The Assessment of underlying latent failures by Tripod

風險評估方法的基礎是"危害辨識"

評估風險(嚴重度*發生機率)的程序是：針對各種"危害"(e.g., 物理性、化學性、生物性、人因性、社會心理性)，推敲(=幻想)其發生的情境&目前針對各種危害我們有哪些軟硬體因應對策(估且不論其對於降低職災的因果關係與藥效大小)，進而算出一個風險大小的等級或者分數....

傳統觀點認為：

危害導致各種職災與工傷，所以預防職災與風險的手法與工具是3E： Engineering(工程改善e.g., 抽氣通風、洩漏偵檢、防溢堤/雙套管...)，Education(教育訓練、改變人員的態度與認知/提昇人員的能耐)， Enforcement(稽查與獎懲，確保人員不至於怠惰)

  

因此當事故發生，總是可以發現應為能為不為的關係者與故障失效的設備設施，針對犯錯的人進行懲處、故障的設備機台進行修繕與工程改善(即可完成一個事故調查與改善預防的動作)，仿佛在玩打地鼠的遊戲：不知道下一隻地鼠(事故)從哪裡冒出來、也只能頭痛醫頭/出事乃論(針對當次事故/就事論事=打地鼠)=治標不治本

而較近期的觀點認為：

發生的事故，有如冰山浮出水面的一角，冰山(Technical factor-犯錯的人與故障的設備)的底下是-各利害關係人的觀念、心態與動機(human factor)，而組織運作的脈絡(organizational factor/ context of organization)導致不安全的行為與不良的安全文化。

因此事故調查與風險評估應該要針對深層的組織因素進行治療與校正，才能對症下藥預防事故再次發生。

那麼該如何針對深層(各種醞釀不安全行為)的組織因素進行風險評估呢？

Tripod這個方法論，可以提供參考與指引

https://publishing.energyinst.org/tripod

Tripod的邏輯與觀念如下：

Underlying Organizational Causes=>Unsafe Pre-conditions(Behavior, Equipment, Procedure or Environment )=>Immediate Causes(wrong or inaction)=>Fail of barriers or controls=>Accident

Tripod將可能導致事故發生的Underlying Organizational Causes and Immediate Causes歸納為以下11項風險因子(Basic Risk Factors or General Failure Types):

1.Hardware (HW)

Failures due to inadequate quality of materials or construction, non-availability of hardware and failures due to ageing (position in the life-cycle). This does not include error-generating mechanisms due to poorly designed equipment (Design) and hardware failures caused by inadequate maintenance (Maintenance management).

2.Design (DE)

Deficiencies in layout or design of facilities, plant, equipment or tools that lead to misuse or substandard acts, increasing the chance of particular types of errors and violations

3.Maintenance management (MM)

Failures in the systems for ensuring technical integrity of facilities, plant, equipment and tools, e.g. condition surveys, corrosion barriers and function testing of safety and emergency equipment. Issues relevant to the execution aspects of maintenance are considered in the BRFs Error-enforcing conditions, Procedures, Design, Hardware, and Communication.

4.Procedures (PR)

Unclear, unavailable, incorrect or otherwise unusable standardised task information that has been established to achieve a desired result.

5.Error-enforcing conditions (EC)

Factors such as time pressures, changes in work patterns, physical working conditions (hot, cold, noisy), etc. acting on the individual or in the workplace that promote the performance of substandard acts – including errors or violations.

6.Housekeeping (HK)

Tolerance of deficiencies in conditions of tidiness and cleanliness of facilities and work spaces or in the provision of adequate resources for cleaning and waste removal.

7.Incompatible goals (IG)

Failure to manage conflict; between organisational goals, such as safety and production; between formal rules such as company written procedures and the rules generated informally by a work group; between the demands of individuals’ tasks and their personal preoccupations or distractions.

8.Communication(CO)

Failure in transmitting information necessary for the safe and effective functioning of the organisation to the appropriate recipients in a clear, unambiguous or intelligible form.

