Contract J0225005 

Battelle, Pacific Northwest Laboratories 

Bureau of Mines Open File Report 195(2)-83 

BUREAU OF MINES 

UNITED STATES DEPARTMENT OF THE INTERIOR 

RlPRODUCfD BY 

NATIONAL TECHNICAL 

INFORMATION SERVICE 

US DtPARTMfNl Of COMMtRCf 

SPRINCfIELD VA 22161 
LEGAL NOTICE 

This report was prepared by Battelle as an account of sponsored 

research activities. Keither Sponsor nor Battelle nor any person acting 

on behalf of either: 

MAKES ANY WARRANTY OR REPRESENTATION, EXPRESS OR 

IMPLIED, with respect to the accuracy, completeness, or useiulness of 

the ~nformat~on conta~ned in this report, or that the use of any ~nformarlon, appara:us, process, or composition disclosed in thls report 

may nor infr~nge pr~katelv owned rights; or 

.Assumes any liabilities wi~h respect to the use of, or for damages 

resulring from the use of, any information, apparatus, grocess, or 

compos~rion disc!osed in rhis report. 

DISCLAIMER 

The vtews and conclusions contained in this document 

are those of the authors andshould not be interpretedas 

necessarily representing the official policies or recommendations of the Interior Department's Bureau of 

Mines or of the U.S. Government. 
+-R'T WJMUTAl'lOH -= * a -8-h 

PAGL BuHines oh 195(2)-83 8 & 

rn# 

~vaEaWn of Safety Assessment ~ethods for the Mining &-m 

May 1983 Industry. Volume XI. User's Manual of Safet,y Assessment 

Methods for Mine Safety Officials 

7. lrB.rw 

P. M. Daling and C. A. Geffen 

*~orprr~t.(~rrcem.cl~drrr 

Battelle, Pacific Ncrthwest Laboratories 

P.O. Box 999 

Richland, WA 99352 . 

Yud 

%-oms tant ~xtor--Minin~ Research 

Bureau of Mines 

U.S. Department of the Interior 

Washin~ton. DC 20241 

Contract research; 

8/24/82-05/24/83 

I '-- 

Approved for release October 15, 1983. 

The objectives of this study were to examine a representative cross section 

of formal safety analysis techniques developed for the nuclear and aerospace 

industries, to recommend those methods that would be suitable for application to 

the mining industry, and to include those methods in a user's manual. Volume XI 

of this report, the user's manual, describes several methods that were determined 

to be immediately transferrable to the mining industry. The handbook gives 

detailed instructions on appropriate application and utilization of the methods. 

Other techniques will require further development before they can be effectively 

transferred to the mining industry. 

. 

Accident investigation Failure modes and effects analysis 

Safety analysis for mining applications Human reliability 

Preliminary hazards analysis Computer application 

Unclassified Release unlimited by NTIS. 

1.'CncW 

Unclassified t. 1 

Or- 1.a- anorWrroUirrlcrn -- 

Preceding page # blank 
FOREWORD 

This report was prepared by B a t t e l l e , Pacific Northwest Laboratories in 

Richland, Washington, under USRM contract number J0225005. The contract was 

initiated under the Minerals Health and Safety Technology Program. It was 

administered under the technical direction of the Spokane Research Center with 

Mr. John C. Kerkering acting as Technical Project Officer. Mr. R. J. Simonich 

was the contract administrator for the Bureau of Mines. This report, in two 

volumes, is a summary of the work recently completed as part of this contract 

during the period September 1982 to March 1983. This final report was 

submitted by the authors in May 1983. 
TABLE OF CONTENTS 

FOREWORD . . . . . . . . . . . . . 

PRELJMINARY HAZARDS ANALYSIS 

Analysis Procedure . . . . . . . . . Advantages and Disadvantages . . . . . Example of Analysis Procedure . . . . . Computer Adaptability . . . . . . . . Estimated Costs of Implementation . . . . FAILURE MODES AND EFFECTS ANALYSIS 

AnalysisProcedure. . . . . . . . . . . . . . . . AdvantagesandDisadvantages . . . . . . . . . . . . Example of Analysis Procedure . . . . . . . . . . . . Computer Adaptability. . . . . . . . . . . . . . . Estimated Costs of Implementation . . . . . . . . . . . BINARY MATRICES . . . . . . . . . . . . . . . . . . CONSEQUENCEANALYSIS . . . . . . . . . . . . . . . . 

MANAGEMENT OVERSIGHT AND RISK TREE (MORT) ANALYSIS . . . . . . Analysis Procedure . . . . . . . . . . . . . . . . AdvantagesandDisadvantages . . . . . . . . . . . . ExampleofAnalysisProcedure . . . . . . . . . . . . ComputerAdaptability. . . . . . . . . . . . . . . Estimated Costs of Implementation . . . . . . . . . . . HUMAN-RELIABILITY ANALYSIS 

Analysis Procedure . . . . . . . . . . . . . . . . STEP 1 - Describe the System Goals and Functions . . . . . STEP 2 - Describe the Situational Characteristics . . . . STEP 3 - Describe the Characteristics of the Personnel . . STEP 4 - Describe the Jobs and Tasks that the Personnel 

Perform. . . . . . . . . . . . . . . STEP 5 - Analyze the Jobs and Tasks to Identify Error-Likely 

Situations (ELSs) and Other Problems . . . . . STEP 6 - Suggest Changes to the System . . . . . . . AdvantagesandDisadvantages . . . . . . . . . . . . Example of Analysis Procedure . . . . . . . . . . . . ComputerAdaptability. . . . . . . . . . . . . . . EstimatedCostsof Implementation. . . . . . . . . . . REFERENCES. a.0 
TABLES 

1 . Cross-reference of recommended safety analysis methods. their 

applications. and expected results .......... 2 . Preliminary hazards analysis format .......eee. 

3 . Checklistsof potential hazards ........... 4 . Categories for ranking the severity of hazards ...... 5 . Step-by-step procedure for performing a prel iminary hazards 

analysis ................... 6 . Example page from a completed preliminary hazards analysis . . 7 . Conceptual input format for a computerized. user-interactive PHA 

8 . Recommended format for guiding and becording a failure modes and 

effects analysis ................ 9 . Listing of potential component failure modes ....... 1 . Categories for ranking the severity or "criticality" of potential 

accidents .................. 11 . Step-by-step procedure for performing a failure modes and 

effects analysis ................ 12 . Example page from a completed failure modes and effects analysis 

13 Example . entries on the critical items list ....... 14 . Binary matrix for two linked flow systems with common power . . 15 . Four-category qual itati ve classification scheme for consequence 

analysis ................... 16 . Expanded four-category qualitative classification scheme for 

consequence analysis ............... 17 . Listing of MORT analysis-related documents pub1 ished by the 

System Safety Development Center (SSDC) ........ 18 . Energy forms present at typical mining sites ....... 19 Examples . of energy barriers at typical mining sites .... 20 . Step-by-step procedure for performing a MORT analysis .... 21 . MORT logic for muck bucket falls to bottom of shaft while 

hoistingpersonnel: examplesheet .......... 
22 . Check1 ist of factors that shape human performance . 77 

23 . Recommended task analysis format for performing an HRA . 80 

24 . A checklist for evaluating task error-likeliness . 83 

25 . Examples of performance shaping factors that could cause 

a roof bolting machine operator to omit a methane check ... 86 

26 . Exampleofacompletetaskanalysisform ........ 88 
FIGURES 

Mine hoisting system used in example problem . . . . . . . 1.9 

Conceptual flow chart for a computerized PHA . . . . . . . 24 

Block diagram of an example mine ventilation system . . . . . 34 

Conceptual flow chart for a computerized FMEA . . . . . . . 39 

Sampleflowcircuitwithcommonpower (IP). . . . . . . . 44 

Logic symbols used in constructing MORT-type analytical trees . 55 

Event symbols and abbreviations used in constructing MORT-type 

analytical trees . . . . . . . . . . . . . . . . . 57 

Structure of the MORT-type analytical tree . . . . . . . . 59 

General structure of the MORT diagram for the example problem . . 64 

Example branch from the MORT diagram for the example problem . . 65 

Conceptual flow chart for a computerized MORT analysis . . . . 69 

Conceptual computer display for the MORT analysis procedure . . 70 

Summary analysis procedure for the qualitative portion of a 

human reliability analysis . . . . . . . . . . . . . . 75 

Link analysis flow diagram for the roof bolting operation . . . 85 

Conceptual flow chart for a computerized HRA . . . . . . . . 93 
INTRODUCTION 

This user's manual was prepared as part of a study performed at Battelle 

Northwest Laboratory for the U.S. Bureau of Mines under contract No. 30225005. 

The overall objective of this study was to evaluate formal safety assesssment 

methods utilized in the nuclear and aerospace industries to determine the most 

useful and effective methods for technology transfer to the mining industry. 

Each method was evaluated relative to the safety interests, needs, and 

requirements of mine safety officials. This information was obtained through 

telephone and personal interviews with mine safety personnel and a tour of an 

operating underground mi nee Results of the interviews were utilized to develop 

evaluation criteria in areas including the complexity of the methods, data and 

resources avai lable at mines to perform the analyses, training and educational 

requi rements for performing the analyses, responsi veness to mine operator 

safety needs, and cost-effectiveness. The evaluation criteria were used to 

examine and select formal system safety assessment methods that are most 

suitable for transfer to the mining industry at this time. 

The objective of this user's manual is to present the safety techniques 

selected for direct application to the mining industry in a self-teaching 

workbook format for use by mine safety officials. The results of the 

interviews with mine safety officials and the evaluation of the various methods 

considered are contained in a separate report prepared for this project. This 

user's manual contains information relating to only those methods recomnended 

for use at this time in the mining industry. Additional methods may be useful 

in the future as mine safety personnel gain more expertise and experience in 

implementing formal safety analysi s technology. These methods are described in 

the project final report. 

Sections in this manual are provided for each of the recommended safety 

analysis methods. Each section contains a general description of the method, a 

detai led discussion of the analysis procedure, advantages and disadvantages of 

the method, an example problem to illustrate the analysis procedure, and an 

estimate of the costs required to perform the analysis. 

A further objective of this study was to evaluate the adaptability of the 

recommended methods to a user-interactive computer system. A computerized 

safety analysis program could benefit the mining industry by increasing the 

efficiency of mine safety officials, increasing the comprehensiveness of the 

analysis without large increases in costs, and reducing the amount of time 

required to perform and update the analysis. Conceptual computer flowcharts 

were developed for each recommended method and are described in each section. 

The safety assessment methods described in this user's manual are 

applicable to many different mining situations and conditions. Each method 

contains features that make it more appropriate than others for analyzing 

certain situations. For example, one selected method is human re1 iabi 1 i ty 

analysis (HRA). As its name implies, HRA is used primarily to examine the 

human element of a system to identify the potential causes of human performance 

errors. This analysis may focus on improving procedures or on a better design 

of the man-machine interface systems. A second selected technique is called 
Management Oversight and Risk Tree (MORT) Analysis. MORT is a total safety 

program concept that focuses on programmatic control of industrial safety 

hazards. It is designed to evaluate the interactions of the complex managementworker-machine system to determine the causes of the contri b u t i n g f a c t o r s to 

potential accidents. Although MORT was originally designed as an accident 

investigation tool, it has also found wide application in the development and 

evaluation of system safety programs and procedures. 

The selection of a particular safety assessment method should consider 

what kinds of mining situations are to be analyzed and what results are 

required from the analysis. Table 1 contains a listing of the recomnended 

safety analysis methods in this user's manual, the applications each method is 

best designed to examine, and the expected results of the analysis methods. 

The reader is urged to consult this table for the purposes of choosing the most 

useful and appropriate system safety analysis method for specific applications. 

It should be noted that the method descriptions provided in this user's 

manual are in some cases not sufficient for mine safety officials to perform 

the analyses without further information. MORT analysis and human re1 iabi lity 

analysis techniques are complex and require significantly more information to 

perform them adequately than thi s document can provide. Therefore, the 

descriptions of these methods are 1 imi ted to introductory-level tutorial -type 

information. The detai 1s of the techniques fill entire textbooks and cannot be 

repeated in full here. If the reader wishes further information regarding 

these methods, appropriate references to documents and short -courses are 

provided. These methods contain many subtle items and minute details that are 

described and discussed to a great extent in the reference documents and shortcourses. A thorough understanding of these details is required to perform 

these methods effectively and adequately. The information presented in this 

user's manual for MORT and human reliability analysis is intended to summarize 

the most important aspects of the method and prompt the reader to obtain 

further information. The descriptions of preliminary hazards analysis, failure 

modes and effects analysi s, binary matrices, and consequence analysis are 

sufficient for the analyst to use in performing the analyses. 

One further point that should be emphasized before the methods are 

presented and discussed is that the methods are tools that help the analyst 

to organize a safety analysis. The tools are used to make a good safety 

official better by enhancing the completeness of the safety program and 

focusing further safety considerations on important areas. The safety program 

still requires a dedicated and knowledgeable analyst for it to be implemented 

successfully. Use of the methods will make the safety program more structured 

and thus, there will be less chance of omitting important safety concerns. 
TABLE 1. - Cross-reference of recommended safety analysis methods, thei r 

applications and expected results 

SAFETY 

ASSCGSPWNT 

NETllOD SUGGESTED APPLICATIONS EXPECTED RESlJLTS 

Prelirinary llazards . Appl lcable to all types of nines and all mining sltua- , Tabular compllatlon of hazards, potentlal accidents, 

Analysis tlons. effects, and exlsting and/or potentlal preventlve or correct lve measures. 

. Inexpensive but comprehensive analysls. 

. Checkl 1st or hazardous condl tlons. 

. Identlflcatlon of hazardous condltlons. potentlal 

accidents and resultlng effects on plant personnel and . Identlflcatlon of ways to reduce occurrence of severe property. accidents with less mpliasls on nltlgatlon of alnor 

accldents. . Useful for identifying broad areas or functions 

requiring accident prevent ion or mi t lgat ion masures. 

Failure llodes and . Applicable to all types of nlnes and all mlt~lng , Tabular c~llatlon of the causes of equipment malEtfects Analysis si tuatlons. functions and their resultlng effects on the system C, 

C, . Ilardriare- and equlpulrnt-oriented approacli. . Checklist of critical Items whose fallure wlll produce hazardous condltlons. . Identifies effects of potentlal equipment malfunctlons 

oti the operation of tlie systm and safety of personnel. . Identlflcatlon of ways to reduce occurrence of accldents caused bJt equipment malfunctlons. . Useful for Identifying Jetalled design areas requlrlng 

accident prevention or mitigation measures. 

Consequence Analysls . Applicable to all types of nlnes and all mlnlng sltua- . Estimated severlty of potentlal accldents. 

tlons. 

Estimates sever1 ty of accldents , Could be qualltatlve or quantltatlve. 

. Requires other type of analysls to Identify potentlal 

accident sequences. 
Bi~~ary Matrices 

MORT Analysis 

Human Reliabilit
PRELIMINARY HAZARDS ANALYSIS 

Preliminary hazards analysis (PHA) is a useful safety assessment method in 

which potential hazards inherent in a system and their effects are evaluated. 

PHA is a broad, all-encompassing study, usually performed early in the design 

stages of faci 1 ities to identify hazards before construction is started, thereby allowing changes for improved safety at relatively low cost before the 

system or component has been completed or installed. However, PHA can be 

performed at any time and is a particularly useful tool for identifying areas 

of concern for a safety program. A major goal of PHA in this application is to 

prevent accidents that have occurred in identical or simi lar systems. 

The objectives of a PHA are to identify the potential hazardous conditions 

in a system and evaluate the significance of potential accidents. From the 

information developed during a PHA, design and procedural safety requirements 

can be established that will help prevent or control these hazardous 

conditions. Performance of a PHA on an operating mining system would help the 

mine safety officials to foresee hardware, procedur.al , and system interface 

problem areas. Results of a PHA can also help to identify areas that need 

further analysis and point out ways in which to mitigate hazardous conditions, 

thereby improving operations. 

Anal vsi s Procedure 

The procedure for performing a preliminary hazards analysis is described 

in this section. The reader should recognize that the first step in performing 

a PHA, or any other safety technique, is to obtain a thorough working knowledge 

of the system under analysis. It is useful to break the system down into major 

subsystems or functions. Functional diagrams can be drawn that show the 

process flow of materials. For example, ore haulage at some mines consists of 

the following sequence of operations: (1) load ore into shuttle car, (2) move 

the shuttle car to dumping station, (3) dump ore into ore chute leading to 

hoisting bucket, (4) hoist bucket to surface, (5) dump ore into surface 

conveyor belt, and (6) move ore to mill or rail car loading station. 

Functional diagrams also show the interfaces between elements of a system. It 

is also useful to prepare narrative descriptions of the functions and 

operations of a1 1 subsystems and components. Interfaces with other subsystems 

and components should be clearly defined. Often, the process of going through 

these two system description exercises helps to identify potential safety 

problem areas. 

The second step in the analysis procedure is to select the format for the 

analysis. A common format for a PHA is a columnar form with specific entries 

that reflect the information determined from each step of the analysis. This 

type of format is used because it allows a way to search and.record specific 

information regarding the system and is also a checklist that guides and 

simplifies the analysis process. Information in a tabular format is easily 

retrievable once it has been recorded. This makes it simple to search for 

specific areas to record additional or updated information as it becomes 

available. Table 2 contains an example format for a PHA. Instructions given 

on Table 2 are intended to describe the information required in each column. 

There have been many PHA formats used in the past; some have as few as four 
TABLE 2. - Preliminary hazards analysis format 

- 

pat: u~r~i Iviicoicik&-- 

MEASURES - ---- 

lhls colun Ilstr 

exlsting pnventlveorc~tml 

sasures that 

mltlpte ldentlf led hazardous 

condl t Ions and/or 

polentlal acclQnts. It my 

also be used for 

rrcou~ndlng 

wasures tor 

mltlgatlan. 

llelght of operator's 

cab. as well as shielding. should 

9 rotect afety glasses operators. 

should be worn. 

Hachlnery Is dsslgd 

to wl thsland 

lrpact fmw 

fragunts . 

