Your safety systems should not depend on the ability of individuals to react in an emergency.

Share

Dear Control Engineering–In the article When should you bypass your safety system, the author makes the following statement:

“Human factors are recognized as severe limitations to the dependability of risk-reduction factors. A layer of protection must be dependable and auditable. Neither of these characteristics would seem to apply to a bypass situation. During process transitions, variables are changing rapidly and protection thresholds are also subject to change. It is not the time to depend on a less reliable protection layer.”

Could you expand on that? Can’t human factors be audited?

The author is trying to make the point that a plant should not depend on people to carry out safety-related functions. For example, your safety procedures probably shouldn’t include something like, “When the horn sounds, the operator must close valve RE1196 within 30 seconds to prevent the release of cyanide gas.”

Maybe that's an extreme example, but think about it. Such a procedure makes some critical assumptions about the operators:

1. They know where valve RE1196 is and which way to turn the handle to close it.

2. They are all physically strong enough to close it and any necessary wrenches, gloves, etc. are available and they know where they are.

3. They know what they are supposed to do when the horn sounds, and can correctly identify the specific sound, and can hear well enough to realize the horn is sounding from anywhere they may be when on duty.

4. Only operators that have been sufficiently trained on this procedure will be on duty at any time when there is any possibility of an emergency happening.

5. They will have the presence of mind to act correctly when under pressure and not panic.

If you are auditing the safety procedures and you see something like this, you can work with some of the points. People and their knowledge of procedures get audited all the time for all sorts of things. You can ask operators to show you that specific valve and indicate which way to turn it in an emergency. You can test physical strength with a similar task. You can ask operators to describe what is supposed to happen in an emergency. You can ask operators to identify the relevant horn sound. If all the operators pass these tests, what’s wrong with the procedure?

You can’t really tell if someone can stay clear headed and not panic in an emergency. You can’t be absolutely certain that the operator won’t be in the restroom when the horn goes off. You can’t test to see if someone will recall the instructions in the chaos of an emergency. You can’t be positive that a supervisor won’t put an untrained operator on duty in a pinch. There is no effective way to audit these elements, which is why safety experts don’t want to include them in procedures. People are simply too unreliable so they flunk the dependability test. I wouldn’t want to live downwind of that plant.

--Peter Welander, pwelander(at)cfemedia.com