Focus on Mission Success: Process Safety for the Atychiphobist

Transcription

1 Focus on Mission Success: Process Safety for the Atychiphobist Mary Kay O Connor Process Safety International Symposium Bill Nelson and Karl Van Scyoc October 28-29, 2008

2 First: A Little Pop Psychology Atychiphobia: Fear of failure Signs and Symptoms: The fear of failure is often one of the most paralyzing phobias. Sometimes, we're so concerned about failing that we don't try an activity we want to try. This is why many have linked it with the fear of success. Like so many other fears, this phobia is often so strong it brings about the very failure that was feared. - Slide 2

3 Armchair Diagnosis, Prognosis, and Treatment Are some industries exhibiting symptoms of atychiphobia? - Difficult to define and communicate organizational objectives. - Ongoing incidents in spite of lessons learned programs. - Inattention to lessons learned from past successes. - Inability to recognize the symptoms and seek help. - Inability to share the pain and learn from other industries. Prognosis if left untreated: - Continued difficulty in achieving organizational goals. - Possibility of future catastrophic accidents that could damage the entire industry. Suggested treatment plan: - Learn how to identify and utilize critical factors that lead to mission success. - Develop and utilize success oriented approaches to risk management. - Share knowledge of effective risk management within and across industries. Slide 3

4 An Everyday Example: Growing Tomatoes The Loss Control Approach Identify and prevent loss scenarios: - Apply pesticides to prevent attack by insects - Cover plants with netting to prevent theft by birds - Erect a fence to prevent damage by dogs or deer - Support the plant to keep tomatoes off the ground - Manually remove tomato hornworms Exclusive reliance on loss control will not result in healthy tomatoes! The Mission Success Approach Provide critical success factors: - Fresh seed - Nutrients in the soil or applied in fertilizers - Water - Sunlight - Pruning Actually, a balanced combination of Loss Control and Mission Success is needed for effective tomato husbandry! Slide 4

5 Questions We ve Been Asking Why do catastrophic accidents continue to happen in some industries? Why haven t risk management tools been more effective at preventing and mitigating accidents? What are the critical components of an effective risk management system? What are critical success factors necessary to ensure that organizational objectives are achieved while controlling losses? How can loss control and mission success perspectives be effectively integrated? Slide 5

6 Hypothesis: There are Five Elements of Effective Safety and Risk Management 1. Effective risk management culture - Safety and risk organizations, systems and processes must be integrated with the engineering, management and operational cultures 2. Effective paradigm or map of the system and process - Used to guide design decisions, define safe operations, and select effective corrective actions during accidents 3. Effective tools for decision making - Procedures, flow charts or software to guide effective information gathering and decision making 4. Effective measures of process performance - The risk management system is dependent on performance information 5. Effective lessons learned systems - Continuously improve risk management decisions and enable organizational learning Risk informed decision making is a key strategy to establish and integrate these five elements of effective risk management. This presentation focuses on the mission success paradigm and associated tools. Slide 6

7 Mission Success Paradigm and Tools: Experience from the U.S. Nuclear Industry Prior to the Three Mile Island Accident in 1979: - Plants were licensed based on a small set of design based events. - Emergency procedures were event-based, requiring accurate diagnosis of the specific event in progress. - Regulatory oversight was prescriptive. - Probabilistic Risk Assessment methods were developed and used, primarily to generate a number. Slide 7

8 U.S. Nuclear Industry Response to TMI Conclusion of The President s Commission on the Accident at Three Mile Island: To prevent accidents as serious as Three Mile Island, fundamental changes will be necessary in the organization, procedures, and practices and above all in the attitudes of the Nuclear Regulatory Commission and, to the extent that the institutions we investigated are typical, of the nuclear industry. Results: - Fundamental, industry-wide changes were made - No additional comparable events in the U.S. - Significantly increased plant performance Slide 8

9 U.S. Nuclear Industry Capacity Factors * * Preliminary Source: Global Energy Decisions / Energy Information Administration Updated: 4/08

10 What Has Changed Since TMI? Increased attention to mission success: Function based emergency procedures to supplement event based procedures Industry self-regulation: the Institute of Nuclear Power Operation (INPO) Improved tools for dynamic risk management: Probabilistic Risk Assessment (PRA) and risk informed applications to support operations, maintenance, and management decisions Risk management culture: Integration of risk management processes into power plant operations Transition by the NRC to a risk informed, performance based Reactor Oversight Process Many challenges remain that could benefit from cross-industry collaboration: - Safety culture - Human reliability - Licensing of digital instrumentation and control systems Slide 10

11 Function-Oriented Resource Assessment Trees for Emergency Procedure Guidelines ca. 1982

12 NASA Focus on Mission Success: Failure is Not an Option Design of missions and systems for mission success Plan for every (imaginable) contingency Improvise for the unexpected (e.g. Apollo 13) with the Right Stuff Challenger accident identified flaws in the risk management decision processes i.e. the Challenger launch decision Post Challenger modifications: - Organizational restructuring - Increased use of Probabilistic Risk Assessment - Emphasis on raising and assessing employee concerns The Columbia accident indicated that risk management processes were still not mature i.e. the foam impact assessment in the Mission Evaluation Room Slide 12

