122 / 648
Safety and environmental standards for fuel storage sites
Final report
120
Table 12 would give a higher level of confidence in the effectiveness of the checking. No figures
for the probability of error are given because these should be determined and justified on a case-
by-case basis by a specialist in human error quantification.
Table 12
Levels of cross-checking effectiveness
Level of dependency Level of checking
Complete
No justifiable reason why the checker should identify the failure when the
person carrying out the original action has not.
High
The checker can determine the correct course of action independently of the
first person. However, checker either has a common link with the first person
or there is good reason to believe that the checker will make the same error as
the first person.
Moderate
Checker has a weak link to the first person or there is moderate likelihood that
the checker will will make the same error as the first person.
Low
Checker has sufficient independence from the person carrying out the original
action and the check is designed to highlight errors that may have occurred.
206
If in doubt, or if a suitable justification cannot be given, no claims should be made
for risk reduction due to checking
.
Annex 7 Incorporating human error in initiating events
Identification of potential human error
207 The first step is to identify which tasks are critical tasks in relation to the overflow event. In
this context, a critical task is one in which human error can trigger a sequence of events leading
to an overflow. The identification of critical tasks is best achieved during the development of a
demand tree, as described in Annex 3.
208 When doing so, there should be coverage of all modes of tank operation: filling, emptying,
maintenance, transfers, and any other abnormal modes of operation etc. A ‘critical (human) task
list’ can then be created. Table 13 shows an example.
Table 13
An example ‘critical (human) task list’
Mode of operation
Task
Potential adverse outcome
Transfers between tanks
Opening manual routing valve
between the transfer pump
discharge and a designated
receiving tank
Opening the wrong valve and thereby
transfer to the tank under review which
has too little ullage and causing the tank
to overflow
Review of each critical task
209 For each critical task it is important to gain a good overview of the task and its context. There
are a number of task analysis techniques that can be used.
Create a timeline with input from a person who does the activity.
■
■
Review timeline against operating instructions and process engineering input for anomalies.
■
■
Consider creating a hierarchical task analysis for the activity to identify the key tasks.
■
■