the dominant sequence discussed above, human-caused failures are likely to occur throughout the fault tree. It is usually the case that human error dominates a risk assessment, if it is properly considered in the analysis. This is illustrated in Bellamy et al. (1986) with an example from the analysis of an offshore lifeboat system. 

---