Hazard causal factor

A more careful comparison has also been made. JAXA (the Japanese Space Agency) and MIT engineers compared the use of STPA on a JAXA unmanned spacecraft (HTV) to transfer cargo to the International Space Station (ISS). Because human life is potentially involved (one hazard is collision with the International Space Station), rigorous NASA hazard analysis standards using fault trees and other analyses had been employed and reviewed by NASA. In an STPA analysis of the HTV used in an evaluation of the new technique for potential use at JAXA, all of the hazard causal factors identified by the fault tree analysis were identified also by STPA [88]. As with the BMDS comparison, additional causal factors were identified by STPA alone. These additional causal factors again involved those related to more sophisticated types of errors beyond simple component failures and those related to software and human errors. 

Limitations are often associated with hazards or hazard causal factors that could not be completely eliminated or controlled in the design. Thus they represent accepted risks. For example,... 

Safety sampling is another technique that can be stmctured for the specific purpose of identifying hazards (causal factors) that have high severity potential. This method relies on the knowledge and expertise of personnel who are familiar with operations and well-trained in recognizing hazards (physical and operational). 

A credible hazard is an identified hazard that is reasonable and realistic based on the best design information available. The hazard causal factors (HCFs) are plausible and convincing. When the hazard or its causal factors can be proven to not exist, then the hazard is no longer credible. If a hazard has an extremely small probability of occurrence that does not mean it is not credible credible refers to the fact that the hazard is possible, regardless of probability. 

Hazard causal factors (e.g., failures, human error, software errors, design flaws, environment)... 

The human factors audit was part of a hazard analysis which was used to recommend the degree of automation required in blowdown situations. The results of the human factors audit were mainly in terms of major errors which could affect blowdown success likelihood, and causal factors such as procedures, training, control room design, team communications, and aspects of hardware equipment. The major emphasis of the study was on improving the human interaction with the blowdown system, whether manual or automatic. Two specific platform scenarios were investigated. One was a significant gas release in the molecular sieve module (MSM) on a relatively new platform, and the other a release in the separator module (SM) on an older generation platform. 

HAZARDOUS EVENTS CAUSAL FACTORS RISK ASS. EFFECTS CODE COMMENTS... 

EPA ARIP Responses to questionnaires sent by EPA from facilities that have had significant releases purpose is to learn about causes and consequences of hazardous material incidents 1986-Present Supplements NRC reports for more significant events Additional information on causal factors, consequences, and company safety programs Data are easily analyzed for common causes Includes all states and localities Survey relies on voluntary compliance Not comprehensive limited to select cases Checklist approach limits value of information to understand root cause Not designed to be a lessons-leamed database... 

Once the causal factors have been identified, the factors are analyzed using a root cause analysis tool, such as 5-AVhys or predefined trees. See Chapter 9 for a more detailed discussion of Barrier Analysis (sometimes called hazard-barrier-target analysis or HBTA) and Change Analysis (also referred to as Change Evaluation/Analysis or CE/A). In essence, these tools act as a filter to limit the number of factors, which are subjected to further analysis to determine root causes. 

The design of most process plants relies on redundant safety features or layers of protection, such that multiple layers must fail before a serious incident occurs. Barrier analysis ) (also called Hazard-Barrier-Target Analysis, HBTA) can assist the identification of causal factors by identifying which safety feature(s) failed to function as desired and allowed the sequence of events to occur. These safety features or barriers are anything that is used to protect a system or person from a hazard including both physical and administrative layers of protection. The concepts of the hazard-barrier-target theory of incident causation are encompassed in this tool. (See Chapter 3.)... 

Change analysis o) (also known as Change Evaluation/Analysis, CE/A) is another tool that can assist the identification of causal factors. It is useful for brainstorming about what has changed since conditions were safe, or perceived as safe. It may also be used for hypothesizing potential contributory factors to a hazardous condition or action. 

