Future accident

For many years the usual procedure in plant design was to identify the hazards, by one of the systematic techniques described later or by waiting until an accident occurred, and then add on protec tive equipment to control future accidents or protect people from their consequences. This protective equipment is often complex and expensive and requires regular testing and maintenance. It often interferes with the smooth operation of the plant and is sometimes bypassed. Gradually the industry came to resize that, whenever possible, one should design user-friendly plants which can withstand human error and equipment failure without serious effects on safety (and output and emciency). When we handle flammable, explosive, toxic, or corrosive materials we can tolerate only very low failure rates, of people and equipment—rates which it may be impossible or impracticable to achieve consistently for long periods of time. 

M. he investigation of accidents and near misses (that is, close calls) provides opportunities to learn how to prevent similar events in the future. Accident investigations, including detailed descriptions and recommendations, are commonly shared within the chemical industry. Many professionals believe that this sharing of information about accidents has been a major contributor to the steady improvement in safety performance. 

Major chemical process incidents are often preceded by multiple warning symptoms in the months, days, or hours before the incident. These symptoms may be occurrences that are called near misses, but what exactly is a near miss A near miss is an incident that presents an opportunity to learn valuable information that may prevent future accidents. 

From a safety management perspective a specific goal within this broader purpose is then to identify likely factors or system elements in the sequence of events leading to near misses which in turn may be considered as precursors to actual future accidents. From such a qualitative analysis two ways emerge to reduce the likelihood of such actual accidents error-inducing factors can be eliminated (or their potential impact weakened), and recovery-promoting factors can be strengthened (or even introduced) in the system. 

Eur 7.5 million has been allowed for future accident and environmental liabilities in the financial accounts. 

For the analysis of accidents and incidents in aviation, roughly two streams can be distinguished in the literature, namely accident analysis and risk analysis. Whilst the former has the goal to determine the cause of an accident that actually took place, the latter aims to assess the likelihood of the occurrence of future accidents. Hence, although both streams have similar purposes, a main difference is that accident analysis attempts to identify one specific combination of hazardous factors, whereas risk analysis basically explores a whole range of such factors, and the associated risks. Nevertheless, most of the existing approaches are used for both streams. 

As an alternative, the current paper presents an approach for analysis of aviation incidents that takes a multi-agent perspective, and is based on formal methods. The approach is an extension of the approach introduced in the work of Bosse and Mogles [4], which was in turn inspired by Blom, Bakker, Blanker, Daams, Everdij and Klompstra [1]. Whereas this approach mainly focuses on the analysis of existing accidents (also called accident analysis or retrospective analysis), the current paper also addresses analysis of potential future accidents (called risk analysis or prospective analysis). This is done by means of a multi-agent simulation framework that addresses both the behaviour of individual agents (operators, pilots) as well as their mutual communication, and interaction with technical systems. By manipulating various parameters in the model, different scenarios can be explored. Moreover, by means of automated checks of dynamic properties, these scenarios can be assessed with respect to their likelihood of the occurrence of accidents. The approach is illustrated by a case study on a runway incursion incident at a large European airport in 1995. 

An underlying assumption of all accident models is that there are common patterns in accidents and that they are not simply random events. Accident models impose patterns on accidents and influence the factors considered in any safety analysis. Because the accident model influences what cause(s) is ascribed to an accident, the countermeasures taken to prevent future accidents, and the evaluation of the risk in operating a system, the power and features of the accident model used will greatly affect our ability to identify and control hazards and thus prevent accidents. 

Making such distinctions between causes or limiting the factors considered can be a hindrance in learning lirom and preventing future accidents. Consider the following aircraft examples. 

The third set of causal factors is only indirectly related to the events and conditions, but these indirect factors are critical in fully understanding why the accident occurred and thus how to prevent future accidents. In this case, the systemic factors include the owner of the ferry (Townsend Thoresen) needing ships that were designed to permit fast loading and unloading and quick acceleration in order to remain competitive in the ferry business, and pressure by company management on the captain and first officer to strictly adhere to schedules, also related to competitive factors. 

An accident model should encourage a broad view of accident mechanisms that expands the investigation beyond the proximate events A narrow focus on operator actions, physical component failures, and technology may lead to ignoring some of the most important factors in terms of preventing future accidents. The whole concept of root cause needs to be reconsidered. 

Where does all this leave us There are two possible reasons for conducting an accident investigation (1) to assign blame for the accident and (2) to understand why it happened so that future accidents can be prevented. When the goal is to assign blame, the backward chain of events considered often stops when someone or something appropriate to blame is found, such as the baggage handler in the... 

In this conception of safety, there is no root cause. Instead, the accident cause consists of an inadequate safety control structure that under some circumstances leads to the violation of a behavioral safety constraint. Preventing future accidents requires reengineering or designing the safety control structure to be more effective. 

If the objective of the accident analysis is to assign blame, then the different radio frequencies could be considered irrelevant because the differing technology meant they could not have communicated even if they had been on the same frequency. If the objective, however, is to learn enough to prevent future accidents, then the different radio frequencies are relevant. 

Because the official report focused only on the role of the operators in the accident and did not even examine that in depth, a chance to detect flaws in the design and operation of the plant that could lead to future accidents was lost. To prevent future accidents, the report needed to explain such things as why the HAZOP performed on the unit did not identify any of the alarms in this unit as critical. Is there some deficiency in HAZOP or in the way it is being performed in this company Why were there no procedures in place, or why were the ones in place ineffective, to respond to the emergency Either the hazard was not identified, the company does not have a poliqr to create procedures for dealing with hazards, or it was an oversight and there was no procedure in place to check that there is a response for all identified hazards. 

One consequence of the completeness of a STAMP analysis is that many possible recommendations may result—in some cases, too many to be practical to include in the final accident report. A determination of the relative importance of the potential recommendations may be required in terms of having the greatest impact on the largest number of potential future accidents. There is no algorithm for identifying these recommendations, nor can there be. Political and situational factors will always be involved in such decisions. Understanding the entire accident process and the overall safety control structure should help with this identification, however. 

The analysis of past accidents may provide lessons learned to avoid the recurrence of accidents and to improve emergency response in future accidents. In order to obtain data about the vulnerability of the equipment items and to get a possible correlation between the lightning severity and the possible damage states, the historical analysis of past accidents was used as a starting point. In fact, the review of records on industrial accidents triggered by lightning events may allow the identification of ... 

---