9.Organisation (OR)

Deficiencies in either the structure of a company or the way it conducts its business that allow responsibilities to become ill-defined and warning signs to be overlooked.

10.Training (TR)

Deficiencies in the system for providing the necessary awareness, knowledge or skill to an individual or individuals in the organisation. In this context, training includes on the job coaching by mentors and supervisors as well as formal courses.

11.Defences (DF)

Failures in the systems, facilities and equipment for control or containment of source of harm or for the mitigation of the consequences of either human or component failures.

以上11項風險因子(Basic Risk Factors or General Failure Types)的評估可以下載附件作為參考

https://publishing.energyinst.org/__data/assets/pdf_file/0020/137081/Caused-by-Leads-to-v1.2.pdf 

以上Basic Risk Factors or General Failure Types可以架構詮釋如下

上：

組織資源有限、卻有各種衝突的目標與不同的利害關係人必須兼顧(Incompatible goals, IG)

在以上情境下造成組織(Organization)與溝通(Communication)的亂象

中(軟硬體機制)：

以上組織脈絡(Organizational Context)-衝突目標/組織與溝通的現實 塑造與影響

硬體Hardware (HW)

設計Design (DE)

維護Maintenance management (MM)

管控程序Procedures (PR)

人員訓練Training (TR)

下(現場運作/干擾因素)：

各種不足、亂象與缺失

Defences (DF)

Error-enforcing conditions (EC)

Housekeeping (HK)

上

Incompatible goals (IG)

• The employees experienced pressure to conform to the informal group norms (norms not accepted by management)同儕壓力/小團體潛規則不同於白紙黑字的聲明
• Internal or external individual circumstances made priority setting more difficult (family problems, other activities that took priority, shyness, over-motivation, addiction, personal goals intruding in work)個人的利益優先不同於組織的利益優先
• Management commitment to the maintenance of optimal working conditions was insufficient (because of short-term profit seeking, meeting immediate production targets)組織受限於短期績效壓力，忽視承諾
• There was insufficient recognition by management of existing contradictory goals (operational priorities not made clear enough, annual programme creating requirements not compensated by safety plan) 組織忽視各種衝突目標
• There were failures on the part of management to manage external pressures (political pressures, national policies on hiring incompatible with necessary competencies)用人只問成本或關係，不問能力
• Conflicting goals hindered the transmission and receipt of information (not wishing to be the bearer of or to hear bad news, pressure of time)大家快被各種衝突的目標搞死，不想再聽到壞消息；也懶得再反應
• Bodies outside the organisation exerted a dominating influence (governments, multinational organisations)呵呵，東方企業是董監事、董娘…
• A conflict between production, financial, government or individual objectives and safety measures hindered the emergency response (waiting too long before shutting down, failure to inform outside bodies, guidelines not hard enough)呵呵，生產>>安全

Organization (OR)

