Accident investigation course


Published on

Published in: Education, Business, Technology
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide
  • I.Background Information:
    Stress the importance of investigating incidents. Your investigation team must understand that their job can save the organization a lot of money and help prevent a similar accident from occurring in the future. The input of every member of the investigation team is vital to a thorough and successful investigation report.
    II.Speaker’s Notes:
    Why should we investigate accidents? To prevent future accidents from occurring is the number one reason. Also, accident investigations will usually bring out “hidden” safety issues that can be addressed in other work areas to prevent accidents in those areas.
    Determining the cause is not a reason to place blame. Usually there are multiple causes or contributing factors. Digging into the root or main cause may take time, because it may be hidden under a number of easy or apparent causes.
    We also need to document the NMFS version of the incident for reporting to the Occupational Safety and Health Administration (OSHA) and so the workers’ compensation claim can be managed correctly.
  • I.Background Information:
    Your accident investigation and reporting procedures should explain who is responsible for investigating the different types of accidents.
    This is just an example of which employees might be on the investigation team. Please make the appropriate changes so the information coincides with your company’s accident investigation and reporting procedures.
    How NOAA’s accident investigation and reporting procedures define “minor” and “major” accidents? Make sure the definitions in the Speaker’s Notes: match the description in your company’s plan.
    II.Speaker’s Notes:
    A “minor” accident is one in which no injury occurs or the most severe injury only requires first-aid, not a visit to the doctor. This type of accident or near miss can easily be handled by the injured employee’s supervisor and a member of the safety committee. The chosen safety committee member should work in a different department so he or she can look at the situation from a fresh perspective.
    A “major” accident is one in which the injury is severe enough that a doctor’s visit is required. Again the supervisor will be involved, along with at least one member (possibly more) of the safety committee. The safety manager and production manager will also be involved.
    The assembled investigation team decides who leads the investigation and who will be responsible for writing the report.
  • I.Background Information:
    The employees in this class will have the basis to become qualified trainers just by their participation in this class. Once they understand the importance of the investigation and learn how to find and communicate details, they will be effective members of an investigation team.
    II.Speaker’s Notes:
    Not everyone is permitted to investigate accidents. Obviously, you are on yourway due to your participation in this class. By the end of this session you will understand the proper way to investigate accidents.
    You should also understand the importance of conducting an investigation. If you don’t take the investigation process seriously, or just go through the motions, the investigation will not be valid.
    A thorough investigation requires the ability to seek out hidden details and to communicate those details successfully so that others reading the investigation report will be able to picture exactly what happened.
  • I.Background Information:
    How do you notify or assemble the investigation team? Is the SECO or safety focal point contacted, and then they contact members of the investigation team?
    II.Speaker’s Notes:
    Ideally, the investigation should begin immediately. The investigation team should be assembled and the process should begin even while the injured employee is still being treated.
    The memories of the injured employee and witnesses are affected by time. They may elaborate on the story or forget important details if they are not questioned immediately.
    Potential causal factors might be removed. For example, the equipment involved may be moved, the slippery floor cleaned up, the broken ladder repaired. Investigators want to arrive at the scene before anything is changed.
    If the investigation team cannot arrive at the scene immediately, they should make it a priority to arrive as soon as possible.
    Waiting a day or two is just not acceptable. By then you have lost important information, and the investigation will not be complete. Recommendations from the investigation may not be valid because they are based on inaccurate information.
  • I.Background Information:
    Do you have an accident investigation kit made up? If so, where is it located? Who has access to the kit? Who is responsible for obtaining the kit when the investigation team is called? All of this information should be explained in your accident investigation and reporting procedures.
    II.Speaker’s Notes:
    This slide lists the essential elements of an investigation kit.
    Pictures can be taken and used as evidence or to help supplement the report.
    Having the report forms will help make sure details are not overlooked while conducting the investigation.
    Barricade tape is used to block off the accident scene until the investigation is complete.
    A flashlight may be needed to look for those hidden details
    A tape measure records the height of fall, etc.
    A tape recorder can be used by all team members to record witnesses’ statements or investigator’s observations.
    Work gloves are needed because equipment or debris may need to be moved.
  • I.Background Information:
    Your employees should already understand the importance of immediately reporting all incidents, including near misses. This is stressed in the “New Employee Safety Orientation” training session.
    Do your supervisors understand how to handle an injured employee? Have they been trained in first-aid/CPR? Do they take the injured worker to the doctor if necessary?
    Does the supervisor know how to initiate an incident investigation? Do they understand the importance of leaving the incident scene intact for the investigators?
    Make sure the supervisor understands that the employee should complete the employee account of incident form as soon as possible.
    II.Speaker’s Notes:
    Employees are responsible for immediately reporting all injuries, near miss incidents, and facility-damaging accidents.
    Remember, as a supervisor, you are responsible for ensuring all injured personnel receive proper treatment.
    Do not touch the incident scene until the investigation team arrives, unless something presents an immediate danger to other personnel, until the investigation team arrives.
    Contact the incident investigation team and have the injured employee complete the employee account of the incident form.
  • I.Background Information:
    How does NMFS call for an investigation team to gather? Who determines the members of a particular investigation team?
    Who retrieves the investigation kit?
    Pass out Accident Investigation forms.
    II.Speaker’s Notes:
    Once the team has gathered at the scene, decide who will be the team leader.
    Step back from the scene to look at the big picture. Do you observe anything that is unusual or out of place?
    Record your initial observations. Try not to record what you think may have happened; just record what you see.
    Take pictures or a video.
  • I.Background Information:
    Does NMFS have any kind of post-accident drug screen requirement? If so, you will find out later if the injured employee was on alcohol or illegal drugs.
    Most of the information contained in this slide will have to be taken from the employee’s statement. The employee may not think to include all of this information, so make sure the employee is thoroughly interviewed.
    II.Speaker’s Notes:
    Write down the complete name of the injured employee(s). What department do they work in? Who is the supervisor?
    Have the injured employee complete his or her account of the incident.
    Was the injured employee taking any medication, either prescription or non-prescription, such as pain medicine, allergy medicine, aspirin, etc.? Is the employee diabetic or subject to seizures? Is there any evidence of use of alcohol or illegal drugs?
    Was the employee feeling ill lately (if so, the employee may have been taking medication)? Did the employee have symptoms of drowsiness, upset stomach, headaches, etc.?
    Was the injured employee working a double shift or rotating shifts? Fatigue or the adjustment in work hours may have contributed to the incident.
    When interviewing the injured employee, do not come across as trying to find the employee at fault for the accident. Just tell the employee that these are standard questions on the form that have to be answered.
  • I.Speaker’s Notes:
    Write down the name(s) of the witness(es), the departments in which they work, and the names of their supervisors.
    Interview witnesses separately and write down or record their statements. Some questions to ask witnesses include:
    Were there any unsafe acts on the part of the person involved that precipitated the incident (i.e., horseplay or not following proper safety procedures).
    Do you know of any personal factor on the part of the individual involved that may have induced an unsafe condition (i.e., inexperience, alcohol use or fatigue).
    If supervisors were nearby, was the employee being directly supervised? Where was the supervisor at the time of the accident?
    Use a facility map or draw a picture of where other employees, including witnesses, were located when the accident occurred. What were they doing?
    If there were no witnesses, why not? Was the injured employee working alone? If not, why had the other employees left the injured employee alone? Was the fact that the employee was alone a contributing factor?
  • I.Background Information:
    If time allows, have the employees conduct some mock interviews to get them comfortable with the process.
    II.Speaker’s Notes:
    When interviewing, avoid using domineering or patronizing mannerisms or speech. The interviewee will probably not respond well to this attitude.
    Convey your sincere concern for the safety of employees at your facility and let them know that you are trying to find ways to fix the cause of this accident.
    Do not interrupt the interviewee; take detailed notes.
    Review your notes at the end of the interview to avoid any misunderstanding.
