a new one. In an ideal case, we do not replace any of the other components at this point. The latter are at different stages of deterioration in their own life cycles. One of these will fail some time thereafter because it has reached the end of its life. We replace it and start a new cycle, while other components continue from their partly worn-out state. The result is that at the assembly level, the failures tend to be randomly distributed and follow the exponential distribution.
The concept of Mean Time To Failures, or MTTF, is worth further consideration at this point. As discussed in Chapter 3, the mean does not tell us much about the distribution. With a given sample, many of the failures could have taken place early or late in terms of age. In such a case, the use of the mean distorts the picture, because one may wrongly infer that the failures take place uniformly over the life. Hence, the use of MTTF without a full understanding of the distribution may lead to inappropriate decisions.
When the hazard rate is constant (meaning that the distribution is exponential), it is perfectly acceptable to use the MTTF. At this point there is (approximately) a 63% probability that the component has failed, and only a 37% probability of survival. In cases where the consequences of failure are high, we must do whatever we can to reduce or eliminate them. If the failure is evident and exhibits incipiency, as with a ball bearing, we can take vibration or other condition monitoring action. If the failure is hidden, as with a gas detector, we carry out a test, or a failure finding task. We must plan preventive maintenance action well before t = MTTF, because we cannot accept a 37% probability of survival at the time of the test or repair. The lay person often thinks of the MTTF as the expected time of failure and, therefore, the maintenance interval, which is clearly not the case.
Nearly three quarters of all accidents are due to the action (or inaction) of human beings. We cannot wish it away, as it is too large a contributor to ignore. Human beings are complex systems, with hundreds of failure modes. In the following discussion, we will use the terms human error and human failure interchangeably.
The causes of human error are many and varied. Lorenzo3 categorizes them as random, systematic, and sporadic. We can correct random errors by better training and supervision. A shift in performance in one direction indicates systematic variability. We can reduce these by providing a regular performance feedback. Sporadic errors are the most difficult ones to predict or control. In this case, the person’s performance is fine for most of the time. A sudden distraction or loss of concentration results in sporadic error.
There is an optimum level of stress at which human beings perform well. A certain level of stress is necessary to keep us alert, active, and expectant. We call this facilitative stress. Too high a stress level can be as a result of physical or psychological pressures. This may result in tiredness and lack of concentration.Too low a stress can be due to the work being repetitive, intellectually undemanding, or otherwise boring. During World War II, the British Royal Navy noted that submarine lookouts became ineffective after about 30 minutes, as they could not remain alert. The lookouts knew that their own lives depended on their vigilance, so motivation was not an issue.
Swain and Guttmann4 give the following examples of psychological stress:
•Suddenness of onset
•Duration of stress
•Task speed
•Task load
•High jeopardy risk
•Threats of failure, loss of job
•Monotonous, degrading, or meaningless work
•Conflicts of motives about job performance
•Reinforcement absent or negative
•Sensory deprivation
•Distractions such as noise, glare, flicker, color, or movement
•Inconsistent cueing
Each person is slightly different and thrives under different levels of stress. However, a number of the stress factors affect many people in similar ways.
In order to reduce human failures, we have to address the factors contributing to stress. By doing so, we can produce the right environment for each person. In most cases, we will not be able to influence stress caused by domestic matters, so we will focus on those at work. Job enrichment deals with the elimination of boredom and unacceptably low stress levels. We can attribute the remaining problems to high stress at work.
Control room operators perform critical functions. During plant upsets, startups, and shutdowns, their skills are in demand. We use alarms to catch their attention when things go wrong. Designers of control rooms have to take care to minimize the number of alarms they install. If too many alarms come on too quickly during a plant upset, operators can lose concentration and react incorrectly, thereby worsening the situation. In an article entitled ‘How Alarming!,’ Bransby and Jenkinson5 report the results of a survey. They studied 96 control room operators in 13 different plants in the U.K. Their findings, listed below, indicate that we have to devote more attention to this issue at the design stage.
•In an average shift, during steady operations, operators receive an alarm about every two minutes;
•Many of these alarms repeats of ones that occurred in the previous five minutes;
•Operators stated that many of them were of little value to them, and that eliminating about 50% would have little or no effect;
•Following a plant disturbance, they estimated that there were about 90 alarms in the first minute and seventy in the next ten minutes;
•About half the operators said that they felt forced to accept alarms during plant upsets, without reading or understanding them;
•During the survey, they observed one such plant upset. The operator did not make a full check of the alarms for about half an hour. This behavior was consistent with that reported by the others in the survey.
Because the purpose of the alarm is to alert the operator, these results indicate that the designers have failed in their objectives. The authors state that improvements are possible, and that a variety of tools are available. Some of the simpler ones include tuning up limit values and dead bands, and adjusting priorities. The use of logic to suppress some non essential posttrip alarms is also possible. As an example, they state that a review of the alarms resulted in a 30% reduction in the number of alarms. A structured and logical process is available to manage instrumented protective systems, which can help designers optimize the number of alarms and trips. We will discuss this process further in Chapter 10.
One of the causes of human failures is tiredness, and this is often due to sleep deprivation. The human body operates with the help of a biological clock. Shift work can disturb normal (or circadian) sleep cycles. As a result, the reaction to stimuli can be slow. This can affect the ability of the operator to respond to a rapidly developing scenario. Night shift workers are more susceptible to this problem than the rest, because of the disturbance to their circadian rhythm. Although there is no direct cause and effect relationship established, we note that some of the worst industrial disasters including Piper Alpha, Bhopal, Chernobyl, Three Mile Island, and Exxon Valdez occurred in the silent hours. This does not automatically mean that it is unsafe to