• There was insufficient discipline with regard to use of procedures (procedures were not updated, wrong version used, became dirty or were lost)SOP參考用
• Planning and demarcation of locations and tasks was unclear or inadequate (which department or shift was responsible for cleaning which location, overviews and duty rosters)各種分工與權責不明確
• There was insufficient supervision of the cleanliness and tidiness of the working environment (e.g. no management visit to look at the tidiness of the location or no 'follow-up' after a working visit)主管與幹部沒有進行巡視確認
• The selection process for the hiring of employees was ineffective (no medical investigations were carried out, no suitable investigation made of the abilities of the employee)組織找人過程草率
• Guidelines on minimum training and experience requirements for specific functions/tasks were inadequate. 對於各工作與職務所需的經驗與訓練沒有適當的指引
• The employees considered themselves not empowered to stop the activities (management did not make it clear how important safety was)員工不覺得自己有停止作業的權利
• Supervision to maintain optimal working conditions was insufficient (individual priorities were not suppressed)幹部沒有跳出來制止不當的個人行為
• Management priorities were wrongly assigned (unsound company management, willfully following the wrong policy)呵呵，很多老闆也是怠惰
• Organisational objectives were ineffectively defined ('quality' was not an
• objective or was not operationalised)組織目標不清不楚
• Company management style was inadequately or insufficiently defined (company management lacks direction, deviation from core business, blurring of business branch)呵呵，組織是一盤散沙與雜草
• Job descriptions were insufficiently defined (work requiring activities
• outside job description, training limited to formal job definition)工作執掌不清不楚
• The company structure/organogram was insufficiently defined (interrelationships between persons and departments unclear or not effective)呵，部門間大家八仙過海各顯神通
• The company organization and communications structure was not effective (too much bureaucracy and rigidity, small scale, lack of flexibility, shareholders'/stakeholders' demands not aimed at improving quality)無解的組織病
• Responsibilities or accountabilities were incorrectly or ineffectively defined (lack of clarity about who or which department had the responsibility for what, responsibility and accountability lying with different people) 無解的組織病
• There had been too many departmental reorganizations or changes of senior management朝令夕改與來來去去的主管
• The control system within the company was ineffective: structure, resources, approach (supervisor(s) overstretched, execution and control lying with one person, supervision ineffective)欸，管理不是那麼容易的
• The organisation was insufficiently involved with safety (lack of systematic registration of who was working where, safety not integrated in working methods, no policy that stimulated safety)這點有導45001的話倒是還好
• The structure of the emergency response organisation was unsound (hierarchy, responsibilities, delegation)這本來就是ERT的罩門
• Supervision during the performance of emergency or other safety related activities was insufficient欸

Communication(CO)

• There was insufficient designer-user communication during the design or modification phase. 規劃設計與使用間的溝通不良
• There was insufficient feedback about the use of the procedures in practice (about the correctness, comprehensibility, usefulness, effectiveness)現場實務的聲音沒有回來
• There was insufficient opportunity to comment and adapt the procedures (valid remarks and criticisms about the procedures are not catered for in revisions)經驗沒有註記在SOP上
• Feedback to management about the physical circumstances and other negative influences was insufficient.報喜不報憂
• There was insufficient feeling of 'ownership' of the location by employees (lack of interest in how the location looked; 'that's for the next shift to do')只交接不管成敗
• Insufficient feedback was given to the training manager/management about the quality and effectiveness of training or educational courses對於經理而言，員工教育訓練沒有效益與績效
• Insufficient feedback about the potentially dangerous situation was given to the persons who had authority to take action.沒有告訴員工當遇到危險該採取什麼行動
• The quality or quantity of the communications equipment was inadequate (many disruptions, too small capacity, too little communications equipment, too few (reserve) communications channels)=>在緊急應變時會遇到的大哉問
• Personal factors made communications more difficult (intoxication (drink/drugs), deafness, stubbornness)個人特質造成溝通困難
• There were language problems (different native language, dialects, jargon)語言造成溝通困難
• There were inadequate controls on the correct use of means of communication and on following communications procedures(要透過秘書等傳達)
• An ineffective communications structure prevented information from getting through, arriving in time, or reaching the right person (lines were too long)時差或距離問題
• There was insufficient exchange of information about safety aspects between the various sites, departments or persons belonging to the company不同部門的人各自閉門造車
• Communications during the emergency were ineffective (ineffective communications structure, inaccessibility, disruptions)難以克服的常態

中

Design (DE)