- - - - - - -- - 

POIEMTIM 

IAZARMUS CONDJTI(W --- -- -. - - 

Ihls coltrn 

IJentlfles 

hdzardouscwidltlons that could 

result frov the 

Interact lo11 of 

tire systew and 

each hazardnus 

elew~tt 111 the 

sy s ter 

Flylng luck 

fragments 

COIIWEWT - - ----- 

fhls colum JItrtlfles 

tlte Itarbtare or 

functlunal eleur~ct 

klny d~ialyzed 

Uwdklnc~ rock 

-- EFFECT --- 

Ihls colun ldentlflrs the posslble 

tffectsofthe 

potentla) accldent. should It 

occuc 

Injury; possible 

mchlnt Lmge 

- 

EVENCUI a 

- 

POTENTIAL ACCIDfNT -- ---- -- 

Ihls colmt 

ldentlfles undeslredeventsor 

faults that could cause the hazardous condl t ion 

to be transfonred 

into the lhntlfled pote~~tlrl 

accident 

Operator donnliole 

-- POIEMT~AI --- -- - -- 

ACCIDENT 

Ihls colun lLnti flus potentlal 

accldentsthat 

could result fmm 

the lkntlfled 

hazardous 

condl tlons 

Operator hl t by 

flylng rock 

f raylae~tts 

M~AR~S 

ELEIYHT 

TJtls colun 

lclentlfles 

hazardous 

elene~tts 

present In 

the harkrre or functlon 

Rock 

-- EVENT crrldin~ 

IIAZARWUS COHDITIW - -- ---- --- 

lhls colmm ldmtlfies condltlons. 

undeslredevents. 

or faults that 

could cause the 

hazardous e leaaent 

to be transformd 

Into tha ldentlfled 

hazardous condltlon 

lrpact hwmr 

fracturing rock 

- 
columns and others have up to ten columns or more. It is believed that use of 

the 8-column format shown in Table 2 is a good trade-off between possibly 

oversimplifying the analysis (and therefore omitting some detail ) and including 

such a great amount of detail that the results are difficult to locate. 

Setting up the format for the analysis can be facilitated by breaking the 

overall system down into subsystems as was described previously. The analysis 

format can also follow this subdivision. In other words, the analyst breaks 

the mining system down into subsystems, such as ventilation, hoisting, ore 

haulage, railcar loading, etc., and examines each subsystem one at a time. It 

is useful to identify each component of each subsystem and address the 

hazardous conditions associated with them, no matter how unlikely or minor they 

appear. This is to ensure that the analyst thoroughly examines each situation 

and so is less likely to overlook some hidden interaction or hazard. 

The next step is to begin analyzing the mining system one item at a time. 

The analyst begins by i d e n t i f y i n g p o t e n t i a l l y hazardous elements or components 

in the system. Hazardous elements are defined as any item or function which 

threatens something of value. The key idea is that something is at risk when 

the hazardous element is within the system. This something may be personnel, 

operating costs, property, production schedules, etc., although the method is 

usually used for determining the potential for injury to persons or damage to 

property. Hazardous elements are often categorized as either hazardous energy 

sources or hazardous processes and events, as shown in the checklist in Table 3 

(Lambert 1975, Hammer 1972). Hazardous energy sources are hazardous by 

themselves when released in a system; i .e., the flow of energy from these 

sources causes personnel injury and property damage. Hazardous processes and 

events are either physical or chemical processes that produce hazardous 

conditions when they interact with the system. The checklists shown in Table 3 

are useful tools for the' identification of the basic hazards that may be 

associated with a mining system. 

The next step in the PHA procedure is to identify events that could 

possibly transform the hazardous elements into potential accidents. These 

events are called "triggering events" or "causative factors" and can be 

conditions, undesired events, or faults within the system. For example, a 

spill of a flammable liquid such as diesel fuel oil does not cause a fire by 

itself. However, if an ignition source is present, such as a bare electrical 

wire, a spark can trigger the potential fire accident. Triggering events are 

important factors in a PHA. Experience in the aerospace and nuclear industries 

has shown that accidents often do not have a single random event as their 

cause, but are the result of a sequence of events which together generate the 

potential accident. This general principle also applies to accidents in the 

mining industry. 

The framework for PHA often includes some evaluation of the importance of 

each hazard. This is commonly done by ranking hazards according to their 

effects. Hazards are categorized by some ranking scheme that considers the 

magnitude of the potential accidents. Many ranking schemes have been used in 

the past. Some were developed for a specific system and are not directly 

applicable to mining. One that is simple but still provides flexibility and is 
TABLE 3. - Checklists of potential hazards 

HAZARDOUS ENERGY SOURCES 

Fuel s 

Explosive Charges 

Charged electrical capacitors 

Storage batteries 

Pressure containers 

Spring-1 oaded devi ces 

Suspension systems 

Mechanical equipment 

Mine Gases 

Electrical generators 

Radioactive energy sources 

Falling objects 

Heating devices 

Pumps, blowers, fans 

Rotating machinery 

Impacting machinery 

HAZARDOUS PROCESSES AND EVENTS 

Acceleration 

Conveying 

Corrosion 

Electrical 

shock 

thermal 

inadvertent activation 

power source fai lure 

electromagnetic radiation 

Explosion 

Fire 

Heat and temperature 

high temperature 

1 ow temperature 

temperature variations 

Drilling 

Excavation 

Moisture - hi gh humidity 

Vibration 

Oxidation 

Pressure 

hi gh pressure 

1 ow pressure 

rapidly changing pressure 

Radiation 

thermal 

electromagneti c 

ionizing 

ultraviolet 

Mechanical shock 

Chemi cal rep1 acement , etc. 

Hoisting (kinetic energy) 

Cl imbi ng 

useful for the mining industry is shown in Table 4. It is difficult to 

distinguish between some of the categories shown on this table. The boundaries 

between the categories are not well defined. Thus, which category a particular 

hazard is placed in depends upon the interpretation of the analyst. The hazard 

ranking is placed in the column labeled "effect." 

The next step in the PHA is to determine what accident prevention measures 

are present, whether preventive measures should be taken, and what preventive 

measures could be or should be used. The ranking scheme described above shows 

which hazards and potential accidents should be receiving preventive or 

corrective action. If no preventive measures are provided for a Class 111 or 

Class IV hazard, the analyst must decide on the measures to be taken. Two 

courses of action are available (Lambert 1975) : (1) corrective action, which 
Advantages and Disadvantaqes 

PHA has the advantage that it is a very simple safety assessment method 

that qualitatively considers all aspects of a system. Almost anyone with a 

detailed knowledge of the system being analyzed can perform a thorough, 

comprehensive PHA. The PHA technique is relatively cost-effective in that it 

is not a time-consuming approach. A further advantage is that PHA results in 

an easy-to-read, highly visible record of the analysis. 

The greatest disadvantage of a PHA using a columnar format is that the 

analyst may fall into what is called a "form-filling mode." This is where the 

analyst is simply filling out a form. There are many subtle items and minute 

details that are important to the system operations that will be missed if the 

analyst is performing a PHA in this manner. The analyst is cautioned to 

thoroughly examine each entry on the PHA table in order to consider these 

details. A further disadvantage of PHA is that it is not quantitative. For 

example, the analyst will not be able to distinguish bzeen accidents that 

cause one death or multiple deaths and frequent or infrequent accident 

occurrence rates from information on the PHA table. 
TABLE 5. - Step-by-step procedure for performing a 

preliminary hazards analysis 

Step 1: Obtain an adequate working knowledge of the- system. 

Step 2: Set up the PHA format: Dividing the large system into subsystems, 

such as the ventilation system, hoisting system, etc., is helpful. 

List the components and equipment in each subsystem. 

Step 3: Identify potentially hazardous elements or components in the 

system: The analyst will find that checklists are a useful tool, 

Step 4: Select a particular subsystem. 

Step 5: Identify triggering events or causative factors that could 

transform the hazardous elements into potential accidents. Begin 

with a particular component of the subsystem, analyze all hazardous 

elements associated with that component, and identify the triggering 

events, Record on PHA table. 

Step 6: Evaluate "criticality" of potential accident sequences identified 

in Step 5. In other words, rank the hazards into the categories 

shown in Table 4. Record rankings on PHA table under "effect", 

Step 7: Determine preventive or corrective measures that are present and 

further measures that could or should be taken. Record these 

measures on the PHA table. 

Step 8: Repeat steps 5, 6, and 7 for each component and hazardous element 

in the subsystem. The analyst should complete the examination of a 

particular component before continuing to the next. 

Step 9: Select a second subsystem and repeat the analysis procedure, Steps 

9 6, /, 8. 

Step 10: Use the results to recommend design and procedural safety changes 

that can reduce accidents, i n-juries, and property damase. 

Example of Analysis Procedure 

Let us now consider an example to illustrate the procedure and results of 

a PHA. The example system used here is a mine hoisting system for haulage of 

men (see Figure 1). This example assumes that the hoisting system is being 

used during shaft sinking operations. The analyst first proceeds to list the 

subsystems and components that are required for the hoisting system to 

function. In this case, the component list includes such items as the bucket, 

wire rope, headframe, sheaves, hoist, shaft collar doors, and the control 

subsystem. Once all of the components have been identified, the analyst 

consults the hazardous element checklist (see Table 3) to identify the 

hazardous elements associated with each component. For example, the bucket is 

a moving object; thus kinetic energy is one hazardous element. The bucket is 

also used to convey heavy objects that may fall out of the bucket. The 

hazardous element in this instance is potential energy. It is recomnended that 

the analyst praceed to examine every column of the PHA one component at a 

time. In this manner, the analyst does not have to switch his/her thinking 

about a specific hazard to go on to the next component, thereby increasing the 

chances of omitting some details. In other words, the PHA form should be 

filled from left to right rather than from top to bottom. 

The next step i s t o consider the hazardous condition and the events which 

could cause the hazardous condition. For the personnel bucket, lowering and 

raising the bucket is an event that could cause a hazardous condition only if 

personnel are waiting for the bucket (i.e., in the energy path). If property 

damage was of concern, items of interest in the path of the bucket could be a 

potentially hazardous condition but does not become one unless the bucket is 

moving. Continuing across the PHA table (see Table Z), the next two columns 

are for the potential accident and the event that could cause the potential 

accident. The event causing the potential accident is one which is required to 

transform the hazardous condition into an accident. For the above hazardous 

condition of people in the path of the bucket, and the bucket moving, the 

potential accident is one where the bucket strikes personnel, caused by 

personnel near the travel path of the bucket being unaware of an approaching 

bucket. This information is recorded in appropriate columns of the PHA table. 

The analyst's next step is to examine the final two columns of the PHA 

table, effects and preventi ve/correcti ve measures of the same potential 

accident. Potential effects, in this case serious injury, are recorded in the 

former column. The latter column lists existing preventive or corrective 

measures that mi ti gate the potenti a1 hazardous conditions and/or potenti a1 

accidents. In the example case, warning lights are provided that warn people 

of the approaching bucket. This column can also be used for recomnending 

alternati ve or additional preventi ve/correcti ve measures. 

The analyst continues systematically examining every hazardous element of 

every component under consideration. The result is a tabular listing of 

potential accidents and their effects, such as the example PHA shown in 

Table 6. The goal of this type of analysis is to identify the potential 

accidents which could cause serious personnel injury or death and with this 

information, eliminate or miti gate the hazard through training, safe operating 

procedures, safety equipment, desi gn changes, or whatever means are practical . Mine safety officials, if they had the results of such an analysis, would be 

equipped with enough safety information and a general knowledge of the costs 

for improving safety in specific areas that they would be able to evaluate the 

costs and benefits of a particular safety feature. If the analyst wishes, cost 

information could be included in the column for corrective and preventive 

measures. One of the advantages of a PHA is that it does not involve complex 

mathematics or statistics and therefore can be performed adequately by the 

people who know the most about their specific mine, the safety officials, 
TABLE 6. - Example page from a completed preliminary hazards 

Buc ktl t 

Shaft collar 

br s Electrlcal 

51 1.u~ tora 1 

failure 

(.url.us lua 

Pc~wrrr source failure 

Personnel waiting Personnel blear trafor bucket vel path of bucket unaware of veblc le 

approach 

Bucket lorded a) Palh of the 

Lucket obstructe 

b) Bucket overloaL 

I Ooors fall to open a) Bucket (lorded) I caring up 

b) Bucket (lwded) 

going dorm 

Hedkel~ed rofw Loaded bucket I 

Ueahelud rqw I Loaded bucket 

b1g11 slrrface fray Lorded bucket 

or pinches rope 1 

analysis 

-7n~ihi ihi P~TiTiif iv2flctiiTC 

ACC l DENT - -- -- ------ EFFECT AASURES 

Personnel struck 

C---l-- 

by 

tho bucket 

hket tilts; wn fall fraa bucket 

Serious Injury Approach warnlng 

lights 

Injury/deathto 

personm 1 

I 

I 

Coll lsion of bucket Personnel injury/ --- with door/rope death 

failure I I 

Fewpercelved 

obstacles In 

pathway; bucket 

us1 tilt in excess of 60' 

to splll passeaRope falls 

Collision of bucket ILulses to personnel Top lander Is 

wlth door I I observing operation - can warn 

Rope falls; bucket InJury/dortb to Factors of safetJ 

and personnel fall personnel; equip- load llmlt 

1 I aeo t davge I 

InJury/daath to 

personnel 

ROW fails 

1 

gers. 

Lid ted cargo 

space; rope 

safety factors. 

Injury/death to Daily inspection/ 

personnel I ma lnte~nco. Test 

run at shift start 
without a great deal of special training. Furthermore, PHA is a comprehensive 

analysis that can be applied to all parts of a mining system in regard t o a l l 

kinds of hazardous conditions. 

It is believed that PHA is adaptable to a computer system. With today's 

relatively compact computer systems, a computerized PHA would, at the very 

least, increase the efficiency of the time safety officials spend at their 

desks. Moreover, with increased efficiency at their desks, the safety staff 

would be free to devote more time to correcting and preventing hazardous 

conditions at the mine. According to mine safety officials, computers are 

currently being used at mines for such purposes as long-term mine planning, 

maintenance planning, accounting, and warehousing. More extensive use of 

computers i s being planned for the coming years. Therefore, enough computer 

operating and programming capability is in use at mines today to recommend that 

the computerized safety analysis be considered. 

The authors were not able to identify any computer programs which have 

been written for PHA. A conceptual computer flowchart is described here for 

i 1 lustration purposes. More research is required for the development of this 

program. 

As currently envisioned, the conceptual PHA computer program consists of 

two parts. The first part is the actual performance of a PHA on a computer and 

the second part is the use and updating of the results. The first part is a 

user-interacti ve scheme where the computer displays questions in their proper 

sequence corresponding to the labels of the columns of the PHA table. In 

addition to inputting the hazard information into the computer memory, the 

analyst is to index each component and some descriptive information (such as 

work environment, location, size, weight, etc.). The indexing scheme will be 

used in the second part of the PHA computer program. 

Table 7 shows an example that illustrates how this process would work. 

The computer asks the analyst to input the name of the mine subsystem being 

analyzed (such as ventilation system, hoisting system, etc.), the component, 

component index number, and any important characteristics. Next, the computer 

asks the analyst t o l i s t the hazardous elements associated with the component 

being examined. The check list of hazardous elements (Table 3) could be 

displayed on the computer monitor to assist the analyst's selection. Then the 

computer asks the analyst to input the event causing the hazardous condition, 

the potential accident, and so on, until the analysis is complete. The result 

is a PHA that has been input to a computer memory and thus is available for keyword searches, updates, and modifications. A conceptual flow chart for the 

computerized PHA is shown in Figure 2. 

The second part of the computerized PHA is the use and updating of the 

results. First, important results can be transferred to a special program 

module that selects and prints important components, characteristics, and 
TABLE 7. - Conceptual input format for a 

computerized, user-i nteracti ve PHA 

QUESTIONS ASKED BY COMPUTER ANALYST'S RESPONSE 

Subsystem name? Example: Mine ventilation system 

Component name? Example: Ventilation fan 

Component index number? Analyst inputs a series of characters 

that identify the subsystem and 

component. 

Important component characteristics? Analyst inputs pertinent component 

information, including operating data 

and envi ronment . Regulations and policies 

regarding component? 

Analyst inputs a cross-reference index 

of policies and regulations. 

What are the hazardous elements Analyst inputs hazardous elements. 

associated with this component? Computer can be programmed to display 

hazardous element checklist to aid the 

analyst. 

What are the events that could Analyst inputs a description of the 

cause the hazardous element to be triggering event. 

transformed into a hazardous 

condition? 

(.. . , computer continues asking (. . . , analyst continues answering the 

questions related to the columns questions asked by the computer.) 

of the PHA table shown in Table 4 

and then returns to examine any 

other hazardous elements associated 

with this component. After 

completing the PHA of the first 

component, a second component may 

be examined, and a third, and so 

on .) 

hazards so the analyst has a checklist that can be carried anywhere. Second, 

the information in the computer memory can be searched for key words and the 

component index number. Thus, the information is available for updates, 

revisions, and changes that can be input in a short period of time. Specific 

information regarding any component or potential hazard can be made avai lable. 

A further item that mine safety officials have .indicated would be useful to 

them is a cross-reference to mining regulations and mine policy statements. 

For instance, if the subject of some safety concern is fire extinguishers, the 

safety officials would like to be able to go to the computer and in a short 

time find out where to look for specific regulations and policies regarding 

fire extinguishers. This extra program module has been included in Table 7 and 

Figure 2. 

Estimated Costs of Implementation 

The costs for implementing a PHA safety program at a mine are estimated as 

follows. First, the costs for implementing a PHA-type program without 

computers is dominated by the costs of labor. It is estimated that a detailed 

PHA of a mining system would require about 0.5 man-years of safety staff 

labor. Assuming the unburdened safety staff labor rate is $15.00/hr and adding 

overhead expenses, taxes, benefits, and a large uncertainty, labor costs total 

$23,000 to $30,000 for performance of the PHA. Since PHA is a dynamic analysis 

that must be updated and revised periodically, it is estimated that 3 to 4 manmonths/yr must be spent on this activity. Thus, total operating costs 

(including uncertainty) are estimated to be about $10,00O/yr-$15,00O/yr. 

The estimated costs for implementing a computerized PHA includes the 

capital costs and installation of the computer system and software in addition 

to staff labor costs. Costs of computer systems were developed from a survey 

of available microcomputer systems and are conservatively estimated to be about 

$5,000, including deli very, instal lation and supplies. Annual supplies and 

maintenance costs are assumed to be 10% per year of the initial capital costs. 

