- Email: [email protected]
Increasing Human Reliability in the Chemical Process Industry Using Human Factors Techniques
0957–5820/06/$30.00+0.00 # 2006 Institution of Chemical Engineers Trans IChemE, Part B, May 2006 Process Safety and Environmental Protection, 84(B3): 200– 207
www.icheme.org/psep doi: 10.1205/psep.05160
INCREASING HUMAN RELIABILITY IN THE CHEMICAL PROCESS INDUSTRY USING HUMAN FACTORS TECHNIQUES ¨ WE S. GITAHI KARIUKI and K. LO Technische Universita¨t Berlin, Institute of Process and Plant Technology, Berlin, Germany
A
comprehensive hazard analysis consists of first understanding different factors that would lead to an unwanted event. This paper addresses this issue by using a risk analysis framework and it is extended to capture human and organization factors that influence the operator performance in order to identify the actual error producing conditions that lead to basic events. The paper describes a methodology that will be used in the process hazard analysis to introduce the design/operator mismatches and management deficiencies. In this method the most important error producing conditions (EPCs) associated with a particular human error are identified and analysed qualitatively. These EPCs will then be quantified to determine how much they influence human reliability. Keywords: human factors; operator error; analytical hierarchy process.
INTRODUCTION
it incorrectly (error of commission). That means ‘what’ the operator did incorrectly or failed to do is investigated while ‘why’ he acted wrongly is not sufficiently investigated (CCPS, 1994) (see Figure 1). However, risk analysis methods have matured over the years. Included in this list are tree-based methods, HAZOP and root cause analysis methods among others. But these methods do not address human related issues with as much rigour as engineering issues. This cannot be justified especially where human reliability plays a vital role in the system safety. The existing human reliability methods concentrate on the symptoms rather than the root causes of human errors (van Vuuren et al., 1997). No matter the type of human failure the underlying causes play a very important role. In order to fully analyse specific erroneous acts, human factors analysis techniques are required. Human factors capture design weaknesses and management failures that affect the performance of the operator negatively. These are called error-producing conditions (EPC). This study is a continuation of the work initiated during the Process Industries Safety Management (PRISM) (2001 –2004) project. The paper first introduces the classification of human factors based on the human factors guidelines developed during that project. Quantification of HF was identified as one of the areas that needed further research and therefore will be discussed here. The approach discussed here is intended to lay a foundation for integrating human factors in QRA. It is part of a larger work already published. Although the example given uses fault trees it is good to note that the results obtained could be used in combination with any QRA framework. The methodology described in this paper systematically models the role of humans in the system and integrates it
Reliability is defined as probability to perform a specified function or mission under given conditions while availability is the probability that the system or component is available when called upon (Dhillon, 1986). When analysing human reliability it is necessary to identify those human actions or inactions that can affect the reliability/availability of a system. These actions/inactions are defined as human errors. Human errors are key causes of accidents in the chemical process industry, just like in many other industries. Statistics show that they account up to 80% (McCafferty, 1995). Another study shows that 64% of accidents are due to human errors (Lo¨we and Kariuki, 2004). In the petrochemical industry e.g., oil refineries where automation is very high, human error accounts up to 50% (HSE, 1999). Therefore, prevention or reduction of human error is vital for the improvement of safety in process plants. The question is why does human error still remain the leading cause of accidents in chemical process industries. One of the reasons is the complexity with which human errors occur. Some experts have classified human errors among mechanisms that contribute to common mode failures. These types of failures are very difficult to quantify especially in quantitative risk analysis (QRA). Another reason is the common practice to regard human error as failure of frontline operators to perform an action (error of omission) or performing Correspondence to: Mr S. Gitahi Kariuki, Technische Universita¨t Berlin, Institute of Process and Plant Technology, Sekr. TK0-1, Straße des 17 Juni 135, 10623 Berlin, Germany. E-mail: [email protected]
200
INCREASING HUMAN RELIABILITY IN CHEMICAL PROCESS INDUSTRY
201
Figure 1. Steps to carry out an incident/accident investigation (DOE, 1992).
into risk analysis. It introduces a documented procedure that seeks to identify human factors in an accident. It helps to cover events that are very rare, for instance operator shutting off a safety valve. These events are only preventable at organisational level (CCPS, 1994). The objective is to reduce human failures by reducing or eliminating EPCs.
Figure 2. A simplified model of interaction of factors that lead to an accident.
HUMAN FACTORS Human factors are workplace and personal factors that affect either positively or negatively the performance of the operator. HSE (1999) defined human factors as follows: ‘Human factors refer to environmental, organizational and job factors, and human and individual characteristics, which influence behaviour at work in a way which can affect health and safety.’ The study of human factors can help identify operations susceptible to human error and improve working conditions to reduce fatigue and inattention. Table 1 shows the areas that need to be considered for a comprehensive human factors analysis (Lo¨we et al., 2005). The list may differ from analysts to analysts but the authors feel that the most important areas have been included. Human factors comprises of analysing ‘why did it happen?’ shown in Figure 1. In incident/accident investigations these are referred to as root causes. The analysis helps to unearth the role that insufficient design and management failures have in human error occurrence and in equipment failure. Figure 2 shows a simple framework to undertake such an analysis.