  • I.Speaker’s Notes:
    Was the injured employee operating a machine, tool, or piece of equipment that may have contributed to the incident? Was there a malfunction? Was the employee trained to use the equipment? How much experience did the employee have with the equipment? Was the employee being directly supervised while using the equipment? Was the employee wearing proper PPE, if required?
    Was the employee using a chemical at the time of the incident? If so, was the employee properly trained, experienced, or supervised? Was the employee wearing appropriate PPE?
    Environmental factors include: slippery floor, inadequate lighting, crowded work space, noise, stress, etc.
    The work schedule can be a factor if the work level was increased well above normal levels. Did this increase cause the injured employee to bypass safety procedures in order to speed up production? Were safety hazards ignored because “production had to be finished”?
  • I.Speaker’s Notes:
    Note the date and exact time of the incident. Was this just before or after a break? Did the injury occur early Monday morning, when the employee may have been tired from a busy weekend?
    Was the employee working his or her normal shift and performing a normal job function? If not, why was the employee doing work that was outside of the normal work functions?
    Was the employee coming off of a vacation or sick leave? Is it possible that the employee was daydreaming about the vacation he or she planned to start the next day?
  • I.Speaker’s Notes:
    The incident location needs to be specific. Start with the main work area such as: the northwest corner of the maintenance shop, lobby of the main office, main deck of the vessel.
    Now get specific:
    Was the employee on something such as a ladder, a machine, a platform, a chair, a staircase, etc.?
    Was the injured employee under a overhead load, workbench, a machine, etc.?
    Was the employee in a forklift, manlift, confined space, etc.?
    If the accident occurred off-site, make sure the address of the accident site is noted along with these details.
    Was the injured employee doing work that is part of his or her normal job functions? If not, was the employee properly trained to do the work?
  • I.Speaker’s Notes:
    What type of motion was the injured employee conducting at the time of the accident? Examples include: walking, running, bending over, squatting, climbing, operating a lever, pushing a broom, using a scalpel, turning a valve, turning a wrench, pounding a hammer, etc.
    Were the motions repetitive?
    Were they handling heavy or light material? Was it big and bulky? Did they have help, or were they using appropriate material handling equipment, such as a pallet jack or truck dollies?
  • I.Background Information:
    Detailed description is important for claims management. Should the employee later claim that he also injured his knee in the accident, you have a detailed account in which no one witnessed his holding a knee or limping after the accident to indicate that the knee was also injured.
    II.Speaker’s Notes:
    The incident should be described on the report in such detail that any reader can clearly picture what happened. For example: The injured employee was walking east down the main aisle, staying to the north side of the aisle, in building #4. He was carrying two boxes of samples with a combined weight of 35 pounds; however, the boxes did come up to his chin and limited his field of vision. The employee did not see the 6-foot, 1/2-inch-diameter extension cord that was laying on the floor and protruding 18 inches into the aisle right next to the newly installed U-Make-It machine. The injured employee stepped on the cord with his left foot, which then rolled forward.
    Body parts: The employee fell onto his left side and did not have time to break his fall, so his left elbow squarely struck the ground. The boxes were released upon impact. Three of the sample containers broke, spilling approximately 1.5 liters of 10% formalin.
    Motions after the incident. The employee rolled to his back, sat up and held his left elbow in his right hand. He sat in this position for about a minute before being helped to his feet.
  • I.Speaker’s Notes:
    There are almost always multiple causes that contribute to an accident. Try not to settle on a single cause theory, because there are usually contributing factors.
    What are all the possible underlying causes or contributing factors. In the example described on the last slide: The employee was carrying a load that partially blocked his vision, the cord should not have protruded out to the aisle. Other considerations: Was the aisle properly lighted? Was there a noise or something that distracted the injured worker from looking down, etc.?
    Once the list of potential causes or contributing factors has been compiled, try to determine the primary cause, or the cause that appears to have contributed the most to the accident. This is the cause that, if removed, the accident probably would have been prevented.
    Other causes will be considered as secondary potential causes.
    All causes should be investigated for corrective actions; however, the primary cause should be the focus of corrective actions.
  • I.Background Information:
    Does NMFS accident investigation and reporting procedures have a form for documenting and recommending corrective actions to management?
    II.Speaker’s Notes:
    Immediate corrective actions are those that are done right after the investigation is complete. These will remove a danger and prevent a repeat of the accident until formal, or long-term, corrective actions can be completed. These do not need a recommendation form, because they are implemented immediately by the supervisor or the investigation team. For example, put the extension cord back in its proper storage location before someone else slips on it.
    Once the investigation team has compiled the investigation report, they can make a number of recommendations to management. Recommendations might include retraining employees on lifting and carrying techniques and material handling equipment, retraining maintenance on putting material away when the job is finished, or maybe improving the lighting in that area of the facility.
  • I. Speaker’s Notes:
    To summarize, these are the steps you should follow when an accident occurs.
  • Accident investigation course

    1. 1. Accident and Incident Investigation 1/210
    2. 2. Objectives of this Section ● ● ● To define the reasons for investigating accident and incidents. To outline the process for effectively investigating accidents and incidents. To facilitate an effective investigation. 2/210
    3. 3. Accident Investigation ● ● Important part of any safety management system. Highlights the reasons why accidents occur and how to prevent them. The primary purpose of accident investigations is to improve health and safety performance by:  Exploring the reasons for the event and identifying both the immediate and underlying causes;  Identifying remedies to improve the health and safety management system by improving risk control, preventing a recurrence and reducing financial losses. 3/210
    4. 4. What to Investigate? ● ● ● All accidents whether major or minor are caused. Serious accidents have the same root causes as minor accidents as do incidents with a potential for serious loss. It is these root causes that bring about the accident, the severity is often a matter of chance. Accident studies have shown that there is a consistently greater number of less serious accidents than serious accidents and in the same way a greater number of incidents then accidents. 4/210
    5. 5. Many accident ratio studies have been undertaken and the one shown below is based on studies carried out by the Health & Safety Executive. 1 Major injury Or illness 7 Minor injuries or illnesses 189 Non Injury Accidents/Illnesses 5/210
    6. 6. Accident Studies ● ● ● In all cases the ‘non injury’ incidents had the potential to become events with more serious consequences. Such ratios clearly demonstrate that safety effort should be aimed at all accidents including unsafe practices at the bottom of the pyramid, with a resulting improvement in upper tiers. Peterson (1978) in defining the principles of safety management says that “an unsafe act, an unsafe condition, an accident are symptoms of something wrong within the management’s system.” 6/210
    7. 7. Accident Studies ● ● All events represent a degree of failure in control and are potential learning experiences. It therefore follows that all accidents should be investigated to some extent. This extent should be determined by the loss potential, rather then just the immediate effect. 7/210
    8. 8. Stages in an Accident/Incident Investigation The stages in an accident/incident investigation are shown in the following diagram. Deal with immediate risks. Select the level of investigation. Investigate the event. Record and analyse the results. Review the process. 8/210
    9. 9. Dealing with Immediate Risks Deal with immediate risks. ● Select the level of investigation. Make the situation safe and prevent further injury. Help, treat and if necessary rescue injured persons. Investigate the event. Record and analyse the results. Review the process. When accidents and incidents occur immediate action may be necessary to: ● An effective response can only be made if it has been planned for in advance. 9/210
