Unplanned Changes

As noted earlier, people will tend to optimize their performance over time to meet a variety of goals. If an unsafe change is detected, it is important to respond quickly. People incorrectly reevaluate their perception of risk after a period of success. One way to interrupt this risk-reevaluation process is to intervene quickly to stop it before it leads to a further reduction in safety margins or a loss occurs. But that requires an alerting function to provide feedback to someone who is responsible for ensuring that the safety constraints are satisfied. 

The key is to allow flexibility in how safety goals are achieved, but not flexibility in violating them, and to provide the information that creates accurate risk perception by decision makers. 

Detecting migration toward riskier behavior starts with identifying baseline requirements. The requirements follow from the hazard analysis. These requirements may be general ( Equipment will not be operated above the identified safety-critical limits or Safety-critical equipment must be operational when the system is operating ) or specifically tied to the hazard analysis ( AWACS operators must always hand off aircraft when they enter and leave the no-fly zone or Pilots must always follow the TCAS alerts and continue to do so until they are canceled ). 

Is such a hard line approach impractical SUBSAFE, the US. nuclear submarine safety program established after the Thresher loss, described in chapter 14, has not allowed waiving the SUBSAFE safety requirements for more than forty-five years, with one exception. In 1967, four years after SUBSAFE was established, SUBSAFE requirements for one submarine were waived in order to satisfy pressing Navy performance goals. That submarine and its crew were lost less than a year later. The same mistake has not been made again. 

Like any set of controls, unplanned change controls involve designing appropriate control loops. In general, the process involves identifying the responsibility of the controller(s) collecting data (feedback) turning the feedback into useful 

---

Planned changes should be documented as part of a formal change monitoring process (for example via a quality assurance system). Unplanned changes should be identified during the accident investigation process. 

In what has been presented so far, it has been made clear that in the example of the hydrogen evolution reaction (h.e.r.), the degree of occupancy of the surface with adsorbed H (i.e., the radical intermediate) builds up with time after the electric current is switched on. The steady state of a reaction is defined as that state at which this buildup of intermediate radicals in the reaction has come to an end. As long as electronic instrumentation is present to keep control of the electrode potential (and the ambient conditions remain the same), the current density—the rate of electrical reaction per unit area—should then be constant. (This assumes a plentiful supply of reactants, i.e., no diffusion control.) It is advisable to add should be, because— particularly for electrode reactions on solids that involve the presence of radicals and are therefore subject to the properties of the surface—the latter may change relatively slowly (seconds) and a corresponding (and unplanned) change in reaction rate (observable in seconds and even minutes) may occur (Section 7.5.10). 

Studies are conducted to evaluate the adverse effects of chemicals and drugs, and are usually based on an earlier study plan. Deviations from study plans are not common. However, such deviations cannot be anticipated or totally ignored. In such a situation, there is a need for documentary evidence. Whereas an amendment is a planned change to the study plan, a deviation is an unplanned change that occurs during the study. Study information, such as a deviation from the study plan, should be noted in documentation. Such notes may be initiated by other personnel involved in the study but should be acknowledged by the study director who must approve any corrective action taken. The study director should consider whether to consult with other scientists to determine the impact of any such information on the study and should report (and discuss where necessary) these deviations in the final report. 

Another source mentions institutional realities that undercut corporate safety goals, such as incentives that promote safety violations in the interest of short-term profitability, shielding upper management from bad news and turnover of management staff. 157 A third says that Many chemical plant disasters have been precipitated by an unplanned change in process, a change in equipment or a change in personnel. 158... 

Having established a validated process, efforts must be implemented to assure that it stays in the validated state. Systems need to be implemented to evaluate both planned and unplanned changes to the process. This refers to any change in materials, conditions, equipment used, and site of manufacture, scale, and so forth. All planned changes must be described and evaluated before implemented. All concerned departments are involved in this analysis the final review and approval is required of the quality unit. 

Because accidents are composed of sets of individual events, all of which are interrelated, each event affects one or more actors and what they do next, changing their state. [Author s note Actors may be things or people.] The first event in the accident process is a perturbation or an undesired or unplanned change by someone or something within the planned process. That first disruptive event initiates a sort of cascading effect, culminating in some harm or damage [p. 31]. 

Setpoint drift can be defined as a change in the input-output relationship of an instrument over a period of time. Setpoint drift can occur as a result of a number of factors including component failure, instrumentation error and environmental conditions. Setpoint drift primarily affects analog instrumentation rather than digital instrumentation (which is less sensitive to the environmental effects of temperature, humidity, etc.). Safety-related instrumentation and controls systems use setpoints as a means of determining when to initiate a safety function. Should an unplanned change in the setpoint of a safety-related component occur (i.e., setpoint drift) the actual value of the measured parameter at which a particular action is specified to occur will be altered. This phenomenon can result in the delay in the initiation of a safety function. 

Change Analysis is used when the problem is obscure. It is a systematic process that is generally used for a single occurrence and focuses on elements that were planned and unplanned changes in the system and determines their significance as causal factors in an accident. (See Chapter 10.)... 

Change analysis Purpose—To detect the hazard implications of both planned and unplanned change. 

In the Aviation Ground Operations Safety Handbook, change analysis is listed among the Tools to Aid in Hazard Identification section as a method to detect the hazard implications of both planned and unplanned change. ... 

Events on the drift in the setpoints of instrumentation important to safety beyond Technical Specification (TS) limits have been reported in US NPPs, as well as NPPs in other countries. An unplanned change in the setpoint of an instrument will alter the actual value of the measured parameter at which a particular action is to occur. If improper surveillance procedures and/or inadequate setpoint methodology are used, the operability of the aforementioned systems cannot be relied upon to perform the desired safety function. 

Every unplanned change in the existing order, operations, inventory or supply situation, specifically the performance process, can cause single accounts to spiral out of control. 

Change analysis is a systematic approach that examines planned or unplanned changes in a system that caused the undesirable results related to the accident. 

---