Table 1. Human factors areas. Criteria Workplace factors
Factors 1 Information
2 Job design
3 Supervision 4 Human-systeminterface (HIS) design 5 Task environment 6 Workplace design Operator factors
7 8 9 10
Physical characteristics Attention/motivation Fitness for duty Skills and knowledge
Attributes Training, procedures and procedure development, communication, labels and signs, documentation Work schedules, staffing, shifts and overtime manual handling and cumulative trauma disorders (CTD) Conflict resolution Controls, displays, field control panels, tools (hand), equipment and valves Lighting, noise, temperatures, toxicity Facility layout, workstation configuration, accessibility Anthropometrics, sex, age Stress and fatigue, illness Experience
An undesired event is caused by equipment failure, human error, external impact (not included in Figure 2) or a combination thereof. These are referred to as direct causes. The science of analysing equipment reliability and failures has developed over the years. Many methods are in existence but none will be discussed here because they lie outside the scope of this paper. Inadequate design implies that the physical and cognitive capabilities and limitations of populations of people are not incorporated into design and operation of a system, process, or equipment. In this case, technical design refers to human factors engineering/human engineering. This branch of engineering is concerned with designing of products and processes and equipment used in manufacturing so as to maximize their ability to be used comfortably, safely and effectively by human beings (Chapanis, 1986). Areas that are considered are workplace layout, workplace accessibility, controls and displays, workplace environment and labelling and signage. Management faults include inadequate training, procedures and procedure development, work schedules, staffing, shifts and overtime among others. From Figure 2 it can be seen that management faults directly influence both the equipment failure and human factors engineering. Equipment failure can be analysed through plant condition or maintenance and inspection management. A risk analysis is carried out to identify and model accident sequence and scenarios. A good analysis method should be able to identify if not all, the major contributors of an event. But most stop when the immediate or direct cause has been identified e.g., operator fails to close the valve (CCPS, 1994). The question is why the operator actually failed to close the valve. Was he able to identify the right valve? Was he at that particular workplace when he was required to close the valve? These questions would be answered at a management level and Kletz has described its importance (Kletz, 2001a, b). Figure 3 shows the procedure of identifying human factors underlying each unwanted event. It is only through addressing these underlying causes that we are able to implement error reduction strategies and therefore increase human reliability. The following sections try to introduce such a procedure. In this work fault tree analysis (FTA) is chosen as the tool to model accidents. This is a powerful technique that is
Trans IChemE, Part B, Process Safety and Environmental Protection, 2006, 84(B3): 200 –207
202
¨ WE GITAHI KARIUKI and LO
Figure 3. Procedure to identify human factors underlying an unwanted event.
able to present complex inter-relations of events that lead to unwanted events. It is able to capture equipment failures, human failures or external impacts. The basic events are then analysed to find those that have human error elements in them. Each basic event is then analysed to find the underlying human factors. The factors are derived from Table 1. When carrying out a human reliability analysis (HRA), each human error event is assigned a probability of occurrence. The probability value is generic and therefore does not represent the actual conditions of the system or plant being analysed (Kariuki and Lo¨we, 2005). Each plant conditions differ significantly from others. Analysing and quantifying human factors is intended to help evaluate the quality of factors affecting operator performance in a particular system or plant. One should be able to establish and measure the EPC/factors that surround each operator error. These factors, i.e., information, job design, supervision, HSI design, task environment and workplace design are given a grade based on subjective evaluation of the system (plant) being analysed. This subjective evaluation depends on the analysts’ experience in HF. To reduce the subjectivity of the analyst analytical hierarchy process (AHP) is used. This is discussed in later chapters.
HUMAN FACTORS AND HUMAN RELIABILITY
Figure 5. Steps in a human operator control operation (adapted from Wickens, 1992).
Operator error could occur at any of these steps. During perception phase operator could, for example, misread information, misperceive or fail to detect visual or auditory information. He may fail to make the right decision due to memory capacity overload, similarity of information perceived or due to lack of or incorrect knowledge. Wrong action could be contributed by similarities in (hard to discriminate) controls or interruption from environment among others. As illustrated by Figure 6, to a big percentage the output operator errors are determined by the quality of several system/plant attributes x1, x2, . . . , xn, on the left hand side of the diagram. The attributes are characterized by the performance measures r1, r2, . . . , rn. These attributes are human factors. Since each human factor attribute influences the error causation differently then weights v1, v2, . . . , vn are assigned. The procedure to assign r and v is discussed in later sections. Not all errors are caused by inadequate human factors. Others could be deliberate violations and single extraneous acts and are classified under ‘other influences and error types’. These are not discussed further in this paper. In order to increase operator reliability the performance measures, ri for attributes that have influence on perception, decision or action of the operator should be maximized. That means maximizing r1, r2, . . . , rn in order to reduce error opportunities. In the following sections the procedure
A human machine system comprises of a human operator, a control and a display/alarm (see Figure 4) Reliability of the control and that of the display/alarm is easy to obtain using the existing reliability methods. This set-up is common in offloading operations. The operator observes the level gauge and closes the valve when the tank is full. The illustrative example demonstrates an operation that is entirely manual. For such an operation and any other operator task the main steps that take place are illustrated in Figure 5.
Figure 4. Components of human system interface.
Figure 6. Factors influencing frontline operator error.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2006, 84(B3): 200– 207
INCREASING HUMAN RELIABILITY IN CHEMICAL PROCESS INDUSTRY to consider human factors during process hazards analysis for the example above is outlined.
Step 1: Identifying Causes of Accident If the filling process were not stopped after the tank is full then there would be an overfilling that would lead to spilling of hydrocarbon. This is the top event and fault tree analysis is constructed to show the combination of events that lead to this accident (see Figure 7). This is a very simple fault tree and is used for demonstration purposes only. A spill would occur depending on the frequency of offloading and the probability that the overfilling barriers fail. The basic events from this fault tree form three minimum cut-sets. These are B1, B2, B3 and B1, B2, B4 and B1, B2, B5. Minimum cut-sets are defined as set of basic events that contains no redundant elements (CCPS, 1989). In case of large fault trees the cut-sets are ranked according to their significance of how they contribute to the top event. For illustration purposes the three cut sets in this case are assumed to have the same significance.
Step 2: Identifying Initiating Events with Human Error Elements Basic events that contain human error elements in them are presented here below: B1: B2: B3: B4: B5:
Filling frequency Receiving tank volume too small High level (HL) detected, wrong action taken Operator fails to detect HL High level (HL) fails
These are typical events found during FTA. Not all basic events are classified as initiating events. Event B1 may not be classified as an initiating event but for the top event to occur this condition (filling the tank) has to be present. Any time the condition is present then an opportunity for error occurs. It is referred to as an enabling event (CCPS, 1989).