    10. 10. Day 2 start 10/210
    11. 11. Selecting the level of investigation The greatest effort should be put into: Deal with immediate risks. Select the level of investigation. Investigate the event. Record and analyse the results. Review the process.  Those involving severe injuries, illhealth or loss.  Those which could have caused much greater harm or damage. These types of accidents and incidents demand more careful investigation and management time. This can usually be achieved by:  Looking more closely at the underlying causes of significant events.  Assigning the responsibility for the investigation of more significant events to more senior managers. 11/210
    12. 12. Investigating the Event Deal with immediate risks. Select the level of investigation. The purpose of investigations is to establish: ● ● Investigate the event. ● Record and analyse the results. Review the process. ● The way things were and how they came to be. What happened – the sequence of events that led to the outcome. Why things happened as they did analysing both the immediate and underlying causes. What needs to be done to avoid a repetition and how this can be achieved. 12/210
    13. 13. A few sources should give the investigator all that is needed to know. Observation Information from physical sources including: • Premises and place of work • Access & egress • Plant & substances in use • Location & relationship of physical particles • Any post event checks, sampling or reconstruction Documents Information from: • Written instructions; Procedures, risk assessments, policies • Records of earlier inspections, tests, examinations and surveys. • • • Checking reliability, accuracy Identifying conflicts and resolving differences Identifying gaps in evidence Interviews Information from: • Those involved and their line management; • Witnesses; • Those observed or involved prior to the event e.g. inspection & maintenance staff. 13/210
    14. 14. Interviews ● ● ● Interviewing the person(s) involved and witnesses to the accident is of prime importance, ideally in familiar surroundings so as not to make the person uncomfortable. The interview style is important with emphasis on prevention rather than blame. The person(s) should give an account of what happened in their terms rather than the investigators. 14/210
    15. 15. Interviews ● ● Interviews should be separate to stop people from influencing each other. Questions when asked should not be intimidating as the investigator will be seen as aggressive and reflecting a blame culture. 15/210
    16. 16. Observation The accident site should be inspected as soon as possible after the accident. Particular attention should/must be given to: • Positions of people. • Personnel protective equipment (PPE). • Tools and equipment, plant or substances in use. • Orderliness/Tidiness. 16/210
    17. 17. Documents Documentation to be looked at includes: ● Written instructions, procedures and risk assessments which should have been in operation and followed. The validity of these documents may need to be checked by interview. The main points to look for are:  Are they adequate/satisfactory?  Were they followed on this occasion?  Were people trained/competent to follow it? ● Records of inspections, tests, examination and surveys undertaken before the event. These provide information on how and why the circumstances leading to the event arose. 17/210
    18. 18. Determining Causes ● ● ● Collect all information and facts which surround the accident. Immediate causes are obvious and easy to find. They are brought about by unsafe acts and conditions and are the ACTIVE FAILURES. Unsafe acts show poor safety attitudes and indicate a lack of proper training. These unsafe acts and conditions are brought about by the so called ‘root causes’. These are the LATENT FAILURES and are brought about by failures in organisation and the management’s safety system. 18/210
    19. 19. Determine what changes are needed The investigation should determine what control measures were absent, inadequate or not implemented and so generate remedial action for implementation to correct this. 19/210
    20. 20. Generally, remedial actions should follow the hierarchy of risk control: ● ● ● ● Eliminate Risks by substituting the dangerous by the inherently less dangerous. Combat risks at source by engineering controls and giving collective protective measures priority. Minimise risk by designing suitable systems of working. Use PPE as a last resort. 20/210
    21. 21. Day 3 start 21/210
    22. 22. Recording & Analysing the Results ● Deal with immediate risks. ● ● Select the level of investigation. ● Investigate the event. ● Record and analyse the results. ● Review the process. ● Recorded in a similar and systematic manner. Provides a historical record of the accident. Analysis of the causes and recommended preventative protective measures should be listed. Completed as soon after the accident as possible. Information on the accident and remedial actions should be passed to all supervisors. Appropriate preventative measures may also have to be implemented by such supervisors. Investigation reports and accident statistics should be analysed from time to time to identify common causes, features and trends not be apparent from looking at events in isolation. 22/210
    23. 23. Reviewing the Process Deal with immediate risks. Select the level of investigation. Investigate the event. Record and analyse the results. Review the process. Reviewing the accident/incident investigation process should consider: – The results of investigations and analysis. – The operation of the investigation system (in terms of quality and effectiveness). Line managers should follow through and action the findings of investigations and analysis. Follow up systems should be established where necessary to keep progress under control. 23/210
    24. 24. The investigation system should be examined from time to time to check that it consistently delivers information in accordance with the stated objectives and standards. This usually requires: ● ● ● Checking samples of investigation forms to verify the standard of investigation and the judgements made about causation and prioritisation of remedial actions. Checking the numbers of incidents, near misses, injury and ill-health events; Checking that all events are being reported. 24/210
    25. 25. What is your definition of an “Accident”? 25/210
    26. 26. What is an Accident - an unplanned event - an unplanned incident involving injury or fatality - a series of events culminating in an unplanned and unforeseen event 26/210
    27. 27. How do Accidents occur? - Accidents (with or without injuries) occur when a series of unrelated events coincide at a certain time and space. -This can be from a few events to a series of a dozen or more (Because the coincidence of the series of events is a matter of luck, actual accidents only happen infrequently) 27/210
    28. 28. Unsafe Acts - An unsafe act occurs in approx 85%- 95% of all analyzed accidents with injuries - An unsafe act is usually the last of a series of events before the accident occurs (it could occur at any step of the event) - By stopping or eliminating the unsafe act, we can stop the accident from occurring 28/210
    29. 29. What is an Accident Investigation? ● A systematic approach to the identification of causal factors and implementation of corrective actions without placing blame on or finding personal fault. The information collected during an investigation is essential to determine trends and taking appropriate steps to prevent future accidents. 29/210
    30. 30. Which Accidents should be Recorded or Reported? ALL accidents (including illnesses) shall be recorded and reported through the established procedures and guidance 30/210
    31. 31. Why Investigate Accidents? ● ● ● ● Determine the cause Develop and implement corrective actions Document the events Meet legal requirements Primary Focus: PREVENT REOCCURENCE!!! PREVENT REOCCURENCE!!! PREVENT REOCCURENCE!!! 31/210
    32. 32. Accident vs. Near-Miss Accident : Any undesired, unplanned event arising out of a given work-related task which results in physical injury/ illness or damage to property. Near-Miss : Events which did not result in injury/illness or damage but had the potential to do so. 32/210
    33. 33. Accident Ratio Study 1 10 30 600 6000 Serious or Disabling Minor Injuries Property Damage Accidents with no visible injury or damage Unsafe Acts or Conditions 33/210
    34. 34. Accident Causes Unsafe Act - an act by the injured person or another person (or both) which caused the accident, and/or ● Unsafe Condition - some environmental or hazardous situation which caused the accident independent of the employee ● 34/210
    35. 35. Accident Causation Model  Results of the accident - physical harm - property damage  Incident Occurrence - contact with - type  Immediate causes - practices - conditions  Basic causes - personal factors - job factors - supervisory performance - management policy and decisions 35/210
    36. 36. Results of the Accident ● ● Physical Harm - catastrophic (multiple deaths) - single death - disabling - serious - minor Property Damage - catastrophic - major - serious - minor 36/210
    37. 37. Incident Occurrence ● ● Type - struck by - struck against - slip, trip - fell from - caught on - fell on same level - caught in - overexertion Contact with - electricity - noise - hazmat - radiation - equipment - vibration - heat/cold - animals/insects 37/210
