Human Factors
Risk Management Services
Department
Are You Perfect?
• Have you ever pushed the wrong
button on a soda machine, left your
car headlights on, or unintentionally
deleted a file on your computer?
• Wonder how often these (and more
serious) errors occur?
Laws of Nature
We accept and design for the laws of
nature.
Example: If a bridge falls down, we don’t
list “gravity” as the root cause.
Example: If there is an asphyxiation, we
don’t list “people need oxygen” as the
root cause of an injury.
Human Error
• Law of nature:
HUMANS MAKE MISTAKES!
• DON’T BLAME IT…PLAN FOR IT!
How Often Do Humans Make Mistakes?
• Trained, not under stress, not fatigued
or overloaded, and enough time:
Error occurs about 1 in every 100 times
the operation is done
How Often Do Humans Make Mistakes?
• Not trained, or under stress, or
overloaded or short period of time:
Error occurs about ½ to every time the
operation is done
How Often Do Humans Make Mistakes?
• Trained and not under stress and not
fatigued and not overloaded and
enough time AND with built in
feedback:
Error occurs about 1 in every 1,000
times the operation is done
What is Feedback?
• Buzzer when you leave your lights on
• Bell if the keys are in the ignition when the
car door is opened
• Control system asking you to confirm that
the charge amount you entered was correct
and showing the proper pumps and valves
are open/closed
If you can see that you are doing the right
thing, then you can be sure that you did
it.
Can a Human Check a Human?
• Principle: If a person knows that
someone else checked, they are not
likely to reliably recheck
Human checking is not generally a
reliable safeguard against errors made
by other humans
(Exception: airline industry, although it
is not 100% reliable…)
Helios Plan Crash Aug. 2005
3 checks by two pilots missed the
switch in the wrong position
Ineffective response
to loss of cabin
pressure and
incapacitation of
crew
Is Technology the Panacea?
Principle: If a safety system is installed
to protect against human error, the
human will depend on it. Then the
safety system becomes the only layer
of protection.
Principle: All mechanical things break.
Safety systems need to be tested to
ensure that they are working properly.
Real-Life Example
• An operator loading a tank overflowed
the tank
• Management put a high level shutoff
on the pump
• The operator relied on the switch and
did not watch the tank level closely
• One day, the switch failed and the tank
overflowed
BP Texas City
• Operators did not fully understand Raffinate
Splitter Tower operation
•Startup procedures not fully followed
•Material fed to column but did not exit; critical
valve not opened during startup
•Level exceeded safe limits; level device failed; not
recognized
•Level instrumentation in blow-down tank failed, but
not repaired
•Blow-down tank overflowed, material reached an
ignition source, and a vapor cloud explosion resulted
BP Texas City Explosion / Fire
March 23, 2005
Caveat
Any system human beings devise to
prevent failure can be overcome by
human beings with sufficient
determination and authority
If there is a will, there is a way!
Guiding Principles for
Preventing Human Error
• Humans and systems designed by
them are vulnerable to error
• Existing facilities contain many traps
that can cause human error
• Designers can provide systems to
facilitate error/deviation detection and
to enable recovery before the
error/deviation becomes serious
Design Considerations
• Ergonomics – Can the operator reach what
he needs to and work safely?
• Operability – Is the work flow designed to
minimize taking shortcuts?
• Procedures – Are they clear, easy to follow,
and explain the consequences of
deviations?
• Maintenance – Is there access and
capability to maintain equipment?
• Simplify – less chance of error
Design Considerations
• Be consistent – orient valves the same
way, use computer diagrams that look like
the equipment layout
• Human limitations – consider color-blind
operators, different heights
• Safety systems – make sure they can’t be
bypassed
• Alarm management – Don’t shower the
operator with alarms he can’t process at
once!
Chernobyl Nuclear Reactor Runaway
April 26th 1986
Chernobyl, Soviet Union 1986
• Nuclear meltdown resulted in 56 direct
deaths, relocation of 336,000 people,
and a plume of radioactive fallout
• Significant design flaws in reactor
• Safety systems switched off
• Operator errors/training
• Alarm showers confused the operators
(also at Three Mile Island)
Cultural Stereotypes
• GREEN is on, RED is off…but not in
Japan!
• H is hot water, C is cold…except in
non-English countries (chaud or
caliente both mean hot in French and
Spanish)
• Light switch is up for on…except in the
UK!
Human Factors Philosophy
1. Make the right way THE ONLY WAY
2. Make the right way THE EASIEST WAY
3. Give the operators feedback that it was
done the wrong way
4. Provide safeguards for when it is done the
wrong way
Remember Other Operations…
Don’t forget about maintenance,
startup, and shutdown. These are the
most risky times in a process. There
must be EHS reviews, management of
change, permitting procedures,
training and communication systems
to avoid human error.
Piper Alpha, 1987
Piper Alpha, 1987
Piper Alpha, North Sea, UK
• Operators switched on a pump that
was undergoing maintenance – poor
lockout/tagout and communications
• Significant leak/fire ensued
• Piper Alpha was destroyed
• 167 fatalities, loss of millions in
revenue per day
Safety Culture
A safety culture that promotes and
reinforces safety as a fundamental value is
inherently safer than one which does not
- Do we have to follow the standards?
- Do we really have to shut down?
- Do we have to install this safety system?
If these questions are asked, it is an indication
of a poor safety culture!
Summary
•
•
•
•
•
•
•
•
Human error is a fact of nature – plan on it
Design process to minimize “traps”
Provide training and clear guidance
Provide feedback that the operator action taken
is right/wrong
Don’t expect humans to check humans
Provide safety systems
Remember to consider startup, shutdown, and
maintenance
Support an interdependent safety culture