Figure 7. Simple fault tree of hydrocarbon spill during offloading operation.
203
Step 3: Identifying Underlying Human Factor Causes Figure 8 represents the procedure to identify the underlying human factors. One initiating event is analysed at a time. Each factor is considered to determine how much it could influence the initiating event. The factors identified to have a ‘high’ influence are given first priority, second priority goes to ‘moderate’ and ‘low’ gets the last priority. The reason for this classification is to limit the number of attributes to a manageable level. The maximum number of attributes recommended for the AHP is seven (Saaty, 2000). This method is discussed later in this paper. Table 2 illustrates a summary of attributes that may have significant impact on basic events B2, B3 and B4. These have been identified using the procedure illustrated in Figure 8. It is worth to note that this exercise is subjective and therefore may require input from several experts to make it valid. As an example, ordering procedures influence the volume that is available in the receiving tank. If documentation were not done adequately then ordering twice would be a feasible error. Job allocation determines the amount of workload on the operator. Supervision is another factor that needs to be analysed under this human error event. In this case task environment i.e., noise, heat, lighting, has no effect at all and so is the workplace design. Each human error event identified as a cause of accident is analysed the same way. Step 4: Quantifying Human Factors and Integrating Them into Quantitative Risk Analysis Each factor identified will be assigned a weight v i , which represents how much it contributes towards human error occurrence. For instance lack of or poor training may have a bigger weight than operator experience. Looking at the basic event B3, the general weights are as follows; procedures v1 , documentation v2 , training v3 , supervision checks v4 and displays v5 . These weights are going to be determined by AHP. The AHP method was developed by Saaty (1980) for solving multi-attribute decision problems. It uses a hierarchical structure to decompose a problem into attributes and then guide decision makers through a series of pair-wise comparison judgements to express relative strength of impact of the attributes in the hierarchy. These judgements are translated into numbers. The first step of AHP is to identify attributes that influence decision or system behaviour. Structuring the problem hierarchically is guided by no specific rule and therefore allows the user to construct his or her own model. Next step is determining the relative influence of each attribute on the system performance. Saaty and Kearns (1985) provided a numerical judgement scale 1 to 9. Each attribute is judged how important it is in dominating the other. The questions asked could take the form ‘When comparing different attributes, which attribute is more important (in achieving the goal)?’ All identified attributes are compared against each other in a matrix pair-wise comparison to express the relative preference among the factors/attributes. This is an n n square matrix. From the matrix of pair-wise comparison weighted eigenvectors are added component-wise to
Trans IChemE, Part B, Process Safety and Environmental Protection, 2006, 84(B3): 200 –207
204
¨ WE GITAHI KARIUKI and LO
Figure 8. Procedure to identify the human factors underlying human error event.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2006, 84(B3): 200– 207
INCREASING HUMAN RELIABILITY IN CHEMICAL PROCESS INDUSTRY
205
Table 2. Attributes having significant impact on basic events B2, B3 and B4. Basic events Receiving tank volume too small Operator fails to detect HL HL detected, wrong action taken
Information
Supervision
Procedures Documentation Training Training Training
Checks
Human-system interface design
Task environment
Workplace design
Operator characteristics
Displays Displays Valve
Accessibility Experience Stress
Table 3. Values for random consistency index. Size of matrix, n
1
2
3
4
5
6
7
8
9
10
Random consistency index, RI
0
0
0.52
0.89
1.11
1.25
1.35
1.40
1.45
1.49
obtain an overall uni-dimensional scale for priorities i.e. v1 , v2 , . . . , vn (Saaty and Kearns, 1985). The results reflect judgemental perception of the relative importance. People’s feelings and preferences remain inconsistent and intransitive and may lead to perturbations in the eigenvectors calculations. Saaty (1977) provided an index to check for consistency of the pair-wise comparisons. He defined consistency ratio CR as the ratio of the consistency index CI to an average consistency index RI, therefore
calculated. The representation is as follows: Human factors index,
b ¼ v1 r1 þ v2 r2 þ þ vn rn =rmax (v1 þ v2 þ þ vn ) n n X X vi ri =rmax vi ¼ i¼1
¼
n X
i¼1
vi ri =rmax
ð3Þ
i¼1
CR ¼
CI RI
(1)
The resulting RI also known as random consistency index is obtained from large number of simulation runs and is dependent on the order of the matrix n. Table 3 shows RI for matrices of order 1 to 10 obtained by approximating random indices using a sample size of 500 (Saaty, 2000). The consistency index can be directly calculated from the comparison matrix.
CI ¼
lmax n n1
Pn since, i¼1 vi ¼ 1 where vi ¼ weight of each attribute; ri ¼ value function (performance measure) of attribute xi. b attains a maximum value of 100% or 1. As the value of b approaches maximum the better the human factors in the plant or system being analysed. It will be reasonable to assume that as b approaches the maximum value human reliability is increased and this means that possibility of error occurrence is minimised. The vice versa applies. The index is mapped on a modified scale to obtain b0 . If human factors score is 50% or 0.5 is taken to be the industrial average and therefore the human error event assumes
(2)
where lmax is the greatest eigenvalue of the matrix of pair-wise comparison and n is the order of the matrix. After these weights have been obtained, a rating of each attribute, xi of the system being analysed is required. These are the performance measures of the system and they indicate the general characteristics in terms of operability and maintainability. High operability and maintainability means consistency of errorless task performance. The better they are the lesser the risk. The rating is represented by r1, r2, . . . , rn. They are assigned a scale 1– 7, where 1 represents the worst and 7 represents excellent (see Figure 9). From weights v and performance measures r, the quality index of human factors behind each human error event is
Figure 9. Rating of attributes.
Table 4. Relative weights of factors affecting a human error event.
