Human error consequences

In particular, with respect to equipment/system, human error consequences may be categorized under the following three classifications [2,14] ... 

Human-error consequence. An undesired consequence of human failiuie. 

Process Hazards Analysis. Analysis of processes for unrecogni2ed or inadequately controUed ha2ards (see Hazard analysis and risk assessment) is required by OSHA (36). The principal methods of analysis, in an approximate ascending order of intensity, are what-if checklist failure modes and effects ha2ard and operabiHty (HAZOP) and fault-tree analysis. Other complementary methods include human error prediction and cost/benefit analysis. The HAZOP method is the most popular as of 1995 because it can be used to identify ha2ards, pinpoint their causes and consequences, and disclose the need for protective systems. Fault-tree analysis is the method to be used if a quantitative evaluation of operational safety is needed to justify the implementation of process improvements. 

Another difficulty is assessing the potential for human errors. If redundancy is accompanied with increased complexity, the resulting increased potential for human errors must be taken into consideration. Redundant systems require maintenance procedures that can correct problems in one part of the system while the remainder of the system is in full operation. When conducting maintenance in such situations, the consequences of human errors can be rather unpleasant. 

The possibility of a human error in the maintenance of the process controls having consequences for the safety interlock system is eliminated. 

Inherently Safer Design Rather than add on equipment to control hazards or to protect people from their consequences, it is better to design user-friendly plants which can withstand human error and equipment failure without serious effects on safety, the environment, output, and efficiency. This part is concerned with this matter. 

For many years the usual procedure in plant design was to identify the hazards, by one of the systematic techniques described later or by waiting until an accident occurred, and then add on protec tive equipment to control future accidents or protect people from their consequences. This protective equipment is often complex and expensive and requires regular testing and maintenance. It often interferes with the smooth operation of the plant and is sometimes bypassed. Gradually the industry came to resize that, whenever possible, one should design user-friendly plants which can withstand human error and equipment failure without serious effects on safety (and output and emciency). When we handle flammable, explosive, toxic, or corrosive materials we can tolerate only very low failure rates, of people and equipment—rates which it may be impossible or impracticable to achieve consistently for long periods of time. 

Frequency Phase 1 Perform Qualitative Study, Typically Using HAZOP, FMEA, or What-if Analysis. To perform a qualitative study you should first (1) define the consequences of interest, (2) identify the initiating events and accident scenarios that could lead to the consequences of interest, and (3) identify the equipment failure modes and human errors that could contribute to the accident... 

In any given situation, there may be different levels of dependence between an operator s performance on one task and on another because of the characteristics of the tasks theraseb e.s. or because of the manner in which the operator was cued to perform the tasks. Dependence levels between the performances of two (or more) operators also may differ. The analyses should account for dependency in human-error probabilities. In addition, each sequence may have a set of human recovery actions that if successfully performed will terminate or reduce the consequences of the sequence. This information, coupled with a knowledge of the system success criteria leads to the development of human success and failure probabilities which are input to the quantification of the fault iices or event trees. With this last step, the HRA is integrated into the PSA, and Pl. ise 4 is complete. 

A critical assembly is a split bed on which fissionable material used to mock up up a separated reactor core that is stacked half on each half. One half is on roller guides so that the two halves may be quickly pulled apart if the neutron multiplication gets too high. Use the Preliminary Hazards Analysis method described in section 3,2.1 to identify the possible accidents that may occur and the qualitative probabilities and consequences. List the initiators in a matrix to systematically investigate the whole process. Don t forget human error. 

This section reflects on the limitations of the PSA process and draws extensively from NUREG-1050. These subjects are discussed as plant modeling and evaluation, data, human errors, accident processes, containment, fission product transport, consequence analysis, external events, and a perspective on the meaning of risk. 

In the case of a latent human error the consequences of the error may only become apparent after a period of time when the condition caused by the error combines with other errors or particular operational conditions. Two types of latent error can be distinguished. One category originates at the operational level and leads to some required system function being degraded or unavailable. Maintenance and inspection operations are a frequent source of this type of latent failure. 

Active Error/Failure An active human error is an unintended action or an intended action based on a mistaken diagnosis, interpretation, or other failure, which is not recovered and which has significant negative consequences for the system. 

The main thrust of the HF/E approach is to provide the conditions that will optimize human performance and implicitly minimize human error. However, there is rarely any attempt to predict the nature and likelihood of specific human errors and their consequences. By contrast, the study of human error in the context of systems reliability is concerned almost exclusively with these latter issues. It is appropriate to introduce the systems reliability assessment approach to human error at this stage because, until recently, it was largely... 

