Functional Human Reliability Analysis: A Systems Engineering Perspective

Abstract

- The human unreliability is the main cause of industrial accidents. In the petrochemical field, about 90% of accidents are due to human errors. Over the years, several models of Human Reliability Analysis have been developed. The major limitation of these models is due to their static nature. Thus, the present research aims to propose a new innovative approach to evaluate the variability of the human error probability between related activities in complex systems using a resilience engineering approach.. Research integrates an HRA evaluation model with a resilience engineering model called Functional Resonance Analysis Model to assess the human error variability. The methodology is applied in a real case study for the emergency management in a petrochemical company.

-

Keywords — Resilience Engineering, FRAM, System Engineering, HRA, Emergency Management.

I. INTRODUCTION

In recent years, many organizations have been studied for their high level of safety (nuclear, aeronautical, chemical and petrochemicals, etc.); many of the results obtained are shocking. The success in terms of safety of these organizations is due to risks limitation, errors reduction, but, especially to the capacity to anticipate and plan “the unexpected” [ 1 ]. The heart of the culture of these organizations is the comprehension of the human factor. If human error comes from unsafe, it is equally true that most of the incidents are avoided due to the ability of operators to handle the unexpected and adapt to the dangers of life by identifying alternative solutions. We speak of “Resilience Engineering” to indicate “a non-event dynamic” [ 2 ]. Resilience is the ability of an organization to develop robust and flexible processes, to monitor and revise the risk models adopted and to proactively use available resources, in the face of a break in production or at greater economic pressure [ 3 ]. System analysis is the fundamental element of continuous improvement. It must understand the functioning of a system to prevent any failures. Of course, it is necessary to understand the functioning of the systems, also considering external factors that could affect the system, such as pressure, temperature, weathering and behavior over time (aging and degradation). The analysis of the environmental factors influencing the system allows to develop a dynamic analysis [ 4 ]. To carry out a dynamic analysis, it is also necessary to analyze all components, their dependencies, energy, information, and so on. All these elements create a high degree of dependence and a high level of possible combinations in which the system can be found. When analyzing accidents, it is rare to have all the necessary information and those few information obtained are influenced by secondary aspects such as prejudices and practical constraints [ 5 ]. An important development in safety management practices has been with the emergence of the human reliability analysis (HRA). HRA techniques allow to calculate the human error probability in relation to a specific task handled by the operator. HRA analyzes linearly events and does not identify a cause-effect relationship [ 6 ]. To work around this problem, it needs to use resilience engineering methods. The Functional Resonance Analysis Model (FRAM) [ 7 ] in particular allows to manage systems considering the order between the various activities that make them and considering how a single upstream activity can affect downstream activities. The most important limitation of the FRAM methodology is its purely qualitative character [ 8 ]. The aim of this paper is to present an integrated framework in order to develop an HRA analysis using a FRAM model to identify the error variability considering the cause-effect connections between the activities. The rest of the paper is organized as follows. Section 2 presents a literature review on HRA models and FRAM; Section 3 explains the proposed methodological approach; in Section 4 a real case study is analyzed. Finally, Section 5 presents the conclusions and future developments of this research.