    38. 38. Immediate Causes ● Practices - operating without authority - use equipment improperly - not using PPE when required - correct lifting procedures not established - drinking or drug use - horseplay - equipment not properly secured 38/210
    39. 39. Immediate Causes (cont’d) ● Conditions - ineffective guards - unserviceable tools and equipment - inadequate warning systems - bad housekeeping practices - poor work space illumination - unhealthy work environment 39/210
    40. 40. Basic Causes ● ● Personal Factors - lack of knowledge or skill - improper motivation - physical or mental condition - literacy or ability Job Factors - Physical environment - sub-standard equipment - abnormal usage - wear and tear - inadequate standards - design and maintenance 40/210
    41. 41. Basic Causes (cont’d) ● ● Supervisory Performance - inadequate instructions - failure of SOPs - rules not enforced - hazards not corrected - devices not provided Management Policy and Decisions - set measurable standards - measure work in progress - evaluate work vs. standards - correct performance No animals were hurt as a result of this accident 41/210
    42. 42. Severity of Incident ● ● Major - Employee fatality, - Hospitalization of 3 or more employees, - Permanent employee disability, - Five or more lost workdays, - Conditions that could pose an imminent and threat of serious injury/illness to other employees - Property losses in excess of $1 Million Minor - All other (less serious) incidents and unsafe conditions reported by employees 42/210
    43. 43. Who Investigates? ● ● Major Accidents - NOAA “GO TEAM” Investigation Team - LO Representative - Other agencies such as NTSB, USCG, OSHA Minor Accidents - First-Line Supervisor - Site Director or Manager - Site Safety Representative - NOAA SECO (if needed) 43/210
    44. 44. Investigator’s Qualifications ● ● ● ● ● ● ● Technical knowledge Objectivity Analytical approach Familiarity with the job, process or operation Tact in communicating Intellectual honesty Inquisitiveness and curiosity 44/210
    45. 45. When to Investigate? ● Immediately after incident   ● Witness memories fade Equipment and clues are moved Finish investigation quickly 45/210
    46. 46. What to Investigate? ● All accidents and near-misses - Conduct investigation upon first notification - Keeping the scene in-tact and recording witnesses statements early is key to a successful investigation 46/210
    47. 47. Accident Investigation Kit May Include: ● Digital Camera ● Report forms, clipboard, pens ● Barricade tape ● Flashlight ● Tape measure ● Tape recorder ● Personal Protective Equipment (as appropriate) 47/210
    48. 48. The Accident Occurs ● ● ● ● ● Employee or co-worker immediately reports the accident to a supervisor Supervisor secures/assesses the scene to prevent additional injuries to other employees, before assisting the injured employee Supervisor treats the injury or seeks medical treatment for the injured The accident scene is left intact Site safety rep is contacted to assist the supervisor in the investigation of the accident. 48/210
    49. 49. Beginning the Investigation ● ● ● ● ● Gather investigation members and kit Report to the scene Look at the big picture Record initial observations Take pictures 49/210
    50. 50. What’s Involved? Who was injured? ● Medication, drugs, or alcohol? ● Was employee ill or fatigued? ● Environmental conditions? ● 50/210
    51. 51. Witnesses Who witnessed the accident? ● Was a supervisor or Team Lead nearby? ● Where were other employees? ● Why didn’t anyone witness the accident (working alone, remote areas)? ● 51/210
    52. 52. Interviewing Tips ● ● ● ● ● Discuss what happened leading up to and after the accident Encourage witnesses to describe the accident in their own words Don’t be defensive or judgmental Use open-ended questions Do not interrupt the witness 52/210
    53. 53. What was Involved? ● ● ● ● Machine, tool, or equipment Chemicals Environmental conditions Field season prep operations 53/210
    54. 54. Time of Accident Date and time? ● Normal shift or working hours? ● Employee coming off a vacation? ● 54/210
    55. 55. Accident Location ● ● ● ● ● Work area On, under, in, near Off-site address Doing normal job duties Performing nonroutine or routine tasks (i.e., properly trained) 55/210
    56. 56. Employee’s Activity ● ● ● Motion conducted at time of accident Repetitive motion? Type of material being handled 56/210
    57. 57. Accident Narrative Describe the details so the reader can clearly picture the accident ● Specific body parts affected ● Specific motions of injured employee just before, during, and after accident ● 57/210
    58. 58. Causal Factors ● ● ● ● Try not to accept single cause theory Identify underlying causes (root) Primary cause Secondary causes   Contributing causes Effects 58/210
    59. 59. Corrective Actions Taken ● ● Include immediate interim controls implemented at the time of accident Recommended corrective actions      Employee training Preventive maintenance activities Better operating procedures Hazard recognition (ORM) Management awareness of risks involved 59/210
    60. 60. Immediate Notification ● Supervisor shall complete the NOAA Web Based Accident/ Illness Report Form and submit within 24 hours of incident occurrence (8 hours for major incidents). 60/210
    61. 61. Accident Analysis Summary ● ● ● ● ● ● Investigate accident immediately Determine who was involved and who witnessed it Ascertain what items or equipment were involved Record detailed description Determine causal factors Implement corrective actions 61/210
    62. 62. 62/210
    63. 63. 63/210
    64. 64. 1. What is an Accident Investigation? a. b. c. d. A systematic approach to the identification of causal factors and implementation of corrective actions. Finding personal fault and placing blame. The appropriate steps to prevent future actions. The essential step to determine trends and taking action against person or persons at fault. 64/210
    65. 65. 2. Which Accidents should be Recorded or Reported? a. b. c. d. Only on the job accidents. ALL accidents (including illnesses) shall be recorded and reported. Only on the job accidents on illnesses that occur on the job and reported within 8 hours. All accidents shall be recorded and reported. 65/210
    66. 66. 3. Why Investigate Accidents? a. b. c. d. To develop and implement corrective actions. To document the events. The Primary Focus is to PREVENT REOCCURENCE!!! To determine the cause. 66/210
    67. 67. 4. Accident vs. Near-Miss? a. b. c. Any unplanned event arising out of work that resulted in injury vs. Any event which did not result in injury but had potential to do so. Any unsafe work habit vs. Any Hazardous working conditions. Any event which warns us of a problem vs. Any circumstances that result in injury or property damage. 67/210
    68. 68. 5. Which of the following are the basic areas that are looked at in an Accident Investigation. a. b. c. d. Policies. Equipment. Training. All of the above. 68/210
    69. 69. Accident Investigation Accident analysis is carried out in order to determine the cause or causes of an accident or series of accidents so as to prevent further incidents of a similar kind. It is also known as accident investigation. 69/210
    70. 70. Accident Investigation It may be performed by a range of experts, including forensic scientists, forensic engineers or health and safety advisers. Accident investigators, particularly those in the aircraft industry, are colloquially known as "tin-kickers". 70/210
    71. 71. Sequence Accident analysis is performed in four steps: Fact gathering: After an accident happened a forensic process starts to gather all possibly relevant facts that may contribute to understanding the accident. 71/210
    72. 72. Sequence Fact Analysis: After the forensic process has been completed or at least delivered some results, the facts are put together to give a "big picture." The history of the accident is reconstructed and checked for consistency and plausibility. 72/210
    73. 73. Sequence Conclusion Drawing: If the accident history is sufficiently informative, conclusions can be drawn about causation and contributing factors. 73/210
    74. 74. Sequence Counter-measures: In some cases the development of countermeasures is desired or recommendations have to be issued to prevent further accidents of the same kind. 74/210
    75. 75. Methods There exist numerous forms of Accident Analysis methods. These can be divided into three categories: 75/210
    76. 76. Methods Causal Analysis Causal Analysis uses the principle of causality to determine the course of events. Though people casually speak of a "chain of events", results from Causal Analysis usually have the form of directed a-cyclic graphs-the nodes being events and the edges the causeeffect relations. Methods of Causal Analysis differ in their respective notion of causation. 76/210
    77. 77. Methods Expert Analysis Expert Analysis relies on the knowledge and experience of field experts. This form of analysis usually lacks a rigorous (formal/semiformal) methodological approach. This usually affects falsify-ability and objectivity of analyses. This is of importance when conclusions are heavily disputed among experts. 77/210
    78. 78. Methods Organizational Analysis Organizational Analysis relies on systemic theories of organization. Most theories imply that if a system's behaviour stayed within the bounds of the ideal organization then no accidents can occur. 78/210
