Case studies on Hazard/threat identification using different creative methods to support the Anticipatory Failure Determination approach A. Jensen University of Stavanger T. Aven University of Stavanger This article presents two cases on Hazard/threat identification. The cases are meant to illustrate the Integrated anticipatory failure determination method laid out in Jensen and Aven (2015). 1 ANTICIPATORY FAILURE DETERMINATION APPROACH We illustrate AFD with a hazard/threat identification of a rock climber, which is to ascend a mountain. The climb consists of three stages. First, the ascend to basecamp where the climber stays for a number of days to acclimatize. Then, an icefall needs to be passed before the final push to the summit. We apply AFD-2 for failure prediction. It follows a 10-step procedure, which guides the analyst through the hazard /threat identification. 1. FORMULATING THE ORIGINAL PROBLEM A mountain is to be climbed. We wish to find all possible ways in which the climber may fail to reach the top. (the descent is ignored for the sake of simplicity). 3 FORMULATION OF THE INVERTED PROB- LEM We switch our mindset in to wanting failures to occur by inverting the original problem. We now seek to create all possible ways in which the climber may fail to reach the top or one of the sub goals: We wish to create all possible ways in which the climber may fail to reach the top. 4 APPARENT WAYS TO DETERIORATE THE SYSTEM FUNCTION We collect all obvious failures that can be readily thought of. To help us with this we focus on Initiating events (IEs), mid-states (MSs) and harmful end states (HEs). Obvious Initiating Events (IE) are: IE1. Not enough stamina IE2. Poor preparation IE3. Avalanches IE4. Slipping 2 IDENTIFY THE SUCCESS SCENARIO Climber to reach the top of the mountain unharmed, or in terms of desired sub goals: Phase Basecamp Icefall Summit Sub goal Reach Basecamp 1 unharmed and with all equipment Passing of icefall without accidents Reaching the top and take a picture Obvious Harmful end states (HES) are: HES1. Freeze to death HES2. Running out of air HES3. Falling HES4. Caught in crevasse HES5. Frostbite HES6. Abort climb Obvious possible failure scenarios (HES) are: IE1 HES2 HES6 IE2 freezing HES5 HES6 IE2 HES2 HES6 IE3 HES1 IE4 HES4
5 IDENTIFY AVAILABLE RESOURCES We follow with step 5, which is to conduct a survey of the resources available in or around the system that might be useful in creating the failure scenarios. From the resource checklist in Kaplan et al. (1999), we identify a number of new IEs, HES and mid states MSs: Resource type Substance resources Field resources Space resources Time resources Informal resources Functional resources Systemic resources Organizational resources Hazardous resources Resource Food Water Medicines Wind Sun Snow Mud Minor icefalls Glaciers Crevasses Mountain shape Cornices Available time during push to summit Time of oxygen available Time spent at campsite Temperature Air pressure Altitude Wind speed Snow depth Oxygen usage Climbing gear Season of the year Climbing partners Food poisoning Dangerous animals IE / HE /MS MS1. Food poisoning MS2. Running out of food MS3. Running out of water MS4. Bacterial infection from water MS5. Strong wind MS6. Strong sun MS7. Deep snow MS8. Snow cornices MS9. Heavy snowing reduce sight MS10. Deep mud before basecamp MS11. Calving of ice MS12. Crossing See snow MS13. Not reaching the top and back before dark MS14. Using oxygen for too long MS15. Spending too much time at campsite MS16. Low temperature MS17. Altitude sickness See wind See snow MS18. Using too much oxygen before push to summit MS19. Using to little oxygen MS20. Breaking of climbing gear See food MS21. Encountering dangerous animal We identify the following additional failure scenarios based on the list of resource above. Note that some additional uncategorized states are included to complete the scenarios. IE2 MS1 HES6 IE2 MS2 starving to death IE2 MS3 dying of thirst IE2 MS4 HES6 MS5 Freezing HES1 MS5 Freezing HES5 MS6 solar radiation Sunblind MS7 IE1 Exhaustion MS8 IE3 