• Insufficient design provisions were made for the operating external environment (extreme temperatures, humidity, particulates etc.)設計沒有考慮到環境極端情況
• The design made insufficient use of industry standards (standard guidelines incorrect, out-of-date, HSE criteria not present)不考慮安全與引用適當的標準
• Insufficient attention was paid to specific ergonomic issues during design (no ergonomic assessment, unfamiliarity with the operational environment)沒考慮操作人因
• There were insufficient controls/criteria in the design process (design change controls, checks on compliance with standards/ guidelines, quality controls)
• Purchase of material was insufficiently controlled (different from previously purchased material, materials failing to meet design specifications)沒有考慮到供應商與材料購買
• Specifications and requirements that the tools or equipment should meet were insufficient (functionality, quality, brand, material, size, and other details)材料規格不清
• Faulty adjustment or construction or lack of insulation in material caused noise, vibration or extreme temperatures 安裝施作不佳，造成噪音振動與異常溫度
• Non-preventable unsuitable working conditions were inadequately recognised, poorly evaluated or insufficiently compensated for (thunderstorms, hurricanes, sandstorms, political upheavals)沒有考慮到各種天災人禍所需的修繕
• The working environment (installations, equipment and tools) could not be cleaned or was difficult to keep clean (became dirty quickly through the nature of the work, or because the dirty places were not easily accessible)環境骯髒或難以清潔
• There was insufficient storage space or a work area that was too small to be kept tidy and clean缺乏維修空間
• There was insufficient collection or filtering of dirt emission from equipment or installations (inadequate gutters, wastepipes, filters)設備排放管路沒有安裝過濾器
• There were insufficient cleaning areas or opportunities for waste disposal (insufficient or badly located containers)沒有考慮到廢棄物處理或存放
• The ergonomic design of the communications equipment was inadequate (no 'hands free' function)
• Disturbing external influences disrupted the communication (atmospheric disturbances, noise
• Equipment was difficult to maintain because of the way it was designed (unreachable or difficult to reach components, total dismantling necessary)
• A tool for maintenance was difficult to use (poor ergonomic design)
• Environmental conditions were disruptive to maintenance (extreme temperatures, darkness, noise, stench, rain, wind)天候造成維修中斷
• The ergonomic design of safety and emergency equipment or protective gear was inadequate (difficult to handle, alarm signal difficult to perceive)
• Environmental conditions at the time of the emergency operations were unfavourable (weather conditions, darkness)

Hardware (HW)

• There was insufficient introduction of a new or modified design (too little information provided, implementation badly planned, insufficient time allocated for implementation)
• The supply system for tools or equipment was ineffective (inventory, administration, ordering, issuing)配送請領料困難
• The control system for regularly evaluating and updating the specifications of the tools or equipment was inadequate
• The physical circumstances in which the tools or equipment were used were unsuitable (used outside the specifications laid down in the design, such as use of corroding material in the tropics, the influence of cold, sea water)承受惡劣環境
• Tools or equipment were not properly stored or insufficiently cleaned (items
• were lost, damaged or became very dirty)沒有妥善維保
• There were financial constraints or pressure of time during the purchase or improvement of the tools or equipment (inferior quality, items with too few possibilities, inadequate number, necessary modifications were not performed)呵呵，現實工廠的常態與窘境
• The inspection system for the tools or equipment was inadequate (frequency, completeness, precision - items remained too long in circulation)檢查周期太長
• Communications between inspection and maintenance departments was inadequate (information about defective material was not notified or was inadequately notified)檢查與維保部門間溝通不良
• There were insufficient checks on the tools or equipment being taken from the workplace (theft)零件與工具被幹走
• The system for checking that the tools or equipment, both on purchase as well thereafter, met the specifications and requirements stipulated was inadequate.

Maintenance management (MM)

