“The gift of failure: New approaches to analyzing and learning from events and near-misses.” Honoring the contributions of Bernhard Wilpert

This special issue presents papers from a workshop conducted by New Technologies and Work (NeTWork) to honor the memory of Bernhard Wilpert, the founder and organiser of NeTWork. The papers reflect the theme that undesirable incidents and events, serious and disturbing as they may be, are a “gift of failure.” In short, events offer an opportunity to learn about safe and unsafe operations, generate productive conversations across engaged stakeholders, and bring about beneficial changes to technology, organization, and mental models (understanding). Papers in the special issue are organised around three topics: the process of event analysis, the relationship between event analysis and organisational learning, and learning at multiple system levels. In this introduction we describe the workshop, summarize the contributions of Bernhard Wilpert, suggest three themes that emerged from the workshop, and offer our thoughts about the future of event analysis and learning from events.     

Examining the asymptote in safety progress: a literature review

Many industries are confronted by plateauing safety performance as measured by the absence of negative events – particularly lower-consequence incidents or injuries. At the same time, these industries are sometimes surprised by large fatal accidents that seem to have no connection with their understanding of the risks they faced; or with how they were measuring safety. This article reviews the safety literature to examine how both these surprises and the asymptote are linked to the very structures and practices organizations have in place to manage safety. The article finds that safety practices associated with compliance, control and quantification could be partly responsible. These can create a sense of invulnerability through safety performance close to zero; organizational resources can get deflected into unproductive or counterproductive initiatives; obsolete practices for keeping human performance within a pre-specified bandwidth are sustained; and accountability relationships can encourage suppression of the ‘bad news’ necessary to learn and improve.     

基于TEM模型的民航不安全事件关联规则挖掘与分析*

为了预防民航不安全事件的发生,应用机组威胁与差错管理（TEM）模型分析2014—2020年民航事故/征候的航空安全报告资料,提取事件里存在于民航运行风险中潜在的情况、威胁、机组差错等因素,通过改进的关联规则方法挖掘其中的关联关系,包括挖掘与事件严重程度有关的因素,找到TEM模型中的关键因素和影响航空器结束状态的致因因素,并进行关联网络图分析。研究结果表明:手动操纵/飞行控制差错、缺少/不足的飞行培训和安全管理、飞行员之间沟通差错与程序执行错误是造成事故/征候的显著因素;关联规则能够有效利用航空安全报告信息,通过定量的方法挖掘事故/征候的特征,找到影响民航不安全事件的强关联因素,为民航安全管理人员提供决策依据。     

Analysis of train derailments and collisions to identify leading causes of loss incidents in rail transport of dangerous goods in Canada

The Canadian railway industry has improved safety performance in the last decade as measured by freight loss incidents per billion gross ton-miles. Further improvements in safety performance require a deeper analysis of the leading causes to identify weaknesses in implementing safety systems. In this paper, we classify the causes of railway loss incidents using a Safety Management System (SMS) framework to identify system weaknesses. The role of human factors is further analyzed through the Human Factors Analysis and Classification System (HFACS) approach. For this, we utilized data from 42 main track derailments and collisions involving the transport of dangerous goods in Canada between 2007 and 2018, which have been investigated by the Transportation Safety Board of Canada in detail. Associations between adjacent sub-categories of the HFACS framework are analyzed to identify any interdependency that exists between active and latent errors using a Chi-square test and Kruskal's lambda analysis. Furthermore, we implement the Decision-Making Trial and Evaluation Laboratory (DEMATEL) method and the Analytical Network Process (ANP) to identify causal relationships between different sub-categories of the HFACS framework and calculate the weighted influence of each sub-category on main track derailments and collisions. Finally, a comparison is made between this work and others', which have analyzed human factors in the railway industry. There is good agreement between the results of these studies that highlight the importance of supervisory and organizational factors in the prevention of railway loss incidents. Based on these findings, we make recommendations to reduce railway loss incidents.     

Factors contributing to US chemical plant process safety incidents from 2010 to 2020