Training Displays Accessibility
Training
Displays
Accessibfility
1 1/3 1/4
3 1 1
4 1 1
Trans IChemE, Part B, Process Safety and Environmental Protection, 2006, 84(B3): 200 –207
Calculated relative weight 0.63 0.19 0.18 CR ¼ 0.03
¨ WE GITAHI KARIUKI and LO
206
Table 5. Example of analysis chart. Initiating event with human error event
Underlying factors
Operator fails to detect high level alarm
Training
Display design Accessibility
Current condition of system being analysed
Weight, vi
Rating, ri
Weighted score, vi ri
Operator is well trained. There is evidence of training manuals, training programs but there is no proof of feedback of training achieved. Display gauge is well designed but they lack basic HF considerations. The scale markers have unusual progression 3, 7, 9, . . .. Display gauge is visible from work station but would be hard to access during an emergency.
0.288
5
1.440
0.449
4
1.796
0.263
5
1.315
Total score % Score, b
the generic probability value. The scale is modified as follows:
b0 ¼ 2b 1
(4)
If b represents another score than 0.5 then human error probability will be modified as follows: 0
HEPcalculated ¼ HEPbase e(b )
(5)
The calculated human error probability will reduce exponentially as the human factors conditions increase positively. The exponential relationship has been chosen because no matter how perfect the human factors conditions are the error rate will approach but never acquire the value of zero.
HYPOTHETICAL EXAMPLE Let us take the basic event ‘operator fails to detect HL’. It has been shown that the human factors that would influence this event are training, display design and accessibility. Using AHP weights v1 ¼ 0.63, v2 ¼ 0.19 and v3 ¼ 0.18 respectively have been obtained. The results are displayed in Table 4. The three factors are compared using the 3 3 matrix and a consistence ratio of 0.03 is obtained. As an example, if training and accessibility are compared then training is said to be four times more important that accessibility. These comparisons are obtained through expert judgement. It is suggested that the expert judges be people from the industry. They should have vast knowledge in human factors. They should through their experience be
4.551 65%
able to determine how important each human factor is when compared to the other. Let us now assume that the performance measures (rating) of each of the attributes is as follows: r1 ¼ 5, r2 ¼ 4 and r3 ¼ 5. We find using equation (3) that b ¼ 65% or 0.65. Using equation (4) b0 ¼ 0.25. A typical base HEP for the event used in quantitative risk analysis is 0.001 (CCPS, 1994). Applying equation (5), this base probability is reduced to HEPcalculated ¼ 0.00078. If we set r to have the same value, r1 ¼ r2 ¼ r3 ¼ 3, implying that HF are below average then HEPcalculated ¼ 0.00122 which means an increase by a factor of 1.22 on the base HEP. CONCLUSION The methodology discussed in this paper introduces HF in chemical process risk analysis. The benefit is two-fold. Firstly, it could be used to modify the base HEP used in QRA. Secondly, there is a possibility of using the structure and assumptions of the analysis as a tool for risk management. The method does not concentrate on the actual types of errors. It assumes that most types of operator errors are caused by common conditions (inadequate HF) surrounding a given operation. Reducing or eliminating these conditions reduces then human error rate and that implies higher human reliability. This method could also be used as HF auditing tool by both companies and the authority. It is still under development. The next stage is validation and an industrial partner has already been identified. REFERENCES CCPS, 1989, Guidelines for Chemical Process Quantitative Risk Analysis (AIChE, New York, USA). CCPS, 1994, Guidelines for Preventing Human Error in Process Safety (AIChE, New York, USA). Chapanis, A.R., 1986, Human-factors engineering, in The New Encyclopaedia Britannica, Vol. 21, 15th edition, 227–229 (Encyclopaedia Britannica, Chicago, USA). Department of Energy (DOE), 1992, Root cause analysis guidance document, DOE-NE-STD-1004-92 (Office of Nuclear Safety Policy and Standards). Dhillon, B.S., 1986, Human Reliability with Human Factors (Pergamon Press, New York, USA).
Trans IChemE, Part B, Process Safety and Environmental Protection, 2006, 84(B3): 200– 207
INCREASING HUMAN RELIABILITY IN CHEMICAL PROCESS INDUSTRY HSE, 1999, Reducing Error and Influencing Behaviour (HSG48) (HSE Books, Suffolk, UK). Kariuki, S.G. and Lo¨we, K, 2005, Incorporating human factors into process hazard analysis, Advances in Safety and Reliability Vol. 1, 1029–1035 (Taylor & Francis, London, UK). Kletz, T.A., 2001a, An Engineer’s View of Human Error, 3rd edition (IChemE, Rugby, UK). Kletz, T.A., 2001b, Learning from Accidents (Gulf Professional Publishers, Oxford, UK). Lo¨we, K. and Kariuki, S.G., 2004, Methods for incorporating human factors during design phase, Loss Prevention and Safety Promotion in Process Industries, 5205–5215. Lo¨we, K., Kariuki, S.G., Porcsalmy, L. and Fro¨hlich, B., 2005, Development and verification of a human factors engineering guideline for process industries, Loss Prevention Bulletin, Issue, 182: 9– 14. McCafferty, D.B., 1995, Successful system design through integrating engineering and human factors, Process Safety Progress, 14(2): 147– 151.