The following are two examples of causal factors identified using STPA step 2 as potentially leading to the hazardous state (violation of the safety constraint). Neither of these examples involves component failures, but both instead result from unsafe component interactions and other more complex causes that are for the most part not identifiable by current hazard analysis methods. 

Using the augmented control structure, the remaining activities in STPA are to identify potentially hazardous control actions by each of the system components that could violate the safety constraints, determine the causal factors that could lead to these hazardous control actions, and prevent or control them in the system design. The process thus involves a top-down identification of scenarios in which the safety... 

Although some causal factors can be hypothesized early, a hazard analysis using STPA can be used to generate a more complete list of causal factors later in the development process to guide the design process after an architecture is chosen. 

If several safety professionals investigate a given hazards-related incident, they should identify the same causal factors, with minimum variation. That is unlikely if the thought processes they use have greatly different foundations. At least 25 causation models have been published. Since many of them conflict, all of them cannot be valid. A review of some of them is followed by a discussion of principles that should be contained in a causation model. 

Most importantly, results of investigations and the actions to be taken concerning causal factors are publicized. Quality of incident reporting and investigation required or tolerated is a principal measure of the accountability system, and of the culture of which the accountability system is a part. It s very difficult to achieve effectiveness in other aspects of hazards management if corrective action is not taken concerning the causal factors for the incidents that do occur. 

Post incident—through investigation of hazards-related incidents to determine and eliminate or control their causal factors. 

Hazards-related incidents, even the ordinary and frequent, are complex and have multiple and interacting causal factors. 

If hazard identification and analysis do not relate to actual causal factors, corrective actions will be misdirected and ineffective. 

Extrapolating from Deming, a large majority of the causal factors for hazards-related incidents are systemic, and a small minority will be principally employee-focused. 

For most all hazards-related incidents, even those that seem to present the least complexity, there are multiple causal factors that derive from less than adequate workplace and work methods design engineering, management and operations, and personnel task performance practices. 

In the hazards-related incident process, deriving from those multiple causal factors ... 

It s possible that the substance of the communications of too many safety professionals to decision makers is perceived as shallow, superficial, and not pertinent to an entity s real hazards management needs. Much of our language developed years ago. It is time to evaluate the real substance of it. As an example, are the terms unsafe act and unsafe condition obsolete Ergonomists and industrial hygienists — closely related practitioners— don t use those terms. They speak of risk factors or causal factors. 

Present methods to identify and act on hazards before they become the causal factors for accidents resulting in severe injuries... 

As you review these incidents, hy to determine the causal factors and how the first hazard, hazardous event, or decision led to other causal factors, in a sequential and cascading manner. The purpose here is to encourage thinking about the complexity and uniqueness of the incident process that resulted in fatality. 

Causal factors include all of the elements—the hazards (the characteristics of things, and the actions and inactions of people) and the events deriving from them—that contribute to the incident process. 

This chapter addresses the need for safety professionals to adopt an incident causation model, a thought process based on a sound understanding of the hazards-related incident phenomenon and which, when applied, identifies the reality of the causal factors in the incident process. 

Safety professionals apply differing and contradictory incident causation models, and the work of some of them is misdirected and ineffective. Professional safety practice requires that the advice given to avoid, eliminate, or control hazards be based on a sound incident causation model, a thought process, so that, through the application of that model, the desired risk reduction is attained. That will not occur if the causation model used does not require identifying the actual causal factors. 

Assume that a given hazards-related incident is to be investigated. Safety professionals who have adopted, and give prominence and near exclusivity to, one or the other of those concepts would give greatly divergent remediation advice. The advice deriving from a narrow application of either approach would not address all of the causal factors, nor would the remedial actions proposed achieve the needed risk reduction. 

As used in this treatise, causation means the act or agency of causing or producing an effect. Causal factors include all of the elements — the events, the characteristics of things, and the actions or inactions of persons— that contribute to the incident process. A model is to represent the theoretical ideal for the process through which hazards-related incidents occur, a process that requires determining when the phenomenon begins and ends. 

---