II. LITERATURE REVIEW

HRA analyzes human reliability and measures the human error probability, considering the physical conditions of the operator and the environmental conditions in which it works [ 9 ]. There are three different generations of the HRA methodologies: The First generation (1970 - 1990) study the human error probability and it is not very sensitive to the causes of behaviors [ 10 ]. The most important first-generation HRA techniques are: Systematic Human Action Reliability (SHARP) which considers the integration between man and machine, The Empirical technique to estimate the operator’s error (TESEO) which calculates human error probability considering five influential factors, Technique for human error rate prediction (THERP), which builds a tree of events and it quantifies the related scenarios, Success likelihood index method (SLIM) which assess the error probability considering the indicators defined by the experts, Human error assessment and reduction technique (HEART) which considers all factors that adversely affect the activity performance and finally Probabilistic Cognitive Simulator (PROCOS) which returns a quantitative results of human error probability; The second generation (1990 – 2005) integrate internal and external factors affecting human performance and cognitive processes [ 11 ]. The most important second-generation HRA techniques are: Cognitive reliability and error analysis method (CREAM) which evaluates the effect of the context of risk of error, Standardized plant analysis risk-human (SPAR-H) which divides causes of error in diagnosis and action and it underlines the external influencing factors and finally Simulator for human error probability analysis (SHERPA) which calculates human error probability considering internal and external factors which influence human error and it calculates the quantitative value of error probability. The third generation (Since 2005) consider the dependence of various factors of human performance. The third-generation models are now only applied in nuclear plants and try to incorporate aspects of variability in analytical models [ 12 ]. HRA models are still very much used today. In fact, the evolution and growing complexity of industrial plants makes it necessary to review the HRA analysis practices, for the management of socio-technical systems engineering management. From the development of these new requirements was born a new analysis concept called “Resilience engineering”. Resilience engineering has become a recognized alternative to traditional approaches to safety management. Whereas these have focused on the risks and failures as the result of a degradation of normal performance, resilience engineering sees failures and successes as two sides of the same coin – as different outcomes of how people and organizations cope with a complex, underspecified and therefore partly unpredictable environment [ 3 ]. All performances require people, technologies, and organizations. Since resources (information, time, etc.) are always limited, the performance can vary. This variation is not necessarily negative, in some cases it can generate benefits, in other cases it can lead to unexpected effects [ 13 ]. For this reason, resilience engineering not only investigates incident events, but studies all events, considering different hypotheses where they can vary. One of the most popular resilience engineering models is the functional resonance analysis method (FRAM) developed by Hollnagel [ 7 ]. This model identifies the main macro functions of a system and combines them to evaluate performance variability, considering a relationship causing effect between downstream (influenced) function and upstream (influencing) function. Although the FRAM model has been developed recently, it has already been applied in the aeronautical [ 14 ], nuclear [ 15 ], petrochemical [ 16 ], and railways [ 17 ] sectors. The fundamental problem of the FRAM model is its qualitative approach. To overcome this limit, several authors have integrated FRAM with other quantitative methods to develop a semi-qualitative model. Bjerga [ 18 ] analyzes the FRAM in terms of modeling uncertainty, showing the need to integrate its context with other reliable decision-making approaches. Rosa et al., [ 19 ] use the built-in FRAM model with AHP to reduce susceptibility to performance variability. Zheng et al., [ 20 ] combine the FRAM model with the SPIN model to test different variability paths. Praetorius et al., [ 21 ] combine FRAM with “Formal Safety Assessment” (FSA), a structured methodology in maritime safety decision-making. Patriarca et al. [ 8 ] define a semi quantitative FRAM model for evaluating function variability by integrating the traditional FRAM model with Monte Carlo simulation. Albery [ 22 ] uses finite element theory (FEM) as an integration of the FRAM model to make it a dynamic system. Furfaro et al., [ 23 ] propose a methodology, called GOReM, for specifying the requirements applied in the analysis of a corporate cloud service. Garro et al., [ 24 ] develop a new modeling language based on time logic called FORM-L to allow visual modeling of system properties with verification through simulation. The last two works mentioned are a clear example of complex system requirements analysis, which could be analyzed by applying the FRAM model. In particular, the models can be used to define the requirements of complex systems before making the combined analysis FRAM-HRA The presented research integrates an HRA model with the FRAM analysis to evaluate the human error probability of a conditional action from a previous action.

III. METHODOLOGY APPROACH

As shown in Figure 1, we have developed an integrated approach to assess the risk of operations. Quantitative risk assessments are made with SHERPA [ 25 ] “in red”, while the qualitative assessment is presented using FRAM “in blue”. SHERPA evaluates the human error probability of each action, while FRAM is applied to the human error analysis to identify the resonance on the network and the variability of human error. In the end, the performance variability of operator is analyzed. The methodological approach is divided into different steps: Step #1: Scope of analysis: Detailed description of the purpose of the analysis, input data and expected output data. Step #2: Activity Description: Description of the case study and the analyzed model. It is necessary to describe all the activities needed to manage the emergency.

Step#3.1: GTTs definition: For each action it is necessary to identify the Generic task that best represents it. Generic tasks (GTTs) are defined in the literature by Williams, [ 26 ]. Table I shows the GTTs with the relative reliability values. GTTs identify the internal factors that influence the human error probability.

Step #3.2: PSFs choice: The calculation of the human error probability also depends on external factors called “Performance Shaping Factors” affecting the operator. Gertman et al., [ 27 ] identify the major environmental factors affecting human reliability (Table II). The value of multipliers increases with the deterioration of environmental conditions.

