1. Class Exercise: Accidents & errors
‘Human error’
‘Unsafe conditions’
For the examples you came up with, which can be attributed to “human error” and which to “unsafe conditions”?
Think of 1 accident you have witnessed/experienced that can be attributed to human error and 1 that can be attributed to unsafe conditions.
ISE

2. Goals of safety engineering/management
Reduce errors
Reduce proportion of errors that become accidents
Reduce proportion of accidents that become injuries
Reduce lost days/injury
ISE

3. Injury and severity rate
Injury rate
= Injury cases/yr× 200,000 ÷ Actual hrs worked/yr
Severity rate = Days charged ÷ Injury cases/yr
Unsafe conditions
Unsafe acts
Injury rate
ISE

4. Selection of problems Decision method:
Multiply frequency rate for each type of accident by the severity rate.
Consider refining by including dollar cost/case.
Rank order annual costs.
Consider using a Pareto analysis.
Examine high-energy sources.
ISE

5. Open Manhole Analogy
‘Warning’ approach
‘Guarding’ approach
Engineering approach
The engineering approach is most effective and is permanent.
ISE

6. Reduction of Unsafe Conditions
Reduce human error
Reduce equipment failure
Design the proper control, display, and environment
Use distance
Use guards
Use time
Reduce Potential / Effects of Human Error – recall the guidelines
Reduce Equipment Failure –
Reduce the Failure Rate
Reduce the number of failure locations.
Design in safety factors.
Use redundant equipment (parallel or standby).
Use preventive maintenance.
Reduce Hazard
Use GFCIs to eliminate electrical hazard.
Use fail-safe designs (fuses, deadman throttles).
Use battery power or compressed air instead of 110V.
Use smaller amounts of dangerous materials.
Use radial tires and front-wheel drive.
Use Distance as a Protective Technique –
Separate people from equipment.
Reduce speeds.
Provide vertical clearance for people and vehicles.
Provide barriers and walls (guards).
Use Guards as a Protective Technique –
Use guards that cannot be defeated easily.
Make guard defeat or failure easily detectable.
Guards should not present a hazard.
A poor guard is a hazard.
Machine guards:
Are attached to equipment to prevent people from dangerous contact.
Do not accept “guarded by location.”
Consider guards as part of a layered defense.
Use lockout/tagout procedures.
Purchase guards from the manufacturer when the machine is purchased.
Guards should not impair machine function.
People Guards:
Are protective clothing.
Problems:
Failure of protective clothing results in injury.
Workers have incentives not to use protective clothing.
Have a variety of sizes available.
Impose severe penalties for not using safety equipment.
Organizations should purchase and maintain the equipment.
Use Time as a Protective Technique –
Limit exposure time to hazardous conditions or materials.
Use GFCIs to reduce electrical exposure.
Provide washing facilities for chemicals.
Minimize distances to carry hazardous items.
ISE

7. Unsafe acts Treat all accidents as unsafe conditions.
Unsafe acts may result from:
Lack of knowledge
Deliberate risk
Drug effects
Address the causes ..
Lack of Knowledge
Make a fault analysis of all possible failures.
Consider both operator errors and equipment failure.
Provide a decision structure table in case of a problem.
Communicate this information to people at risk.
Remember that training is not permanent.
Deliberate Risk
Occurs because risk is low, cost of compliance is high, or rewards are large and immediate.
People modify their behavior to take more risks when a device reduces the risk.
Reinforce safe behavior with positive rewards; punish unsafe behavior.
Consider using a “safety traffic light.”
Drug Effects
Alcohol contributes to a significant number of accidents.
Focus on changing the machine/system rather than the individual.
ISE

8. Warnings Are information about a possible negative consequence.
An effective warning should change behavior.
May be visual, auditory, or vibratory.
Need increases when:
Injury potential increases
Danger is less obvious
Injury onset is not obvious
More people are exposed
ISE

9. Problems with Warnings
P The information must be Present.
R The warning must be Read.
U The reader must Understand the warning.
M The information must remain in Memory.
A The person must Act on the information.
E The warning must be Effective (the person
must be able to perform the desired
behavior).
ISE

10. Fault Tree Analysis (FTA)
Fault Tree: A graphic “model” of the pathways within a system that can lead to a foreseeable, undesirable loss event.
The pathways interconnect contributory events and conditions, using standard logic symbols.
Numerical probabilities of occurrence can be entered and propagated through the model to evaluate probability of the foreseeable, undesirable event.
ISE

11. FTA is best applied to cases with …
Large, perceived threats of loss, i.e., high risk.
Numerous potential contributors to a mishap.
Complex or multi-element systems/processes.
Already-identified undesirable events (a must!)
Indiscernible mishap causes (i.e., autopsies.)
Caveat: Large fault trees are resource-hungry and should not be undertaken without reasonable assurance of need.
ISE

12. FTA produces:
Graphic display of chains of events/conditions leading to the loss event.
Identification of those potential contributors to failure that are “critical.”
Improved understanding of system characteristics.
Qualitative/quantitative insight into probability of the loss event selected for analysis.
Identification of resources committed to preventing failure.
Guidance for redeploying resources to optimize control of risk.
Documentation of analytical results.
ISE

13. Some definitions FAULT FAILURE
An abnormal undesirable state of a system or a system element induced 1) by presence of an improper command or absence of a proper one, or 2) by a failure (see below). All failures cause faults; not all faults are caused by failures. A system which has been shut down by safety features has not faulted.
FAILURE
Loss, by a system or system element, of functional integrity to perform as intended, e.g., relay contacts corrode and will not pass rated current closed, or the relay coil has burned out and will not close the contacts when commanded – the relay has failed; a pressure vessel bursts – the vessel fails. A protective device which functions as intended has not failed, e.g, a blown fuse.
ISE