Also included in the estimated costs for a computerized safety program are 

costs for the safety staff to attend short-courses on safety analysis training 

and computer training (including registration fees, travel, 1 i ving expenses, 

and wages). These costs are developed in the final report of this study and 

the assumptions and bases will not be repeated here. The total fixed and 

operating costs are summarized below: 

FIXED COSTS 

Computer system purchase 

andinstallation. ................ $5,000 

Short course attendance 

and expenses ................... $ 9,000-12,000 

Analyst's burdened labor costs 

Initiate Program ................. $10,000-15,000 

Perform Analysi s ................. $23,000-30,000 

TOTAL $47,000-62,000 
ANNUAL OPERATING COSTS 

Computer System Maintenance .. .. ........ $ 500/yr 

Analyst's burdened labor costs ........... $10,000-15,00O/yr 

TOTAL ....................... $10,500-15,500/yr 

Note that these estimates do not contain the costs for developing the computer 

software. These costs are difficult to estimate and it is not known at this 

time whether they will be paid by the mining industry or by government. Therefore, software development costs will not be included in this analysis. The 

reader should recognize that software development costs are in addition to the 

estimated imp1 ementation costs presented above. It should also be noted that 

these costs include the wages of mine safety officials and are thus not an 

additional cost for mine operators. Generally, the time spent working on the 

safety assessment would replace the time safety officials currently spend at 

their desks. 
FAILURE MODES AND EFFECTS ANALYSIS 

Failure Modes and Effects Analysis (FMEA) is a safety assessment technique 

that was developed as a means of assuring that hardware and equipment are 

reliable (Jordan 1972). FMEA is a qualitative technique that is used to 

analyze the ways in which particular pieces of equipment can fail (failure 

modes) and the resulting effects on the system and personnel. This technique 

is often used to analyze a system design to enable the designer to locate and 

identify failure modes whose occurrence can cause loss of system function, 

personnel in jury and death, or property damage. Once these "critical " fa1 lure 

modes have been identified, the designer is able to mitigate the safety 

problem through uti 1 izing redundant components, providing alternate operating 

modes, personnel training or other available means. This technique is being 

used more and more extensively to evaluate existing and operating industrial 

processes and can be beneficial if applied to a mining system. 

FMEA can be applied to all types of mines and to all mining situations. 

The techique is comprehensive and simple. It can be performed adequately with 

relatively little training. The technique requires a detailed knowledge of the 

system being analyzed, and thus is most suitable for the mine safety officials 

to perform. The technique is useful because it is a systematic method that 

identifies and evaluates the effects of hazardous conditions, which allows the 

mine safety people to plan for safety and remove or correct hazards as they are 

found. FMEA examines the failures of components of the mining system and 

evaluates the effects of failures on persons and objects at the mine. The 

results can be used as a checklist of hazards that the mine safety official can 

use to plan corrective and preventive measures that will eliminate or mitigate 

the hazards. For these reasons, FMEA was selected as a suitable safety 

analysis method for technology transfer to the mining industry. 

Analysi s Procedure 

The purpose of this subsection is to describe the procedure for performing 

an FMEA. The first step in the performance of an FMEA is to obtain a thorough 

knowledge of the system. It is often useful in complex systems to break them 

down into major subsystems and components. Functional diagrams that i denti fy 

the subsystems according to their purpose or function are a most useful way of 

defining the system under analysis. It is also extremely useful to prepare 

descriptions of the functions of a1 1 subsystems and components. Interfaces 

with other components and subsystems should also be clearly defined. The 

amount of detail required depends upon the uniqueness of the functions 

performed or the application of the particular item. An example of a 

functional statement is presented later in this section. 

The next step is to establish the format that will be used in the 

analysis. The most comnonly used format is a tabular format with labeled 

columns for specific entries. Many FMEA formats have been developed in the 

past and some are more useful than others. One format that is recomnended for 

use in the mining industry is shown in 'Table 8. This format is relatively 

simple and contains the items of most interest to the mining industry. Also 

included on this table is a description of the information that should be 
TABLE 8. - Recommended format for guiding and recording a failure modes 

and effects analysis 

I 1. Name of element or component under analysis. Can use symbols and abbreviations to identify components 

1 2. Concise statement of the function performed. 

8. Existing or 

Recommended 

Correcti ve 

Actions 

13. Description of the failure mode (see Table 9). 

7. Detection 

Method 

4. Estimate the failure occurrence rate. Usually this is a numerical value, although descriptive entrie: 

may be used such as frequent, infrequent, not expected to occur, etc. 

5. A brief description of the effect of the failure on the system, subsystem, and plant personnel. 

( 6. Statement of the cri tical i ty category (see Table lo). 

5. Failure 

Effect 

1. Item 

Identification 

I 7. A description of the methods by which occurrence of the failure mode is detected. If not readily 

detectable, indicate how testing or inspection could lead to detection. 

3. Failure 6. Criticality 

Mode 

2. Function 

8. A description of the existing or recommended corrective actions that can eliminate the failure mode 

or minimize its effect. 

4. Failure 

Rate 
recorded in each column. This form is used as a checklist to guide the 

analysis and enables the analyst to systematically and thoroughly evaluate the 

plant or process under consideration. 

The next step in the FMEA is the analysis of the failure modes and their 

effects. The analyst begins by selecting a specific subsystem and listing the 

components of the subsystem in the first column of the FMEA table. Next, the 

analyst picks a specific component and writes a clear, concise statement of the 

function the component performs in column 2. In column 3, the analyst records 

the specific failure modes regarding the component. This process can be aided 

by consulting the list of component failure modes shown in Table 9. Next, the 

analyst estimates the failure occurrence rate for the failure mode of the 

component under analysis. This can be done by referring to handbooks of 

failure rate data or by using a descriptive appraisal of the failure rate such 

as "frequent," "infrequent," "expected once per year," or "not expected to 

The analyst continues to column 5 of the FMEA table and records a 

description of the effect of the failure on the system, subsystem, and 

workers associated with the component. This column is particularly useful for 

identifying interactions and interfaces of the particular component with other 

aspects of the system under analysis. A detailed knowledge of the system is 

required for this step. It may be useful for the analyst to subdivide column 5 

into three columns, one for system effects, one for subsystem effects,. and one 

for human effects to further organize the thinking process. Next, the analyst 

evaluates the "criticality" or importance of the failure. This process is 

faci 1 itated by the use of "criticality categories," which simply classify the 

severity of the effects of the failures. A hazard classification system 

TABLE 9. - Listing of potential component failure modes (Garrick et a1 1967) 

Fai lure to open 

Failure to close 

Failure to start 

Fai 1 ure to continue operation 

Failure to stop 

Spurious failure, i .e., premature operation of a component 

when not called for 

Degradation 

Erratic operations 

Scheduled service 

Scheduled replacement 
recommended for use by mine safety officials is shown in Table 10. See the 

section describing consequence analysis later in this manual for additional 

information. The analyst evaluates the failure effects and assigns each 

component failure to a criticality category. Then the analyst records the 

information in column 6 of the FMEA table. It should be noted that an FMEA 

does not normally consider "consequences" except in terms of system 

degradation. FMEA can do no more than specify the degree of system (or 

function) degradation. Thus, this column may be emitted to avoid confusing the 

analysi s. 

The analyst's next step is to identify and describe the methods used to 

detect the component failures. In some cases, the components are provided with 

sensors that alert operators of specific problems. In other cases, no sensing 

system is provided and failure is detected by inspection, testing and operator 

attention. In either case, the analyst should record this information in 

column 7. The final column of the suggested FMEA table is used to record 

descriptions of e x i s t i n g o r recommended corrective actions that can eliminate 

the failure mode or minimize its effect. This information can be determined 

using the analyst's knowledge and experience, system designs, and corrective 

measures used in related systems. Vendor catalogs, trade shows, industry 

publications, such as those published by the American Institute of Mining 

Engineers (AIME) , and engineering designs are particularly useful sources of 

potential preventive and correcti ve measures. 

It is recommended that the analyst perform the FMEA steps in the 

following order. The table should be completed from left-to-right and not 

from top-to-bottom. In other words, the analyst should perform the evaluation 

and complete the FMEA table for one component before continuing to a second 

component. There are many subtle items and details that could be forgotten if 

the analyst switches from one component to another before completing the - evaluation of the first. If a left-to-right approach is used, the analyst is 

TABLE 10. - Categories for ranking the severity or "criticality" 

of potential accidents 

HAZARD CATEGORY EFFECT ON SYSTEM 

Class I 

Class I1 

Class 111 

Class IV 

Ne li ible - loss of function that has 

&%&-on system 

Mar inal - degrades system to some -% extent ut does not cause system to be 

unavailable 

Critical - this hazard will completely 

degrade the system 

Catastrophic - this fault will produce 

severe consequences 
less likely to omit subtle details, particularly the details of the component 

interfaces and interactions with other areas. 

The next step in the performance of an FMEA is preparation of a "Critical 

Items List." This list facilitates communication of the significant results 

of the analysis to management. The Critical Items List is also useful for the 

safety officials to carry with them on periodic inspections of the mining 

system. The information placed on the list consists of components whose 

failure wi 11 produce hazardous conditions for the persons and property 

involved. This list is extremely useful for helping the mine safety official 

identify and correct hazardous conditions before they result in an accident, 

i.e., helps them to plan for safety. A typical Critical Items List contains 

the following information for each critical component failure: 

a Item - Identify function/item by name 

a Failure mode - Concise statement of failure mode(s) (see Table 8) 

a Failure rate - List probability stated in FMEA, such as probable, 

possible, frequent, etc., or numeric failure rate data if desired. One 

could assign generic number ranges to these terms; e.g., probable = 0.1 to 

1 occurrence per year, possible = 0.01 to 0.1 per year, etc. 

a List page number of FMEA 

a Criticality category - Enter the applicable criticality category stated in 

the FMEA 

a Prevention/Correction - List existing or recommended means for eliminating 

the hazard or explain why the critical condition is not or cannot be 

eliminated or mitigated. 

The preparation of the Critical Items List is the final step in performing 

an FMEA. The results are essentially documented as the analysis is performed. 

Final documentation of the FMEA process should include the detailed system 

description, i n c l u d i n g t h e functional descriptions and flow diagrams, the 

completed FMEA tables, and the Critical Items List. A sumary of the FMEA 

analysis procedure is presented in Table 11. It should be noted that FMEA is a 

dynamic process that can and should accomnodate updates and revisions to the 

system under analysis. Since a mining system is also constantly changing, the 

FMEA approach is particularly suitable for incorporating the modified 

information. 

Advantaqes and Di sadvantaaes 

One of the primary advantages of the FMEA in regard to the mining industry 

is the simplicity of the analysis procedure. No complex mathematics or 

specialized training is required of the analyst. Thus, this method can be 

learned and performed effectively by mine safety officials in a short period of 

time. FMEA can be used in all types of mining systems and in reference to all 

kinds of safety problems. The FMEA format provides an orderly and structured 
TABLE 11. - Step-by-step procedure for performing a failure 

modes and effects analysis 

Step 1 

Step 2 

Step 3 

Step 4 

Step 5 

Step 6 

Step 7 

Step 8 

Obtain adequate working knowledge of the system: 

Helpful to break system down into large blocks. Prepare 

functional flow diagrams and functional statements. . 

Establish FMEA format: Recommended format shown in 

Table 1. 

Select first subsystem to be analyzed and list 

components of subsystem in column 1 of FMEA table. 

Select first component for analysis. 

Analyze failure modes of initial comoonent and their 

ettects: Complete analysis ot the initial component by 

recording the information required in columns 2 through 8 

of the FMEA table. 

Select and analyze the rest of the components of the 

first subsvstem: Re~eat steo 5 for each com~onent. 

Continue until all subsystems and components have been 

analyzed: Repeat steps 4, 5, and 6 for each subsystem. 

Prepare Critical Items List: For components whose 

failure produces detrimental effects on the subsystem 

function or personnel ; contains information such as the 

critical component, failure mode, failure rate,,page 

number where item is evaluated on the FMEA, criticality 

category, and preventi ve/correcti ve measures. 

examination of the hazardous conditions inherent in an industri a1 process. 

The advantage here is that with the results of an FMEA, the mine safety 

officials may begin to plan for safety by preventing or correcting hazardous 

conditions before they cause accidents. FMEA results in a highly visible and 

orderly display of information that can accommodate updates and revisions to 

the system under analysis. A further advantage of FMEA is that the Critical 

Items List prepared from the results is a useful format for communicating 

hazard information to management and can also be used by mine safety officials 

as a checklist to assist in walk-through inspections of the mining system. 

The main disadvantage of FMEA is that it considers only one failure dt a 

time. Multiple and pre-existing fai lures are not normally considered. 

However, the analyst can enter dual component failures in column 1 of the FMEA 

table and proceed as with any other entry. There is no limitation on the 

number of com onents that can be considered simultaneously. The analyst is 

also cautione +T-o avoid the "form-filling mode" in which the analyst takes the 

attitude that he or she is simply filling out a form. Many details and subtle 

items are likely to be omitted if the analyst is performing the FMEA in this 

manner. 
Exam~le of Analvsi s Procedure 

This section presents and discusses an example FMEA to illustrate the 

analysis procedure and results. The example presented is a partial analysis of 

an underground coal mining system. The complete FMEA cannot be shown due to 

its length; thus one page will be shown to illustrate the analysis of the mine 

venti lation system. 

The first step in the analysis of the mine ventilation system is to 

describe the system under analysis. One useful method is to break the 

ventilation system down into major blocks. A block can be a large component 

(such as a ventilation fan including its associated connections), functional 

subsystem (an arrangement of components that performs a speci fic function; for 

example an electric substation or ventilation ductwork), location (such as a 

specific level or building of the mine), safety system, or other major part of 

the mine. A simplified example of a block diagram of the mine ventilation 

system is shown in Figure 3. 

As can be seen on Figure 3, the example ventilation system operates using 

the exhaust principle where fresh air is drawn downward through the intake 

tunnel to the underground areas by the suction created by a large exhaust fan 

at the surface. There is one primary fan and an identical standby fan in case 

the primary fan fails. There is. also a booster fan station at an underground 

level that reduces the load and power requirements of the larger primary fan 

The booster fan also provides chilled air via hard piping and collapsible 

tubing directly to the rock faces where coal is extracted. In a detailed 

analysis, the design of drifts and air flow separation techniques, such as 

regulators, overcasts, and stoppings, may be of interest. For the purposes of 

this illustration, the detai 1s of the underground airflow paths and the 

potential effects of fugitive air losses will not be examined. 

It is also useful to prepare narrative descriptions of the functions of 

all subsystems and components. The functional statements should contain clear, 

concise descriptions of the operation of each item. Interfaces and 

interconnections with other components or subsystems are important items and 

should be clearly defined. An example of a functional statement is as follows: 

Primary Ventilation Fan: 

Provides fresh air to miners while downhole. Also required for 

dilution of potentially harmful and explosive gases which are liberated by 

mining activities. Specifications: 240,000 cu.ft./min., 2000 hp, 

electric-dri ven, two-blade, propel ler-type fan. Alarm at high motor 

temperature, low air flow, and electric power failure. Redundant standby 

fan provided. Interfaced with electric power supply (off-site and 

emergency standby on-site), ventilation exhaust shaft,. and fan exhaust 

tunnel. 

This information is particularly useful for evaluating the effects of component 

failures. 

must resist the temptation of considering fan failure in conjunction with the 

hoist failure (which would prevent evacuation of the mine). Only one failure 

at a time can readily be considered, using this technique. However, situations 

such as this should be noted by the analyst and examined more closely to 

determine if a single failure event could cause both systems to be inoperable 

simultaneously. This type of failure is called a common cause failure. 

Furthermore, if the analyst wi,shes, these combined failures could be entered as 

one time on the FMEA so that they could be considered. 

The final two items on the FMEA table are for the method(s) of detecting 

fan failure and preventive/corrective meausures. Several methods are available 

that detect and warn operators of the fan failing to continue operating. Often 

fans are equipped wi th temperature sensors, ai r-flow indicators, and other 

sensing. devices that are connected to an alarm or annunciator system. These 

fans are also large endugh and create so much noise that their failure would be 

immediately noticed by operators. Detection methods are recorded in column 7. 

Column 8 is for the analyst to record existing measures which are employed to 

eliminate or mitigate the hazardous condition. The hazardous condition of a 

lack of fresh air downhole can be corrected by simply starting the standby 

fan. This hazardous condition is also prevented as much as practical by 
C) a 

- 41 

:z 

5 

- ab -- -- * uaL 

gbi 

-7- OCL 

QIQ 
periodic testing and maintenance of both the primary and standby fans. In 

addition, in the event of loss of off-site electric power, these fans receive 

hi gh .priority for the electricity generated by the emergency diesel electric 

power supply system. 

This completes the analysis of the failure of the primary fan to continue 

operation. The analyst continues examining the next failure mode of the 

ventilation fan, i.e., scheduled service. The process for completing the FMEA 

is repeated for this mode of fan failure. When all of the failure modes of the 

primary fan have been examined, the analyst continues to the next component, 

and so on, until all items associated with the underground ventilation system 

have been examined. Then the analyst can continue the analysis by examining 

other subsystems, one at a time, until the entire mine system has been analyzed. 

This example has served to illustrate the procedure for performing an FMEA 

and recording the results. The next step is to develop a Critical Items List 

from the FMEA results. This list consists of components whose failure will 

produce hazardous conditions, or in other words, potentially dangerous 

situations for the persons or property involved. The format for displaying 

this information was shown previously and includes the item name, function, 

failure mode, failure rate, page number where found on the FMEA tables, 

criticality category, and preventi ve/correcti ve measures. The Critical Items 

List serves two purposes. First, it is a tool to be used for communicating 

significant results of the analysis to management. Second, it can be used as a 

checklist for mine safety officials to carry with them on inspections. Used in 

this manner, the checklist is a tool that helps mine safety officials and 

management to plan and execute a hazard prevention program. Some example 

entries on a Critical Items List are shown in Table 13. It is also beneficial 

to show if failures of additional items in conjunction with the critical item 

could potentially have severe consequences, such as failure of both the primary 

and standby fans in conjunction with failure of the hoisting system. Again, 

multiple failures can be handled directly as a single item in the FMEA. 

Computer Adaptability 

Results of the evaluation of the adaptability of FMEA to a userinteractive computer program indicate that it is possible and desirable to do 

so. No complex mathematics or logic is required to perform an FMEA so it is 

believed that it would be relatively simple to develop this computer program. 

Furthermore, it i s be1 i eved that devel opment of a user-i nteracti ve program as 

a guide to the performance of the FMEA would simp1 ify the analysis procedure. 