Process safety incidents can result in injuries, fatalities, environmental impacts, facility damage, downtime & lost production, as well as impacts on a company's and industry's reputation. This study is focused on an analysis of the most commonly reported contributing factors to process safety incidents in the US chemical manufacturing industry. The database for the study contained 79 incidents from 2010 to 2019, partly investigated by the Chemical Safety Board (CSB). To be included in the study, the CSB archive of incident investigations were parsed to include only incidents which occurred at a company classified as 325 in the North American Industry Classification System (NAICS), assigned to businesses that participate in chemical manufacturing. For each incident, all of the identified contributing factors were catalogued in the database. From this list of identified contributing factors, it was possible to name the ‘top three’ contributing factors. The top three contributing factors cited for the chemical manufacturing industry were found to be: design; preventive maintenance; and safeguards, controls & layers of protection. The relationship between these top contributing factors and the most common OSHA citations was investigated as well. The investigation and citation history for NAICS 325 companies in the Occupational Safety & Health Administration (OSHA) citations database was then analysed to assess whether there was any overlap between the top reported contributing factors to process safety events and the top OSHA citations recorded for the industry. A database consisting of the inspection and citation history for the chemical manufacturing industry identified by NAICS code 325 was assembled for inspections occurring between 2010 and 2020 (August). The analysis of the citation history for the chemical manufacturing industry specifically, identified that the list of the top contributing factors to process safety incidents overlapped with the most common OSHA violations. This finding is relevant to industry stakeholders who are considering how to strategically invest resources for achieving maximum benefit – reducing process safety risk and simultaneously improving OSHA citation history.     

An analysis of accidents caused by improper functioning of machine control systems.

The scope of this study covers events resulting from improper functioning of machine control systems. An accident model providing a basis for formulating a checklist for accident analysis has been developed. Data about 700 accidents were collected. An analysis has proved that in the group of accidents caused by improper functioning of machine control systems, serious accidents happened much more frequently as compared to the group of accidents with no relation to the control system. The reasons for the majority of incidents caused by improper performance of safety functions consist in the errors made by designers. In view of that, incorrect behaviour of a worker should be treated as a normal event instead of a deviation causing an accident.     

An Analysis of Accidents Caused by Improper Functioning of Machine Control Systems

The scope of this study covers events resulting from improper functioning of machine control systems. An accident model providing a basis for formulating a checklist for accident analysis has been developed. Data about 700 accidents were collected. An analysis has proved that in the group of accidents caused by improper functioning of machine control systems, serious accidents happened much more frequently as compared to the group of accidents with no relation to the control system. The reasons for the majority of incidents caused by improper performance of safety functions consist in the errors made by designers. In view of that, incorrect behaviour of a worker should be treated as a normal event instead of a deviation causing an accident.     

Learning from incidents – A method for assessing the effectiveness of the learning cycle

This paper describes a method for assessing the effectiveness in the steps of the learning cycle: the 1st loop with reporting – analysis – decision – implementation – follow-up, and the 2nd loop on an aggregated basis. For each step, the dimensions considered the most relevant for the learning process (scope, quality, timing and information distribution) and for each dimension the most relevant aspects (e.g. completeness and detail) were defined. A method for a semi-quantitative assessment of the effectiveness of the learning cycle was developed using these dimensions and aspects and scales for rating. The method will give clear indications of areas for improvement when applied. The results of the method can also be used for correlation with other safety parameters, e.g. results from safety audits and safety climate inquiries. The method is intended to be used on a sample of the broad range of incidents normally seen in process industry companies. The method was tested on a two-year incident reporting material from six companies from various types of process industries. It was found that the method and the tools worked very well in practice. The results gave interesting insights into the effectiveness of learning from the incidents.     

Subsea pipelines incidents prevention: A case study in Brazil

There are more than 4000 subsea pipelines in Brazil. These pipes include umbilicals, drilling risers, flexible risers, rigid risers, hybrid risers, flowlines, and export pipelines. Despite all standards, regulations, guides, and risk management tools designed to avoid events, subsea pipeline incidents still occur, revealing possible failures in companies' risk control. Identifying similarities between different subsea pipeline failure events is crucial to improving the design, risk management practices, and regulation requirements, besides promoting accident prevention. This paper proposes applying the life cycle and management practices combined to analyze subsea pipeline incidents from the RDI (Detailed Incident Report) and investigations reported to ANP (Brazilian National Agency of Petroleum, Gas, and Biofuels), the Brazilian safety regulatory agency. Furthermore, subsea pipeline incidents data were analyzed: correlated circumstances, consequences, and causes. The results show that most riser and flowlines causal factors are related to equipment failures, and recurrent root causes are design errors and integrity control. Based on the proposed approach, it was possible to identify gaps in most riser and flowlines accident investigations since there are few causal factors, root causes, and the absence of riser and flowlines failure mode and mechanisms. Therefore, the development of accident recommendations can be compromised. Thus, this paper proposes improvements to current Brazilian regulations to clarify the minimal subsea pipeline accident investigation requirements.     