HES1 MS8 IE3 HES3 MS9 Reduce sight HES6 MS10 IE1 HES2 HES6 MS11 Hit by ice MS12 HES3 MS13 Get lost MS14 HES2 MS15 MS19 HES2 MS16 Freezing HES1 MS16 Freezing HES5 MS17 HES6 MS18 HES2 MS19 Altitude sickness MS20 HES3 MS20 HES6 MS21 Animal attack MS21 Poisoned 6 UTILIZING THE KNOWLEDGE BASE Going through the template in Kaplan et al. (1999) we utilize our knowledgebase. The following subsections explains the various checkpoints in the checklist. The checkpoints that do not induce any new events are left blank Typical weak and dangerous zones in the system MS22. We know that there are some particularly rocky places on the way to basecamp and that the climber might be hit by a falling rock. Typical functional failure MS23. We know that a typical functional failure is applying a used rope which may be worn out Typical Harmful impacts on systems (humans included) Typical lifecycle stages of technological systems Typical dangerous periods in the system functioning and evolution Typical sources of high danger Typical disturbances in flows of substance, energy and information MS24. Sudden shift in weather Which gives rise to the following new scenarios: MS22 death HES3 MS23 death MS24 Get lost MS24 HES6
7 INVENT NEW SOLUTIONS We wish to generate additional ways in which the already identified failures can occur. We apply the Algorithm for Inventive Problem Solving (ARIZ) for the applicable Harmful End states: ARIZ for HES1 Scenario: Freeze to death i. Secondary problem: Causing the climber to freeze to death ii. Ideal solution: Colder than first anticipated a. Little clothing b. Colder than weather forecast iii. Limitations to providing the ideal solution a. The climber is well prepared and bring enough clothes b. The weather forecast is very accurate iv. Solve this contradiction by the separation of time principle a. Clothing gets ripped earlier on the ascend b. Waiting on weather in camp where no weather forecasts are available. ARIZ for HES2: Scenario: Running out of oxygen during push to summit i. Secondary problem: Causing the climber to run out of oxygen ii. Ideal solution: Consuming more oxygen then available: a. More exhausting than assumed b. Waiting on weather may extend camp stay c. Bringing to little oxygen iii. Limitations to providing the ideal solution a. Is in overall good shape b. Climber to acclimatize c. Climber is well prepared iv. Solve this contradiction by the separation of time principle a. May have previously caught an illness, but continues the expedition b. While waiting in camp the climber will use more oxygen c. See a ARIZ for HES5: Scenario: Climber gets frostbite i. Secondary problem: Causing the climber get frostbite ii. Ideal solution: body parts exposed to cold: a. Insufficient clothing b. Colder weather than first anticipated iii. Limitations to providing the ideal solution Figure 1 Schematic version of the scenarios identified with AFD a. Well prepared, thus having sufficient clothing b. The weather forecast is very accurate iv. Solve this contradiction by the separation of time principle a. Clothing gets ripped earlier on the ascend b. Waiting on weather in camp where no weather forecasts are available. We thus have the following additional failure scenarios: Ripped clothing freezing HES1 WOW at camp MS15 unreliable weather forecast MS24 HES1 Caught an illness HES2 WOW at camp HES2 Ripped clothing freezing HES5 WOW at camp MS15 unreliable weather forecast MS24 HES5 8 INTENSIFY AND MASK HARMFUL EFFECTS We explore how to aggravate and intensify the possible harmful effects identified in previous steps. This is done by analysing the effect of keeping them hidden until they become appropriately sever. A template for this is provided in Kaplan et al. (1999). We do only do those which we do not consider worst case; hence we start with HES2 running out of air. If this where to happen. The climber may choose to carry on, thus intensifying the effect. Thus: HES2 Death
