LP News issue 17 - UK P&I Members Area

Policymakerspneumonia or ‘flu’ – all designed toprevent illness in the first place. Thus ratherthan acting in response to an incident weseek instead to act before an incident.The research, delved deep into thecausation theory in order to establish aconcrete link between breached defencesand controls, and active and latent failures,thus the Tripod causation model was born(see diagram below).The interesting point about this model,is that it introduces two new elements intothe causation chain. First it provides alinking mechanism, known as theprecondition, though sometimes referredto as the ‘psychological precursor’,between the active and latent failures.Secondly, it introduces the policy makerat the very start of the chain, thusillustrating the clear relationship betweencommitment by the policy makers at thebeginning of the chain and the results atthe end of the day.No commitment = No effective safety orHSE management systemBy comparing the diagram of the Tripodcausation model and the simple accidentdiagram on the front page, it shouldbecome obvious that the link between thetwo is established through failed defences(for the target) and failed controls (for thehazard). The combined accident model,known as the Tripod-BETA tree, completewith all basic components is shown in thediagram (above right).Bearing in mind that any accidentconsists of a series of interlinking events, acompleted accident tree can beexceedingly complex indeed.Active failuresBoth defences and controls are breachedby ‘active failures’. Active failures are thefailures close to the accident event thatdefeat the controls and defences on thehazard and target trajectories. In manycases, these are the actions of people, i.e.unsafe acts. Human errors are implicatedin at least four out of five active failures,LatentfailuresPreconditionsPreconditionsTripod causation modelActive failures(incl. unsafe acts)PolicymakersPolicymakersLatentfailures LatentfailuresHAZARDTARGETPreconditions but human error as we have already seenis a broad term that includes a number ofdifferent sources of error.Not all active failures are humanactions. Physical failure of controls anddefences also occur due to conditions suchas over-stress, corrosion or metal fatigue.These are often referred to as ‘unsafeconditions’. Having said that, humanactions are often implicated ascontributory causes to this form of activefailure but they are not, in themselves,unsafe acts. For instance, a designer mayhave failed to identify the need to use aparticular high-tensile material in a specificthe future potential for adverse effects ofdecisions may not be fully appreciated, orcircumstances may change that alter theirlikelihood or magnitude.The accident-producing potential oflatent failures may lay dormant for a longtime, only becoming apparent when theycombine with local triggering factors –active failures, technical faults, abnormalenvironmental conditions or abnormalsystem states; some of which even the bestHSE management systems will haveabsolutely no control over whatsoever.Rather than dealing with an infinitenumber of active failures, it is reassuring toA defining characteristic of latent failuresis that they have been present within the operationbefore the onset of a recognisable accident sequencecircumstance, thus sometime later causingcomponent failure.Latent failuresAs already mentioned, latent failures are the‘vital organs’ of the safety equation. Latentfailures are deficiencies, or anomalies, thatcreate the preconditions that result in thecreation of active failures. Management(the so-called policy or decision makers)decisions often involve the resolution ofconflicting objectives. Decisions taken usingthe best information available at thatmoment prove to be fallible with time. Also,Failed systemdefences/controls IncidentThe Tripod-BETA treeActivefailuresActivefailuresFailed controlFailed defenceEVENTnote that there are just eleven latentfailures on which to work to ensureabsolute good health.The eleven latent failures, whichconstitute the general failure types (GFTs)are:■ HARDWARE■ DESIGN■ MAINTENANCE MANAGEMENT■ PROCEDURES■ ERROR-ENFORCING CONDITIONS■ HOUSEKEEPING■ INCOMPATIBLE GOALS■ COMMUNICATIONS■ ORGANISATION■ TRAINING■ DEFENCESThe Club’s new DVD No Room For Errorexamines these in detail ■3