航天器AIT未遂事件管理系统设计及数据分析

为了加强对航天器AIT未遂事件的管理及数据采集、分析,确保航天器AIT作业安全,结合北京卫星环境工程研究所安全管理工作实际,从加强航天器AIT未遂事件管理入手,利用EXCEL服务器,设计了未遂事件管理模式及管理流程,建立了未遂事件管理系统及数据库,实现了未遂事件的“上报-信息录入-数据分析-整改验证”流程的有效闭环;同时,基于研究所2014—2016年未遂事件统计数据,进行了多维度解析和定性分析,利用层次分析法对未遂事件的形成原因进行了定量分析,为加强安全管理、持续改进安全管理体系提供了方向。     

Worker-fatigue contributing to workplace incidents in New Zealand Forestry

ProblemReports of incidents in dangerous work environments can be analysed to identify common hazards, in turn aiding in the prevention of future accidents. Whilst studies exist that do this, most focus on causes that involve physical risks. In this paper we propose an alternative approach, and illustrate causes of forestry incidents from the perspective of worker-failure and fatigue. Method This paper outlines the analysis of eight years’ worth of New Zealand forestry incident data, with a focus on the cause of, and time that, incidents occur. Results This has resulted in two main findings. First, 70% of incidents can be attributed, at least in part, to worker-failures. Second, 78% of worker-failure based causes show indications of fatigue. This indicates that a significant number of forestry incidents are caused by worker-fatigue. Finally, this dataset showed inconsistencies in data quality, similar to those that exist in other datasets. This did not affect our analysis. However, these types of errors have the potential to affect the data quality in the national reporting system. Impact on industry The results from this study will be used in a larger project on detecting fatigue in forestry workers for injury and incident prevention. It is also our hope that other researchers may find these results of interest for further fatigue prevention research in hazardous industries.     

Development of a database for accidents and incidents in the Greek petrochemical industry

The present paper describes the development of a database that comprises all incidents from the Greek petrochemical industry for the period 1997–2003. This database includes industrial incidents, accidents, operational accidents and near misses from all petrochemical sites in Greece and Cyprus. The design of the database has been conceived in a user-friendly way with additional possibilities for its further use, such as: statistical analysis of the data, calculation of safety indicators, accident reports and human factors analysis. The database allows the various participating industries to compare the analysis of indicators in their own installations with the national average, as the database comprises data from the entire Greek petrochemical industry. Special care has been given to include data from near misses too.     

Lessons learned from recent incidents: Facility siting, atmospheric venting, and operator information systems

Recent incidents have focused attention on a number of technical and management systems that need to be addressed by industry. A multiple layer of protection approach is essential for the prevention of incidents and/or reduction of consequences. Safety culture and operational discipline are the overall embracing factors that influence the safety performance of a facility. However, as recent events have indicated, there are a number of technical and engineering issues that must also be developed and implemented appropriately. Some of these issues that could lead to incidents with catastrophic consequences include facility siting and atmospheric relief venting. Impact of operator information systems on the prevention of releases of hazardous materials from their containment is also another significant factor that should be given appropriate attention.

This paper describes these three topics based on the findings from recent incidents and historical data. Engineering standards, regulatory requirements, and industry practices are discussed for facility siting, atmospheric relief venting, and operator information systems. Finally, a summary of gaps and needs in technology, standards, and practices is presented.     

SESAR safety decision-making: Lessons from environmental,nuclear and defense modeling

SESAR, the ‘Single European Sky Air traffic Research’ program, envisages radical changes for European Air Traffic Management (ATM). It integrates and implements new technologies and information processing. This paper examines the safety decision-making in the implementation of SESAR projects. SESAR poses new safety problems because it adopts new paradigms for ATM safety – what lessons are there from environmental, nuclear and defense modeling? These disciplines have also had to confront the limitations of modeling the rates of rare and damaging – even catastrophic – events. A major conceptual change in SESAR is that of automated separation assurance systems. Some existing responsibilities transfer from the controller – either to the pilot or to computer systems – in a progressively phased approach. The major problem for SESAR safety validation is that mixed equipage/operations within a common airspace potentially generate new and different safety issues regarding the validation of safety predictions. A potential way forward uses high-fidelity Human In The Loop Simulations (HITLS) to generate confidence in the resilience of the ATM system. The focus changes from proving safety, i.e. through traditional kinds of validation processes, to extensive resilience testing using these simulations. The aim would be to test how resilient the system is to seeded errors, penetration testing, and crash/stress testing. This would be a high cost process because of the large investments required and the need for long sequences of testing. However, these demanding processes can provide ‘justified belief’ to the decision-maker that the changed ATM system is acceptably safe.     