Stress

Complexity

Training

Procedures

Ergonomics Low

Medium

High

High

Medium

Nominal

High

Medium

Nominal Low

Nominal

High

Not available

Incomplete

Poor

Missing

Poor

Nominal

Values 1 0.1 0.01 5 2 1 5 2 1 3 1 0.5 50 20 5 50 10 1

Step #3.3: HEP calculation: SHERPA estimates the human error probability firstly considering the error probability influenced by internal factors and then also adds to the influence of the external environment. The nominal human error probability (HEPnom) represents the human error probability considering only internal factors. The following equation shows the calculation model:

HEPnom = 1 – k e – α (1-t) β (1)

Where α and β are parameters, of Weibull function which represents human error [ 28 ]. The contextualized human error probability (HEPcont) with the external environment is calculated as: HEPcont = (HEPnom * PSFcomp)/(HEPnom* (PSFcomp-1)+1) (2) Where PSFcomp is the product of all PSFs value above described. This model calculates the human error probability for each action, but it is not possible to establish a cause and effect relationship.

Step #4.1: Build a FRAM: The FRAM model must include all actions (functions) of the analyzed model. The analysis can start from any essential function for the system, by adding iteratively any other function that may be needed to provide a complete description of the system. FRAM functions represent a hexagon with 6 different characteristics (Figure 2): Input, Time, Control, Output, Resource and Precondition. All functions are connected to each other through the 6 characteristics.

Fig. 2. FRAM hexagon

Step #4.2: Functions Variability: This step analyzes the functions variability, that make up the FRAM model. If the output function does not vary, then the function variability is of no interest, while it is crucial if it causes a change in the output of the function. Function output, can vary in terms of time and accuracy.

Step #4.3: Variable Aggregation: The FRAM analysis considers two functions: downstream function and upstream function, connected to each other. So if an upstream function is performed precisely and in a precise time it does not generate variability in the downstream function. However, if a function is performed imprecisely, or in an excessively high or excessively limited time, a variability in the downstream function is generated. The variable aggregation tables by characteristics are reported by Hollnagel [ 7 ]. Table III shows an example of coupling upstream and downstream functions for input and output.

The limit of this model is the qualitative approach. Patriarca et al., [ 8 ] overcome this limit by introducing quantitative values that have been used to develop this model (Table IV). If the upstream function amplifies effects on the downstream function, it associates a value of 2, if it dampens the effects, it associates a value of 0.5, otherwise a value of 1 is associated.

Step #5: HEP Variability: With the SHERPA model (steps # 3) we have calculated the human error probability of each function (HEPcont). With, FRAM we have built a qualitative connection model between the different functions, identifying the variability of accuracy (VARA (u,d)) and the variability of time (VART (u,d)), generated by a upstream function on a downstream function for a particular scenario. The product between variability of accuracy and variability of time is Total variability VARTOT. In conclusion, considering a particular scenario and a certain action of an operator on a downlink function, it is possible to calculate the human error probability conditioned (HEPcond) by the upstream function such as: HEPcond = (HEPcont * VARTOT)/ [HEPcont *(VARTOT -1)+1] (3)

IV. CASE STUDY

The proposed model has been integrated into a real case study for the analysis of an emergency in a petrochemical plant. The company recycles used oil, so it works with extremely hazardous materials: diesel, methane, hydrogen, etc. These substances create a highly explosive environment, so, it is necessary to thoroughly study the safety management system.

Step #1: Scope of analysis: To analyze emergency management activities by assessing the human error probability, related to each activity and by using FRAM to detect the performance variability generated by a upstream function on the downstream function by detecting a conditional error probability value.

Step #2: Activity Description: The case study analyzes the standard actions to be taken after the explosion of a liquid methane tank. The analysis predicts actions of the desk operator (in bold) who works in the control room and the subsequent actions of the operator who work in the production site. The model analyzes the variability of the operator's error probability if the desk operator makes a mistake earlier. 1. Alarm signal 2. Evacuation 3. Closing steam systems 4. Power shutdown 03T102A / F 5. Closing distillation systems 6. Cross pump stop 01P102B / C 7. Power pump stop 01P104A / D 8. Suction valve closure 04 04 BN192 9. Closing the heating system 10. Switch off oven 0H03 11. Extraction pump stop 02P104G / H 12. Air cooler stop 09KL198I / N The analysis focuses on operation #3(developed from desk operator) and operation #4 (developed from operator).

Step#3.1: GTTs definition: Action 3 is associated with the GTT5 "Routine, highly-practised, rapid task involving relatively low level of skill" while action 4 is associated with the GTT3 "complex task requiring high level of comprehension and skill." Each operation is associated with the GTT that best represents it.