There are no FMEA computer programs at this time to draw conclusions about 

their utility and effectiveness. However, it is believed that implementation 

of an FMEA computer program will increase the efficiency of the time safety 

officials spend at their desks, thus allowing more time to be spent preventing 

or correcting hazardous conditions at the mine. In addition, the FMEA and 

related Critical Items List provide new insights to the mine safety officials 

and management on the causes of potential accidents, and thus can lead to 

el imination or reductions of the accidents by el iminating their causes. 
TABLE 13. - Example entries on the critical items list 

Item/function : Primary ventilation fanlprovides fresh air to miners 

and dilution of mine gases 

Failure Mode: Fai lure to continue operation 

Failure Rate: Infrequent 

FMEA Page No. : A- 1 

Class 1 I; potential contributor to catastrophic 

accident if evacuation of mine is hindered or not 

possible (not 1 i kely) 

Prevention/ Redundant standby fan, re1 iable and we1 1 maintained 

Correction : primary and standby fans, failure mode readily detected 

Itemlfuncti on : Vent fan electrical connections/transmi ts off -site 

power to primary and standby fans 

Failure Mode: Failure to continue operation 

Fai lure Rate: Infrequent 

FMEA Page No. : A-2 

Class 1 I ; potential contributor to catastrophic 

accident if hoisting system is unavailable, although 

this failure has minor effects in itself 

Prevention/ Re1 i able equipment and off-site power supply, 

Correct i on : standby diesel generator on-site, delay time before 

oxygen is depleted and gases reach dangerous 

concentrations. 

A conceptual computer program uti 1 i zing the FMEA method01 ogy was developed 

for this study. A relatively small computer system is required for this 

conceptual program. As currently envisioned, the conceptual FMEA program 

consists of three stages as shown in Figure 4. Stage 1 is a user-interactive 

scheme that guides the analysis procedure by asking appropriate questions for 

the analyst to respond to. The computer displays questions in the same 

sequence the analyst would ask himself if he were performing the analysis 

without the computer. In addition, the analyst will index the components and 

subsystems to aid Stages I1 and I11 of the program. 

An example that illustrates how the Stage I analysis will work is the same 

as that previously shown for a computerized preliminary hazards analysis in 

Table 7. The computer displays a question asking the analyst to identify a 
Output: 

User inputs user-specified 

key-word and key-word search information on 

search command subject of search 

or revised FMEA 

FIGURE 4. - Conceptual flow chart for a computerized FMEA 
subsystem and assign an index number, such as "ventilation subsystem" and 

assign the letter "A" to represent this subsystem. Next, the computer will ask 

the analyst to identify a component of the subsystem and assign a second index 

to this component. For example, the analyst will input "Primary ventilation 

fan" and assign index Ala. The indices represent the subsystem and the 

component identification number, respectively. The small "a" in the index 

indicates there is more than one ventilation fan in the subsystem that is 

capable of performing the same function. If there are similar components that 

perform different functions, they woul d be assigned a separate numerical 

index. For example, the downhole booster fan in the example system is assigned 

the index number u, rather than A1 L. The conceptual program is also 

capable of displaying parts of the FMEA table where the answers to the 

questions are being.recorded. This feature enables the analyst to keep track 

of where his or her responses are being recorded and also to visualize the 

analysis as it progresses across the FMEA table. 

The next questions in the conceptual FMEA computer program examine the 

component failure mode(s) and the failure effects. The computer will follow the 

analysis sequence from left-to-right on the FMEA table until an examination of 

a particular failure mode has been completed. Then the program returns and 

asks the same questions for the analyst to answer regarding the second, third, 

or additional failure modes. When a particular component and all of its 

fai lure modes and effects have been examined, the analyst selects a second 

component for analysis. This selection process can be aided by lists of 

components input to the computer memory before the analysis begins. Th2 

analyst would simply ask the computer to display the component list and then 

make a selection. A similar procedure may be used to assist in the selection 

of component failure modes and hazard categories (see Tables 9 and 10). 

Stage I1 of the conceptual computer program is the use of the results. 

The computer can be used to search for critical items that, if they fail, can 

have adverse effects on personnel or property. This procedure is essentially 

the same as preparation of the Critical Items List. This can be done in two 

ways. First, the computer can perform a key word search of the criticality 

category and identify those items which are Class 111 or Class IV hazards. The 

analyst risks omitting some of the Class I1 items which are also critical items 

at the mine but do not have adverse consequences due to a requirement for one 

or more additional failures, delay time or some other mitigating condition. In 

the example presented, the primary ventilation exhaust fan would have been 

omitted because it's failure is a Class I1 item for the reason that there is a 

long delay time before failure of the fan produces personnel injury and 

property damage. However, the ventilation fans are critical to the mining 

process because without them, production must be interrupted unti 1 repair is 

effected. The second way to prepare the Critical Items List is for the analyst 

to indicate which items should be included on the list as the analysis 

progresses. In fact, the user-interactive computer program can be instructed 

to ask the analyst if a particular component is to be included on the list 

after each failure mode is evaluated. If the component and failure mode are 

judged to be critical, the computer automatically commits this to memory. Once 

the analysis has beem completed, the analyst would input a command to display 
or print the Critical Items List and the computer would scan its memory and 

output this list. The computer can also be programmed to display or print all 

component details on the Critical Items List format, shown previously. 

FMEA, like many safety analysis techniques, is a dynamic process. 

Therefore, the conceptual computer program should include a means to revise, 

update, and modify the FMEA of the mining system. Stage 111 of the conceptual 

computer program combines key-word search capabi 1 ities and deletion/correction 

capabi lities of current micro-computer systems to accomplish this. The analyst 

will simply input a key-word or component identification number and input the 

"search" command. Then the computer will scan its memory for the appropriate 

combinations of letters and symbols and display exactly where they were found. 

Then the analyst can have these entries displayed on a monitor and using the 

deletion/correction capabi 1 ities of modern word processing software, make the 

revisions or modifications in appropriate locations. 

Estimated Costs of Implementation 

This section contains estimates of the costs for implementing an FMEA-type 

safety program at a typical mining system. Estimated costs were developed for 

two cases: 1) for an FMEA-type paper study and, 2) for a computerized FMEA 

program. The bases for these cost estimates are contained in the final report 

for this study and will not be repeated here. 

The estimated costs for implementing a paper-study FMEA safety program are 

dominated by the costs of labor. It is estimated that approximately 1.0 manyear is required to perform a thorough FMEA of a mining system. Assuming the 

mine safety officials are paid about $15.@O/hr, and adding a 50% burden for 

overheads, occasional overtime, and supplies, the estimated direct labor costs, 

including uncertainty, are between $45,000 and $65,000. It is estimated that 3 

to 4 man-months/yr are required to periodically review, update, and revise the 

information on the FMEA tables. Thus, total operating costs are estimated to 

be about $10,000-$15,00O/yr. 

The estimated costs for implementing a computerized safety program based 

on the FMEA technique include the capital and installation costs of the 

computer system in addition to the staff labor costs. Costs of potential 

computer systems are estimated at $5,000, but this can most likely be reduced 

to about $3,000 due to the relatively small computer capabilities required for 

this type of analysis. The $5,000 estimated cost includes purchase of the 

complete computer system (including the processor, monitor, disk drive, 

keyboard, and printer), deli very, instal lation, and supplies. Annual 

maintenance costs are assumed to be 10% of the initial capital costs per year. 

Also included in the estimated costs for a computerized FMEA safety program are 

the costs for the safety staff to attend short-courses on computer training and 

safety analysis training (including registration fees, wages, 1 i ving expenses, 

and travel costs). These costs are developed in the companion document to 

this user's manual and will not be repeated here. The estimated total fixed 

and operating costs are sumnarized below: 
FIXED COSTS 

Computer system purchase and installation ...... $ 5,000 

Short course attendance and expenses ........ $ 9,000-12,000 

Analyst's burdened labor charges 

Initiate program ............. ; .. $10,000-15,000 

Perform analysis ................ $45,000-65,000 

TOTAL ........................ $69,000-78,000 

OPERATING COSTS 

Computer system maintenance ............. $ 500/yr 

Analyst's burdened labor charges. .......... $10,000-15,000/yr 

TOTAL ........................ $10,500-15,50O/yr 

Note that these estimates do not contain the costs for development of the 

computer program. These costs are difficult to estimate and it is not known 

whether the computer software will be developed by the government or the mining 

industry. Thus, the reader should be aware that software development costs are 

in addition to the estimated implementation costs presented above. Also, these 

costs do not represent the additional costs for implementing a formal safety 

program. Mine safety officials would be performing the safety assessment 

rather than their current duties in some instances and thus the actual 

additional costs that would be paid by mine operators are less than the 

costs presented here. 
BINARY MATRICES 

Many systems safety analysis techniques do not adequately address interactions among the components or subsystems of an overall system. A binary 

matrix (Cybulskis, et a1 1981) represents a logical, qualitative approach to 

help identify systems interactions. This analysis tool can be applied during 

the system description stage of safety analysis or as a final checkpoint in an 

FMEA or PHA to ensure that all important systems dependencies have been 

addressed in the analysis. 

The specific tool utilized in this technique is the binary matrix. The 

binary matrix contains information on the relationships between the elements of 

a system or systems. The purpose of the matrix is to identify the one-on-one 

dependencies that exist between these elements of a system. These elements can 

be any entities of interest to the analyst: entire systems, system functions, 

subsystems, components, physical locations, maintenance crews, electrical 

connections, etc. Elements of any level of detail can be intermixed. The 

important thing is to identify which elements affect others in some dependency 

relationship. Usually this is a "subordination" relationship where the analyst 

indicates the sequence of operations by identifying the events or operations 

that must occur prior to a specific event. This is usually done by placing a 

"1" in the binary matrix to indicate prior occurrence is required and a "0" to 

indicate there is no functional or operational relationship. Then, in 

performing the chosen safety analysis, when an accident sequence or failure 

mode has been identified for a particular system, the analyst can review the 

matrix to determine whether the failure under consideration can have 

repercussions in other parts of the overall system. In this sense, the matrix 

serves merely as a tool to "remind" the analyst that failures in one part of a 

system may affect the operation of other, seemingly unrelated, subsyStems in 

another area. 

An example of the application of the binary matrix to two simple, linked 

flow systems (shown in Figure 5) is presented1 below. In these flow systems, 

each flow line has a sensor (Sl, S2) and a control valve (Vl, V2) attached to 

it. The sensors rely on a common power source (IP). Attached to each valve is 

a motor (MI, M2), each of which has its own AC power (AC1, AC2). Each valve 

sensor system is controlled by a controller (Cl, C2) which has its own DC power 

source DC1 and DC2. 

Table 14 is a binary matrix that depicts the dependencies among the 

elements of the flow system. The relationship identified between components 

can be any area of interest. This dependency can be assigned by flow direction 

or by dependency on power sources, for example. The purpose of the matrix is 

to highlight for the analyst these kinds of interactions within an operating 

system. I n t h i s example, the analysis has been performed atthe component 

level. Each separate component of the system is used to construct the format 

of the matrix. The matrix itself is filled in by placing a "1" in the matrix 

cell if a dependency exists between the elements and a "0" if no relationship 

seems to exist. In completing the matrix, one always works across the relevant 

rows, rather than down the vertical column. When complete, the matrix presents 

a useful tool in analyzing system interdependencies. For example, if one 

examines the row for F02 in Table 14, it becomes evident that this flow is 
Motor 1, Motor 2 

AC Power Source 1 and Source 2 

Control 1 and Control 2 

Sensor 1 and Sensor 2 

Valve 1 and Valve 2 

Instrument Power 

DC Power Source 1 and 2 

Flow In 

Flow Out at 1 and at 2 

FIGURE 5. - Sample flow circuit with common power (IP) 
TABLE 14. - Binary matrix for two linked flow systems with comnon power 

dependent on flow at FI (input flow occurring), power by IP, AC2 and DC2, the 

valve V2 operating properly, the motor M2 operating, and the control C2 and 

sensor S2 operating properly. 

Although this example has concentrated on specific components within a 

particular subsystem, the analysis may also be performed at a broader level by 

examining functions within the system. For example, one can investigate the 

interactions among the different operations, locations, etc., within an overall 

mining system. The analysis would be performed in the same way as for the 

example presented above. Note that a good understanding of the system under 

consideration is necessary to successfully perform this analysis. 
CONSEQUENCE ANALYSIS 

Consequence analysis refers to the determination of a specific piece of 

information - the degree of severity of an accident. There is no generally 

applicable method for determining that information, since each specific 

accident may result in a different type of consequence, depending on the 

materials or operations involved. In addition, the analyst often specifically 

limits the scope of the safety analysis effort by deliberately analyzing in 

detail only those accident sequences that are believed to have a specific 

consequence of interest, e.g., in juries, fatalities, property damage in 

dollars, etc. Consequence analysis methods are then chosen or developed to 

determine the magnitude of consequence from a particular accident once the type 

of consequence has been decided. 

Consequence analysis is one of the intermediate steps of a safety 

analysis. Accident sequences are usually determined initially using methods 

such as PHA or FMEA. Consequences are then examined for each accident, either 

within the scope of the originally used analysis technique or as a separate 

step. Finally, some measure of magnitude is assigned to the consequence and 

some measure of probability of occurrence to the accident sequence to 

prioritize system hazards and/or required mi ti gation measures in a meaningful 

way. Accident sequences with low levels of consequence may be ranked lower in 

overall hazards, a1 lowing mine operators to concentrate their resources on 

mitigating hazards with larger potential consequence levels. 

Because the methodology employed is so dependent on the type of accident 

sequences and consequences identified, there are no rigorous guide1 ines 

available for performing a consequence analysis. However, there are a few 

general approaches that may be useful in determining the potential magnitudes 

of i dent i f i ed consequences. 

The primary consequences of concern in a mining system include injuries, 

fatalities, and losses due to property damage and operational downtime. These 

may be evaluated either qualitatively or in a quantitative manner. Oualitative 

measures can be very useful in generally determining which areas of the 

operation are most in need of safety improvements and for ranking of hazard 

types. Tn this method, consequences may be ranked simply as negligible, low, 

moderate and high, using a four-class system for all consequence types. An 

example of this classification scheme is shown in Table 15. Alternatively, the 

same method can be used with each type of consequence called out separately 

(see Table 16). When using this method, some quantitative or explanatory 

measure is necessary to properly differentiate among the four classification 

categories. Judgement of the analyst is then used to determine in which 

category each accident sequence falls. This method is useful in that it 

provides a ranking of hazards without requiring detai led numerical. analysis of 

each accident sequence. For most purposes, such as identifying areas of safety 

improvement at a mine, thi s technique shoul d prove adequate, provi ding 

meaningful results in a cost-effective manner. Often there are provisions made 

in preliminary hazards analysis and failure modes and effects for an evaluation 

of the consequences of potential hazards. 
TABLE 15. - Four-category qua1 itati ve classification 

scheme for consequence analysi s 

Category of Consequence Attributes of Category 

Negl i gi bl e 

Low 

Moderate 

High 

Minor equipment damage/downt ime 

e.g., $100 

Moderate equipment damage/downtime 

e.g., $100-$3000; potential for 

mi nor injuries 

Moderate equipment damage/downtime; 

potential for major injuries/lost time 

Major equipment damage; halt to system 

operation; potential for fatalities 

Quantitative consequence analysis brings another level of detai 1 to the 

safety assessment. This method basically assigns specific attributes of the 

consequence category d i r e c t l y to the accident sequence, rather than classifying 

that sequence with others in a group that a1 1 have generally the same range of 

attributes. This method is somewhat more complex, in that each accident 

sequence may have a different consequence magnitude (or even type). However, 

it also allows more detailed differentiation among accident sequences if this 

is required for the analyst's purposes. Historical accident data as catalogued 

at the mine or at the Mine Safety and Health Administration's Health and Safety 

Analysis Center in Denver, Colorado, may be used to help determine appropriate 

numbers for use as consequence magnitudes with specific accident sequences. 

Mathematical models may also be required to predict the consequences of a 

particular accident. These models can vary from dispersion analysis and 

inhalation models in the case of smoke inhalation and its effects underground 

to radiation dose modeling in predicting consequences of a failure in the 

ventilation system of a uranium mine. 

The specific consequence analysis techniques chosen wi 11 be highly 

variable, dependent on the mine system being analyzed, the level of detail 

required in the analysis, and the specific accident scenarios under 

consideration. For most purposes, particularly when uti 1 ized in conjunction 

with a PHA or FMEA technique, qualitative consequence analysis should be 

sufficient. More detailed quantitative techniques are generally uti 1 ized in 

conjunction with a more detailed, quantitative safety analysis methodology, 

such as fault tree analysis. Education level and time requirements of 

consequence analysis are highly dependent on the specific requirements of the 

overall safety analysis task purpose, and will vary according to the complexity 

and degree of detail required for the analysis. 
TABLE 16. - Expanded four-category qualitative classification 

scheme for consequence analysis 

Consequenc (ia 1 Consequence 

TY pe Categories (a Attributes of Category 

Averaqe days lost (b 

PERSONNEL INJURY Negl i gi ble 

(mi nor/or nondisabling 

injuries) 

PROPERTY DAMAGE 

Low 

(major injuries) 

Moderate 

(permanent 

disabilities) 

Hi gh 

(fatalities) 

6000 or more 

Dollars 

Negl i gi ble 100 or less 

Low 100-1000 

Moderate 1000-5000 

High 5000 or more 

(a) Other consequence types and categories may be constructed as appropriate 

for the purposes of the analysis. Attributes of each category may be 

assigned based on importance for specific mining operations. 

(b) This figure may be based on standard values utilized in Mine Safety and 

Health Administration reports. 
MANAGEMENT OVERSIGHT AND RISK TREE (MORT) ANALYSIS 

Management Oversi ght and Risk Tree (MORT) analysis i s a comprehensi ve 

safety assessment method appl icable to any mine safety program. MORT analysi s 

is a very structured and formal safety technique that was designed originally 

as an accident investigation tool. MORT analysis has also been used as a 

safety program planning tool and as an aid in developing training programs. 

This technique was chosen for transfer to the mining industry because it 

requires little specialized training and could be learned and performed by mine 

safety officials in a relatively short period of time. . MORT analysis appears 

to be readily adaptable to the computer, being especially valuable as a userinteractive aid to guide the analysis. For these reasons, MORT analysis is 

chosen for technology transfer to the mining industry. 