    79. 79. Methods Organizational Analysis Organizational Analysis can be falsified and results from analyses can be checked for objectivity. Choosing an organizational theory for accident analysis comes from the assumption that the system to be analysed conforms to that theory. 79/210
    80. 80. Using Digital Photographs to Extract Evidence Once all available data has been collected by accident scene investigators and law enforcement officers, camera matching, photogrammetry or rectification can be used to determine the exact location of physical evidence shown in the accident scene photos. 80/210
    81. 81. Camera matching: Camera matching uses accident scene photos that show various points of evidence. The technique uses CAD software to create a 3-dimensional model of the accident site and roadway surface. 81/210
    82. 82. Camera matching: All survey data and photos are then imported into a three dimensional software package like 3D Studio Max. A virtual camera can be then be positioned relative to the 3D roadway surface. Physical evidence is then mapped from the photos onto the 3D roadway to create a three dimensional accident scene drawing. 82/210
    83. 83. Photogrammetry Photogrammetry is used to determine the three-dimensional geometry of an object on the accident scene from the original two dimensional photos. 83/210
    84. 84. Photogrammetry The photographs can be used to extract evidence that may be lost after the accident is cleared. Photographs from several viewpoints are imported into software like PhotoModeler. 84/210
    85. 85. Photogrammetry The forensic engineer can then choose points common to each photo. The software will calculate the location of each point in a three dimensional coordinate system. 85/210
    86. 86. Rectification Photographic rectification is also used to analyze evidence that may not have been measured at the accident scene. Two dimensional rectification transforms a single photograph into a top-down view. Software like PC-Rect can be used to rectify a digital photograph. 86/210
    87. 87. Failure mode and effects analysis 87/210
    88. 88. Failure mode and effects analysis Failure Mode and Effects Analysis (FMEA) was one of the first systematic techniques for failure analysis. It was developed by reliability engineers in the 1950s to study problems that might arise from malfunctions of military systems. 88/210
    89. 89. Failure mode and effects analysis A FMEA is often the first step of a system reliability study. It involves reviewing as many components, assemblies, and subsystems as possible to identify failure modes, and their causes and effects. 89/210
    90. 90. Failure mode and effects analysis For each component, the failure modes and their resulting effects on the rest of the system are recorded in a specific FMEA worksheet. There are numerous variations of such worksheets. A FMEA is mainly a qualitative analysis. 90/210
    91. 91. Failure mode and effects analysis A few different types of FMEA analysis exist, like Functional, Design, and Process FMEA. 91/210
    92. 92. Failure mode and effects analysis Sometimes the FMEA is called FMECA to indicate that Criticality analysis is performed also. 92/210
    93. 93. Failure mode and effects analysis An FMEA is an inductive reasoning (forward logic) single point of failure analysis and is a core task in reliability engineering, safety engineering and quality engineering. Quality engineering is specially concerned with the "Process" (Manufacturing and Assembly) type of FMEA. 93/210
    94. 94. Failure mode and effects analysis A successful FMEA activity helps to identify potential failure modes based on experience with similar products and processes - or based on common physics of failure logic. 94/210
    95. 95. Failure mode and effects analysis It is widely used in development and manufacturing industries in various phases of the product life cycle. Effects analysis refers to studying the consequences of those failures on different system levels. 95/210
    96. 96. Failure mode and effects analysis Functional analyses are needed as an input to determine correct failure modes, at all system levels, both for functional FMEA or Piece-Part (hardware) FMEA. 96/210
    97. 97. Failure mode and effects analysis A FMEA is used to structure Mitigation for Risk reduction based on either failure (mode) effect severity reduction or based on lowering the probability of failure or both. 97/210
    98. 98. Failure mode and effects analysis The FMEA is in principle a full inductive (forward logic) analysis, however the failure probability can only be estimated or reduced by understanding the failure mechanism. 98/210
    99. 99. Failure mode and effects analysis Ideally this probability shall be lowered to "impossible to occur" by eliminating the (root) causes. It is therefore important to include in the FMEA an appropriate depth of information on the causes of failure (deductive analysis). 99/210
    100. 100. Failure mode and effects analysis The FME(C)A is a design tool used to systematically analyze postulated component failures and identify the resultant effects on system operations. The analysis is sometimes characterized as consisting of two sub-analyses, the first being the failure modes and effects analysis (FMEA), and the second, the criticality analysis (CA). 100/210
    101. 101. Failure mode and effects analysis Successful development of an FMEA requires that the analyst include all significant failure modes for each contributing element or part in the system. FMEAs can be performed at the system, subsystem, assembly, subassembly or part level. 101/210
    102. 102. Failure mode and effects analysis The FMECA should be a living document during development of a hardware design. It should be scheduled and completed concurrently with the design. If completed in a timely manner, the FMECA can help guide design decisions. The usefulness of the FMECA as a design tool and in the decision making process is dependent on the effectiveness and timeliness with which design problems are identified. 102/210
    103. 103. Failure mode and effects analysis Timeliness is probably the most important consideration. In the extreme case, the FMECA would be of little value to the design decision process if the analysis is performed after the hardware is built. 103/210
    104. 104. Failure mode and effects analysis While the FMECA identifies all part failure modes, its primary benefit is the early identification of all critical and catastrophic subsystem or system failure modes so they can be eliminated or minimized through design modification at the earliest point in the development effort. 104/210
    105. 105. Failure mode and effects analysis Therefore, the FMECA should be performed at the system level as soon as preliminary design information is available and extended to the lower levels as the detail design progresses. 105/210
    106. 106. Failure mode and effects analysis Remark: For more complete scenario modelling other type of Reliability analysis may be considered, for example fault tree analysis(FTA); a deductive (backward logic) failure analysis that may handle multiple failures within the item and/or external to the item including maintenance and logistics. It starts at higher functional / system level. A FTA may use the basic failure mode FMEA records or an effect summary as one of its inputs (the basic events). Interface hazard analysis, Human error analysis and others may be added for completion in 106/210 scenario modelling.
    107. 107. Functional analysis The analysis may be performed at the functional level until the design has matured sufficiently to identify specific hardware that will perform the functions; then the analysis should be extended to the hardware level. When performing the hardware level FMECA, interfacing hardware is considered to be operating within specification. In addition, each part failure postulated is considered to be the only failure in the system (i.e., it is a single failure analysis). 107/210
    108. 108. Functional analysis In addition to the FMEAs done on systems to evaluate the impact lower level failures have on system operation, several other FMEAs are done. Special attention is paid to interfaces between systems and in fact at all functional interfaces. The purpose of these FMEAs is to assure that irreversible physical and/or functional damage is not propagated across the interface as a result of failures in one of the interfacing units. 108/210
    109. 109. Functional analysis These analyses are done to the piece part level for the circuits that directly interface with the other units. The FMEA can be accomplished without a CA, but a CA requires that the FMEA has previously identified system level critical failures. When both steps are done, the total process is called a FMECA. 109/210
    110. 110. Ground rules The ground rules of each FMEA include a set of project selected procedures; the assumptions on which the analysis is based; the hardware that has been included and excluded from the analysis and the rationale for the exclusions. The ground rules also describe the indenture level of the analysis, the basic hardware status, and the criteria for system and mission success. 110/210
    111. 111. Ground rules Every effort should be made to define all ground rules before the FMEA begins; however, the ground rules may be expanded and clarified as the analysis proceeds. A typical set of ground rules (assumptions) follows: 111/210