Step #3.2: PSFs choice: Table V shows the external working conditions for the two operators, considering the level of stress, complexity and ergonomics. The operator in the production plant has worse stress and ergonomics values than the operator in the control room that perform very complex operations. All other PSFs not included in this table are nominal hypotheses and assume value 1.

Step #3.3: HEP calculation: Analyzing the internal factors obtained from GTTs and the external factors obtained by PSFs, it is possible to calculate the human error probability of the two activities during the 8 hours of work (Figure 3). Step #4.1: Build a FRAM: The functions described in step # 2 are represented with a graph FRAM. The model identifies the connections between the various functions. The two analyzed functions # 3 and # 4 are highlighted in red. In particular, the output of function # 3 is the precondition for function # 4. Step #4.2: Functions Variability: In the case study, only human functions are analyzed. In particular, the scenario simulated shows that the operator performs the actions in the right way, but does too late. The causes of this delay may be internal to the operator, psychologically and physiologically, but also external to the operator, social and organizational. Both causes are very frequent and have serious consequences on variability.

Step #4.3: Variable Aggregation: The case study has considered two functions, linked as output and precondition. Step #5: HEP Variability: The last step of the study calculates the conditioned human error probability for activity #4, influenced by the variability generated by activity # 3. In this case study, the function #3 has a variability due to a delay of action, so the error probability in the action is higher. Figure 5 compares the contextual error probability with the conditional error probability for activity #4. The complexity of the most recent industrial plants drives managers to continually analyze processes, especially in terms of safety management to limit the number of workplace accidents and occupational disease complaints. Technology and machine reliability studies have considerably reduced the percentage of accidents due to mechanical failures. Today the major cause of accidents is due to human error. Historically, several HRA models have been developed to assess human error. The major limitation of these models is due to their static nature. In recent years, to address the complexity of industrial plants, a new type of analysis called "Resilience Engineering", has developed, which evaluates performance variability of dynamical functions, considering the causeeffect link. An engineering resilience model is the FRAM that allows to evaluate the performance variability of different functions. The most important limit of FRAM is its qualitative approach. This research integrates a quantitative model of HRA with the qualitative FRAM. It numerically calculates the human error probability of human of functions, considering the influence of upstream function on downstream function. The research model is applied in an emergency management analysis in a petrochemical company. The case study identifies an emergency situation created by the explosion of a methane tank. Two activities (Closing steam systems and Power shutdown 03T102A / F) are identified and independent error probabilities are calculated. Then the FRAM of the incident is analyzed and the error probability of action #4 is calculated considering the errors made in activity #3. The output of action #3 is a precondition of action #4. The results show a growing trend of error probability with the passage of time. The analysis of errors identified HEPcont more for function #4. After considering the variability of the performance HEPcond value is greater than the previous. Future model development involves the development of a simulation model for integrated HRA-FRAM analysis.

References

[1] A. Bahoo Toroody , F. Bahoo Toroody , and F. De Carlo, “ Development of a risk based methodology to consider influence of human failure in industrial plants operation ,” Summer School “Francesco Turco”, September 2017 .

[2] K.E. Weick , and K. M: Sutcliffe, “Managing the unexpected: Resilient performance in an age of uncertainty” , vol. 8 , 2011 John Wiley & Sons.

[3] E. Hollnagel , “ Resilience engineering in practice: A guidebook” , Ashgate Publishing, Ltd, 2013 .

[4] A. Petrillo , D. Falcone , F. De Felice , and F. Zomparelli , “ Development of a risk analysis model to evaluate human error in industrial plants and in critical infrastructures”, International Journal of Disaster Risk Reduction , 23 , 15 - 24 , 2017 .

[5] G. Haddow , J. Bullock , and D.P. Coppola , “Introduction to emergency management”, Butterworth-Heinemann , 2017 .

[6] N. Norazahar , F. Khan , B. Veitch , and S. MacKinnon, “ Prioritizing safety critical human and organizational factors of EER systems of offshore installations in a harsh environment” , Safety science, 95 , 171 - 181 , 2017 .

[7] E. Hollnagel , “ FRAM, the functional resonance analysis method: modelling complex socio-technical systems” , Ashgate Publishing, Ltd, 2012 .

[8] R. Patriarca , G. Di Gravio , F. Costantino , and M. Tronci , “ The Functional Resonance Analysis Method for a systemic risk based environmental auditing in a sinter plant: A semi-quantitative approach” , Environmental Impact Assessment Review , 63 , 72 - 86 , 2017 .

[9] I.S. Kim , “ Human reliability analysis in the man machine interface design review” , Annals of nuclear energy , 28 , 1069 - 1081 , 2001 .