When performing human reliability assessment in CPQRA, a qualitative analysis to specify the various ways in which human error can occur in the situation of interest is necessary as the first stage of the procedure. A comprehensive and systematic method is essential for this. If, for example, an error with critical consequences for the system is not identified, then the analysis may produce a spurious impression that the level of risk is acceptably low. Errors with less serious consequences, but with greater likelihood of occurrence, may also not be considered if the modeling approach is inadequate. In the usual approach to human reliability assessment, there is little assistance for the analyst with regard to searching for potential errors. Often, only omissions of actions in proceduralized task steps are considered. 

The other main application area for predictive error analysis is in chemical process quantitative risk assessment (CPQRA) as a means of identifying human errors with significant risk consequences. In most cases, the generation of error modes in CPQRA is a somewhat unsystematic process, since it only considers errors that involve the failure to perform some pre-specified function, usually in an emergency (e.g., responding to an alarm within a time interval). The fact that errors of commission can arise as a result of diagnostic failures, or that poor interface design or procedures can also induce errors is rarely considered as part of CPQRA. However, this may be due to the fact that HEA techniques are not widely known in the chemical industry. The application of error analysis in CPQRA will be discussed further in Chapter 5. 

Predictive human error analysis (PHEA) is the process via which specific errors associated with tasks or task steps are predicted. The process also considers how these predicted errors might be recovered before they have negative consequences. The inputs to the process are the task structure and plans, as defined by the task analysis, and the results of the PIF analysis. The basic procedure of the PHEA is as follows ... 

The objective of consequence analysis is to evaluate the safety (or quality) consequences to the system of any human errors that may occur. Consequence Analysis obviously impacts on the overall risk assessment within which the human reliability analysis is embedded. In order to address this issue, it is necessary to consider the nature of the consequences of human error in more detail. 

At least three types of consequences are possible if a human error occurs in a task sequence ... 

During the PHEA stage, the analyst has to identify likely human errors and possible ways of error detection and recovery. The PHEA prompts the analyst to examine the main performance-influencing factors (PIFs) (see Chapter 3) which can contribute to critical errors. All the task steps at the bottom level of the HTA are analyzed in turn to identify likely error modes, their potential for recovery, their safety or quality consequences, and the main performance-influencing factors (PIFs) which can give rise to these errors. In this case study, credible errors were found for the majority of the task steps and each error had multiple causes. An analysis of two operations from the HTA is presented to illustrate the outputs of the PHEA. Figure 7.12 shows a PHEA of the two following tasks Receive instructions to pump and Reset system. 

The main output from this stage is a detailed assessment of the human error problem areas. If possible this should include quantitative data on the incidence of errors and the significance of their consequences. This will provide a valuable baseline against which to evaluate the success of the error management program. 

Recovery Error Failure to correct a human error before its consequences occur. 

There arc oilier methods of hazard identification. A "wliat-if analysis presents certain questions about a particular hazard and then tries to find llie possible consequences of that hazard. The human-error analysis identifies potential human errors that will lead to an accident. They can be used in conjunction with llic two previously described methods.. ... 

An event tree provides a diagrammatic representation of event sequences tliat begin with a so-called initiating event and terminate in one or more undesirable consequences. In contrast to a fault tree, which works backward from an undesirable consequence to possible causes, an event tree works forward from the initiating event to possible undesirable consequences. The initiating event may be equipment failure, human error, power failure, or some other event that has the potential for adversely affecting an ongoing process. 

A part of the test plan must include testing for the consequences of equipment malfunction, deviations in process conditions, and human error. Bench-scale equipment, for example, the RC1, is quite suitable for such experiments. By analysis of the process, critical conditions can be defined, which then need to be tested in order to be able to proceed safely from the laboratory to pilot plant studies. In testing abnormal conditions or process deviations, caution is required to assure that no uncontrollable hazard is created in the laboratory. Typical deviations, including impact on the process, are discussed in the following paragraph. 

A human error or reliability analysis (HRA) can be performed to identify points that may contribute to an accidental loss. Human errors may occur in all facets of a the hydrocarbon industry. They are generally related to the complexity of the equipment, human-equipment interfaces, hardware for emergency actions, and procedures for operations, testing and training. The probabilities of certain types of errors occurring are normally predicted as indicated in Table 29. Individual tasks can be analyzed to determine the probability of an error occurring. From these probabilities, consequences can be identified which detemline the risk of a particular error. 

---