207
Saaty, T.L., 1977, A scaling method for priorities in hierarchical structures, Journal of Mathematical Psychology, 3: 234 –281. Saaty, T.L., 1980, The Analytic Hierarchy Process (McGraw-Hill, New York, USA). Saaty, T.L. and Kearns, K.P., 1985, Analytic Planning: The Organization of Systems (Pergamon Press, Oxford, UK). Saaty, T.L., 2000, Fundamentals of Decision Making and Priority Theory with the Analytic Hierarchy Process (RWS Publications, Pittsburgh, USA). van Vuuren, W., Shea, C.E. and van der Schaaf, T.W., 1997, The development of an incident analysis tool for the medical field, Report EUT/BDK/85, Eindhoven University of Technology, Eindhoven. Wickens, C.D., 1992, Engineering Psychology and Human Performance, 2nd edition (Harper Collins, New York, UK). The manuscript was received 28 July 2005 and accepted for publication after revision 20 February 2006.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2006, 84(B3): 200 –207
www.icheme.org/psep doi: 10.1205/psep.05160
INCREASING HUMAN RELIABILITY IN THE CHEMICAL PROCESS INDUSTRY USING HUMAN FACTORS TECHNIQUES ¨ WE S. GITAHI KARIUKI and K. LO Technische Universita¨t Berlin, Institute of Process and Plant Technology, Berlin, Germany
A
comprehensive hazard analysis consists of first understanding different factors that would lead to an unwanted event. This paper addresses this issue by using a risk analysis framework and it is extended to capture human and organization factors that influence the operator performance in order to identify the actual error producing conditions that lead to basic events. The paper describes a methodology that will be used in the process hazard analysis to introduce the design/operator mismatches and management deficiencies. In this method the most important error producing conditions (EPCs) associated with a particular human error are identified and analysed qualitatively. These EPCs will then be quantified to determine how much they influence human reliability. Keywords: human factors; operator error; analytical hierarchy process.
INTRODUCTION
it incorrectly (error of commission). That means ‘what’ the operator did incorrectly or failed to do is investigated while ‘why’ he acted wrongly is not sufficiently investigated (CCPS, 1994) (see Figure 1). However, risk analysis methods have matured over the years. Included in this list are tree-based methods, HAZOP and root cause analysis methods among others. But these methods do not address human related issues with as much rigour as engineering issues. This cannot be justified especially where human reliability plays a vital role in the system safety. The existing human reliability methods concentrate on the symptoms rather than the root causes of human errors (van Vuuren et al., 1997). No matter the type of human failure the underlying causes play a very important role. In order to fully analyse specific erroneous acts, human factors analysis techniques are required. Human factors capture design weaknesses and management failures that affect the performance of the operator negatively. These are called error-producing conditions (EPC). This study is a continuation of the work initiated during the Process Industries Safety Management (PRISM) (2001 –2004) project. The paper first introduces the classification of human factors based on the human factors guidelines developed during that project. Quantification of HF was identified as one of the areas that needed further research and therefore will be discussed here. The approach discussed here is intended to lay a foundation for integrating human factors in QRA. It is part of a larger work already published. Although the example given uses fault trees it is good to note that the results obtained could be used in combination with any QRA framework. The methodology described in this paper systematically models the role of humans in the system and integrates it
Reliability is defined as probability to perform a specified function or mission under given conditions while availability is the probability that the system or component is available when called upon (Dhillon, 1986). When analysing human reliability it is necessary to identify those human actions or inactions that can affect the reliability/availability of a system. These actions/inactions are defined as human errors. Human errors are key causes of accidents in the chemical process industry, just like in many other industries. Statistics show that they account up to 80% (McCafferty, 1995). Another study shows that 64% of accidents are due to human errors (Lo¨we and Kariuki, 2004). In the petrochemical industry e.g., oil refineries where automation is very high, human error accounts up to 50% (HSE, 1999). Therefore, prevention or reduction of human error is vital for the improvement of safety in process plants. The question is why does human error still remain the leading cause of accidents in chemical process industries. One of the reasons is the complexity with which human errors occur. Some experts have classified human errors among mechanisms that contribute to common mode failures. These types of failures are very difficult to quantify especially in quantitative risk analysis (QRA). Another reason is the common practice to regard human error as failure of frontline operators to perform an action (error of omission) or performing Correspondence to: Mr S. Gitahi Kariuki, Technische Universita¨t Berlin, Institute of Process and Plant Technology, Sekr. TK0-1, Straße des 17 Juni 135, 10623 Berlin, Germany. E-mail: [email protected]
200
INCREASING HUMAN RELIABILITY IN CHEMICAL PROCESS INDUSTRY
201
Figure 1. Steps to carry out an incident/accident investigation (DOE, 1992).
into risk analysis. It introduces a documented procedure that seeks to identify human factors in an accident. It helps to cover events that are very rare, for instance operator shutting off a safety valve. These events are only preventable at organisational level (CCPS, 1994). The objective is to reduce human failures by reducing or eliminating EPCs.
Figure 2. A simplified model of interaction of factors that lead to an accident.
HUMAN FACTORS Human factors are workplace and personal factors that affect either positively or negatively the performance of the operator. HSE (1999) defined human factors as follows: ‘Human factors refer to environmental, organizational and job factors, and human and individual characteristics, which influence behaviour at work in a way which can affect health and safety.’ The study of human factors can help identify operations susceptible to human error and improve working conditions to reduce fatigue and inattention. Table 1 shows the areas that need to be considered for a comprehensive human factors analysis (Lo¨we et al., 2005). The list may differ from analysts to analysts but the authors feel that the most important areas have been included. Human factors comprises of analysing ‘why did it happen?’ shown in Figure 1. In incident/accident investigations these are referred to as root causes. The analysis helps to unearth the role that insufficient design and management failures have in human error occurrence and in equipment failure. Figure 2 shows a simple framework to undertake such an analysis.