We continue with HES5 frostbite. If not reacting quickly on signs of frostbit it may in a worst-case scenario lead to severe gangrene followed by amputation of limb or death. Thus: HES5 Amputation HES5 Death 9 ANALYZING THE REVILED HARMFUL EF- FECTS We clean our scenarios and remove potential duplicates. Uncategorized scenarios are denoted U. Se e Appendix A for further details. We plot them to get a view of our scenarios: 10 ELIMINATION OF SCENARIOS. To keep the example to a reasonable length we leave the elimination part of the AFD method to the reader
2 INTEGRATED ANTICIPATORY FAILURE DETERMINATION APPROACH USING THE OSBORN PARNS PROBLEM SOLVING PROCESS 1. FORMULATING THE ORIGINAL PROBLEM A mountain is to be climbed. We wish to find all possible ways in which the climber may fail to reach the top. (the descent is ignored for the sake of simplicity). 3 IDENTIFY THE SUCCESS SCENARIO Climber to reach the top of the mountain unharmed, or in terms of desired sub goals: Phase Basecamp Icefall Summit Sub goal Reach Basecamp 1 unharmed and with all equipment Passing of icefall without accidents Reaching the top and take a picture 4 FORMULATION OF THE INVERTED PROB- LEM We switch our mindset in to wanting failures to occur by inverting the original problem. We now seek to create all possible ways in which the climber may fail to reach the top or one of the sub goals: We wish to create all possible ways in which the climber may fail to reach the top. 4. ALTERNATIVE CREATIVE METHOD In this Section, we generate possible failures that may cause the climber to fail. 4.1 Identify relevant data and attributes of the system. We go through the various stages of the climb and identify corresponding data. Carabiners Rope Ice screws Climbing harness Helmet Clothing Goggles (Dark + Clear) Shoes Tent Oxygen system Food supplies GPS Rocks Snow Data Storm Syntoms Summit Temperatures Terrain Training Water Weight Ascent Steapness Gloves Companions Other people Ice ax Snow bridge Powder Rain Wind Sun Mud Ice Icefall Rockfall Seracs Pressure Avalanche Snow cornices Glaciers Crevasses Day/Night Drugs Elevation Animals Climbing group Hace / fog Heights Hypothermia Lightning People Planning Plateus Crampons Medical kit Sun screen Travel to the mountain Ridge Route Security Shelter Shovel Sleep Altitude watch 4.2 Problem finding We identify the main obstacles to causing the climber to fail the attempt to reach the summit. The climber is well prepared The climber is in good shape Good nature conditions No equipment failures No unforeseen events 4.3 Generating solutions We exhaustively identify the solutions to the problem outlined above by using the data/attributes outlined in section 4.1. We start with the problem the climber is well prepared, and combine this with the data: Carabiners, rope, ice screws and so on until we have combined all the data/attributes with all the problems. We then use each combination as an inspiration for generating solutions (failures). This is typically done during one or more brainstorming sessions. The various solutions are regarded as failure scenarios. If no solution (failure scenario) to the combination of problem and data/attribute is identified we continue to the next combination. We identify IES s, MS s and HES s as well as uncategorized events which we simply denote U. For a complete list, see Appendix A. We identify the following scenarios: IE5 -> HES5 IE6 -> HES3 -> U9 IE7 -> HES5 IE8 -> HES3 IE9 -> HES5 IE10 -> HES3 IE11 -> HES6 IE12 -> HES3 IE13 -> MS25 -> HES6 MS25 -> U12 IE15 -> HES6 IE15 -> HES5 IE15 -> U3 -> U12 Scenarios HES7 -> HES6 HES7 -> U12 MS18 -> HES7 U18 -> MS33 -> U9 -> U12 IE28 -> U7 -> U6 -> U12 IE2 -> MS27 -> U7 MS27 -> IE19 -> HES7 IE29 -> U7 IE29 -> MS18 IE29 -> HES3 #Good Nature conditions MS7 -> IE3 -> U12 MS8 -> IE3
