Human Factors in Barrier Thinking
•Download as PPTX, PDF•
2 likes•12,131 views
The oil and gas industry places great reliance on layers-of-defenses, or barrier thinking, to protect against process safety incidents. Human performance continues to be the single most widely relied on barrier: whether as a defense in its own right, or in implementing, inspecting, maintaining and supporting engineered defenses. Human error, in its many forms, also continues to be a significant threat to the reliability of engineered and organizational defenses. While approaches to developing and assuring layers of defenses strategies have become increasingly formalized and rigorous in recent years, many organizations struggle to know how to ensure the human defenses they rely on are as robust as they reasonably can be when those strategies are developed and implemented. Drawing on the 2005 explosion and fire at the Buncefield fuel storage site as a case study, the presentation considers issues associated with the independence and effectiveness of human defenses. The key idea SPE members should take away from the lecture is that organizations can improve the strength of their human defenses by being clearer about exactly what it is they expect and intend of human performance to protect against threats. The presentation sets out challenges organizations can use to ensure the human defenses they rely on are as robust and reliable as they reasonably can be.
More Related Content
What's hot
What's hot (20)
Similar to Human Factors in Barrier Thinking
Similar to Human Factors in Barrier Thinking (20)
More from Society of Petroleum Engineers
More from Society of Petroleum Engineers (20)
Recently uploaded
Recently uploaded (20)
Human Factors in Barrier Thinking
- 1. Society of Petroleum Engineers Distinguished Lecturer Program www.spe.org/dl 1 Professor Ron McLeod Ron McLeod Ltd. Human Factors in Barrier Thinking
- 2. Objectives • Explore the role that human performance has in layers-of- defences strategies • Consider what Independence and Effectiveness mean for Human Factors • Demonstrate how controls reflect an organizations Intentions and Expectations of human behaviour and performance • Illustrate how those Intentions and Expectations can be defeated in the real-world. 2
- 3. Content 1. Basic concepts in Barrier Thinking • Bow-Tie Analysis • Criteria for robust barriesr 2. Human Factors in control Independence • Example: Fuel spill during tank filling 3. Human Factors in control Effectiveness • The importance of understanding Intentions and Expectation 4. Lessons from reality: Buncefield 5. Five challenges in assuring human controls 3
- 4. Basic Concepts in Barrier Thinking Bow-Tie analysis Criteria for robust barriers
- 6. Layers of Protection Analysis Standards • IEC 61508, 2003 – Functional safety of electrical. Electronic. Programmable electronic safety-related systems • IEC 61511, 2010 – Functional Safety – Safety Instrumented systems for the process industry sector Good Practices • Process Safety Leadership Group, 2010 – Safety and environmental standards for fuel storage sites • Centre for Chemical Process Safety, 2015 – Guidelines for initiating events and independent protection layers in layers of protection analysis “Human factors appear to dominate ….in all the LOPA studies assessed in this work” (Chambers, et al, 2009)
- 7. Bowtie Analysis ConsequenceThreat Hazard Top Event Degradation Factor Barrier • Critical Equipment – Physical structures or equipment that support a control. • Critical Activities – Human tasks necessary to assure the integrity of structural or equipment controls. • Critical Positions – Roles responsible for the performance of Critical Activities. Barrier Barrier Barrier Barrier Degradation Factor Barrier
- 8. Current industry initiatives • Chartered Institute of Ergonomics and Human Factors (CIEHF) – White paper: “Human factors in Barrier Thinking” • Expected early 2017 • Centre for Chemical Process Safety (CCPS) – Concept Book: “BowTies for Risk Management” • Energy Institute, EPSC, AICHE, AIDC • Lyondellbasel, Braskem, Linde, ABS, Eni, Phillips66, Shell, BP, BHPBilliton • Expected 2017
- 9. Criteria for good barriers Every barrier should be: Specific: Specific actor, specific object, specific goal Effective: It – and it alone - must be capable of blocking the threat Independent: A single failure should not be able to defeat more than one control Capable of being Assured: Be implemented so it is capable of functioning as intended Be in-place, maintained and supported. 9
- 10. • An issued Bowtie Analysis is a very strong statement of intent. – It sets out what the organisation intends to do to protect its workers, the public and the environment. • The organisation chooses which controls it intends to rely on. • If controls are not sufficiently robust, they should not be relied on. Note! 10
