44
Sensemaking in Safety Critical and Complex Situations
Health and Safety Executive UK guidance, albeit in somewhat different ways. The
level definitions presented in Table 3.6 are adopted from EI’s guideline, only with
some minor adjustments. In case human failure alone has the potential to initiate or
fail to prevent/ mitigate a major accident, the consequence is high. With some exceptions, such as in drilling and marine operations, most offshore petroleum systems
nowadays are, however, well protected and error tolerant, and so trend is that this is
increasingly less likely to be the case. Emergency systems, such as those responsible
for shutting down the plant in case of abnormalities, are often fully automated and
only require the operator to intervene in case of automation failures. Alternatively,
there may also be scenarios where the procedure instructs the operator to activate
systems even before automation kicks in, as an additional safeguard. In such cases,
the consequence from human failure is considered medium. If humans have little
interaction with the systems associated with the MAH, or if the system is very well
protected, the consequence is low.
Definitions of the “ consequence” levels are described in Table 3.6.
Dependency ( on human actions). A third characteristic, specific to operational barrier elements, is the degree to which a barrier function relies on human actions to be
realized ( i.e. performed). This mostly reflects the degree of automation and coincides
with the definitions of high, medium and low for “ Consequence”. The definition was
nevertheless kept as a way of creating awareness about the task’s role as part of a barrier
function. For example, depending on the information available about the task, in some
cases it may be easier to determine dependency than consequence, and vice versa. In
the method developed for criticality ranking, the dependency and consequence characteristics were therefore combined into one factor, as described later in this chapter.
TABLE 3.5
Major Accident Hazard ( MAH) Severity Levels
MAH Severity
Levels
High (H)
The hazard involves potential ignition of large HC releases or other incidents which
immediately cause a major accident
Medium (M)
The hazard involves incidents which require escalation to cause a major accident
Low (L)
The hazard requires significant escalation to cause a major accident and is therefore
considered unlikely
TABLE 3.6
Consequence ( from Task Failure) Levels
Consequence
Levels
High (H)
Human failure could alone initiate or fail to prevent/ mitigate a major accident
Medium (M)
Human failure could initiate or fail to prevent/ mitigate a major accident, but only if
other safeguards fail ( e.g. automation, equipment)
Low (L)
Human failure should not initiate or fail to prevent/ mitigate a major accident
Sensemaking in Safety Critical and Complex Situations
Health and Safety Executive UK guidance, albeit in somewhat different ways. The
level definitions presented in Table 3.6 are adopted from EI’s guideline, only with
some minor adjustments. In case human failure alone has the potential to initiate or
fail to prevent/ mitigate a major accident, the consequence is high. With some exceptions, such as in drilling and marine operations, most offshore petroleum systems
nowadays are, however, well protected and error tolerant, and so trend is that this is
increasingly less likely to be the case. Emergency systems, such as those responsible
for shutting down the plant in case of abnormalities, are often fully automated and
only require the operator to intervene in case of automation failures. Alternatively,
there may also be scenarios where the procedure instructs the operator to activate
systems even before automation kicks in, as an additional safeguard. In such cases,
the consequence from human failure is considered medium. If humans have little
interaction with the systems associated with the MAH, or if the system is very well
protected, the consequence is low.
Definitions of the “ consequence” levels are described in Table 3.6.
Dependency ( on human actions). A third characteristic, specific to operational barrier elements, is the degree to which a barrier function relies on human actions to be
realized ( i.e. performed). This mostly reflects the degree of automation and coincides
with the definitions of high, medium and low for “ Consequence”. The definition was
nevertheless kept as a way of creating awareness about the task’s role as part of a barrier
function. For example, depending on the information available about the task, in some
cases it may be easier to determine dependency than consequence, and vice versa. In
the method developed for criticality ranking, the dependency and consequence characteristics were therefore combined into one factor, as described later in this chapter.
TABLE 3.5
Major Accident Hazard ( MAH) Severity Levels
MAH Severity
Levels
High (H)
The hazard involves potential ignition of large HC releases or other incidents which
immediately cause a major accident
Medium (M)
The hazard involves incidents which require escalation to cause a major accident
Low (L)
The hazard requires significant escalation to cause a major accident and is therefore
considered unlikely
TABLE 3.6
Consequence ( from Task Failure) Levels
Consequence
Levels
High (H)
Human failure could alone initiate or fail to prevent/ mitigate a major accident
Medium (M)
Human failure could initiate or fail to prevent/ mitigate a major accident, but only if
other safeguards fail ( e.g. automation, equipment)
Low (L)
Human failure should not initiate or fail to prevent/ mitigate a major accident