MORT is a total safety program concept that focuses on administrative or 

programmatic control of hazardous conditions. This technique has been desi gned 

to identify, evaluate, and prevent safety-related oversi ghts, errors, and 

omi ssi ons by management and workers that can cause acci dents. MORT recogni zes 

that in any industrial situation, there will be hazardous conditions that cannot be prevented or corrected due to economic or techno1 ogical considerations. 

The MORT analysis technique is designed to identify this type of hazard and 

refer it to proper management levels. With the information obtained by MORT 

analysis, mine management will be able to allocate resources in a manner that 

will benefit the safety program the most, which is reducing injuries to the 

mining personnel and downtime due to equipment damage and accidents. 

The MORT technique is the most optimum safety assessment method that is 

suitable for evaluating the three main factors that affect safety in an 

industrial situation; technological factors (such as the plant and hardware), 

human factors (such as personal abilities and training), and organizational 

factors (such as management control s and procedures). MORT analysi s evaluates 

these factors both individually and as they interact together in a safety 

program. No other safety technique, by itself, has this capability. 

The MORT technique is based primarily on a document written by 

W. R. Johnson (1973), hereinafter referred to as the "MORT text ." The MORT 

text contains many safety system concepts and safety program elements which 

together produce the MORT safety program model. The MORT model is composed of 

safety concepts and elements such as human factors, hazard analysis, management 

systems, information systems, inspection and maintenance programs, and 

services. The detai 1s of these concepts fill a textbook and thus cannot be 

repeated here. MORT analysi s cannot be performed adequately without the MORT 

text, so the mining industry, if they wish to perform this analysis themselves, 

will most likely have to obtain this document. It is available from National 

Technical Information Service in Springfield, Virginia. Supplementary MORTrelated documents are listed in Table 17. These documents are extremely useful 

for helping to explain the analysis technique and specific safety program 

concepts. In addition to these documents, a one-week short-course on MORT 

analysis is taught under the sponsorship of the System Safety Development 

Center, operated for the Department of Energy by E.G. and G. Idaho, Inc. It 

is recommended that the mine safety officials who may be performing this 
TABLE 17. - Listing of MORT analysis-related doc m nts published 

by the system safety development center (SSDC) Y9 a 

DOCUMENT NUMBER TITLE 

ERDA-76-45-1 SSDC-1 Occupancy-Use Readiness Manual 

ERDA-76-45-2 SSDC-2 Human Factors in Design 

ERDA-76-45-3 SSDC-3 A Contractor Gui de to Advance Preparation for Acci dent 

Investi gati on 

ERDA-76-45-4 SSDC-4 MORT User's Manual 

ERnA-76-45-5 SSDC-5 Reported Significant Observation (RSO) Studies 

ERDA-76-45-8 SSD C-8 

Training as Related to Behavioral Change 

ERDA Guide to the Classification of Occupational 

Injuries & I1 1 nesses 

Standardization Guide for Construction 8 Use of MORTType Analytic Trees 

Safety Informati on System Gui de 

Safety Information System Cataloging 

Risk Management Gui de 

Safety Consi derations i n Evaluation of Maintenance 

Programs 

Management Factors i n Accident /Tnci dents (lncl u d i n g 

Management Self-Evaluation Checksheets) 

Events & Causal Factors Charting 

Work Process Control Guide 

SPRO Drilling 8 Completion Operations 

Applications of MORT to Review of Safety Analyses 

Safety Performance Measurement System 

Job Safety Analysis 

Management Evaluation 8 Control of Re! ease of Hazardous 

Materia 1s 

Change Control and Analysis 

Reliability & Fault Tree Analysis 

(a) SSDC is currently operated for the U.S. Department of Energy by E.G. and G. 

Idaho, Inc., Idaho Falls, Idaho. 
analysis on their mines have copies of these documents and attend the short 

course. Valuable insights on the procedure and on the total safety program 

concept are revealed in these sources that cannot be presented in this 

document due to the length of the discussion. 

The MORT analysi s technique was ori ginal ly devel oped as an accident 

investigation tool. It could be used successfully in the mining industry for 

this application. MORT is designed to determine the basic events associated 

with an accident and thus, if used in this manner, could prevent the recurrence 

of many mining accidents. However, MORT analysis has been increasingly 

utilized as a planning tool for developing safety and training programs. The 

MORT methodology is an integration of hundreds of safety program elements and 

can be used as a checklist for ensuring that as many safety concepts as 

possible are considered. Used in this manner, implementaton of MORT analysis 

techniques would benefit the mining industry by structuring the planning of an 

accident prevention program into a logical format. It is believed that this 

could reduce the numbers of both serious and minor accidents at mines which not 

only improves safety but also reduces the medical and lost work-time expenses 

paid by mine operators and increases productivity. 

Anal-~si s Procedure 

The acronym MORT is the name given to the logic diagram that displays the 

elements and concepts of the MORT safety program. A universal logic diagram is 

used in MORT analysis as a master "work sheet" to examine a specific accident 

or to evaluate existing or developing safety programs. The MORT diagram is 

very large and displays over 1500 safety program elements or "basic events" in 

an orderly and structured manner. It identifies the detai 1s and relationships 

that must be considered to .identify potential hazards and prevent oversights 

and omissions that could lead to accidents. The MORT diagram and analysis 

technique can be applied in some form to all types of safety concerns in all 

areas of the mining industry. In addition to identifying and evaluating 

potential safety problems, MORT analysis identifies the management system's 

weaknesses and strengths in regard to the safety program and provides a basis 

for management to make rational and informed decisions concerning accident 

prevention. 

MORT analysis uses the concept of unwanted energy flows and barriers to 

the energy flows to identify the many factors contributing to a potential 

accident. Energy flows are normally classified into categories of energy 

forms, such as thermal, electrical, or kinetic. For example, if the potential 

accident under consideration is a person being struck by a moving front-end 

loader, the unwanted energy flow is a flow of kinetic energy, or the energy of 

moving objects. Examples of energy forms present at a mining site are shown in 

Table 18. Accidents are caused by some interaction of these energy flows with 

persons and objects. Accidents usually occur because of a lack of adequate 

barriers and/or controls associated with the unwanted energy flow. 

This brings up the concept of barriers. Barriers are provided to prevent 

the transfer of unwanted energy from its source to a target (persons or 

objects). Some examples of energy barriers at typical mining sites are shown 
. -0 

TABLE 18, - Energy forms present at typical mining sites 

ELECTRICAL 

Transformers 

Wiring 

Power tools 

Pumps 

Hoisting equipment 

Crane loads in motion 

Moving vehicles 

High pressure ai r 1 i nes 

High pressure oil lines 

KI NET1 C/ROTATI ONAL 

Pumps 

Fans 

Motors 

Rotating components 

Hoisting Equipment 

FLAMMABLE MATERIALS 

Diesel fuel (emergency 

generators and storage) 

Gasoline (vehicles and 

storage) 

Lubrication oi 1 

Grease 

Rags and waste 

THERMAL 

Con vect i on 

Conduction 

Fire 

CORROSIVE 

Aci ds 

Caustics 

Natural chemicals (air, water, soil ) 

Excavated material (leaching) 

POTENTIAL (Fa1 1 s and Dro~sl 

Human effort 

Stairs, ladders, scaffolds 

Excavation 

POTENTIAL (Cranes and Lifts 1 

Cranes 

Slings 

Hoi sts 

Elevators 

TOX I UPATHOGEN1 C 

Carbon monoxide 

Dust and particulates 

Oxygen deficiency 

Radioactive particulates 

Mine gases 

Dynami te 

caps 

Primer Cord 

Dust 

Fuel oi 1 and gasoline trucks 

Mine gases 

in Table 19. Barriers may be physical design features, protective equipment, 

safety devices, warnings of hazardous conditions, safe operating procedures, 

and personnel experience, The MORT technique allows the analyst to evaluate 

the adequacy of barriers to each potential accident sequence to determine if 

there are failed barriers, barriers which are not provided, available barriers 

which were not used, or no barriers possible, 
TABLE 19. - Examples of energy barriers for typical mining sites 

TY pe Example Barriers 

Limit energy source Motor speed control lers 

Prevent build-up of energy form Pressure relief valve, burst disc 

Prevent release of energy source Electrical insulation 

Separate or channel away energy Electrical groundi ng 

source 

Physical barriers 

- Placed on source Guards on fans, motors, etc. 

- Placed between personnel Rail on scaffold 

and source 

- Placed on Personnel Hard hat 

In addition to examining unwanted energy flows and barriers, MORT analysis 

examines the third factor in a potential accident sequence, i .e., the persons/ 

objects that may be injured/damaged by interacting with the unwanted energy. 

These persons/objects are said to be in the energy "channel ." MORT analysis 

examines the functional presence of persons or objects in the energy channel, 

i .em, the analyst must answer the question, "For what reasons are these persons 

or objects involved in this location?" The MORT technique evaluates the 

administrative controls on and evasive actions that could be taken by 

particular persons or objects in the potential accident. Analysis of this 

third factor in a potential accident is particularly useful for identifying 

safe operating procedures for personnel and for evaluating one aspect of 

management's preparation for emergency situations where a large fraction of the 

mine personnel might be in the energy channel. 

MORT analysis involves the use of what are called "analytical trees." 

These are simply a convenient way of displaying a large amount of information 

on a diagram. Analytical trees are shaped like trees in that they start at the 

top with a single undesired event and branch out below until the basic events, 

which are the underlying causes of the top event, are determined. In an 

analytical tree, the top or major event or outcome is stated. On the next 

lower tier are listed those events that could lead to occurrence of the top 

event. Each of these is broken down into more and more basic events to reveal 

the sources that contribute to the top event. 

To illustrate the thinking process behind this logic, consider a mine 

ventilation system. Failure of this system to provide fresh air to miners 

downhole could cause suffocation and build-up of harmful or explosive gases. 

The top event for this illustration is assumed to be failure of the mine 
ventilation system to provide sufficient fresh air downhole. The thinking 

process the analyst goes through to construct an analytical tree for this top 

event is as follows. First, the analyst considers the top event and asks the 

test question, "How could this happen?" Some of the answers might be failure 

of the electric power supply system or failure of the ventilation fan. Next, 

the analyst asks the test question regarding the second tier of events. The 

analysis continues until the specific causes and entire range of accident 

"sequences" have been i denti f ied. 

To understand the MORT analysis procedure and the techniques for 

construction and use of analytical trees, the reader must become fami 1 iar with 

the symbols and abbreviations used in MORT analysis. The symbols (sometimes 

referred to as "gates") are used to represent the logic for combining events 

into accident sequences. For example, the mine ventilation system could fai 1 

if either electric power is unavailable OR if the fan system fails to operate. 

Thus a symbol is needed to represent thea~ relationship, which means that the 

output event (i.e., mine ventilation systG failure) can result if any of the 

input events occur. A second symbol used extensively in analytical trees is 

the - AND symbol. This symbol represents the logic where a1 1 of the input events 

must occur for the output event to occur. For example, in order for a mine 

hoi sting bucket to fa1 1 uncontrol led down the shaft (output event), the 

bucket's primary braking system - AND the emergency braking system must both 

fai 1 at the same time. Therefore, the latter two events, which are input 

events to the uncontrolled falling bucket event, are connected with an - AND 

symbol, These symbols are presented and described in Figure 6. 

The - AND and - OR symbols are used the most often when constructing 

analytical trees. Two other logic symbols or gates that are used occasionally 

in specific situations, as shown in Figure 6, are the "INHIBIT-gate" and the 

"DELAY-gate." The INHIBIT-gate is a special case of the AND-gate, where some 

qualifying condition must be satisfied before the input can produce the 

output. A hexagon is used to represent the INHIBIT-gate and the conditional 

input is spelled out in an ellipse drawn to the right of the gate. As an 

example of an application of this type of gate, consider the event "Fire occurs 

in a diesel electric generator." One of the causes of this event might be a 

leak in the fuel system that ignites when the generator is energized. One 

condition that must be satisfied in order for this fire to occur is that 

current must be supplied to the diesel engine starter system in order for an 

electrical spark to ignite the leaking fuel. This is an example of an INHIBITgate for i 1 lustration purposes only. 

i 

The DELAY-gate, shown in Figure 6, is represented by an ellipse attached 

beneath an event symbol. This gate is used to indicate that the output occurs 

only after a specified delay time has elapsed. To illustrate the use of this 

gate, consider the mine venti lation system which not only supplies breathing 

air for miners downhole, but also dilutes and carries away potentially 

explosive mine gases such as methane. Once the ventilation system has failed, 

it takes a period of time before the mine gases can build up to a point where 

they are potentially explosive mixtures. The DELAY-gate would be used in this 

instance to indicate the amount of time that must elapse after the ventilation 

system fai 1s (input event) to produce the potential explosion of mine gases 

(output event). 
fault 

lnput I fault I 

(cause) 

output 

And-gate: Coexistence of all input events 

required to produce output event 

Or-gate: Output will occur if at least one input 

occurs 

Inhibit-gate: lnput produces output directly 

when conditional input is satisfied 

Delay-gate: Output occurs after specified delay 

time has elapsed 

Priority and-gate: Output occurs only if all input events 

occur in a particular sequence ' 

FIGURE 6. - Logic symbols used in construction MORT-type analytical trees 
The ellipse symbol is used to indicate conditions or restrictions that 

apply to normal AND- and OR-gates. When attached to an OR-gate, the new symbol 

is called an "EXCLUSIVE OR-gate." This gate is used in the special case where 

the output event occurs only if exactly one of the inputs occur. This gate 

differs from the usual OR-gate in situations where the output event will not 

occur if more than one input event occurs at the same time. When the ellipse 

is attached to the normal AND-gate, the new symbol is called a "PRIORITY ANDgate." This gate is used where the output event occurs only if all input 

events occur in a particular sequence. The sequence is recorded within the 

ellipse. It is rarely necessary in practice to have to use these symbols. 

Symbols are also used to represent events. The event symbols used for 

constructing analytical trees are shown in Figure 7. The different event 

symbols are used to represent different types of events. The CIRCLE denotes a 

basic event that can not be developed further. These are the underlying causes 

of accidents that the analyst wishes to determine. Somewhat similar to the 

CIRCLE-symbol i s the DIAMOND-symbol which a 1 so represents events that are not 

developed further. However, the events within a DIAMOND are not fully 

developed to their basic causes, either because the event is not sufficiently 

important or because information relevant to the event is unavailable. The 

HOUSE-symbol is used to signify an event that is normally expected to occur and 

is thus not a fault or failure event. For example, consider a fire caused by 

failure of the filling lines used to transport fuel from storage tanks to 

surface vehicles such as front-end-loaders. This fire can only occur during 

filling operations as these lines have fuel in them only during this time. The 

HOUSE-symbol is used in this situation to indicate that this fire can only 

occur while a vehicle is being refueled. The final event symbol on Figure 7 is 

the RECTANGLE which is used to identify events that are combinations of more 

basic events. The outputs shown above the logic gates previously discussed 

must be within RECTANGLE symbols. 

A TRIANGLE symbol is also shown on Figure 7 but is not actually an event 

symbol. The TRIANGLE signifies what is called the "transfer operator." The 

transfer symbol is essentially a time-saving measure used to represent exact 

repetitions of a branch of a tree that is found elsewhere. For example, 

failure of the electric power supply at a mine is an event associated with many 

system fai lures, including ventilation system and hoisting system failure. Let 

us say, for instance, that the electric power failure event is developed as one 

of the causes of the ventilation system failure. By using the transfer symbol, 

the enti re branch of the tree for electric power failure can be repeated under 

the hoisting system failure event without drawing the entire branch. Two 

TRIANGLE symbols are required for this operation; a transfer-in symbol is 

placed in the location where the branch of the tree will not be drawn (i .em, 

under the hoisting system failure in the above illustration) and the transferout, which is placed in the location where the branch of the tree is drawn 

(i .em, under the ventilation system failure, attached to the electric power 

failure event that is assumed to be drawn in this location). Numbers or 

letters are normally placed insde the triangle symbols to help the analyst keep 

track of the transfers. 
n Event symbols 

[ ) Circle - Denotes basic initiating event req"iring no further 

development 

0 Diamond - Denotes undeveloped events which are not further 

developed because it is of insufficient consequence 

or because information is unavailable 

Rectangle - Denotes an intermediate event that occurs because of 

one or more prior causes acting through logic gates 

0 House - Denotes an event that is normally expected to occur 

0 Ellipse - Denotes a conditioning event or restrictions that apply 

to any logic gate (used with priority and inhibit gates) 

Triangle - Transfer symbols; used to represent portions 

of the tree developed elsewhere 

'Common abbreviations used in Mort analysis 

D/N Did not MGH Potential energy 

LT A Less than adequate SUPV Supervisor 

MGMT Management CONS Consequent 

W/ With PREC Precedent 

FIGURE 7. - vent symbols and abbreviations used in constructing 

MORT-type analytical trees 
Many abbreviations are used in MORT analysis to aid the analyst in fitting 

descriptive information into the event symbols. The most cormnonly used 

abbreviations are shown in Figure 7. 

This completes the discussion of the symbols the analyst uses when 

constructing analytical trees. The structure of the MORT-type analytical tree, 

or MORT diagram, is shown in Figure 8. This figure shows the top elements of 

the MORT diagram which in full is a large and detailed analytical tree. A copy 

of the entire MORT diagram is available from the System Safety Development 

Center, E.G. and G., Idaho Inc., Idaho Falls, Idaho. The MORT diagram is the 

actual checklist of safety program concepts and elements that are examined to 

determine the causes of accidents. A detailed discussion of all of these 

concepts fills several large documents and thus cannot be repeated here. For 

this report, some general information concerning the three main branches of 

the MORT diagram is sufficient. The reader is directed to the MORT text and 

supporting documents for a more detailed discussion. 

The structure of the top of the MORT diagram, as shown in Figure 8, is 

composed of three main branches. Assumed risks are shown on the right and 

oversights and omi ssions due to specific control factors and management system 

factor are shown on the left. The MORT technique is based on the premise that 

all accidents are a result of either oversights and omissions (i .e., mistakes) 

or assumed risks. Assumed risks are those events that have been recognized 

and accepted by proper levels of management as accidents or hazardous conditions that cannot be prevented due to technological or economic constraints. 

Unknown or unanalyzed risks cannot be considered as assumed risks. The reader 

should recognize by inspecton of Figure 8 that the occurrence of the top event 

of the tree is either the result of assumed risks or the result of oversights 

and omissions from a combination of less than adequate specific control factors 

- AND management system factors, i.e., both of the latter two factors are to 

blame for the potential accidents under analysis. 