- 11. Human Factors in Control Independence Independence: A single failure should not be able to defeat more than one control 11
- 12. A hypothetical Bowtie for tank filling Top Event = Spill of flammable fuel during tank filling Fuel spill Tank overfill Flammable Fuel Transfer plan Fuel level displayed in control room High Level Alarm High-High Level Alarm Independent Shut-off Experienced operator monitors fill
- 13. Are the controls specific? Fuel spill Tank overfill Flammable Fuel Transfer plan Fuel level displayed in control room High Level Alarm High-High Level Alarm Independent Shut-off Experienced operator monitors fill - Specific Actor? - Specific Object? - Specific Goal? ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔
- 14. Are the controls Independent? Fuel spill Tank overfill Flammable Fuel Transfer plan High Level Alarm High-High Level Alarm Independent Shut-off Fuel level displayed in control room Experienced operator monitors fill
- 15. Human Factors issues in control Independence • Organisational factors can influence all operators – Chain of Command; Incentives; Contracts • Cross-checking by another operator is often not independent • Often, there is no-one else. UK Process Safety Leadership Group “…the intended independence of the checking process may not in fact be achieved . .” Swain & Guttman, 1983 “…the behaviour of an operator and a checker are not independent”.
- 16. Level Guage Independent High Level Switch Are the controls Independent? Fuel spill Tank overfill Flammable Fuel Transfer plan High Level Alarm High-High Level Alarm Independent Shut-off Fuel level displayed in control room Experienced operator monitors fill Proactive operator monitoring Tank level alarm and operator response
- 17. Are the barriers Effective? What is Intended and what is Expected? Tank overfill Flammable Fuel Tank level alarms Independent Shut-Off Proactive operator monitoring Transfer Fuel spill
- 18. Intentions and Expectations • Intentions – Things the proposers intends to ensure are in place for the Barrier to function – Are within the scope of supply of the proposers – Will often be about the design of the work environment and equipment interfaces • Expectations – Are not within the proposers scope of supply. – But must be assumed to be true for a control to be considered effective. – Will often be about organisational arrangements and operational and commercial practices
- 19. Examples of Intentions Tank overfill Flammable Fuel Tank level alarms Independent Shut-Off Proactive operator monitoring Transfer • …will be fit for the purpose • …will be set at appropriate levels • …will be effective in attracting the operators’ attention • …will make the operator aware of the problem in good time… • … And that • …operators will know if the alarm is not working… • … “Our intention is that the tank level alarms… Fuel spill
- 20. Examples of Expectations Tank overfill Flammable Fuel Tank level alarms Independent Shut-Off Proactive operator monitoring Transfer Fuel spill • …the alarms will be installed and maintained correctly • …operators will be present and in a fit state to respond • …operators will be trained and competent to know what an alarm means and how to respond • …operators will do what is needed in time… And that • …operators will report known faults • …reported faults will be fixed • ..operators will not initiate a fuel transfer if the alarm system is not working… “Our expectations are that …
- 21. After test of HF Independence Tank overfill Flammable Fuel Tank level alarms Independent Shut-Off Proactive operator monitoring Transfer Unexpected change to plan Communications with supplier Operator does not monitor proactively Job design and work arrangements allow effective proactive monitoring Operators understand safety critical nature of operation Tank level sensor does not function Regular Routine Maintenance and testing Independent shut-off does not function Regular Routine Maintenance and testing Fuel spill Using independent data sources Same operator ? + Degradation Factors and their safeguards
- 22. Buncefield Fuel Storage Depot - Dec 11 2005 • Sat 10 Dec, 18:50 – Receipt of parcel of unleaded fuel initiated into tank 912 • Sunday 11 Dec, 05:37 – Tank capacity exceeded. Fuel began to spill • 06:00 – Vapour cloud ignited – 250,000l fuel • Fire burned for 5 days – 0 Fatalities – 40 injuries – Major economic and social disturbance Why did it happen? 1. Failure of automatic tank gauging system 2. Failure of independent high-level switch Health and Safety Executive: “Buncefield: Why did it happen? The underlying causes of the explosion and fire at the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005”. http://www.hse.gov.uk/comah/investigation-reports.htm. 22
