Functional Safety 2014

– 5

November 2014

Page 8 of 14

Fig. 4 – Swiss cheese model of the Safety Lifecycle

The illustration also tries to correct the general misconception that the majority of human errors lie

in the later stage of the lifecycle activities: for example, restoring operations without resetting the

bypass valve; a block valve associated with a relief valve is left closed after maintenance; or leaving a

transmitter root valve closed.

With reference to some of the major accidents in the past few decades, human errors were found in

various phases of the safety lifecycle. With reference to the UK HSE survey (see Fig. 2), 44% of the

incidents were attributed to inadequate specification of the Safety Instrumented System. These could

be caused by incorrect assumptions during the SIL determination workshop leading to an inaccurate

safety requirement specification and an incorrect design requirement specification. For example, over

claiming the risk reduction credit on an alarm system during the SIL determination workshop. When

the wrong requirement is set out in the beginning, the activities that follow are almost certain to be

incorrect. It often happens that such a mistake may only be discovered when

site integration tests are carried out; or, for example, in the Buncefield oil

storage depot fire, the system testing was not carried out prior to putting the

system online with a consequence of major damage. This is similar to the

domino effect - the system is so vulnerable that when the first domino falls

down, the rest of the dominos will follow on and eventually the whole

construction collapses.

Resolution – Applying a systematic approach

Whatever industry, whether it is a fully-automated or is operated by humans, there is always some

degree of human involvement and it is unlikely that all possible systematic human failures can be

avoided throughout the project lifecycle. A number of studies by various researchers have

investigated how to minimise systematic human failures.

Professor J. Reason

states