14. Assumptions and limitations
Non-repairable system.
No sabotage.
Markov…
Fault rates are constant.
The future is independent of the past – i.e., future states available to the system depend only upon its present state and pathways now available to it, not upon how it got where it is.
Bernoulli…
Each system element analyzed has two, mutually exclusive states.
ISE

15. The logic symbols (see also table 18.4, pg. 360)
Most Fault Tree Analyses can be carried out using
only these four symbols.
Events and Gates are not component parts of the system being analyzed. They are
symbols representing the logic of the analysis.
ISE

16. Steps in FTA 1 Identify undesirable TOP event. 3
Link contributors to TOP by logic gates. 2
Identify first level contributors. 5
Link contributors to events by logic gates. 4
Identify 2nd level contributors. 6
Repeat/continue.
ISE

17. Use FTA to … Identify probability of failures and faults.
Identify candidates for engineering solutions.
Identify common cause events …
Events which, if they occur, will cause two or more fault tree events to occur.
Typical common cause events include power failures, dust & grit, temperature effects (freezing/overheating), operator oversight, etc.
Can be overcome through redundant systems, isolation or shielding, etc.
ISE

18. Your turn …
Identify a specific potential occurrence using a product, tool, or piece of equipment with which you are familiar (enough to analyze the occurrence in detail.)
Conduct a FTA using this occurrence as the top-level event.
ISE

19. Failure Modes & Effects Analysis, FMEA
Evaluates reliability and identifies single-point failures that can lead to systems failure.
Functional vs hardware FMEA:
used early in design programs
top-level, focus on systems and subsystems
Hardware FMEA:
based on detailed design data
concentrates on assemblies, subassemblies, and components
Limitations – FMEA doesn’t address
operational interface
multiple failures
human factors
ISE

20. Three key questions to be answered by the FMEA process:
What could fail in each component of my product or design?
To what extent might it fail and what are the potential hazards produced by the failure?
What steps should be implemented to prevent failures?
ISE

21. The FMEA process Define the system
Identify potential failure modes & their causes
Evaluate the effects on the system of each failure mode
Identify failure detection methods
Identify corrective measures for failure modes
Document analysis / prepare FMEA report
ISE

22. Your Turn … Define the system
Identify a product with which you are familiar (enough to perform an analysis of failure modes.)
Identify one part on that product to analyze in detail.
(NOTE: use the attached FMEA form for this exercise.)
ISE

23. FMEA Form and Definitions
Part & Function
Potential Failure Modes
Potential Effect(s) of Failure ∆ S E V
Potential Cause(s) / Mechanisms of Failure
OCC
Detection Method & Quality Controls DE T R P N
Recommended Actions
Design FMEA Analysis
∆ = Critical characteristic which may effect safety, compliance with Gov. regulations, or require special controls.
SEV = Severity rating (1 to 10)
OCC = Occurrence frequency (1 to 10)
DET = Detection Rating (1 to 10)
RPN = Risk Priority Number (1 to 1000) = SEV * OCC * DET
ISE

24. Your turn … Identify potential failure modes & their causes
Identify 2 – 3 potential failure modes and what could cause them.
Evaluate the effects on the system of each failure mode Identify 2 – 3 potential failure modes and what could cause them.
Using the table on the following page, evaluate the potential severity of each failure mode.
ISE

25. Criteria: Severity of Effect
Severity Rating, SEV
Ranking
Effect
Criteria: Severity of Effect 1
None
No effect 2
Very Minor
Very minor effect on product or system performance. 3
Minor
Minor effect on product or system performance. 4
Low
Small effect on product performance.
The product does not require repair. 5
Moderate
Moderate effect on product performance.
The product requires repair. 6
Significant
Product performance is degraded. Comfort or convenience functions may not operate. 7
Major
Product performance is severely affected but functions. The system may not be operable. 8
Extreme
Product is inoperable with loss of primary function.
The system is inoperable. 9
Serious
Failure involves hazardous outcomes and I or noncompliance with govt. regulations or standards. 10
Hazardous
Failure is hazardous, and occurs without warning. It suspends operation of the system and/or involves noncompliance with govt. regulations.
ISE

26. Your turn … Identify failure detection methods
How would you as the user/operator of this product recognize that the part has failed or is about to fail?
Use the OCC table on the following page to evaluate the probability of failure occurrence.
Identify corrective measures for failure modes
Do you know how to correct the fault to restore safe and correct operation of the product?
Use the DET table to evaluate the probability of detecting the failure.
ISE

27. Probability of Occurrence, OCC
Ranking
Possible
Failure Rates
Probability of Failure 1
< 1 x 10-6
Nearly Impossible 2
1 x 10-5
Remote 3
1 x 10-4
Low 4
4 x 10-4
Relatively Low 5
2 x 10-3
Moderate 6
1 x 10-2
Moderately High 7
4 x 10-2
High 8
0.2
Repeated Failures 9
0.33
Very High 10
> 0.55
Extremely High: Failure Almost
Inevitable
ISE

28. Probability of Detection, DET
Ranking
Detection Probability 1
Almost Certain Detection 2
Very High Chance of Detection 3
High Probability of Detection 4
Moderately High Chance of Detection 5
Moderate Chance of Detection 6
Low Probability of Detection 7
Very Low Probability of Detection 8
Remote Chance of Detection 9
Very Remote Chance of Detection 10
Absolute Uncertainty - No Control
ISE

29. Your turn … Document analysis / prepare FMEA report
Calculate the risk priority number,
RPN = SEV * OCC * DET
Recommend action based on the RPN.
ISE