- 23. How did the tank level alarms perform at Buncefield? Tank overfill Flammable Fuel Tank level alarms Independent Shut-Off Proactive operator monitoring Transfer Tank level sensor does not function Routine Maintenance and testing Fuel spill
- 24. There were no alarms… “At 0305 hrs on Sunday 11 December the ATG display …stopped registering the rising level of fuel in the tank..” • The control room operators had nothing to draw their attention to the fact that the alarm had failed • There was a history of repeated failure and unreliability of these alarms • The same control room operators who knew the alarms were unreliable continued to rely on them. It had stuck 14 times during the three months before the incident Intention: “…operators will know if the alarm is not working…” Expectation: “..operators will not initiate a fuel transfer if the alarm system is not working…”
- 25. What happened at Buncefield? Tank overfill Flammable Fuel Tank level alarms Independent Shut-Off Proactive operator monitoring Transfer Unexpected change to plan Communications with supplier Operator does not monitor proactively Job design and work arrangements allow effective proactive monitoring Operators understand safety critical nature of operation Tank level sensor does not function Regular Routine Maintenance and testing Independent shut-off does not function Regular Routine Maintenance and testing Fuel spill “..the flow rate.. changed from 550 to 900 m3/h without the knowledge of the supervisors.” “The supervisors relied on the alarms to control the filling process.” “The servo-gauge had stuck..” “..was installed without the padlock.”
- 26. Proactive operator monitoring Tank overfill Flammable Fuel Tank level alarms Independent Shut-Off Proactive operator monitoring Transfer Operator does not monitor proactively Job design and work arrangements allow effective proactive monitoring Operators understand safety critical nature of operation Fuel spill What is Intended and what is Expected?
- 27. Pro-active operator monitoring Examples of intentions • The design of the control room and instrumentation will provide all of the information and controls needed. – Without relying on the tank level sensors. • Operators will be able to access, understand and use the information and controls. • Etc… Examples of expectations • The operators job will be designed to support proactive monitoring – Simultaneous tasks will not interfere with the operator’s ability to monitor the transfer – The operator will not be incentivised to give pro-active monitoring a low priority – Etc.. • Operators will check the progress of the transfer frequently enough and while they have time to intervene, without prompting. • Etc…
- 28. Five Human Factors challenges 1. What exactly is the control? – What is intended and what is expected of human performance? 2. Who will be involved? – Who Detects? Who Decides? Who Acts? 3. What information will they need? – Where will they get it? 4. What judgements or decisions will they need to make? – Are they reasonable in the conditions? – Could safety compete with production? 5. What actions will they need to take? – Will they have the time? – How and when will they know they were succesful?
- 29. In summary • Considered what Independence and Effectiveness mean for controls that rely on people • Demonstrated that controls reflect the organizations Intentions and Expectations of human performance • Illustrated how those intentions and expectations can be defeated in the real-world. • Suggested 5 challenges to ensure human controls are as robust as they reasonably can be. 29
- 30. Challenges and Take-Aways • How many of the controls/barriers your business relies on depend on human performance? – Operations/ Maintenance/ Inspection / Support • Would you know exactly what those controls are? – What is Intended and what is Expected of your people? • How does your business ensure those human controls are as robust as they reasonably can be? – That intentions are actually implemented – That expectations are managed during planning and operations 30
- 31. Look our for…. • CIEHF White paper: “Human factors in Barrier Thinking” • Expected early 2017 • CCPS Concept Book: “BowTies for Risk Management” • Expected 2017
- 32. Thank you for your attention Any Questions? ron@ronmcleod.com www.ronmcleod.com 32
- 33. Society of Petroleum Engineers Distinguished Lecturer Program www.spe.org/dl 33 Your Feedback is Important Enter your section in the DL Evaluation Contest by completing the evaluation form for this presentation Visit SPE.org/dl