[10] E. Hollnagel , “ Reliability analysis and operator modeling . Reliability Engineering & System Safety” , 52 , 327 - 337 , 1996 .

[11] E. Hollnagel , “ Cognitive reliability and error analysis method (CREAM)” , Elsevier, 1998 .

[12] W. Jung , J. Park , and J. Ha , “ Analysis of an operators' performance time and its application to a human reliability analysis in nuclear power plants”, Nuclear Science , IEEE Transactions on, 54 , 1801 - 1811 , 2007 .

[13] A. Azadeh , M. Partovi , and M. Saberi , E. Chang , and O. Hussain , “ A Bayesian Network for Improving Organizational Regulations Effectiveness: Concurrent Modeling of Organizational Resilience Engineering and Macro-Ergonomics Indicators” , In International Conference on Intelligent Networking and Collaborative Systems , pp. 285 - 295 , Springer, Cham, 2017 .

[14] I.A. Herrera , E. Hollnagel, and S. Håbrekke , S. , “ Proposing safety performance indicators for helicopter offshore on the Norwegian Continental Shelf . PSAM10” - Tenth Conf. Probabilistic Saf. Assess. Manag , 2010 .

[15] K. Lundblad , J. Speziali, “ FRAM as a risk assessment method for nuclear fuel transportation” , Int. Conference Work. Saf , 2008 .

[16] G. Shirali , V. Ebrahipour , and L. Mohammad Salahi , “ Proactive risk assessment to identify emergent risks using Functional Resonance Analysis Method (FRAM): a case study in an oil process unit” , Iran Occup. Health 10 , 33 - 46 , 2013 .

[17] R. Steen , and T. Aven , A risk perspective suitable for resilience engineering . Saf. Sci . 49 : 292 - 297 , 2011 .

[18] T. Bjerga , T. Aven , E. Zio, “ Uncertainty treatment in risk analysis of complex systems: the cases of STAMP and FRAM” , Reliab. Eng. Syst. Saf. 156 , 2016 .

[19] L.V. Rosa , A.N. Haddad , and P.V. de Carvalho, “ Assessing risk in sustainable construction using the Functional Resonance Analysis Method(FRAM)” , Cogn. Technol. Work 17 , 559 - 573 , 2015 .

[20] Z. Zheng , J. Tian , and T. Zhao , “ Refining operationguidelines with model-checkingaided FRAM to improve manufacturing processes: a case study for aeroenginebladeforging” , Cogn. Tech. Work 18 , 2016 .

[21] G. Praetorius , A. Graziano , J.U. Schröder-Hinrichs , and M. Baldauf , “ Fram in FSA-Introducing a function-based approach to the formal safety assessment framework” , Adv. Intell. Syst. Comput. , 2016 .

[22] S. Albery , “ Dynamic Numerical Simulation Using the Finite Element Method (LS- Dyna , Altair Hyperworks)”, 2013 .

[23] A. Furfaro , T. Gallo , A. Garro , D. Saccà , and A. Tundis. ( 2016 ). Requirements specification of a cloud service for cyber security compliance analysis . In Cloud Computing Technologies and Applications (CloudTech) , 2016 2nd International Conference on (pp. 205 - 212 ). IEEE.

[24] A. Garro , A. Tundis , D. Bouskela , A. Jardin , N. Thuy , M. Otter , and H. Olsson. ( 2016 ). On formal cyber physical system properties modeling: a new temporal logic language and a Modelica-based solution . In Systems Engineering (ISSE) , 2016 IEEE International Symposium on (pp. 1 - 8 ). IEEE.

[25] V. Di Pasquale , S. Miranda , R. Iannone , and S. Riemma , “ Simulative analysis of performance shaping factors impact on human reliability” , In manufacturing activities. 27TH European modeling and simulation symposium , pp. 93 - 102 , 2015

[26] J.C. Williams , “ HEART-a proposed method for assessing and reducing human error” , In 9th Advances in Reliability Technology Symposium , University of Bradford, 1986 .

[27] D.I. Gertman , H.S. Blackman , J.L. Marble , J. Byers , and C. Smith , “ The SPAR-H Human Reliability Analysis Method. U.S. Nuclear Regulatory Commission , NUREG/CR-6883, INL/EXT-05-00509”, Washington DC, USA, 2005 .

[28] B. Kirwan , “ The validation of three human reliability quantification techniques - THERP, HEART and JHEDI. Part 1: technique descriptions and validation issues” Applied Ergonomics, 27 , 359 - 373 , 199