• Maintenance of the tools or equipment was inadequate (planning, execution, registration)
• The inspection system for the tools or equipment was inadequate (frequency,
• completeness, precision - items remained too long in circulation)維修檢測不夠精準
• Communications between inspection and maintenance departments was inadequate (information about defective material was not notified or was inadequately notified)
• Maintenance material, tools or equipment was of inadequate quality.使用次級品
• Maintenance documentation was inadequate (no manuals, unauthorized drafts or sub-standard manuals)
• There were personal factors disruptive to maintenance (problems at home or at work, illness, use of medications, addiction or a disturbed day-night rhythm)
• Resource constraints made good maintenance difficult (too few maintenance personnel, budget for materials too small, too little time)
• There was insufficient co-operation between inspection and maintenance teams (no notification of defective material)
• Maintenance history or documentation on the 'settings' of the tools or equipment were inadequate (changing settings 'back and forth', repeated mistakes)
• Planning and co-ordination of maintenance activities was inadequate (no oversight of the maintenance to be performed, no priorities set for essential material, no or inadequate maintenance schedules)
• Checking of maintenance quality was inadequate (no feedback about the effectiveness, no functional tests carried out, no inspection)
• The maintenance philosophy was inappropriate (breakdown, preventative or condition based maintenance, philosophy inappropriate to equipment)
• There was insufficient maintenance and repair of safety and emergency equipment or protective gear (no checks made on fire extinguishers, fire suits, no testing of alarm systems, emergency exits)

Procedures (PR)

• Procedures for operating tools or equipment were inadequate (resulting in wrongful use)
• The storage and retrieval system for procedures was ineffective (no index or a non-effective index, location of the storage system too distant from the workfloor, authorisation required)
• Procedures were drawn up by people not suited to the task (no specific operational
• knowledge, no knowledge or experience of how procedures should be drafted)
• There were constraints on making improvements, renewals or corrections to procedures (budget was too small, time was too short, too few personnel)
• The way in which the organisation decides when to produce a procedure was incomplete/inadequate (the lack of vital procedures)
• Procedure implementation was inadequately supervised (inadequate timing, insufficient verification that the procedure introduced was actually understood)
• The quality and quantity of procedures within the organisation was insufficiently controlled (no-one was responsible for 'maintenance' of the procedures, no 'overview' of the whole package of procedures, no quality control of contractor procedures)
• Procedures specifying under what environmental conditions the work must be stopped were ineffective (e.g. above 50°C, below -40°C)
• Instructions for cleaning or tidying-up the work environment were inadequate (how and how often something must be cleaned and tidied)
• Procedures about the communications structure were ineffective (who should receive or request what information, who you have to notify something to, medium to use, standard terminology and abbreviations, hand signals, 'repeat to confirm' procedure)
• Work procedures for maintenance tasks were ineffective (out-or-date, noneffective, incorrect)
• The safe system of work (e.g. PTW) for the performance of maintenance was ineffective
• Emergency procedures/ operational disaster plans were ineffective (out-of-date, insufficiently informative or not flexible enough about what to do in what situation, last line defences not included)

Training (TR)

• Tools or equipment were wrongfully used (by untrained, inexperienced or unqualified personnel)錯誤使用
• Training or experience of the cleaning personnel was inadequate Tests of the effectiveness of training or education given were inadequate (no final test on the material or skills taught)沒有驗收
• There were insufficient resources to carry out the training programme (money, time)沒有資源辦好
• There was inadequate notification of the need for training or educational courses or for specifically trained personnel沒有傳達正確的資訊給需要訓練的人
• There was insufficient standardisation of training courses, educational standards and competence requirements between companies and countries沒有標準化的訓練課程
• Timing, co-ordination or planning of training and educational courses was inadequate (employees were not sent on time to the necessary 'refresher' and 'certification' training courses)員工沒有在職教育與例行驗證
• Inadequate records were kept of the training and educational courses employees had followed, or what tested level of competence they had achieved沒有完整的訓練紀錄
• Guidelines on establishing the requirements of training and educational courses were lacking or inadequate缺乏教育訓練需求的鑑別與依據
• Quality control of (the standard of) training and educational courses was inadequate (training was inadequate, the standard had fallen)沒有訓練品質的評量
• Training was poorly organised/managed within the organisation (no focal point, no control, no overview)訓練沒有妥善管控
• No training courses were authorised/organized (lack of management concern regarding competence)無病呻吟無關痛癢的教育訓練
• Inadequate training was given for staff, supervisors and management about the best way to communicate (standard terminology and abbreviations, hand signals , simple and clear formulation, repetition of instructions/notification)主管與幹部用錯誤方式溝通與管理
• Knowledge and experience levels among the maintenance personnel were insufficient (no specific training or on-the job training given)人員能耐與資格沒有明確的分級
• Employees involved had insufficient know-how to be able to carry out the emergency operations or the preventative measures (operational knowledge, insufficient emergency training, no first aid qualifications)人員欠缺應變技能與能耐