Table 1. Human factors areas. Criteria Workplace factors
Factors 1 Information
2 Job design
3 Supervision 4 Human-systeminterface (HIS) design 5 Task environment 6 Workplace design Operator factors
7 8 9 10
Physical characteristics Attention/motivation Fitness for duty Skills and knowledge
Attributes Training, procedures and procedure development, communication, labels and signs, documentation Work schedules, staffing, shifts and overtime manual handling and cumulative trauma disorders (CTD) Conflict resolution Controls, displays, field control panels, tools (hand), equipment and valves Lighting, noise, temperatures, toxicity Facility layout, workstation configuration, accessibility Anthropometrics, sex, age Stress and fatigue, illness Experience
An undesired event is caused by equipment failure, human error, external impact (not included in Figure 2) or a combination thereof. These are referred to as direct causes. The science of analysing equipment reliability and failures has developed over the years. Many methods are in existence but none will be discussed here because they lie outside the scope of this paper. Inadequate design implies that the physical and cognitive capabilities and limitations of populations of people are not incorporated into design and operation of a system, process, or equipment. In this case, technical design refers to human factors engineering/human engineering. This branch of engineering is concerned with designing of products and processes and equipment used in manufacturing so as to maximize their ability to be used comfortably, safely and effectively by human beings (Chapanis, 1986). Areas that are considered are workplace layout, workplace accessibility, controls and displays, workplace environment and labelling and signage. Management faults include inadequate training, procedures and procedure development, work schedules, staffing, shifts and overtime among others. From Figure 2 it can be seen that management faults directly influence both the equipment failure and human factors engineering. Equipment failure can be analysed through plant condition or maintenance and inspection management. A risk analysis is carried out to identify and model accident sequence and scenarios. A good analysis method should be able to identify if not all, the major contributors of an event. But most stop when the immediate or direct cause has been identified e.g., operator fails to close the valve (CCPS, 1994). The question is why the operator actually failed to close the valve. Was he able to identify the right valve? Was he at that particular workplace when he was required to close the valve? These questions would be answered at a management level and Kletz has described its importance (Kletz, 2001a, b). Figure 3 shows the procedure of identifying human factors underlying each unwanted event. It is only through addressing these underlying causes that we are able to implement error reduction strategies and therefore increase human reliability. The following sections try to introduce such a procedure. In this work fault tree analysis (FTA) is chosen as the tool to model accidents. This is a powerful technique that is
Trans IChemE, Part B, Process Safety and Environmental Protection, 2006, 84(B3): 200 –207
202
¨ WE GITAHI KARIUKI and LO
Figure 3. Procedure to identify human factors underlying an unwanted event.
able to present complex inter-relations of events that lead to unwanted events. It is able to capture equipment failures, human failures or external impacts. The basic events are then analysed to find those that have human error elements in them. Each basic event is then analysed to find the underlying human factors. The factors are derived from Table 1. When carrying out a human reliability analysis (HRA), each human error event is assigned a probability of occurrence. The probability value is generic and therefore does not represent the actual conditions of the system or plant being analysed (Kariuki and Lo¨we, 2005). Each plant conditions differ significantly from others. Analysing and quantifying human factors is intended to help evaluate the quality of factors affecting operator performance in a particular system or plant. One should be able to establish and measure the EPC/factors that surround each operator error. These factors, i.e., information, job design, supervision, HSI design, task environment and workplace design are given a grade based on subjective evaluation of the system (plant) being analysed. This subjective evaluation depends on the analysts’ experience in HF. To reduce the subjectivity of the analyst analytical hierarchy process (AHP) is used. This is discussed in later chapters.
HUMAN FACTORS AND HUMAN RELIABILITY
Figure 5. Steps in a human operator control operation (adapted from Wickens, 1992).
Operator error could occur at any of these steps. During perception phase operator could, for example, misread information, misperceive or fail to detect visual or auditory information. He may fail to make the right decision due to memory capacity overload, similarity of information perceived or due to lack of or incorrect knowledge. Wrong action could be contributed by similarities in (hard to discriminate) controls or interruption from environment among others. As illustrated by Figure 6, to a big percentage the output operator errors are determined by the quality of several system/plant attributes x1, x2, . . . , xn, on the left hand side of the diagram. The attributes are characterized by the performance measures r1, r2, . . . , rn. These attributes are human factors. Since each human factor attribute influences the error causation differently then weights v1, v2, . . . , vn are assigned. The procedure to assign r and v is discussed in later sections. Not all errors are caused by inadequate human factors. Others could be deliberate violations and single extraneous acts and are classified under ‘other influences and error types’. These are not discussed further in this paper. In order to increase operator reliability the performance measures, ri for attributes that have influence on perception, decision or action of the operator should be maximized. That means maximizing r1, r2, . . . , rn in order to reduce error opportunities. In the following sections the procedure
A human machine system comprises of a human operator, a control and a display/alarm (see Figure 4) Reliability of the control and that of the display/alarm is easy to obtain using the existing reliability methods. This set-up is common in offloading operations. The operator observes the level gauge and closes the valve when the tank is full. The illustrative example demonstrates an operation that is entirely manual. For such an operation and any other operator task the main steps that take place are illustrated in Figure 5.
Figure 4. Components of human system interface.
Figure 6. Factors influencing frontline operator error.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2006, 84(B3): 200– 207
INCREASING HUMAN RELIABILITY IN CHEMICAL PROCESS INDUSTRY to consider human factors during process hazards analysis for the example above is outlined.
Step 1: Identifying Causes of Accident If the filling process were not stopped after the tank is full then there would be an overfilling that would lead to spilling of hydrocarbon. This is the top event and fault tree analysis is constructed to show the combination of events that lead to this accident (see Figure 7). This is a very simple fault tree and is used for demonstration purposes only. A spill would occur depending on the frequency of offloading and the probability that the overfilling barriers fail. The basic events from this fault tree form three minimum cut-sets. These are B1, B2, B3 and B1, B2, B4 and B1, B2, B5. Minimum cut-sets are defined as set of basic events that contains no redundant elements (CCPS, 1989). In case of large fault trees the cut-sets are ranked according to their significance of how they contribute to the top event. For illustration purposes the three cut sets in this case are assumed to have the same significance.
Step 2: Identifying Initiating Events with Human Error Elements Basic events that contain human error elements in them are presented here below: B1: B2: B3: B4: B5:
Filling frequency Receiving tank volume too small High level (HL) detected, wrong action taken Operator fails to detect HL High level (HL) fails
These are typical events found during FTA. Not all basic events are classified as initiating events. Event B1 may not be classified as an initiating event but for the top event to occur this condition (filling the tank) has to be present. Any time the condition is present then an opportunity for error occurs. It is referred to as an enabling event (CCPS, 1989).
Figure 7. Simple fault tree of hydrocarbon spill during offloading operation.