13 The NASA Mission Success Framework Concept A concept was developed for real-time risk management in the Mission Evaluation Room of the International Space Station. Major features: - Definition of the mission and measures of mission success - Hardware, software, human, and organizational resources that can be employed to achieve the mission - Critical functions that must be maintained to achieve the mission - Types of challenges that can endanger the critical functions - Success paths that can be used to maintain or restore the critical functions - Guidance for selecting the best success paths for responding to critical function challenges - Information required to monitor the health of the critical functions and performance of the success paths Slide 13

14 Overall Structure of Mission Success Framework MISSION Critical Function Subtask Subtask Critical Function RESOURCES Critical Function Support Systems

15 Example: ISS Model of Mission Success Mission MAINTAIN HABITABLE ISS RESEARCH PLATFORM Page 2 Critical Functions Maintain Pressurized Atmosphere Attitude Control s Activate & Monitor Atmospheric Gas Makeup Isolate Compartments for Emergency Depressurization Activate & Monitor Attitude Control Resources Russian Portable Gas MakeupRepress Unit US O2/N2 Storage Internal Hatches USOS Control Moment Gyros (4) Service Module Thrusters Progress Thrusters Support Systems Progress Tanks Service Module Tanks Tanks Pressure Control Assembly Thermal Control Loop Electric Power (Page 4) Attitude Control Subsystem Attitude Determination System Fuel Control Fuel Control

16 Integrating Risk Information with other Information: Risk Informed Decision Making RIDM is a discipline. It starts with a need, an issue, or situation for which a decision is required. It involves considering, weighing, and integrating often complex inputs and insights from traditional engineering (deterministic) analyses, probabilistic analyses, operational experience, compensating or mitigating measures, or other pertinent considerations It involves a way of thinking to integrate such inputs, insights, and assessments to result in safe, sound, and optimum management or operational actions or decisions. - International Atomic Energy Agency, draft Safety Guide DS365 Much work will need to be done to refine and implement these concepts! Slide 16

17 The IAEA Defense in Depth Objective Tree An Approach for Organizing RIDM Information To be maintained To be achieved and to be protected Level of Defense Objectives and barriers Prevent, control, and mitigate challenges to the objectives and barriers To cope with Safety function Safety function Challenge Challenge Challenge Challenge Induced by Mechanism Mechanism Mechanism Measures to be taken to prevent mechanisms from occurring that challenge safety functions Provision Provision Provision Provision Provision Provision Provision Provision Provision Slide 17

18 Treatment of Technical Risk: Objective Tree for RCS Cooling Safety functions Challenges Excessive heat production due to recriticality Inadequate removal of heat from degraded core Maintain RCS Cooling Consequential damage of RCS due to inadequate heat removal Inadequate heat removal from the containment Mechanisms Core heat-up and relocation Hydrogen generation Provisions Secondary side bleed and feed Prevention of core heat-up RCS depressurization Water injection into the core by any means Slide 18

19 Treatment of Management Systems and Safety Culture: Objective Tree for Conduct of Operations Safety functions Challenges Staff unable to safely operate the plant Maintain RCS Cooling Lack of safety culture Operations conducted outside of procedures Mechanisms Environment not conducive to safety Inadequate response of individuals Desired behavior reinforced by supervisors and managers Safety awareness of activities and potential errors Provisions Avoidance of inappropriate work patterns Attention to good housekeeping Questioning attitude facing unusual phenomena Rigorous and prudent response to alarms Staff discipline Prompt remedial actions to detected deficiencies Slide 19

20 The NASA RIDM Paradigm Focuses on Mission Success in a Decision Analysis Framework Representative PMs Related to Objectives Objective Hierarchy Slide 20

21 Other Risk Informed Decision Making Activities Safety management system for development of the next generation air transportation system (NextGen) Federal Aviation Administration and Joint Planning and Development Office (JPDO) Risk Management Effectiveness Assessment Guide - Electric Power Research Institute (EPRI) Industry-wide strategy for development of a risk management infrastructure U.S. commercial nuclear power industry Slide 21

22 Status and Potential Path Forward We are working with EPRI and IAEA to identify requirements for risk informed decision making and the risk management culture. We have also solicited input from utilities, NRC, NASA, and FAA. We will work with EPRI in updating the Risk Management Effectiveness Assessment (RMEA) Application Guide. Identify potential participants for collaboration in a Joint Industry Project. Create decision cases to test the concept, for example: - Use objective trees to define and implement the safety objectives for an organization. - Develop a risk culture assessment tool based on generic objective trees. Test and validate the products in pilot projects. Develop an RIDM implementation guide. We are actively seeking potential collaborators. Slide 22

23 Slide 23