Classification of errors contributing to rail incidents and accidents: A comparison of two human error identification techniques

Identifying the errors that frequently result in the occurrence of rail incidents and accidents can lead to the development of appropriate prevention and/or mitigation strategies. Nineteen rail safety investigation reports were reviewed and two error identification tools, the Human factors analysis and classification system (HFACS) and the Technique for the retrospective and predictive analysis of cognitive errors (TRACEr-rail version), used as the means of identifying and classifying train driver errors associated with rail accidents/incidents in Australia. We aimed to identify the similarities and differences between the techniques in their capacity to identify and classify errors and also to determine how consistently the tools are applied. The HFACS analysis indicated that slips of attention (i.e. ‘skilled based errors’) were the most common ‘unsafe acts’ committed by drivers. The TRACEr-rail analysis indicated that most ‘train driving errors’ were ‘violations’ while most ‘train stopping errors’ were ‘errors of perception’. Both tools identified the underlying factors with the largest impact on driver error to be decreased alertness and incorrect driver expectations/assumptions about upcoming information. Overall, both tools proved useful in categorising driver errors from existing investigation reports, however, each tool appeared to neglect some important and different factors associated with error occurrence. Both tools were found to possess only moderate inter-rater reliability. It is thus recommended that the tools be modified, or a new tool be developed, for complete and consistent error classification.     

A risk reduction approach for academic research labs: A case study on naphthenic corrosion

Academic research and development (R&D) labs are a significant part of academic life. But there can be physical, environmental, and experiment quality risks associated to this activity. Academic labs can present specific experiments, which have associated risks for researchers. Academic labs are also characterized by a high turnover of students and many of them are not fully aware of the level of physical and environmental risks of their activity. Accidents in academic labs with injuries and loss of life are facts that have to be tackled through risk management approaches. The objective of this paper is to present an integrated management approach, tackling risk management and analysis methods. HAZOP (Hazard and Operability Study) and PFMEA (Process Failure Mode and Effects Analysis) enabled, respectively, the analysis of safety and environmental risks. By quantifying the level of risk according to the type of experiment and the research context, it is possible to provide safety to the system. The resulting Digital Poka-Yoke – a mistake-proofing approach – has brought about the desired quality of results in experiments. The proposed approach was validated through a case study monitoring naphthenic corrosion experiments conducted by the Lab of Surface Electrochemistry and Corrosion (LSEC) at the Federal University of Paraná (UFPR). As a consequence, this approach is currently in use at this lab.     

Distributed Safety Management as a tool for creating a safety culture in university students and future professionals

The main hypothesis of this work is that it is possible to create a safety culture not only in industrial or commercial organizations, but also in educational institutions. The goal is communicating a culture of safety to their students, which will be spread by the new professionals. Consequently, the objective of this paper is showing the results of first steps of application – establishing the baseline – of the Gaining Distributed Safety – GDS – tools to the academic community of the Universidad Centroamericana "José Simeón Cañas" (UCA) of El Salvador. GDS tools establish those aspects to which attention should be posed in order to achieve excellence in safety. Also enables analysis to recognise the weaker aspects of safety, so corrective actions can be taken.Before applying any improvement action according GDS, the initial parameters to measure the culture of safety in UCA were established. Special versions of the AsSeVi Survey Tool were developed and checked out. The first one was adapted to academy and administration of UCA. The second, to students. Both communities showed similar characteristics according GDS, opening the door of improving the safety culture of students working only with academy. Finally, the JST Safety Survey and a traditional behavioural safety observation activity were used to establish reference indicators. Use a handrail in stairs and walking watching cell phone are two excellent potential possibilities to be used as indicators.     

Insight from hindsight: A practitioner’s perspective on a causal approach to performance improvement

The petrochemical industry works relentlessly on many fronts to improve performance and to create desired performance outcomes. Companies’ approaches vary widely; yet despite best efforts, the industry continues to experience periods of undesirable performance outcomes in product quality, reliability, process safety, environmental, and personal injury. The industry continues to search for better methods, techniques, and technology that are assumed to be missing, but the causes of incidents illustrate that what is in the way of improving performance may not be what is missing but rather what already exists.This paper provides an alternative perspective of performance problems viewed from underlying causes and patterns of causes of incidents in these so-called “high hazard industries” (Carroll, 2004) across several years and geographic regions. The perspective includes two distinct insights.

First, although problems can have a wide range of outcomes and impact, the underlying causal patterns are relatively few in number. These few represent essential elements that are repeatedly discovered in various forms under many unrelated problems.

Second, several common obstacles within organizations often inhibit the ability to find the causes, learn from the causes and to effectively address the causes of performance problems.

The conclusion is that when these repeating patterns are combined with a limited ability to effectively find, learn, and eliminate the causes, organizations are left with repeating periods of performance problems despite well-intended efforts to improve.