Analysis of the specific control factors branch of the MORT diagram 

develops a detailed understanding of the accident sequence. This branch is 

used to examine the sources of unwanted energy flows to determine if specific 

control factors were overlooked or omitted. This branch also evaluates the 

adequacy of the barriers provided and the involvement of the persons and/or 

objects that may be injured or damaged. Finally, this branch examines the 

re1 at i onshi ps between the safety management system and the accident sequence. 

Examples of safety program elements in this branch are inspection and 

maintenance plans, supervision, and technical information systems. 

Oversights and omissions due to management system factors are broken down 

into three main sub-branches. The idea i s t o separately examine the management 

system's safety policies, the implementation or fulfillment of the policy 

statements, and the system used by management to assess the risk of personnel 

injury or property damage and take appropriate actions. The risk assessment 

system is used by management to determine whether a particular accident should 

be an assumed risk or whether preventive action is appropriate and feasible. 
What and how large were the losses? 

1 Injuries, damage, other I 

costs, performance lost 

or degraded undesired 

program/public impact 

Oversights 

omissions 

S/M 

risks 

What happened? I Why 

I 1 

Specific 

control 

factors LTA I I Management 

system 

factors LTA I 

Amelioration 

Risk 

Accident Implementation LTA assessment 

system LTA 

LTA-Less than adequate 

FIGURE 8. - Structure of the MORT-type analytical tree 
Causes of the unwanted energy flow(s) are one of the three specific 

controls associated with the potential accidents. The other two controls are 

less than adequate barriers (SR2) and less than adequate control of persons or 

objects in the energy channel (SB3). The analyst evaluates these factors by 

examining the safety concepts shown on the MORT diagram under these two 

"events." Again, the above referenced documents help to make the short "event" 

statements more clear. This completes the discussion of the analysis procedure 

for the specific control factors branch of the MORT diagram. 

Management system factors that could contribute to the potential accident 

are examined under the branch labeled "M". The analyst considers the 

management system concepts, which, if less than adequately defined or 

implemented, could contribute to the occurrence of the accident. These factors 

are considered in light of the knowledge gained by analysis of the specific 

control factors branch. The analysis procedure for the management systems 

branch is identical to the procedure for the specific control factors branch. 

Again, detailed discussion of each management system factor is beyond the scope 

of this manual. 
yy 

between pages. This completes the discussion of the MORT analysis procedure. 

The procedure is summarized in Table 20. 

Advantages and Disadvantages 

One advantage of MORT analysis is that it is a very comprehensive technique that attempts to evaluate all aspects of safety in any type of work. It 

is essentially the only method that examines all three aspects associated with 

an industrial system (hardware, humans, and management systems) separately and 

as they act together to cause accidents. MORT is a structured and systematic 

analysis technique although it is flexible and allows incorporation of new 

ideas and concepts. MORT analysis results can suggest improvements to an 

existing safety program which could save lives, reduce injuries, and reduce 

property damage. In addition, the technique is useful for-identifying areas 

where further use of safety systems (such as safety equipment, warning signs, 

and training) could reduce the 1 ikelihood of accidents. Furthermore, much of 

the analysis has been performed for the analyst in that the MORT diagram and 

reference documents contain a wealth of information that could assist improving 

an existing safety program or developing a new one.. 
TABLE 20. - Step by step procedure for performing 

a MORT analysis 

Step 1: Obtain adequate working knowledge of the system. 

Step 2: Select the accident to be analyzed: The selection process can be 

aided by performing a preliminary hazards analysis to identify 

potential accident sequences. 

Step 3: Identify hazardous energy flows and barriers associated with the 

potential accident sequence: The analyst may use checklists to 

identify these elements. 

Step 4: Record this information in the standard MORT-type analytical tree 

format: The analyst should copy the structure of the standard MORT 

diagram and incorporate the unwanted energy flow and barrier 

information. This information is contained in the specific control 

factors branch of the MORT diagram. 

Step 5: Evaluate the causative factors of the initial unwanted energy 

flows : This is done by examining all safety program elements of the 

MORT diagram in regard to the unwanted energy flow. The technique 

asks questions about each safety element that the analyst is to 

answer. 

Step 6: Record the safety program elements which are determined to be less 

than adequate in regard to the unwanted energy flow: Copy the 

structure of the MORT diagram and include only those elements that 

are determined to be less than adequate. 

Step 7: Continue analyzing the safety program elements in regard to the 

rest of the unwanted energy flows (if any): Repeat steps 5 and 6 for 

every unwanted energy t low. 

Step 9: Examine the completed analysis for safety program elements 

thatcould reduce the likelihood of the potential accident occurring. 

The MORT analysis technique has the disadvantage that it creates a vast 

amount of complex detai 1. The analyst should make a habit of recording notes 

throughout the analysis so he or she is not overcome by the great detail. The 

technique is also time-consuming, at least until the analyst has gained 

experience. MORT analysis is a flexible technique, thus being harder to 

perform than a "cookbook" type of analysis. This technique is also a difficult 

one because it emphasizes management's responsi bi lity to provide a safe work 

place. Results of this analysis can test the understanding and commitment to 

safety that management must have to ensure a successful safety program. 
Exam~l e of Ana 1 vsi s Procedure 

This section presents an example t.o illustrate the MORT analysis 

procedure. The postulated accident chosen for this example is one where a 

hoisting bucket falls down a mine shaft. The analyst first becomes familiar 

with the hoisting system (see Figure 1 shown previously) and can quickly 

determine that this is a low probability accident because of the presence of 

many barriers. The postulated sequence of events leading up to rope failure 

and a falling bucket is as follows. First, the hoistman must be lifting 

personnel from the shaft bottom with defective brakes. Either the brake 

hydraulic pressure gauge is defective or has been disengaged resulting in the 

bucket being hoisted without brakes. In conjuncton with this, the emergency 

brakes must be inoperable. Another barrier to the accident is the overwind 

control, which allows the hoist to be automatically shut down when the top 

limit is reached, thus avoiding a collision of the bucket with the headframe 

and resulting rope failure. If the bucket is still being hoisted at this 

point, a crash bar is provided that could stop the bucket before it hits the 

headframe. Two additional barriers are provided in case the bucket reaches 

this point. First, the rope is designed with a factor of safety that could 

prevent its failure if the crash is not too violent. If the rope does snap, a 

safety catch is provided that may be capable of stopping the bucket from 

falling to the shaft bottom. It is due to these many safety features that this 

accident is assigned a low probablity of occurrence. 

With the above accident sequence in mind, the analyst begins to identify 

and examine the unwanted energy flows that caused the accident. First, the 

unwanted energy that causes the bucket to fall down the shaft is potential 

energy or the increase in energy due to raising an object over some distance. 

Prior to this, the kinetic energy (energy of a moving object) of the bucket 

causes it to strike the headframe. Before this happens, the bucket must be in 

motion (kinetic energy) with defective brakes. The analyst records this 

information by copying the general structure of the MORT diagram and incorporating this information, as shown in Figure 9. This is drawn under the 

specific control factors branch of the tree. Each of the causes of the 

unwanted energy flows are then examined, including an assessment of the 

adequacy of the barriers to the energy flows. The analyst examines each safety 

element of the MORT diagram and indicates which could be contributing factors 

to the postulated accident. An example of a branch for the falling bucket 

accident is shown in Figure 10 for illustration purposes (note the use of the 

triangle transfer symbol on Figures 9 and 10). The branch of the tree 

shown in Figure 10 is the result of the analysis that identifies potential 

causes of the falling bucket accident. The analyst continues examining and 

recording the specific control factors shown on the large MORT diagram that 

could cause the unwanted energy flows. Then, with the information from this 

procedure, the analyst is ready to evaluate the management system factors that 

could contribute to the potential accident. The procedure for this is 

identical to the procedure used to evaluate the specific control factors 

branch, i .e., an element-by-el ement exami nation of the management system 

factors branch of the large MORT diagram. 

Information Maintenance lnrpmion 

I 

systems 

LTA LTA LT A 

1 + 

Did not Did not Task 

dmect conm performance 

hazard hazard mom 

1 

Personnel 

performance 

recommended 

dl d2 d3 

FIGURE 10. - Example branch from the MORT diagram for the example problem 
specifying the proper ropes for use should be well trained with a thorough 

knowledge of the task. In addition, these calculations and specifications 

should be reviewed thoroughly by competent personnel. Designs of safety 

systems or the hoisting equipment should incorporate the techno1 ogy , as much as 

possible, to ensure reliability and availability. It is the responsibility of 

management to supply information on the latest technology to designers and to 

incorporate it in final designs. Supervisors should be aware of design and 

operating personnel discrepancies, such as personal conflicts, lack of 

motivation, or disregard of recomnended procedures. As mentioned earlier, the 

most effective accident prevention and control measure is to design the system 

for minimum hazard, as has been done for this system. 

This example has illustrated the MORT analysis procedure and has provided 

an example for the reader to follow when actually performing the analysis. It 

has also shown the kind of results to expect from application of this technique. The complete analysis of the postulated accident can not be shown due 

to its length and level of detail. 
TABLE 21. - MORT logic for muck bucket fa1 1s to bottom of shaft 

while hoistinq personnel : example sheet 

SA1. Accident : 

The bucket falls to the bottom of the shaft while hoisting personnel. 

SB1. Incident: 

Brake failure causes the bucket to overrun the top limit, strike the 

headrame, and snap the rope. 

SB2. Barriers LTA: 

Two barriers are provided to prevent the bucket from falling after 

striking the headframe. Both must fail in order for the bucket to fall. 

al. The bucket will not fall unless the rope snaps. The rope is designed 

with a safety factor. 

a2. In case the rope snaps, a safety catch is provided to prevent the 

bucket from falling. 

SR3. Persons in Energy Channel : 

Persons are inside the muck bucket when they are being hoisted. 

NOTE: A similar accident would be one where the persons in the energy 

channel are underneath the muck bucket on a galloway deck or on the shaft 

floor under the muck bucket wells. 

al. Nonfunctional personnel may be in bucket, e.g., authorized visitors, 

trespassers, etc. 

bl. Control of access to the bucket by non-functional persons may be 

LTA. 

b2. Control of access may be impractical. 

a2. Persons in bucket may be functional (operators). 

bl. Control of access to bucket by functional personnel may be LTA. 

b2. Control of access may be impractical. 

SC1. - Consequent Unwanted Enerqv Flow : 

MGH - bucket falls down shaft. 
Evaluation of the computer adaptability of MORT analysis indicates that it 

is both feasible and desirable. Since MORT has been reduced to a large, comprehensive diagram, the feasibility of adapting it to the computer is virtually 

ensured. It is desirable to adapt the MORT technique to the computer for the 

purposes of reducing the amount of paperwork involved and for assisting the 

analyst to conduct the assessment in a structured format, thus reducing the 

possibility of error or omission. The size of the computer program required to 

adapt MORT analysi s to a user-interacti ve computer i s re1 ati vely large because 

the technique integrates over 1500 safety program elements and safety concepts 

into the large MORT diagram. This results in a significantly larger labor 

requirement to install the program initially and to perform the first stage 

of the analysis. 

The conceptual computerized MORT safety analysis program is envisioned to 

be a 2-stage approach as shown in Figure 11. Stage 1 is a computerized guide 

to the analysis procedure, including checklists and other specialized forms 

commonly used in MORT analysis. The computer program could be made userinteractive so the computer would ask questions that the user must answer. 

With the aid of computer graphics, portions of the MORT diagram could be 

displayed on the screen to offer the analyst a broad view of the location of 

specific information. In other words, the conceptual computer program would be 

able to ask a question for the analyst to answer regarding some element of the 

MORT diagram while displaying the immediate branch of the tree surrounding the 

element . 

Stage 1 of the conceptual computer program is the actual performance and 

recording of the'analysis. The structure and framework of the standard MORT 

diagram would be programmed into the computer software. As discussed above, 

the computer could display the top portion of the MORT diagram and begin asking 

the suggested questions contained in the event boxes, just as in the paper-type 

study. Prior to this, the analyst must have chosen the potential accident 

sequence to be analyzed and given some consideration to the hazardous energy 

flows and barriers. The checklists shown in Tables 18 and 19 could be 

programmed into the computer software and displayed when needed to refresh the 

analyst's memory. The analysis procedure begins with the computer asking 

questions regarding the top event of the MORT diagram, then continues down the 

specific control factors branch of the tree, and then analyzes the management 

system factors branch. The standard rules and symbols of analytical tree 

construction would be used, although only the event statements of the MORT 

diagram need be shown on the displayed tree branch. The answers to the 

questions asked by the event statements would be typed into the computer memory 

and displayed on the screen. It may take a special, large screen to display 

this much information, although it is believed it can be done. A drawing of 

the conceptual display is shown in Figure 12. Important conclusions from the 

analysis may be input to a special memory file that may be printed out and 

utilized as a checklist for future safety inspections. This checklist may 

contain the hazardous elements and contri butory causes to potential accidents. 
-------- 

I Stage 1 

I 

User inputs I key-word or symbol, 

I 

search capability 

I search command, 

and revised or 

I 

I updated information I 

I I 

I I 

I I 

I 

I 

I Stage 1 L I 

FIGURE 11. - Conceptual flow scheme for a computerized MORT analysis 

I I 

I I 

I I 

I I 

I User inputs 

answers to 

I 

I mo;t analysis directed to special 

suggested 

I 

I questions I 

I I 

I I 

I 

mort analysis of 

I 

I 

I specific accidents 

in computer 

I 

I 

L -------- ------- 

Load mort 

analysis 

computer program 
Computer monitor A I 

I portion of standard 

Inspection mort diagram 

under consideralion 

I 1 I Plan Execution 

LTA LT A 

* 

a1 a 2 

SAl - SO1 - SC2 - SD4 - a1 - b2 - c3 - I 

Did llre inspeclion plan specify minimum requirements for the compenlence and training of Spece for analyst to 

Individuals used in the inspeclion program? inpul amwer and 

4 further commnnds 

1 

FIGURE 12. - Conceptual computer display for the MORT analysis procedure 
Stage I1 of the conceptual computer program is necessary because MORT 

analysis and mining systems are both dynamic processes. The conceptual 

computer program is capable of deleting out-dated information and inserting 

modified or revised information regarding any safety program element the 

analyst wishes. It is envisioned that the program is provided with key-word 

search capabilities and indices to allow the analyst to rapidly search and 

display specific entries contained in the computer memory. The word processing 

capabi 1 ities of current computer systems enables the analyst to delete and 

insert information as needed. Using these capabilities, the MORT accident 

analyses could be revised in relation to the constantly changing mining system 

and the potentially new hazardous situations created by these changes. 

Estimated Costs of Im~lementation 

This section presents the bases, assumptions and estimated costs for 

implementation of a MORT-type safety program at a mine. Two estimated costs 

are developed: 1) the estimated costs for implementing a conventional papertype MORT analysis safety program and 2) estimated costs for a computerized 

MORT safety program. The estimated costs developed in this section can be used 

by mine operators to weigh the costs of utilizing the MORT approach versus its 

benefits which have been discussed throughout this section. 

The estimated costs of a MORT-type paper study were developed based on the 

assumption that the analysis is performed by the mine safety staff. Thus the 

costs are dominated by the costs for training these people and the labor costs 

for the training and for performing and updating the analysis. It is estimated 

that approximatley 1 month is required for MORT analysis training for each 

individual involved in the analysis. This month includes attendance at a oneweek short course on MORT analysis and three weeks to review the analysis 

procedure and work some example problems. With this detailed training, the 

MORT analyst should be capable of completing the analysis of a potential 

accident sequence relatively quickly. Therefore, it is estimated that 1.0 manyears of staff labor is required to complete the initial MORT analysis of a 

large mining system. Assuming the safety staff labor rates and overheads 

discussed in the final report for this study, labor costs total $45,000 to 

$65,000 for performance of the initial analysis. The total cost of 

implementation also includes 1 month's labor costs for training 3 safety people 

in the MORT technique, including 2 safety foremen and their supervisor. These 

estimated costs are about $8,000 to $10,000. The estimated costs for three 

persons to attend the MORT analysis short course is about $9,000 to $12,000 

including attendance fees, airline travel to the short-course location and the 

three persons' salaries, lodging and living expenses for one week. The total 

estimated cost of implementing a MORT-type safety program at a mine are thus 

$62,000 to $87,000. Since MORT is a dynamic process that must be updated and 

revised periodically, it is estimated that 3 to 4 man-monthslyear is required 

for this activity. Therefore, the estimated annual operating costs of the MORT 

safety program are about $10,000 to $15,@00/yr. Note that these costs do not 

include the costs for an initial analysis (such as a Preliminary Hazards 

Analysis) to identify potential accident sequences. Only the costs associated 

with performing a MORT analysis are included in the above estimate. 
The estimated costs for implementing a computerized MORT analysis includes 

the capital costs and installation of the computer system and software in 

addition to staff labor costs. Costs for an adequate computer system are based 

on a survey of currently available micro-computer systems and are estimated to 

be about $5,000, including deli very, instal lation and supplies. Annual 

computer maintenance costs are estimated to be 10% of the initial capital cost 

per year, or $500/yr. Also included in the estimated costs for a computerized 

safety program are costs for the safety staff to attend short courses on MORT 

training and computer training (including registration fees, travel, and living 

expenses). These costs are developed in the companion to this document and the 

assumptions will not be repeated here. It should be indicated that the onemonth MORT training period and staff labor required to learn the paper-type 

analysis technique has been increased to 3 to 4 man-months to allow for the 

computer program to be loaded onto the computer system and the analysis to be 

initiated. Also, note that the estimated costs do not contain the costs for 

developing the computer software. These costs are difficult to estimate and it 

is not known if they will be paid by government or the mining industry. 