203
Step 3: Identifying Underlying Human Factor Causes Figure 8 represents the procedure to identify the underlying human factors. One initiating event is analysed at a time. Each factor is considered to determine how much it could influence the initiating event. The factors identified to have a ‘high’ influence are given first priority, second priority goes to ‘moderate’ and ‘low’ gets the last priority. The reason for this classification is to limit the number of attributes to a manageable level. The maximum number of attributes recommended for the AHP is seven (Saaty, 2000). This method is discussed later in this paper. Table 2 illustrates a summary of attributes that may have significant impact on basic events B2, B3 and B4. These have been identified using the procedure illustrated in Figure 8. It is worth to note that this exercise is subjective and therefore may require input from several experts to make it valid. As an example, ordering procedures influence the volume that is available in the receiving tank. If documentation were not done adequately then ordering twice would be a feasible error. Job allocation determines the amount of workload on the operator. Supervision is another factor that needs to be analysed under this human error event. In this case task environment i.e., noise, heat, lighting, has no effect at all and so is the workplace design. Each human error event identified as a cause of accident is analysed the same way. Step 4: Quantifying Human Factors and Integrating Them into Quantitative Risk Analysis Each factor identified will be assigned a weight v i , which represents how much it contributes towards human error occurrence. For instance lack of or poor training may have a bigger weight than operator experience. Looking at the basic event B3, the general weights are as follows; procedures v1 , documentation v2 , training v3 , supervision checks v4 and displays v5 . These weights are going to be determined by AHP. The AHP method was developed by Saaty (1980) for solving multi-attribute decision problems. It uses a hierarchical structure to decompose a problem into attributes and then guide decision makers through a series of pair-wise comparison judgements to express relative strength of impact of the attributes in the hierarchy. These judgements are translated into numbers. The first step of AHP is to identify attributes that influence decision or system behaviour. Structuring the problem hierarchically is guided by no specific rule and therefore allows the user to construct his or her own model. Next step is determining the relative influence of each attribute on the system performance. Saaty and Kearns (1985) provided a numerical judgement scale 1 to 9. Each attribute is judged how important it is in dominating the other. The questions asked could take the form ‘When comparing different attributes, which attribute is more important (in achieving the goal)?’ All identified attributes are compared against each other in a matrix pair-wise comparison to express the relative preference among the factors/attributes. This is an n n square matrix. From the matrix of pair-wise comparison weighted eigenvectors are added component-wise to
Trans IChemE, Part B, Process Safety and Environmental Protection, 2006, 84(B3): 200 –207
204
¨ WE GITAHI KARIUKI and LO
Figure 8. Procedure to identify the human factors underlying human error event.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2006, 84(B3): 200– 207
INCREASING HUMAN RELIABILITY IN CHEMICAL PROCESS INDUSTRY
205
Table 2. Attributes having significant impact on basic events B2, B3 and B4. Basic events Receiving tank volume too small Operator fails to detect HL HL detected, wrong action taken
Information
Supervision
Procedures Documentation Training Training Training
Checks
Human-system interface design
Task environment
Workplace design
Operator characteristics
Displays Displays Valve
Accessibility Experience Stress
Table 3. Values for random consistency index. Size of matrix, n
1
2
3
4
5
6
7
8
9
10
Random consistency index, RI
0
0
0.52
0.89
1.11
1.25
1.35
1.40
1.45
1.49
obtain an overall uni-dimensional scale for priorities i.e. v1 , v2 , . . . , vn (Saaty and Kearns, 1985). The results reflect judgemental perception of the relative importance. People’s feelings and preferences remain inconsistent and intransitive and may lead to perturbations in the eigenvectors calculations. Saaty (1977) provided an index to check for consistency of the pair-wise comparisons. He defined consistency ratio CR as the ratio of the consistency index CI to an average consistency index RI, therefore
calculated. The representation is as follows: Human factors index,
b ¼ v1 r1 þ v2 r2 þ þ vn rn =rmax (v1 þ v2 þ þ vn ) n n X X vi ri =rmax vi ¼ i¼1
¼
n X
i¼1
vi ri =rmax
ð3Þ
i¼1
CR ¼
CI RI
(1)
The resulting RI also known as random consistency index is obtained from large number of simulation runs and is dependent on the order of the matrix n. Table 3 shows RI for matrices of order 1 to 10 obtained by approximating random indices using a sample size of 500 (Saaty, 2000). The consistency index can be directly calculated from the comparison matrix.
CI ¼
lmax n n1
Pn since, i¼1 vi ¼ 1 where vi ¼ weight of each attribute; ri ¼ value function (performance measure) of attribute xi. b attains a maximum value of 100% or 1. As the value of b approaches maximum the better the human factors in the plant or system being analysed. It will be reasonable to assume that as b approaches the maximum value human reliability is increased and this means that possibility of error occurrence is minimised. The vice versa applies. The index is mapped on a modified scale to obtain b0 . If human factors score is 50% or 0.5 is taken to be the industrial average and therefore the human error event assumes
(2)
where lmax is the greatest eigenvalue of the matrix of pair-wise comparison and n is the order of the matrix. After these weights have been obtained, a rating of each attribute, xi of the system being analysed is required. These are the performance measures of the system and they indicate the general characteristics in terms of operability and maintainability. High operability and maintainability means consistency of errorless task performance. The better they are the lesser the risk. The rating is represented by r1, r2, . . . , rn. They are assigned a scale 1– 7, where 1 represents the worst and 7 represents excellent (see Figure 9). From weights v and performance measures r, the quality index of human factors behind each human error event is
Figure 9. Rating of attributes.
Table 4. Relative weights of factors affecting a human error event.