    112. 112. Ground rules Only one failure mode exists at a time. ● All inputs (including software commands) to the item being analyzed are present and at nominal values. ● All consumables are present in sufficient quantities. ● Nominal power is available ● 112/210
    113. 113. Benefits Major benefits derived from a properly implemented FMECA effort are as follows: 113/210
    114. 114. Benefits It provides a documented method for selecting a design with a high probability of successful operation and safety. 114/210
    115. 115. Benefits A documented uniform method of assessing potential failure mechanisms, failure modes and their impact on system operation, resulting in a list of failure modes ranked according to the seriousness of their system impact and likelihood of occurrence. 115/210
    116. 116. Benefits Early identification of single failure points (SFPS) and system interface problems, which may be critical to mission success and/or safety. They also provide a method of verifying that switching between redundant elements is not jeopardized by postulated single failures. 116/210
    117. 117. Benefits An effective method for evaluating the effect of proposed changes to the design and/or operational procedures on mission success and safety. 117/210
    118. 118. Benefits A basis for in-flight troubleshooting procedures and for locating performance monitoring and faultdetection devices. 118/210
    119. 119. Benefits Criteria for early planning of tests. 119/210
    120. 120. Basic terms The following covers some basic FMEA terminology. Failure The loss under stated conditions. 120/210
    121. 121. Basic terms Failure mode The specific manner or way by which a failure occurs in terms of failure of the item (being a part or (sub) system) function under investigation; it may generally describe the way the failure occurs. It shall at least clearly describe a (end) failure state of the item (or function in case of a Functional FMEA) under consideration. It is the result of the failure mechanism (cause of the failure mode). For example; a fully fractured axle, a deformed axle or a fully open or fully closed electrical contact are each a separate failure mode. 121/210
    122. 122. Basic terms Failure cause and/or mechanism Defects in requirements, design, process, quality control, handling or part application, which are the underlying cause or sequence of causes that initiate a process (mechanism) that leads to a failure mode over a certain time. A failure mode may have more causes. 122/210
    123. 123. Basic terms Failure cause and/or mechanism For example; "fatigue or corrosion of a structural beam" or "fretting corrosion in a electrical contact" is a failure mechanism and in itself (likely) not a failure mode. The related failure mode (end state) is a "full fracture of structural beam" or "an open electrical contact". The initial Cause might have been "Improper application of corrosion protection layer (paint)" and /or "(abnormal) vibration input from another (possible failed) system". 123/210
    124. 124. Basic terms / Failure effect Immediate consequences of a failure on operation, function or functionality, or status of some item. 124/210
    125. 125. Indenture levels (bill of material or functional breakdown) An identifier for system level and thereby item complexity. Complexity increases as levels are closer to one. 125/210
    126. 126. Local effect The failure effect as it applies to the item under analysis. 126/210
    127. 127. Next higher level effect The failure effect as it applies at the next higher indenture level. 127/210
    128. 128. End effect The failure effect at the highest indenture level or total system. 128/210
    129. 129. Detection The means of detection of the failure mode by maintainer, operator or built in detection system, including estimated dormancy period (if applicable) 129/210
    130. 130. Risk Priority Number (RPN) Cost (of the event) * Probability (of the event occurring) * Detection (Probability that the event would not be detected before the user was aware of it) 130/210
    131. 131. Severity The consequences of a failure mode. Severity considers the worst potential consequence of a failure, determined by the degree of injury, property damage, system damage and/or time lost to repair the failure. 131/210
    132. 132. Remarks / mitigation / actions Additional info, including the proposed mitigation or actions used to lower a risk or justify a risk level or scenario. 132/210
    133. 133. Example FMEA Worksheet 133/210
    134. 134. Probability (P) In this step it is necessary to look at the cause of a failure mode and the likelihood of occurrence. This can be done by analysis, calculations / FEM, looking at similar items or processes and the failure modes that have been documented for them in the past. A failure cause is looked upon as a design weakness. All the potential causes for a failure mode should be identified and documented. 134/210
    135. 135. Probability (P) This should be in technical terms. Examples of causes are: Human errors in handling, Manufacturing induced faults, Fatigue, Creep, Abrasive wear, erroneous algorithms, excessive voltage or improper operating conditions or use (depending on the used ground rules). A failure mode is given an Probability Ranking. 135/210
    136. 136. Probability (P) 136/210
    137. 137. Severity (S) Determine the Severity for the worst case scenario adverse end effect (state). It is convenient to write these effects down in terms of what the user might see or experience in terms of functional failures. Examples of these end effects are: full loss of function x, degraded performance, functions in reversed mode, too late functioning, erratic functioning, etc. 137/210
    138. 138. Severity (S) Each end effect is given a Severity number (S) from, say, I (no effect) to VI (catastrophic), based on cost and/or loss of life or quality of life. These numbers prioritize the failure modes (together with probability and detectability). Below a typical classification is given. Other classifications are possible. See also hazard analysis. 138/210
    139. 139. Severity (S) 139/210
    140. 140. Detection (D) 140/210
    141. 141. Detection (D) The means or method by which a failure is detected, isolated by operator and/or maintainer and the time it may take. This is important for maintainability control (Availability of the system) and it is specially important for multiple failure scenarios. 141/210
    142. 142. Detection (D) This may involve dormant failure modes (e.g. No direct system effect, while a redundant system / item automatic takes over or when the failure only is problematic during specific mission or system states) or latent failures (e.g. deterioration failure mechanisms, like a metal growing crack, but not a critical length). 142/210
    143. 143. Detection (D) It should be made clear how the failure mode or cause can be discovered by an operator under normal system operation or if it can be discovered by the maintenance crew by some diagnostic action or automatic built in system test. A dormancy and/or latency period may be entered. 143/210
    144. 144. Detection (D) 144/210
    145. 145. Detection (D) DORMANCY or LATENCY PERIOD The average time that a failure mode may be undetected may be entered if known. For example: During aircraft C Block inspection, preventive or predictive maintenance, X months or X flight hours During aircraft B Block inspection, preventive or predictive maintenance, X months or X flight hours During Turn-Around Inspection before or after flight (e.g. 8 hours average) During in-built system functional test, X minutes Continuously monitored, X seconds 145/210
    146. 146. Detection (D) INDICATION If the undetected failure allows the system to remain in a safe / working state, a second failure situation should be explored to determine whether or not an indication will be evident to all operators and what corrective action they may or should take. 146/210
    147. 147. Detection (D) Indications to the operator should be described as follows: Normal. An indication that is evident to an operator when the system or equipment is operating normally. Abnormal. An indication that is evident to an operator when the system has malfunctioned or failed. Incorrect. An erroneous indication to an operator due to the malfunction or failure of an indicator (i.e., instruments, sensing devices, visual or audible warning devices, etc.). 147/210
    149. 149. Detection (D) This type of analysis is useful to determine how effective various test processes are at the detection of latent and dormant faults. The method used to accomplish this involves an examination of the applicable failure modes to determine whether or not their effects are detected, and to determine the percentage of failure rate applicable to the failure modes which are detected. The possibility that the detection means may itself fail latent should be accounted for in the coverage analysis as a limiting factor (i.e., coverage cannot be more reliable than the detection means availability). 149/210