Therefore, the reader should recognize that software development costs are in 

addition to the estimated costs for imp1 ementing the computerized MORT-type 

safety program. The fixed and operating costs are sumarized below: 

FIXED COSTS 

Computer system purchase and installation ...... $ 5,nOO 

Short course attendance and expenses ........ $ 9,000-12,000 

Analyst's burdened labor charges 

Initiate analysis ... .. .......... $10,000-15,000 

Perform analysi s ................ $45,000-65,000 

TOTAL.. eeeee......eeeee..e.ee $69r000-97,000 

ANNUAL OPERATING COSTS - 

Computer system maintenance ............. $ 5OO/yr 

Analyst's burdened labor charges .......... $10,000-15,00O/yr 

TOTAL ........................ $10,500-15,50O/yr 

Since the MORT safety assessment program would be performed as a 

replacement to current mine safety official duties, the costs shown above are 

not additional costs. The actual additional costs above the costs for the 

current mine safety programs are lower. 
HUMAN-RELIABILITY ANALYSIS 

The most difficult component of a complex industrial system to characterize and evaluate is the human element. Accident statistics in industries 

where operations are predominantly some form of material handling, such as the 

mining industry, indicate that a large percentage of accidents are either 

caused initially by humans or human error in some way contributed to accident 

propagation. Human error is an important aspect of both normal and emergency 

situations. For this reason, human error (or conversely, human reliabi lity) 

should be considered in a detailed systems safety analysis of a mining system. 

Human-reliability analysis (HRA) is the study of human performance within 

a complex man-machine operating system. HRA can be used to develop qualitative 

information regarding the causes and effects of human error in specific 

situations. HRA can also be used to develop numerical human failure rate data 

that is normally used by fault tree analysts to estimate the probability of 

system failure. The quantitative portion of HRA is at this time not 

recommended for technology transfer to the mining industry due to the complex 

mathematics involved and minimal uti lity of the quantitative results at this 

time. It is believed that the qualitative portion of HRA can yield significant 

results for the mining industry by helping to identify the causes of their most 

frequent accidents, i .e., those caused by human error. With the information 

resulting from this analysis, mine safety officials and management will be able 

to identify desi gn changes, procedural improvements, and specific areas of 

training that can help reduce hazards at mines. 

Analysi s Procedure 

The procedure for performing the qualitative portion of an HRA is 

described in this section. First, a bri'ef discussion of the limitations of 

such an analysis is presented. Then the analysis procedure is outlined and the 

major tasks are described. The reader should be aware that a detailed 

discussion of all aspects of the HRA fill entire textbooks. For a greater 

understanding of the methods presented in this sub-section, the reader is urged 

to study a recent publication, the Handbook of Human Reliability Analysis with 

Emphasis on Nuclear Power Plant Applications, NUREGICR-1218 (Swain and Guttman 

1982). As the title suggests, this handbook emphasizes nuclear power plant 

operations but the general concepts are applicable to the mining industry. 

Human performance is variable and thus, difficult to predict. Any given 

person frequently shows variability from day to day and from one moment to the 

next. Human behavior is also difficult to predict because humans perform more 

different functions in more different envi ronments than any other component of 

a system. Furthermore, humans interface with many different elements 

(including other humans), accept a wide variety of inputs, and provide a wide 

variety of outputs. For these reasons, one of the limitations of HRA is that 

it cannot identify and eliminate - all human errors. However, it is possible to 

evaluate the reliability of a human involved in a task for which he is 

adequately trained and suggest changes that might improve that re1 iabi 1 ity. 
Human errors can be classified into two categories: situation-caused 

errors (SCEs) and human-caused errors (HCEs). SCEs are errors that are caused 

primarily by factors related to the design of the work situation. For example, 

less than adequate equipment designs, management practices, and operating 

procedures are SCEs. HEs are errors with primary causes related to some human 

characteristic, such as sabotage or intentional errors. It has long been 

recognized that most errors in a well-defined work situation are due to SES 

and relatively few are due to HCEs. Therefore, the techniques described in 

this section are intended to enable the reader to identify and examine the 

effects of SCEs. 

The analysis procedure for performing the qualitative HRA is sumnarized in 

Figure 13. The procedure consists of 6 tasks or steps. Each step is described 

separately in the following paragraphs. 

STEP 1 - Describe the System Goals and Functions 

The purpose of this step is to see where people fit into the system goals 

and functions. The analyst looks for what people are supposed to do to 

accompl i sh various functions and for points of interaction between the system 

and the people. These points are often defined as the interfaces between 

equipment and personnel ; e.g., manual valves, switches for motor-operated 

equipment, displays to be read, and signals or cues to respond to. A useful 

technique for helping the analyst to identify interfaces is called a "link 

analysis". This technique is used to indicate the operational relationships 

between two elements of a system, whether they are two persons or a person and 

a piece of equipment. Link analysis is concerned with their positions, 

arrangements, and frequency of interchange. Once all 1 inks are identified, 

this step in the HRA is complete. However, the link analysis technique itself 

can be extended to gain further information for the task analysis procedure 

(see step 4 and 5) and on suggesting changes to the system' (see step 6). 

Link analysis is normally performed on c e n t r a l i z e d c o n t r o l operations and 

may not be as useful to the mining industry where most of the operations are 

performed manually. However, this technique is useful for defining the 

procedures used to perform a specific task, their proper order of performance, 

and cues to the operator related to which step in the task should be performed 

next. For example, consider the cutting operation at a coal mine. This 

operation is assumed to be performed using a rubber-tired vehicle that cuts the 

rock face with a cutting bar similar to a large chainsaw. A typical cutting 

cycle consists of several steps, including a methane check,'a step to unlock 

the cutting bar, a step for connecting water hoses, and several steps for the 

actual cutting process. Link analysis consists of the following steps: 

(1) Describe the task procedure in the proper operating sequence 

(2) Estimate the time requirements of each step in the procedure 

(3) Draw a simple illustration of the operation and indicate the 

movements of personnel that are required to perform the task. Record 

the locations where the tasks are performed and show by arrows the 

paths the operators must take. 
Describe 

the system 

goals and 

functions 

Describe 

the 

situational 

characteristics 

Describe the 

characteristics 

of the 

personnel 

I 

I 

I 

I 

I 

I 

I 

I 

I 

Task 

analysis 

Describe the 

jobs and tasks 

that the personnel 

perform 

I 

I 

I 

I 

I 

I 

I 

I 

I 

I 

Suggest 

changes 

to the 

Analyze the jobs 

and tasks to identify 

error-1 i kely situations 

(ELSs)&otherproblems 

b I 

s sys tem 

FIGURE 13. - Summary analysis procedure for the qualitative 

portion of a human-reliability analysis 
With the task movements indicated on the diagram drawn in the last step, the 

analyst can identify such items as steps for which too little time is allowed 

for movement between stations, specific locations where the operator frequently 

returns, and cues which inform the operator when a task or step in a task 

should be i n i t i a t e d o r completed. 

Sources of information for this step include schematics, flow diagrams, 

block diagrams, design requi rements, written procedures, and personal interviews with system planners and personnel with experience in the operation of 

similar systems. Visits to an existing or similar plant are also good sources 

of information. An extremely useful source of information is for the analyst 

to actually perform the tasks himself to get a very good understanding of the 

actual and potential problems in each task. 

STEP 2 - Describe the Situational Characteristics 

Many factors affect (or shape) human performance in a complex man-machine 

system. Some of these factors are external to the person in the system and 

some are internal. Such factors include the general work environment 

(especially equipment design and written and oral work procedures), the 

individual's skills, motivations, and expectations, and psychological and 

physiological stresses. These factors are termed "performance shaping factors" 

(PSFs). PSFs determine whether human performance wi 11 be highly re1 iable, 

highly unreliable or some level in between. A checklist of PSFs that can be 

used when performing this step is shown in Table 22. This checklist can be 

used by the analyst to identify the factors that could potentially cause a 

human to comnit a performance error or omit a task or step. The analyst is to 

examine the system goals and functions obtained from Step 1 and identify the 

PSFs that could adversely affect the actions taken by operators. 

As can be seen from Table 22, PSFs can be divided into three general 

categories: (1) those outside the individual, the external PSFs, (2) those 

that are a part of the individual himself, the internal PSFs, and (3) stresses 

and stressors. In general, external PSFs are those that define the work 

situations at the mine. External PSFs fall into three general categories. The 

first category is called "Situational Characteristics". Situational 

characteristics include PSFs that are often plant-wide or that cover many 

different jobs and tasks at the mine. For example, many deep underground mines 

are very warm and humid. These are two measures of the quality of the working 

envi ronment which is a PSF that covers many jobs and tasks at the mine. "Task 

and Equipment Characteristics," include PSFs that are restricted or limited to 

some given job or even to a task within a job. This can be illustrated by the 

many tasks at mines that are performed by workers who specialize in a specific 

job, such as loading and firing blasting rounds or operating the hoisting 

equipment. "Job and Task Instructions," are those PSFs connected with 

instructional and training activities. This is essentially a sub-group of task 

characteristics, but are singled out because they represent an area that is a 

cost-effective method of improving human re1 iabi 1 ity. 

The second general category of PSFs, internal PSFs, are the certain 

skills, abilities, attitudes and other human attributes a person comes to the 
TABLE 22. - Checklist of factors that shape human performance 

- Situational Characteristics 

PERFORtUHCE . SlUPING FACTORS 

EXTERNAL STRE SSORS I NTERHAL 

Archi tectural Features 

Qttal i ty of Environment: . 

Temperature. Humidi ty. 

Air Quality 

Noise and Vibratlon 

Degree of General 

Clean1 lness 

Work Ilours/Work breaks 

Ava i lab i 1 i ty/Adequacy of 

Special Equipment. 

Tools, and Supplies 

tbnning Parameters 

Or anizational Structure 

7e.g.. Autlari ty. Responsibil ity. Communicatlon Channels) 

Actions by Supervisors. Coworkers. Union Representatives. and Regulatory Personne 1 

Rewards, Recogni tion. 

Benef i ts 

Job and Task Instructions 

Procedures Requ i red 

(Hritten or not Written) 

Wri tten or Oral Couunrnications 

Cautions and Warnings 

Work flethods 

Plant Pol icies (Shop 

Practices) 

Task and Equi nent 

Characteristk 

Perceptual Requ i ren~n ts

Motor Requi remnts (S eed. 

Strength. Precision! 

Control-Display Relationships 

Anticipatory Requirements 

Interpretat ion 

Decision-Making 

Complexity (Infornation 

Load) 

Narrowness of Task 

Frequency and Repet i t i veness 

Task Critical i ty 

Long-and Short-Tenn hmry 

Calculational Requirements 

Feedback (Knoul edge of 

Results) 

Continuity (~iscrete vs 

Con t i nuous ) 

Team Structure 

Man-Machine Interface 

Factors: 

Design of Prime Equipwent. Test Equipment. 

Mnufactur ing Equipnent , Job Aids. Tools. 

Fixtures 

Psychological Stressors 

Suddenness of Onset 

Duration of Stress 

Task Speed 

Task Load 

High Jeopardy Risk 

Threats (Of Fa i l ure. 

Loss of Job) 

Monotonous. Degrading. 

or Heaningless Work 

Long. Uneventful Vigi1 ance Periods 

Conflicts of Hotives about 

Job Perfonnarbce 

Reinforcenlent Absent or Nega t i ve 

Sensory Oepri va t ion 

Distractions (Noise, 

Glare. Hovement . Fl icker. Color) 

Incons i stent Cue ing 

Physiological Stressors 

Duratlon of Stress 

Fatigue 

Pain or Discom~fort 

Ilunger or Thirst 

Tsll~erature Extremes 

Radiation 

G-Force Extremes 

Atamspheric Pressure 

Extremes 

Oxygen Insufficiency 

Vibration 

Hoventent Constriction 

Lack of PhysJcal Exercise 

Organi smic Factors 

Previous Training/Experience 

State of Current Practice or Skill 

Personality and Intelligence 

Variables 

Motivation and Attitudes 

Knowledge of Requi red Performance Standards 

Physical Condi tion 

Attitudes Based on lnf 1 uence 

Of Family and Other Outside 

Persons or Agencies 

Group Identifications 
job with. Internal PSFs determine the potential level to which an individual 

can be developed. Attitudes based on both outside and inside influences are 

especial ly important in mining because things are constantly moving about and 

changing. In this type of operation, one brief moment of uncertainty or 

inattention can cause someone to be struck by a moving ore car or by a 

backlashing scaling bar when the rock gives way. 

The third class of PSFs are called stressors. In a well-designed manmachine system, the demands placed on workers to perform their tasks are 

consistent with the worker 's capabi lities, limitations, and needs. Any time 

that the requirements of a task impose too many demands on a worker, performance will suffer. This is one cause of stress. Stress can be psychological 

(mental) or physiological (physical). Stress can arise when there is a 

mismatch between the external and internal PSFs. For example, assume a mine 

under analysis uses blasting to loosen ore from the rock face. Blasting is 

normally restricted to two times each day, at the end of the day and evening 

shifts. This means that work is often hurried towards the end of the shift to 

prepare for blasting or the charge cannot be set until the end of the next 

shift. Many minor injuries, such as pinched fingers, crushed toes, etc., occur 

because of this psychological stressor - excessive task speed. In this 

example, the internal PSFs that motivate workers to complete a blast at the end 

of their shift (such as competition between shifts, bonus pay or incentive 

contracts) overshadow the external PSFs (such as warnings and cautions). 

A detailed explanation of each PSF shown on Table 22 cannot be presented 

in this user's manual due to its length. Fortunately, most of the PSFs are 

self-explanatory statements. For a detailed discussion of each PSF, the reader 

is urged to study the primary reference for this section (Swain and Guttman 

1982). To summarize the procedure, the analyst evaluates the' PSFs in relation 

to the system goals and functions that were identified in Step 1. Then, the 

analyst records PSFs that could have an impact on the performance of humans and 

equipment i ndi vi dual ly and as they interact together to cause accidents. Thi s 

step is particularly useful for identifying areas in which relatively minor 

changes can significantly reduce hazards. 

STEP 3 - Describe the Characteristics of the Personnel 

I n t h i s step, the analyst identifies the skills, experience, training, and 

motivation of personnel who operate and maintain the plant systems. This is 

done so the analyst can understand the capabilities and limitations of plant 

personnel. These aspects are then compared with the demands the systems place 

upon the personnel . Mismatches between capabi 1 ities/l imitations and demands 

requi re modifications to the man-machine interfaces. 

Two important aspects of this step are as follows. First, it is important 

to evaluate people's past experiences with other systems in order to avoid 

transfer of bad habits to the new system. Second, for safety-related systems 

it is especially important to evaluate provisions for response to low 

probability events, such as a failure of the ventilation system at a mine. 

Without this practice, the readiness to handle such events will decrease. 
pp 

integrate the information from Steps 1, 2, and 3 into a logical format. There 

are many different formats for task analysis. The format is unimportant to the 

analysis. However, it is important to describe and analyze each task as 

necessary to identify error-1 ikely and accident-prone situations. A 

recommended task analysis format that includes both a descriptive part and an 

analytical part is shown in Table 23. 

The first five columns in Table 23 are the descriptive part of the example 

format. The analyst considers the job or task under analysis and assigns 

numbers to indicate the sequence of performance. Under the column labeled 

"Instrument or control ,' the analyst indicates each item that displays 

information to the operator, such as bells, lights, gauges, meters, and stripchart recorders. The controls include such items as switches, keys on a 

computer console, connectors, and tools. The column labeled "Activity" is used 

for action verbs that describe the kinds of human actions related to the items 

in the second column. The action verbs used should help identify the kind of 

display or control used. For example, if a toggle switch is used, the words 

"Flip up," or "Flip down" can be used to describe the action. The analyst 

should indicate the position to which a switch is set or other measure of 

response adequacy. Under the column labeled "Cue for initiation or completion 
* Task or Step * 4 

>> 

<s Instrument* 

ctrt 

zz or Control** 

3 3 t 

atn Activity 

ctce 

55 nlw Cue for initiation or cect 

completion of activity -re n 

M ln (immediate or delayed) 

g?, 

3 nl -r. Y u ln 

5 ,. nJ 3 

rt-h Remarks rD 0 

p3 nl 

2. 

0 

? Task or Step 

Scanning, perceptual, 

anticipatory requi rements 

Recall req's 

(LT = long-term 

ST = short-term 

# = initiating 

cue absent or poor) 

Interpreting req's 

Manipulative Problems 

Likely human errors 

(or other problem 

areas) 4 

V, C t 0 w u ct . . 9, 

ln 

x 

. . 

I I 

4 

9, 

ln 

x o . . 0 

3 

2 

c. 

0 

I 

I 

--I ln 

. . 02. 

rD V, 

I mr; 

0 

7 UJ -'* m 

Z% 

-'* < 

0 w 3 0 

-m V, 

4 W 9, 9, 

ln IP K ID 

> 

I 

?!A 

z 

I 

0 

rt -h 

. . 

I I 

w 

9, 

IP 

VI ID 

u-l 

a> 

ZV, 

mr; 

Z 

40 

"'52 

L 
of activity," the analyst indicates the cue that tells the operator when to 

begin a step and the cue that indicates the step has been completed successfully. Errors can result if the design of equipment and procedures do not 

provide good cues. Misleading or incomplete cues can result in the omission of 

some step in a procedure. Column 5, "Remarks," is used for relevant 

information that is not covered in Columns 1 through 4. This completes the 

task description phase that is designed to provide the necessary information 

for the analytical phase (Step 5) where error-likely and accident-prone 

situations are identified and examined. 

A useful aid to the task description process is link analysis (see Step 

1). This tool aids in the design and layout of control rooms and control 

consoles by depicting the pathways among different parts of a system as 

operators and other plant personnel move about checking and manipulating 

gauges, dials, etc., and comnunicating. This type of analysis can suggest 

improvements in the design of control centers and operating procedures to make 

the actions required of operators more convenient and thus, improve human 

performance. Link analysis can be applied to task procedures where a specific 

sequence of steps is required. 

STEP 5 - Analyze the Jobs and Tasks to Identify Error-likely Situations 

(ELSs) and other Problems 

This step is the analytical part of a task analysis. Each human action is 

analyzed to determine error-likely situations (ELSs) arising from equipment 

design features, methods of use, methods of training, and the skill levels of 

people in the system. ELSs involve errors that are likely to occur because the 

demands placed on humans exceed their capabilities and 1 imitations. For 

example, if a toggle switch is used where the up position is "OFF," errors are 

likely because in this country we expect the opposite arrangement. A special 

case of error-1 i kel iness that is often encountered is called an "Accident-Prone 

Situation" (APS). A familiar example of an APS is a slippery floor. 

There are no well -defined rules for making the determinations of ELSs. 

The validity and effectiveness of the task analysis depends upon the ability of 

the analyst to put himself in the place of the operator so the actual and 

potential problems in each task can be identified and understood. For this 

reason, mine safety officials are the ideal candidates for performing a task 

analysis. However, even the best task analyst cannot hope to identify all 

possible human responses, predict a1 1 errors of omission or commission, or 

predict all extraneous actions by personnel. Still, it is possible in a 

thorough task analysis, given sufficient time, to identify - most of the 

important tasks to be performed at a mine and - most of the ways errors may be 

committed. 