Training Displays Accessibility
Training
Displays
Accessibfility
1 1/3 1/4
3 1 1
4 1 1
Trans IChemE, Part B, Process Safety and Environmental Protection, 2006, 84(B3): 200 –207
Calculated relative weight 0.63 0.19 0.18 CR ¼ 0.03
¨ WE GITAHI KARIUKI and LO
206
Table 5. Example of analysis chart. Initiating event with human error event
Underlying factors
Operator fails to detect high level alarm
Training
Display design Accessibility
Current condition of system being analysed
Weight, vi
Rating, ri
Weighted score, vi ri
Operator is well trained. There is evidence of training manuals, training programs but there is no proof of feedback of training achieved. Display gauge is well designed but they lack basic HF considerations. The scale markers have unusual progression 3, 7, 9, . . .. Display gauge is visible from work station but would be hard to access during an emergency.
0.288
5
1.440
0.449
4
1.796
0.263
5
1.315
Total score % Score, b
the generic probability value. The scale is modified as follows:
b0 ¼ 2b 1
(4)
If b represents another score than 0.5 then human error probability will be modified as follows: 0
HEPcalculated ¼ HEPbase e(b )
(5)
The calculated human error probability will reduce exponentially as the human factors conditions increase positively. The exponential relationship has been chosen because no matter how perfect the human factors conditions are the error rate will approach but never acquire the value of zero.
HYPOTHETICAL EXAMPLE Let us take the basic event ‘operator fails to detect HL’. It has been shown that the human factors that would influence this event are training, display design and accessibility. Using AHP weights v1 ¼ 0.63, v2 ¼ 0.19 and v3 ¼ 0.18 respectively have been obtained. The results are displayed in Table 4. The three factors are compared using the 3 3 matrix and a consistence ratio of 0.03 is obtained. As an example, if training and accessibility are compared then training is said to be four times more important that accessibility. These comparisons are obtained through expert judgement. It is suggested that the expert judges be people from the industry. They should have vast knowledge in human factors. They should through their experience be
4.551 65%
able to determine how important each human factor is when compared to the other. Let us now assume that the performance measures (rating) of each of the attributes is as follows: r1 ¼ 5, r2 ¼ 4 and r3 ¼ 5. We find using equation (3) that b ¼ 65% or 0.65. Using equation (4) b0 ¼ 0.25. A typical base HEP for the event used in quantitative risk analysis is 0.001 (CCPS, 1994). Applying equation (5), this base probability is reduced to HEPcalculated ¼ 0.00078. If we set r to have the same value, r1 ¼ r2 ¼ r3 ¼ 3, implying that HF are below average then HEPcalculated ¼ 0.00122 which means an increase by a factor of 1.22 on the base HEP. CONCLUSION The methodology discussed in this paper introduces HF in chemical process risk analysis. The benefit is two-fold. Firstly, it could be used to modify the base HEP used in QRA. Secondly, there is a possibility of using the structure and assumptions of the analysis as a tool for risk management. The method does not concentrate on the actual types of errors. It assumes that most types of operator errors are caused by common conditions (inadequate HF) surrounding a given operation. Reducing or eliminating these conditions reduces then human error rate and that implies higher human reliability. This method could also be used as HF auditing tool by both companies and the authority. It is still under development. The next stage is validation and an industrial partner has already been identified. REFERENCES CCPS, 1989, Guidelines for Chemical Process Quantitative Risk Analysis (AIChE, New York, USA). CCPS, 1994, Guidelines for Preventing Human Error in Process Safety (AIChE, New York, USA). Chapanis, A.R., 1986, Human-factors engineering, in The New Encyclopaedia Britannica, Vol. 21, 15th edition, 227–229 (Encyclopaedia Britannica, Chicago, USA). Department of Energy (DOE), 1992, Root cause analysis guidance document, DOE-NE-STD-1004-92 (Office of Nuclear Safety Policy and Standards). Dhillon, B.S., 1986, Human Reliability with Human Factors (Pergamon Press, New York, USA).
Trans IChemE, Part B, Process Safety and Environmental Protection, 2006, 84(B3): 200– 207
INCREASING HUMAN RELIABILITY IN CHEMICAL PROCESS INDUSTRY HSE, 1999, Reducing Error and Influencing Behaviour (HSG48) (HSE Books, Suffolk, UK). Kariuki, S.G. and Lo¨we, K, 2005, Incorporating human factors into process hazard analysis, Advances in Safety and Reliability Vol. 1, 1029–1035 (Taylor & Francis, London, UK). Kletz, T.A., 2001a, An Engineer’s View of Human Error, 3rd edition (IChemE, Rugby, UK). Kletz, T.A., 2001b, Learning from Accidents (Gulf Professional Publishers, Oxford, UK). Lo¨we, K. and Kariuki, S.G., 2004, Methods for incorporating human factors during design phase, Loss Prevention and Safety Promotion in Process Industries, 5205–5215. Lo¨we, K., Kariuki, S.G., Porcsalmy, L. and Fro¨hlich, B., 2005, Development and verification of a human factors engineering guideline for process industries, Loss Prevention Bulletin, Issue, 182: 9– 14. McCafferty, D.B., 1995, Successful system design through integrating engineering and human factors, Process Safety Progress, 14(2): 147– 151.
207
Saaty, T.L., 1977, A scaling method for priorities in hierarchical structures, Journal of Mathematical Psychology, 3: 234 –281. Saaty, T.L., 1980, The Analytic Hierarchy Process (McGraw-Hill, New York, USA). Saaty, T.L. and Kearns, K.P., 1985, Analytic Planning: The Organization of Systems (Pergamon Press, Oxford, UK). Saaty, T.L., 2000, Fundamentals of Decision Making and Priority Theory with the Analytic Hierarchy Process (RWS Publications, Pittsburgh, USA). van Vuuren, W., Shea, C.E. and van der Schaaf, T.W., 1997, The development of an incident analysis tool for the medical field, Report EUT/BDK/85, Eindhoven University of Technology, Eindhoven. Wickens, C.D., 1992, Engineering Psychology and Human Performance, 2nd edition (Harper Collins, New York, UK). The manuscript was received 28 July 2005 and accepted for publication after revision 20 February 2006.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2006, 84(B3): 200 –207