    150. 150. Detection (D) Inclusion of the detection coverage in the FMEA can lead to each individual failure that would have been one effect category now being a separate effect category due to the detection coverage possibilities. Another way to include detection coverage is for the FTA to conservatively assume that no holes in coverage due to latent failure in the detection method affect detection of all failures assigned to the failure effect category of concern. The FMEA can be revised is necessary for those cases where this conservative assumption does not allow the top event probability requirements to be met. 150/210
    151. 151. Detection (D) After these three basic steps the Risk level may be provided. 151/210
    152. 152. Risk level (P*S) and (D) Risk is the combination of End Effect Probability And Severity. Where probability and severity includes the effect on non-detectability (dormancy time). This may influence the end effect probability of failure or the worst case effect Severity. The exact calculation may not be easy in case multiple scenarios (with multiple events) are possible and detectability / dormancy plays a crucial role (as for redundant systems). In that case Fault Tree Analysis and/or Event Trees may be needed to determine exact probability and risk levels. 152/210
    153. 153. Risk level (P*S) and (D) Preliminary Risk levels can be selected based on a Risk Matrix like shown below, based on Mil. Std. 882.[24] The higher the Risk level, the more justification and mitigation is needed to provide evidence and lower the risk to an acceptable level. High risk should be indicated to higher level management, who are responsible for final decision making. 153/210
    154. 154. Risk level (P*S) and (D) 154/210
    155. 155. Risk level (P*S) and (D) After this step the FMEA has become like a FMECA. 155/210
    156. 156. Timing The FMEA should be updated whenever: A new cycle begins (new product/process) Changes are made to the operating conditions A change is made in the design New regulations are instituted Customer feedback indicates a problem 156/210
    157. 157. Uses Development of system requirements that minimize the likelihood of failures. Development of designs and test systems to ensure that the failures have been eliminated or the risk is reduced to acceptable level. Development and evaluation of diagnostic systems To help with design choices (trade-off analysis). 157/210
    158. 158. Advantages Improve the quality, reliability and safety of a product/process Improve company image and competitiveness Increase user satisfaction Reduce system development time and cost Collect information to reduce future failures, capture engineering knowledge 158/210
    159. 159. Advantages Reduce the potential for warranty concerns Early identification and elimination of potential failure modes Emphasize problem prevention Minimize late changes and associated cost Catalyst for teamwork and idea exchange between functions Reduce the possibility of same kind of failure in future Reduce impact on company profit margin Improve production yield 159/210
    160. 160. Limitations If used as a top-down tool, FMEA may only identify major failure modes in a system. Fault tree analysis (FTA) is better suited for "top-down" analysis. When used as a "bottom-up" tool FMEA can augment or complement FTA and identify many more causes and failure modes resulting in top-level symptoms. It is not able to discover complex failure modes involving multiple failures within a subsystem, or to report expected failure intervals of particular failure modes up to the upper level subsystem or system. 160/210
    161. 161. Limitations Additionally, the multiplication of the severity, occurrence and detection rankings may result in rank reversals, where a less serious failure mode receives a higher RPN than a more serious failure mode. The reason for this is that the rankings are ordinal scale numbers, and multiplication is not defined for ordinal numbers. The ordinal rankings only say that one ranking is better or worse than another, but not by how much. For instance, a ranking of "2" may not be twice as severe as a ranking of "1," or an "8" may not be twice as severe as a "4," but multiplication treats them as though they are. See Level of measurement for further discussion. 161/210
    162. 162. Types Functional: before design solutions are provided (or only on high level) functions can be evaluated on potential functional failure effects. General Mitigations ("design to" requirements) can be proposed to limit consequence of functional failures or limit the probability of occurrence in this early development. It is based on a functional breakdown of a system. This type may also be used for Software evaluation. 162/210
    163. 163. Types Concept Design / Hardware: analysis of systems or subsystems in the early design concept stages to analyse the failure mechanisms and lower level functional failures, specially to different concept solutions in more detail. It may be used in trade-off studies. 163/210
    164. 164. Types Detailed Design / Hardware: analysis of products prior to production. These are the most detailed (in mil 1629 called Piece-Part or Hardware FMEA) FMEAs and used to identify any possible hardware (or other) failure mode up to the lowest part level. It should be based on hardware breakdown (e.g. the BoM = Bill of Material). Any Failure effect Severity, failure Prevention (Mitigation), Failure Detection and Diagnostics may be fully analysed in this FMEA. 164/210
    165. 165. Types Process: analysis of manufacturing and assembly processes. Both quality and reliability may be affected from process faults. The input for this FMEA is amongst others a work process / task Breakdown. 165/210
    166. 166. 166/210
    168. 168. Why should you be conducting assessments? ● ● ● ● To spot unsafe conditions and equipment To focus on unsafe work practices or behavior trends before they lead to injuries Reveal the need for new safeguards To provide a safe working environment for all workers
    169. 169. What should I look for during an office assessment? ● ● ● ● ● ● ● Emergency Egress Work Environment Ergonomics Emergency Information Fire Prevention Electrical Systems Employee Behavior
    170. 170. Emergency Egress ● ● ● ● ● Blocked or locked doorways Locking devices that can impede emergency egress Properly marked exits Properly illuminated exits Clear aisles and pathways
    171. 171. Work Environment ● ● ● ● Clean, sanitary and orderly work spaces Tripping hazards such as loose tiles, carpeting, flooring Are drawers kept open when not in use Are items stored above shoulder level and unsecured
    172. 172. Ergonomics ● ● ● Are workstations configured to prevent employee discomfort and injury Are employees aware of ergonomic risk factors Have employees received ergonomic training
    173. 173. Emergency Information ● ● ● Are emergency phone numbers posted where they can be readily found Are employees trained in emergency procedures Are evacuation procedures and diagrams posted
    174. 174. Fire Prevention ● ● ● ● Are portable fire extinguishers readily available and unobstructed Are fire pull stations clearly marked and unobstructed Are all fire sprinkler heads kept clear and unobstructed (at least 18 inches) Are space heaters used and authorized
    175. 175. Electrical Systems ● ● ● ● ● Are extension cords/power strips kept uncoupled (piggy-backed) Are all extension cords/power strips provided by the agency Are electrical outlets clear of combustible materials Do electrical cords create trip hazards Are extension cords used as permanent wiring
    176. 176. Employee Behavior ● ● ● Are employees observing established safety rules Do employees minimize hazards by applying Operational Risk Management principles Are employee allowed to report unsafe conditions or acts without restraint
    177. 177. Operational Risk Management Identify Supervise Assess ORM Control Decide
    178. 178. How to assess safety SUMMARY ● ● ● ● Promoting Safety Monthly Assessment Program Positive Findings (above & beyond minimum requirements) Assessments – emergency info, egress, environment, ergonomics, fire prevention, electrical, unsafe behavior
    179. 179. Risk Assessment and Management
    180. 180. Getting the Measure of Risk ● ● ● ● Having understood the potential accident sequences associated with a hazard (e.g. using ETA) … Next step is to determine the severity of the credible accidents identified Remember risk is the product of severity and probability of an accident Two different approaches: – Estimate probability of accident, and hence get a measure of accident risk… then decide whether estimated risk is acceptable ● ● Used in many domains, including rail, military aerospace Will discuss this approach first, using rail standards as
    181. 181. Accident Severity ● Accident Severity Categories are qualitative descriptions of consequences of failure conditions (hazards) – considering likely impact Severity Level Consequence to Persons or Environment Consequence to Service Catastrophic Fatalities and/or multiple severe injuries and/or major damage to the environment Critical Single fatality and/or severe injury and/or significant damage to the environment Loss of a major system Marginal Minor injury and/or significant threat to the environment Severe system(s) damage Insignificant Possible minor injury Minor system damage EN 50126