IE16 -> HES6 IE16 -> U5 -> HES6 IE17 -> HES2 -> U12 HES2 -> HES6 IE18 -> MS2 -> HES6 MS2 -> U12 IE19 -> HES2 -> U7 -> U9 HES2 -> MS17 -> U12 MS17 -> HES6 IE20 -> MS26 -> HES6 IE21 -> MS18 -> HES2 MS27 -> HES2 IE22 -> MS26 IE2 -> MS28 IE23 -> MS17 IE23 -> U16 IE24 -> U4 -> HES6 IE25 -> MS29 -> HES7 IE2 -> MS30 -> HES4 -> U12 MS30 -> HES3 -> U12 MS30 -> MS22 -> U12 MS30 -> MS10 -> U6 -> U2 #The climber is ingood shape IE2 -> U18 -> MS14 -> HES2 -> U12 HES2 -> HES6 HES2 -> MS17 MS7 -> IE1 -> HES2 IE1 -> MS18 -> HES2 IE26 -> IE1 MS31 -> IE1 MS32 -> IE1 IE1 -> U6 -> U12 IE1 -> HES7 IE27 -> HES7 MS9 -> IE3 IE30 -> HES3 IE30 -> HES4 IE31 -> MS22 IE31 -> MS10 -> HES8 -> U12 HES5 -> U19 -> U17 HES5 -> U12 IE32 -> U4 IE32 -> U5 MS31 -> IE33 -> U8 -> U12 U8 -> MS34 IE34 -> HES7 IE35 -> MS34 -> HES6 MS34 -> U12 MS16 -> HES1 MS16 -> HES5 #No equipment failures MS20 -> HES3 IE36 -> HES2 IE17 -> IE36 IE36 -> U9 #No Unforseen events IE37 -> IE36 IE39 -> U1 IE39 -> HES1 IE39 -> HES3 IE38 -> HES9 IE38 -> U12 MS26 -> MS35 -> HES4 MS35 -> MS36 MS35 -> MS34 MS36 -> HES7 MS36 -> U3 5 ANALYZING THE REVILED HARMFUL EF- FECTS We clean our scenarios and remove potential duplicates. We plot them to get a view of our scenarios: 5. INTENSIFY AND MASK HARMFUL EF- FECTS We explore how to aggravate and intensify the possible harmful effects identified in previous steps. This is done by analysing the effect of keeping them hidden until they become appropriately sever. This as in Appendix 1. Figure 2 Schematic version of the scenarios identified with th Osborn Parns based AFD. 6 ELIMINATION OF SCENARIOS. To keep the example to a reasonable length we leave the elimination part of the integrated AFD method to the reader
States A.1 Initiating events Tables: Events and N IE 1 Not enough stamina 2 Poor preparation 3 Avalanches 4 Slipping 5 Forgetting carabiner 6 Buying carabiner from unqualified source 7 Forgetting rope 8 Buying rope from unqualified source 9 Forgetting icescrews 10 Buying ice screws from unqualified source 11 Forgetting climbing harness 12 Buying climbing harness from unqualified source 13 Forgetting helmet 14 Buying helmet from unqualified source 15 Forgetting vital clothing 16 Forgetting googles 17 Buying oxygen system fromcunqualified source 18 Not enough food 19 Not arrange for aclimatization 20 Not knowing the rest of the climbing group beforehand 21 Bringing to much weight 22 Not being mentally prepared 23 Not bringing sufficent medical supplies 24 Not bringing sun screen 25 Forgetting Visa passports etc 26 Heavy wind 27 Lower pressure 28 Haze / fog 29 To heavy climber 30 Snowbridge 31 Heavy rain 32 Strong Sun 33 Seracs 34 Elevation 35 Lightning 36 Breaking of support systems (Air, tent, GPS) 37 Sabbotage 38 Terror 39 Steeling of supplies A.3 Harmful endstates N HES 1 Freeze to death 2 Running out of oxygen 3 Falling 4 Caught in crevasse 5 Frostbite 6 Abort climb 7 Altitude sickness 8 Mudslide 9 Captivity A.4 Uncategorized N U 1 Starving to death 2 Dying of thirst 3 Freezing 4 Solar radiation 5 Sunblind 6 Exhaustion 7 Reduce sight 8 Hit by ice 9 Get lost 10 Poisoned 11 Animal attack 12 Death 13 Ripped clothing 14 WOW at camp 15 Unreliable weather forcast 16 Caught an illness 17 Amputation 18 Bad shape 19 Gangerene A.2 Mid states N MS 1 Food poisoning 2 Running out of food 3 Running out of water 4 Bacterial infection from water 5 Strong wind 6 Strong sun 7 Deep snow 8 Snow cornices 9 Heavy snowing 10 Deep mud before basecamp 11 Calving of ice 12 Crossing crevasse 13 Not reaching top before dark 14 Using oxygen for too long 15 Spending too much time at basecamp 16 Low temperature 17 Altitude sickness 18 Using too much oxygen before push to summit 19 Using too little oxygen 20 Breaking of climbing gear 21 Encountering a dangerous animal 22 Falling rocks 23 Worn out rope 24 Sudden shift in weather 25 Not withstanding damage to head 26 Reduced motivation 27 Ascending too fast 28 Unqualified Companions 29 Not able to enter region 30 Climbing a dangerous root 31 Crossing of icefall 32 Crossng rockfall 33 Left by climbing group 34 Seriously harmed 35 Human mistakes 36 Not turning back
7. REFERENCES Jensen, A. & Aven, T. 2015. Hazard/threat identification using different creative methods to support the Anticipatory Failure Determination approach. ESREL. Switzerland. Kaplan, S., Visnepolschi, S., Zlotin, B. & Zusman, A. 1999. New Tools for Failure and Risk Analysis - Anticipatory Failure Determinatio (AFD) and the Theory of Scenario Structuring IDEATION INTERNATIONAL.