下

Error-enforcing conditions (EC)

• Employees were insufficiently accustomed to or familiarised with the physical environment, weather or climatic conditions.
• There were insufficient resources to make improvements in the working environment (budget too small, too little time or too few personnel made available)巧婦難為無米之炊
• Insufficient arrangements were made for (the recognition of) persons with serious personal problems當事人有個人問題與情緒困擾
• Insufficient arrangements were made for (the recognition of) persons who were ill or who used or failed to use medicines that affect their functioning當是人生病或吃感冒藥
• Insufficient arrangements were made for (the recognition of) persons with problems in the social environment (boredom, no prospects, colleagues)職場霸菱
• Employees with a nondesirable working attitude were inadequately supervised or insufficiently corrected (no training in delegation, no attention to motivation and fear of failure, no way of dealing with a macho culture)欸，始亂終棄
• Insufficient arrangements were made for the recognition and management of unsuitable working conditions (management did not want to hear)管理階層不聽員工意見
• The weather conditions made it difficult to clean and tidy-up properly海上風電
• The condition of people at the time of the emergency operations was unfavourable (people were ill, drunk, very frightened, stressed)欸，廢話

Housekeeping (HK)

• Insufficient attention was given to keeping the work floor clean or tidied up (unpleasant smells)
• Cleaning equipment or cleaning material was insufficient, unavailable or of inadequate quality
• Insufficient resources were allocated for keeping the work floor clean and tidy (purchasing budget was too small, time allowed was too short, too few personnel)

Defences (DF)

• There was insufficient (personal) protection against external disturbing influences (no sunshades, air conditioning, ear plugs, insulating suits)
• Congestion or chaos in the operating environment hindered the emergency operation or preventative measures (inability to find the necessary equipment, emergency exits or evacuation routes were blocked)
• Release of money, personnel or other means was inadequate to guarantee effective preventative measures, emergency procedures or safety equipment當潘仔與冤大頭

評論Tripod這個方法論

優點：

1. 作為Golden Sample，讓大家對照看看與想想：Cheese Cake Theory當中，各層的缺失孔洞(latent failure)在哪裡；補足大家(腦袋有洞)光講乳酪理論中各防護層上的空洞，卻不提human and organizational factors如何塑造了這些洞(幫大家腦補)
2. 讓各利害關係人與高階主管，看見與意識到：自己個人或成員集體的作為或不作為，如何塑造組織的命運(Drift into failure or thrive to succeed. 方以類聚、物以群分，吉凶生矣  https://eshmanager.blogspot.com/2015/04/blog-post.html#more )
3. 相較於Behavioral Safety Approach(邪教洗腦般的指認覆頌、晨會呼頌安全口號、規定上下樓梯手扶扶手、辦公室筆尖一律朝下等)， Tripod的邏輯與因果關聯解釋相對合理與容易讓人接受。

缺點：

1. 組織資源有限/有各種衝突與兩難目標/必須做出取捨（https://eshmanager.blogspot.com/2014/02/blog-post_22.html ），所以依照Tripod的指引與guideline 進行組織自我查核，應該會看到一堆問題；然而發人省思的是：「為什麼組織存在這麼多的問題，卻還沒出事？！」
2. Tripod的指引標準是一種理想的應然，不考慮實際上的種種干擾因素、資源限制、亂象與愛恨情仇，也沒告訴大家該如何循序漸進；在執行與使用上可謂是是微觀與耗費人力與時間的手工藝。
3. Tripod聚焦於組織內氣候與文化的成型，不適用多個利害關係人之間的分析(e.g., 航空事故)