A situational analysis of how barriers to systemic failure are undermined during accident sequences

The concept of barriers to accident sequences is an important one in reasoning about the ways in which risks in a system can be reduced to acceptable levels. An attempt was made to characterize the phenomena that, in practice, undermine such barriers. This involved an analysis of 50 accident reports from the hydrocarbons drilling industry. The analysis characterized the barriers that had failed in terms of their source and effect, and it identified what had undermined them -- concentrating on aspects of the situation, rather than the dispositions of the people involved in the accidents. These undermining phenomena varied widely, but in general there was some element that made them intrinsically difficult for designers of systems to discern: for example, the indirectness of causal paths in which some aspect of the design induced some behaviour on the part of an operator, which then created some condition that circumvented the action of a barrier. In a few cases it was the barrier itself that lay at the start of this causal path, making the barrier essentially self-limiting. A simple planning tool was developed to exploit this analysis by helping system designers reason about the ways in which the barriers they incorporate are vulnerable to being defeated.