Feedback Channels

Feedback is a basic part of STAMP and of treating safety as a control problem. Information flow is key in maintaining safety. 

The desire to predict the future often leads to collecting a large amount of information based on the hope that something useful will be obtained and noticed. The NASA Space Shuttle program was collecting six hundred metrics a month before the loss of Columbia. Companies often collect data on occupational safety, such as days without a lost time accident, and they assume that these data reflect on system safety [17], which of course it does not. Not only is this misuse of data potentially misleading, but collecting information that may not be indicative of real risk diverts limited resources and attention from more effective risk-reduction efforts. 

Poorly defined feedback can lead to a decrease in safety. As an incentive to reduce the number of accidents in the California construction industry, for example, workers with the best safety records—as measured by fewest reported incidents— were rewarded [126]. The reward created an incentive to withhold information about small accidents and near misses, and they could not therefore be investigated and the causes eliminated. Under-reporting of incidents created the illusion that the system was becoming safer, when instead risk had merely been muted. The inaccurate risk perception by management led to not taking the necessary control actions to reduce risk. Instead, the reporting of accidents should have been rewarded. 

Feedback requirements should be determined with respect to the design of the organization s safety control structure, the safety constraints (derived from the system hazards) that must be enforced on system operation, and the assumptions and rationale underlying the system design for safety. They will be similar for different organizations only to the extent that the hazards, safety constraints, and system design are similar. 

The hazards and safety constraints, as well as the causal information derived by the use of STPA, form the foundation for determining what feedback is necessary to provide the controllers with the information they need to satisfy their safety 

---

Figure 3.1 A simplified version of Reason s (1990) model of safety-related feedback channels.

Another important reaction supporting nonlinear behaviour is the so-called FIS system, which involves a modification of the iodate-sulfite (Landolt) system by addition of ferrocyanide ion. The Landolt system alone supports bistability in a CSTR the addition of an extra feedback channel leads to an oscillatory system in a flow reactor. (This is a general and powerful technique, exploiting a feature known as the cross-shaped diagram , that has led to the design of the majority of known solution-phase oscillatory systems in flow... 

When the agnals are fed back over the feedback channel in such a manner that they... 

At each level of the hierarchical structure, inadequate control may result from missing constraints (unassigned responsibility for safety), inadequate safety control commands, commands that were not executed correctly at a lower level, or inadequately communicated or processed feedback about constraint enforcement. For example, an operations manager may provide unsafe work instructions or procedures to the operators, or the manager may provide instructions that enforce the safety constraints, but the operators may ignore them. The operations manager may not have the feedback channels established to determine that unsafe instructions were provided or that his or her safety-related instructions are not being followed. 

Besides setting the culture through their own behavior, managers need to establish the organizational safety policy and create a safety control structure with appropriate responsibilities, accountability and authority, safety controls, and feedback channels. Management must also establish a safety management plan and ensure that a safety information system and continual learning and improvement processes are in place and effective. 

Because feedback is so important to safety, robustness must be designed into feedback channels. The problem of feedback in emergencies is complicated by the fact that disturbances may lead to failure of sensors. The information available to the controllers (or to an automated system) becomes increasingly unreliable as the disturbance progresses. 

At Citichem, all problems were reported orally to the control room operator, who was supposed to report them to someone above him. One conduit for information, of course, leads to a very fragile reporting system. At the same time, there were few formal communication and feedback channels established—communication was informal and ad hoc, both within Citichem and between Citichem and the local government. 

Improve process safety communication channels both within the corporate level as well as information and feedback channels from Citichem plants to corporate management. 

Regularize and improve communication channels. Create the operational feedback channels from controlled components to controllers necessary to maintain accurate process models to assist in safety-related decision making. If the channels exist but are not used, then the reason why they are unused should be determined and appropriate changes made. 

Just investigating the incident or accident is, of course, not enough. Recommendations must be implemented to be useful. Responsibility must be assigned for ensuring that changes are actually made. In addition, feedback channels should be established to determine whether the recommendations and changes were successful in reducing risk. 

Finally, not only must a safety policy be defined, it must be disseminated and followed. Management needs to ensure that safety receives appropriate attention in decision making. Feedback channels must be established and progress in achieving the goals should be monitored and improvements identified, prioritized, and implemented. 

Create a corporate or organizational safety policy. Establish criteria for evaluating safety-critical decisions and implementing safety controls. Estabhsh distribution channels for the policy. Estabhsh feedback channels to determine whether employees understand it, are following it, and whether it is effective. Update the policy as needed. 

Establish safety education and training for all employees and establish feedback channels to determine whether it is effective along with processes for continual improvement. The education should include reminders of past accidents and causes and input from lessons learned and trouble reports. Assessment of effectiveness may include information obtained from knowledge assessments during audits. 

Perform an in-depth investigation of any operational anomalies, including hazardous conditions (such as water in a tank that will contain chemicals that react to water) or events. Determine why they occurred before any potentially dangerous operations are started or restarted. Provide the training necessary to do this type of investigation and proper feedback channels to management. 

Perform safety audits, performance assessments, and inspections using the hazard analysis results as the preconditions for operations and maintenance. Collect data to ensure safety policies and procedures are being followed and that education and training about safety is effective. Establish feedback channels for leading indicators of increasing risk. 

Use the hazard analysis and documentation created during development and passed to operations to identify leading indicators of migration toward states of higher risk. Establish feedback channels to detect the leading indicators and respond appropriately. 

Feedback There was a missing or inadequate feedback channel from the launch personnel to the development organization. 

Establish feedback channels for adverse test results. Provide multiple paths. Enforce legislation, regulations and policies applying to construction and operation of municipal water systems. 

No monitoring or feedback channels established to evaluate impact of changes. 

All of these changes in the Ontario water safety control structure over time led to the modified control structure shown in figure C.7. Dotted lines represent communication, control or feedback channels that still existed but had become ineffective. One thing to notice in comparing the original structure at the top and the one at the bottom is the disappearance of many of the feedback loops. 

The institution has in place rapid, useful, and intelligible feedback channels to communicate the lessons learned from both the reactive and proactive safety information systems. Throughout the institution the emphasis is on generalizing these lessons to the system at large rather than merely localizing failures and weaknesses. 

---