When is a facility safe?
This is a common question we would have in our daily job.
When is an activity safe?
It is not an easy question to answer.
But we know how to make a system safer by adding protections.
Now when we speak of barriers,
we are speaking of protection features.
Let's say, the protection relies on an electric installation
or in the containment building in a nuclear power plant.
Whenever someone designs a system,
it is always important to think of the possible outcome,
and how to avoid the negative ones,
the accidents, the dangerous incidents.
All those things that can make a system fail.
And when it fails, it affects people and harms them.
So a question arises:
How many barriers or protections are enough
to make a system safe?
What kind of barriers?
Are they going to be enough to protect people?
Now imagine an oil drilling rig.
Those that you use to drill the earth and take oil out.
We have designed one with eight different barriers
to protect it from failure.
All of them independent. That sounds really safe.
Because what are the probabilities of a barrier failing?
Maybe they are low, but they are not that low.
But imagine two barriers. Or even three.
Each one of them will have very low probabilities of failing.
So the adding is going to decrease that probability.
So we will see later an example of that oil drilling rig
which has eight different independent barriers
and we will see what happens to it.
But as I said before,
probabilities decrease, but they are never going to be zero.
I know that the chances and probabilities are important,
but there is always a chance
of somebody crossing through a wall by channeling effect.
Although it is so low, that if I see it in my real life
I will quit and would enter a monastery.
So it's really difficult that a facility with eight different barriers fails.
But it's not impossible.
So some years ago,
James Reason, a professor from Manchester University,
proposed a new model
that has been widespread
in risk analysis and risk management in several fields,
such as aviation, engineering or healthcare.
Basically, this model says that most accidents can be traced back
to one or more of the following domains:
Organizational influence.
All the organizational issues like having a poor training
in a dangerous task.
Or supervision.
This example can be seen both in aviation and in the nuclear industry.
You never have a pair of new control...
...sorry, new pilots during a night flight
with a known adverse weather.
Or a crew of rookies as operators in a nuclear main control room
during the first reactor startup.
Also the preconditions.
For example, component fatigue in an engine
or improper communication during a task.
And finally, the specific acts
could be all the things that the person who makes the activity can perform.
So this model describes any system
as the combination of different cheese slices in a row,
like this.
The model includes both the active and latent failures.
And all those weaknesses
are represented by holes in the cheese slices.
Those holes are in different parts of the system.
And they are changing their size and position constantly.
That means that sometimes,
there would be an opportunity for a clear trajectory
for an accident to happen.
So a hazard can go through all the holes in all the slices,
leading to a failure.