    182. 182. Accident Probability Next, estimate (predict) accident probability ● ● Use historical results, analysis, and engineering judgment to determine appropriate qualitative probability category Note we may have to consider both – – how likely hazard is to arise how likely hazard is to develop into accident Category Description Frequent Likely to occur frequently. The hazard will be continually experienced. Probable Will occur several times. The hazard can be expected to occur often. Occasional Likely to occur several times. The hazard can be expected to occur several times Remote Likely to occur sometime in the system lifecycle. The hazard can reasonably be expected to occur Improbable Unlikely to occur, but possible. It can be assumed that the hazard will exceptionally occur. Incredible Extremely unlikely to occur. It can be assumed that the hazard may not occur. EN 50126
    183. 183. Classifying Risk ● ● Having assigned severity and probability associated with hazard consequences … Next step is to use a Hazard Risk Matrix to classify the the risk Frequency of occurrence of a hazardous event Risk Levels Frequent Undesirable Intolerable Intolerable Intolerable Probable Tolerable Undesirable Intolerable Intolerable Occasional Negligible Undesirable Undesirable Intolerable Remote Negligible Tolerable Undesirable Undesirable Improbable Negligible Negligible Tolerable Tolerable Incredible Negligible Negligible Negligible Negligible Insignificant Marginal Critical Catastrophic Severity Level of Hazard Consequence EN 50126
    184. 184. Accepting Risk Reasoning about risk ● Using HRI now possible to say, e.g. Risk(Hazard H1) > Risk(Hazard H2) ● In order to say what is acceptable / unacceptable, must provide an interpretation, Risk Actions to be applied against each category e.g.Category Intolerable Undesirable Shall be eliminated Shall only be accepted when risk reduction is impracticable and with the agreement of the Railway Authority or the Safety Regulatory Authority, as appropriate Tolerable Acceptable with adequate control and with the agreement of the Railway Authority Negligible Acceptable with the agreement of the Railway Authority EN 50126
    185. 185. Managing Risk Risk Resolution ● Can associate objectives or actions with risk class, e.g. – – – ● technologies used development processes assessment criteria Example, for “undesirable” risk, might decide – – – no single point of failure shall lead to system accident probability of fatality must be < 1x10-8 per hour failure behaviour over time (lifetime of system)
    186. 186. Determining Risk - Civil Aerospace Style 1 Start with determination of severity ● very similar to rail categories ARP 4761
    187. 187. Determining Risk - Civil Aerospace Style 2 ● When severity has been determined, can set objectives (requirements) for risk control – primarily boundaries on acceptable probability of failure condition (hazard) S e v e r ity C la s s ific a tio n P r o b a b ility O b je c tiv e Q u a n tita tiv e D e s c r ip tiv e (p e r flig h t h o u r ) C a ta s tro p h ic E x tr e m e ly Im p r o b a b le < 1 0 -9 H a z a rd o u s E x tr e m e ly R e m o te 1 0 -7 t o 1 0 -9 M a jo r R e m o te 1 0 -5 t o 1 0 -7 R e a s o n a b ly P r o b a b le 1 0 -3 t o 1 0 -5 M in o r F re q u e n t > 10 -3 Adapted from ARP 4761
    188. 188. Determining Risk - Civil Aerospace Style 3 For civil aerospace, severity-related objectives are set in standards ● easy to work with ● unambiguous – provided you can agree on standardised and objective measures of severity! BUT ● Need to understand that direct mapping from severity to probability objectives is based on important assumption:
    189. 189. Determining Risk - Civil Aerospace Style 4 Where does acceptable risk come from? ● in principle, requirements reflect “what risk the public is willing to accept” – – ● risk (A) = probability (A) * severity (A) level of acceptable risk hard to determine, and subjective in practice, certification bodies (airworthiness authorities) act as surrogates for the public – – “bottom line” is hull loss rate civil aviation hull loss rate target is currently 10 -7 per flying hour ● for comparison, military aviation (UK) hull loss rate
    190. 190. Determining Risk - Civil Aerospace Style 5 ● Has further implications: – – ● implicit assumption about number of catastrophic failure conditions on an aircraft also implicit assumption about how probable failure condition is to actually develop into an accident Example: – – – probability objective (target) for catastrophic failure condition is < 10-9 per flight hour target hull loss rate is < 10-7 per flight hour implies either a maximum of 100 catastrophic failure conditions on an aircraft, assuming all occurrences of catastrophic failure conditions will
    191. 191. Determining Risk - Civil Aerospace Style 6 ● ● Note that objective of probability per flying hour has its problems… Consider: – – histogram shows accidents / time 1.8% of accidents occur in load / taxi / unload
    192. 192. The ALARP Principle 1 ALARP = As Low As Reasonably Practicable R is k c a n n o t b e ju s tif ie d o n a n y g ro u n d s IN T O L E R A B L E T H E A LA R P ( A s L o w A s R e a s o n a b ly P r a c t ic a b le ) R E G IO N R is k is u n d e r t a k e n o n ly if b e n e f it is d e s ir e d B R O A D LY A C C E P T A B LE R E G IO N TO LE R A B LE o n ly if r is k r e d u c tio n s a r e im p r a c t ic a b le o r c o s t g r o s s ly d is p r o p o r tio n a te to th e im p r o v e m e n t g a in e d TO LE R A B LE if c o s t o f r e d u c t io n w o u ld e x c e e d im p r o v e m e n t g a in e d N E G L IG IB L E R IS K
    193. 193. The ALARP Principle 2 ● ● ● ● ● Provides an interpretation of identified risks Pragmatic – although you can always spend more money to improve safety, it is not always cost-effective However, “cost-effectiveness” introduces ambiguity Regions of tolerability defined by regulatory domain and customer Approach is often implicit in the management of safety-critical projects anyway
    194. 194. Risk Reduction Flowchart 1 Identify and determine risk associated with identified hazards ID E N T IF Y H A Z A R D a n d R IS K H a za rd Id e n tific a tio n S y s te m D e s ig n H a z a r d R is k (S e v e r ity /P r o b a b ility ) E s ta b lis h e d
    195. 195. Risk Reduction Flowchart 2 Id e n tify H a z a r d a n d R is k H a za rd Id e n tific a tio n A S S E S S R IS K H a z a r d R is k (S e v e r ity /P r o b a b ility ) E s ta b lis h e d R is k M e a s u r e d A g a in s t H R I M a tr ix C r ite r ia S y s te m D e s ig n No R is k Yes A c c e p ta b le ?
    196. 196. Risk Reduction Flowchart 3 Id e n tify H a z a r d a n d R is k H a za rd Id e n tific a tio n S y s te m D e s ig n H a z a r d R is k (S e v e r ity /P r o b a b ility ) E s ta b lis h e d R is k M e a s u r e d A g a in s t H R I M a tr ix C r ite r ia T A K E A C T IO N A p p ly R e -d e s ig n P re c e d e n c e C r ite r ia O p e ra to r / C re w T r a in in g R e q u ir e d A s s e s s R is k 1. 2. 3. 4. No R is k Yes A c c e p ta b le ? C o n tin u e d e s ig n . D o c u m e n t a n a ly s is a n d ju s tific a tio n R e d e s ig n to e lim in a te h a z a r d , o r r e d u c e lik e lih o o d In c o r p o r a te m itig a tio n , e .g . s a fe ty d e v ic e s P r o v id e w a r n in g s D e v e lo p p r o c e d u r e s a n d tr a in in g
    197. 197. Precedence in Risk Reduction 1 ● Redesign to eliminate risk – Best where practical ● ● Redesign to reduce hazard likelihood – Select architecture or components ● ● ● Change in operational role, or removal of hazardous material Duplex or triplex or … Higher integrity components, with lower failure rates Incorporate mitigation to reduce impact of failures – – Automated protection, e.g. pressure relief valves Where incorporated, need to check periodically
    198. 198. Precedence in Risk Reduction 2 ● Provide warning devices – Detect the hazardous condition and warn operators ● ● ● Provide procedures and training – Reduce likelihood of hazard, or mitigate ● – may involve use of personal protective equipment Do not assume procedures are enough by themselves ● ● e.g. indicate that landing gear has not fully deployed e.g. to evacuate building due to fire or fumes consider evolution of power guillotine regulations Precedence order
    199. 199. Residual Risk - 1 ● Residual Risks are those that cannot be ‘designed out’ – ● ● risks inherent to design, where benefit is desirable Significant residual risks must be formally accepted by the appropriate authority (typically customer / operator) Can use Decision Authority Matrix, e.g. Hazard Severity Categories Frequency of Occurrence I II III IV CATASTROPHIC CRITICAL MARGINAL NEGLIGIBLE A FREQUENT HIGH HIGH HIGH MEDIUM B PROBABLE HIGH HIGH MEDIUM LOW C OCCASIONAL HIGH HIGH MEDIUM LOW D REMOTE HIGH MEDIUM LOW LOW E IMPROBABLE MEDIUM LOW LOW LOW (MIL-STD-882C)
    200. 200. Residual Risk 2 Appropriate Decision Authority (From MIL-STD882C) HIGH – Service Acquisition Executive – e.g. no ground collision avoidance on F22 – signed off by 4-star Air Force General MEDIUM – Program Executive Officer LOW – Program Manager ● ● Usually a requirement to document all actions taken to resolve risk within terms of contract Customer authority can then decide whether
    201. 201. Risk Management Summary ● ● Risk Assessment is the process of identifying the risk associated with system hazards Approach in many sectors (military, rail…) is to use Hazard Risk Matrix to determine the risk associated with a hazard from severity and probability estimates – ● then decide on acceptability of risk Alternative approach (Civil Aerospace) is based around severity – – assumption of fixed level of acceptable risk... … so can derive objectives, including probability, from severity