The "analytical" part of the task analysis format shown in Table 23 

indicates the kinds of factors'the analyst must consider in identifying an 

ELS. The 1 isted factors are under four broad headings that are selfexplanatory: (1) scanning, perceptual, anticipatory requirements, (2) recall 

requi rements (long-term or short-term memory), and initiating cue (present, 

absent or poor), (3) interpreting requirements, and (4) manipulative problems. 
Normally, entries are made in the analytical half of the form only when the 

analyst identifies an ELS. In reference to the factors in the columns, ELSs 

exist when the operator's capabilities are exceeded by the system demands for 

recall ing, interpreting, decision-making, or manipulating processes. These 

errors can be errors of commission or omission, extraneous acts, or sequential 

or time errors. 

The analyst makes entries in the analytical part of the form only when an 

ELS is identified. The analysis is done for each task or step in a task to 

determine the PSFs that seem likely to result in errors. In other words, ELSs 

are situations in which the performance shaping factors in a task are not 

compatible with the capabilities and limitations of the intended performer of 

the task. Task performance errors can also result when there are conflicts 

between external and internal PSFs. This type of information leads to the 

identification of the causes of ELSs and will indicate if human reliability can 

be improved by changing any PSF. This leads up to the final step in performing 

the qualitative portion of an HRA. 

For further assistance in identifying ELSs, the reader is referred to 

several pub1 ications. Accordina to Swain and Guttman (19821, the most concise 

document' is MIL-STD-14276, Mi 1 iiary Standard, Human ~ngineerin~ Design Criteria 

for Mi 1 i tary Systems, Equipment and Faci 1 ities (U.S. Department of Defense 

4 Two other useful oublications include ERDA-76-45-2. SSDC-2. - Human 

 actors in Desiqn (~ertne; and Bullock 19761 and a textbook Human-Factors in 

kngineering and-~esi gn (~kormick 1975). ~hese documents present large amounts 

ot information on the best ways to design human interfaces. Although these 

documents are useful, the best way to identify ELSs is for the analyst to 

perform the tasks himself supplemented by observing and interviewing operators 

who perform the tasks. To ensure that sufficient information is obtained by 

the analyst, the checklist shown in Table 24 can be used. This checklist is 

extremely useful for identifying the information that should be placed in the 

analytical half of the task analysis format. 

STEP 6 - Suggest Changes to the System 

This is the final step in the qualitative assessment stage of an HRA. In 

this step, the analyst reviews the information obtained in Steps 1 through 5 

and suggests measures that could eliminate or mitigate specific ELSs. The 

three documents on human factors listed in Step 5 are excellent sources of 

information for suggesting these measures. Using the results of the task 

analysis as a guide, suitable design changes to system components can be 

developed that could reduce the 1 ikelihood of human errors, increase the 

likelihood that an error will be detected or corrected, or it may provide for 

the system to tolerate the error. The design changes may address any of the 

performance shaping factors associated with the potential error. 

Advantaaes and Disadvanta~es 

A major advantage of performing an HRA on a mining system is that the 

contributions of human error to system failure can be examined. Human error is 

a potential reason for an accident to occur in the first place, and also 

82 . 
TABLE 24. - A checklist for evaluating task error-likeliness 

- - - - - -- - - - - 

1. The cue or sign that tells the operator to begin each task and each 

activity in a task is simple and unambiguous: 

a. No inconsistencies, gaps, or misleading information that could result 

in errors of judgment. 

b. No competing activities that could interfere with perceiving the cue or 

with responding in a timely manner. 

2. The cue or sign points to the correct task or activity only. 

3. The task or activity is easy to do. 

a. No special problems in the scanning, anticipatory, or other perceptual 

requirements; in long-term or short-term memory requirements; in 

interpreting and decision-making requirements; or in manipulative 

requi rements. 

b. No special problems with competing activities or past experience. 

4. The completion cue or sign for the task or activity is simple and 

unambi guous. 

a. No misleading feedback to the operator. 

b. No special problems with competing activities. 

5. The completion cue or sign for one activity in a task cannot be 

misinterpreted as signaling the completion of the enti re task. 

contributes to less than adequate recovery from accidents. The analysis 

procedure discussed in this section is particularly suitable for identifying 

the causes of human errors, whether they are characteristics of the plant and 

hardware or of the human himself. The results of the analysis suggests areas 

that can reduce the likelihood of human errors by such measures as focusing 

operator training sessions on identified hazards, providing input to safe 

operating procedures, and postulating appropriate design changes. Thi s stage 

of the HRA requires little system safety analysis expertise beyond a detailed 

knowledge of the system, control configurations, and operating procedures. 

The primary disadvantage of an HRA is that an adequate and effective 

analysis is relatively time-consumi ng. The technique a1 so requires si gni ficant 

subjecti ve judgement by the analyst which introduces uncertainty. Also, the 

technique requires more than a detailed knowledge of how the system functions. 

It requires the analyst to know how to operate equipment and components, how to 

monitor plant variables, and what changes in plant variables mean. This, 

however, was considered an advantage in the evaluation of safety methods 

performed for this study because the people who believe they should perform 

these methods, the mine safety officials, are a1 ready knowledgeable regarding 

this information. 
Exam~le of Analysis Procedure 

The example chosen for illustration of the HRA procedure is a roof bolting 

operation at an underground coal mine. The reader should recognize that HRA is 

applicable to all aspects of the mining operation. Only the analysis of the 

roof-bolting operation is presented because a complete HRA of a mining system 

is too lengthy to present in this manual. Roof-bolting is one of the most 

hazardous of a1 1 underground mining operations. The roof bolter is a rubbertired vehicle used to drill holes and insert and tighten expansion-shellanchor bolts into the roof, thus supporting the roof either through beamstrengthening (clamping thin layers into a thick layer) or hanging the weaker 

strata to a competent bed. Normally, drilling is accomplished with a rotary 

action using auger-type bits with tungsten carbide inserts. Dust resulting 

from drilling is collected through the bit and the hollow drill rod. 

The first step of the HRA of the roof-bolting task is to describe the 

operation. A partial description is provided above. It is also recommended to 

perform 1 ink analysis on the operating procedure because this operation 

consists of several steps performed in a specific sequence. The first step of 

the link analysis is to describe the task procedure in the proper operating 

sequence and estimate the time requirements for each step in the procedure. 

This is done below. 

(1) Check general roof conditions and check roof bolt spacings: 

1.0-2.0 minutes 

(2) Methane check: 0.5-1.0 minutes 

(3) Maneuver to first drill hole, extend jacks: 0.2-0.4 minutes 

(4) Place drill steel : 0.1-0.2 minutes 

(5) Drill hole: 0.2-0.5 minutes/foot drill rate 

(6) Add extension to drill steel (or change steel ): 0.1-0.2 minutes 

(7) Place steel aside: 0.05-0.1 minutes 

(8 Lower drill boom, retract drill rods: 0.05-0.1 minutes 

(9 1 Insert bolt and tighten: 0.20-0.50 minutes (without planks or 

straps) 

(10) Place wrench asi de : 0.05-0.1 mi nutes 

(11) Retract stablizing jacks: 0.1-0.2 minutes 

(12) Empty dust bin: 0.5-1 minute 

(13) Mark off hole locations: 0.5-1 minute 

(14) Repeat operations 2 through 12 for subsequent roof bolting. 

Roof quality plays an important role in determining cycle times since the 

length of hole, hole spacing, drilling rate, and the necessity for planks, 

straps, or blocks as part of the roof support are governed by roof conditions. 

Once the procedure has been described and time requirements have been 

estimated, the next step in link analysis is to draw a diagram showing where 

the operating steps occur. Arrows are drawn between these locations indicating 

the movements of the operator. A link analysis flow diagram for the roof 

bolting operation is shown in Figure 14. It can be seen that there is 

considerable mounting and dismounting of the roof bolting machine by the 

operator to perform some of the steps. This is one potential hazard, 
Rock face 

I Roof bolter I 

I (initial position) I I + Haulage way + 

I I 

I 

I I 

Lo-----& 

&. The legend for the numbered task symbols 

is shown in the text 

FIGURE 14. - Link analysis flow diagram for the roof bolting operation 

particularly in moist, humid, and slippery conditions. Another potential 

hazard is to omit the methane check or to perform it out of sequence, thus 

possibly allowing the methane concentration to build to explosive levels 

without being noticed by operators. Similarly, the steps for setting and 

retracting the stabilizing jacks may be omitted or delayed which could cause 

damage to the machine while drilling or when it is moved to a new location. 

Personnel may also be injured if the drill bit slips out of the drill hole 

because the jacks are not in place. A further potential sequencing problem 

could occur if the operator fails to check the hole spacings before drilling. 

Regulations require a maximum spacing of roof bolts (5 ft x 5 ft or less) and 

if this spacing is not met, the likelihood of roof collapse is increased in 
addition to the civil penalties and fines that the mining company would be 

subject to if the proper spacing is not maintained. This essentially completes 

Step 1 of the HRA procedure as it applies to the roof bolting operation. 

Step 2 of the analysis procedure is to describe the situational characteristics associated with the roof-bolting task. To do this, the analyst consults 

the checklist of performance shaping factors (see Table 22) and identifies 

those PSFs that could potentially affect the actions taken by operators. The 

analyst fol lows the task ,operating procedure and identifies the PSFs associated 

with each step in the task. For example, in Step 2 of the roof-bolting task 

procedure, the operator is required to check methane levels in the cut, prior 

to starting the drilling machine motor. It is possible that the operator might 

omit this step and start the motor in a high methane atmosphere and cause an 

explosion. The analyst identifies the potential causes of the operator 

forgetting or deliberately omitting the methane check. Some of the PSFs 

associated with this task error are shown in Table 25, supplemented by a brief 

explanation of why they were selected. Other PSFs are associated with this 

task step but are not shown due to the length of the explanation required. 

Table 25 is presented for illustration purposes only. 

TABLE 25. - Examples of performance shaping factors that 

could cause a roof bolting machine operator to 

omit the methane check 

TASK STEP - Methane Check Prior to Starting Machine 

Potential PSFs 

a Qua1 i ty of environment - Uncomfortable temperature and humidity, 

potential ly slippery conditions. This could cause the operator to 

deliberately omit the methane check because he must dismount the machine 

to do so. 

a Avai labi 1 ity/Adequacy of methane detectors - Operator may feel his 

perception of the methane levels is better than a potentially inaccurate 

or unreliable methane detection device. 

Job and task instructions - Inadequate procedures, warnings, and plant 

policies could affect this step. 

a Interpretation - Possibly the operator performs the methane check and 

misinterprets the results. 

a Frequency and repetitiveness - The operator may feel that since he has 

checked methane levels prior to drilling a previous hole a second check is 

not needed. 

a Man-machine interface factors - Design of the methane detector may be 

inadequate which could lead to interpretation errors. 
Once the PSFs associated with each step of the roof bolting task have been 

identified, the analyst continues to Step 3 of the analysis and describes the 

characteristics of the machine operators and the personnel who maintain the 

machines. The analyst should examine the characteristics of the personnel 

involved in order to determine if the demands placed on the operators by the 

task exceed the capabilities and limitations of the personnel. For example, 

methane checks are repetitive and frequent task steps. Examination of the 

machine operator characteristics may indicate that a particular operator has 

little or no patience for performing repetitive checks which may not yield any 

different results than previous checks. This is a comnon characteristic of 

humans and in this case it would only take one omitted methane check to 

seriously injure that operator. The analyst continues to compare the personnel 

characteristics with the PSFs to determine this type of information for each 

task and each step in the tasks. 

Steps 4 and 5 of the HRA procedure together constitute a task analysis. 

Results of the task analysis are often combined on one table, as shown 

previously in Table 23. Step 4 consists of the descriptive portion of the task 

analysis and Step 5 is the analytical part. The objective of these two steps 

together is to identify error-1 ikely situations and their potential causes. A 

completed task analyis for human error while checking methane levels prior to 

starting a roof bolting machine is shown in Table 26 for the reader to follow 

throughout the following i 1 lustration of the task analysis procedure. 

As can be seen in Table 26, the step in the roof bolting task for the 

methane check is broken down into four smaller units of behavior, labeled 2A, 

26, 2C, and 2D. The procedures for these sub-tasks are described in column 3 

of the table. Activity 2A is for the operator to dismount the roof bolting 

machine, acquire the .methane detector, and advance to the rock face. There is 

no cue or sign for the operator to begin this activity. This is recorded in 

column 4. In column 5, the analyst places remarks concerning the performance 

shaping factors associated with the activity. The identified PSFs for sub-task 

2A include the quality of the environment (often hot, humid, slippery, and dark 

conditions), perceptual requirements (the operator should know when not to 

expose himself to a loose roof), task speed (treacherous footing), and fatigue 

(over-tired operators are more likely to omit part of a task or commit an 

operating error). In addition, this column is used for recording personnel 

characteristics that may have an impact on task performance. Note that one 

operator i s identified as one who lacks patience and takes unnecessary chances 

for the sake of increased speed at his tasks. Other examples of items of this 

nature include personal problems, medical conditions (such as back injuries, 

asthma, alcohol ism, etc.), personal capabi 1 ities (such as physical strength, inshape, out-of-shape, etc.) and mental capabi 1 ities (disciplined, expertise in 

some specific area, reasoning ability, etc.). This completes the descriptive 

part of the task analysis. 

Next, the analyst begins the analytical por ion of task analysis. The 

objective of this part of the analysis is to ide d tify situations where human 

error is 1 i kely and thei r potenti a1 causes. Error-1 i kely situations may arise 
1 kg 

Yal 0 C Y cO 2 U'Y u 36 

(soado mlqo~d ~aqao= , & YU ~OC 

10) SJOJJ~ umunq Qaq~1~ 82 E"l 

er= u w al . y=E 4 .- ul 

Q C L L mc ul 

m al acoa 

U-- U 

55 % UU ul aJ omoc 2;s C al- c I L as 

Y L 

ulu I U 1 al3Y 

n 

ruralqud anbao lnd~uo~ = 

$6 0 L 

cala 3 P 

CUO 

m 3 WSL 1 OCOL 

C-cC g SZY - a= %Y 

(~ood JO auasqv ana 

6uca~!akuc - Y 

uuaa-uoqs - IS = 

uuaa-buol U) 

-- g-" -- ul - C3s *- 

3$=al-Yv)W mal my. mal -ualal 3L CC UYLmalUQh a000 a- o QC PO- L ~uYCUa!m-OOYulP 

# 

sau- knbad 1 lo3au 

from equipment design features, methods of use,.methods of training, and the 

skill levels of.people in the system. The kinds of factors the analyst is 

looking for in each human action are grouped into four broad categories, as 

shown in columns 7, 8, 9, and 10 of Table 26. Column 7 is for scanning, 

perceptual , and anticipatory requi rements. The analyst examines the number 

and kinds of gauges, dials, labels on switches, warning signs, and other items 

that convey information about the process to the operator. With this 

information the analyst can identify situations where the operator may omit a 

step or fail to detect a hardware failure, alarm, or other cue for the operator 

to begin a task. Recall requirements for the tasks are recorded in column 8. 

Recall requirements can be categorized into short-term memory and long-term 

memory requi rements. The analyst examines the thinking processes that 

operators must use to perform their tasks and identifies whether the task 

procedure is one that is considered by the operator frequently (possibly daily 

or weekly) or infrequently. Emergency evacuation procedures are an example of 

a 1 ong-term memory i tem. Emergency procedures are not frequently considered by 

workers. Obviously it i s not economical to practice emergency evacuation 

procedures at a mine on a relatively frequent basis. Therefore, other methods 

for training workers to escape from an emergency situation must be utilized in 

addition to infrequent practice evacuations. Such measures as emergency, 

battery-powered lighting and posted, well-lit escape routes are often used at 

mines and other operating systems. Interpreting requirements are recorded in 

column 9. For this column, the analyst examines the workers' responses to the 

cues for him to begin or complete a task. Often workers are required to 

analyze a situation and react accordingly, gathering information from 

indicators, alarms, gauges, and his environment. As can be seen from the 

example in Table 26, environmental variables can play an an important role in 

interpreting requirements at mines where conditions are often wet and 

slippery. Excessive task speed is also a likely cause of interpretive errors. 

Manipulative problems are recorded in column 10. These are problems regarding 

the physical performance of the task. In the example problem, potential 

manipulative problems related to the wearing of gloves are identified. These 

items are most often related to the design of the control mechanisms, plant 

hardware, and work stations. A further example might be a toggle switch in 

which the up position means OFF and the down position means ON, exactly the 

opposite of what is expected in this country. This completes the 

identification of factors that could cause error-1 i kely situations. The. reader 

should recognize that this process is repeated for every task and operation at 

the mine requiring human interaction. 

Error-likely situations are identified and recorded in column 11 of the 

task analysis form, The identification of ELSs is facilitated by the use of a 

checklist of questions that the analyst asks himself to answer. This checklist 

was shown previously in Table 24. The analyst begins at the top of the list 

and evaluates each question in regard to the performance of the tasks under 

analysis. For example, an ELS was identified in Task 26, the check-out of the 

methane detector required before its actual use. The analyst inspected the 

checklist and identified items that were inconsistent with the statements 

contained therein. The specific statement that the actual situation conflicts 

with is Item 3a of Table 24, "No special problems in scanning, anticipatory or 

other perceptual requirements ; in interpreting and deci sion-making requirements; 
or in manipulative requirements." More specifically, the actual situation in 

the mine has many distractions, normally poor environmental conditions (muddy; 

coul d result in warning signs and equipment operating stamps being rendered 

unreadable), and there is often significant economic incentive for workers to 

perform their tasks as quickly as possible. Any of these situations can result 

in a task performance error which in this case is an error of omission of a 

step in a task. The analyst continues evaluating each task described in 

columns 1 to 5 of the task analysis table, consulting the checklist for each 

task step, until he has examined every task and step in a task for ELSs. This 

completes the discussion of the example of the task analysis procedure. The 

results can be used to prepare a checklist of ELSs for the safety official to 

use in planning a hazard reduction program, communicating the results to 

management, and identifying areas for safety improvements. 

The analyst's next step is to use the information obtained thus far to 

postualte measures that could eliminate or mitigate specific ELSs. In the 

stated example, one of the identified ELSs is where a worker reads an 

inaccurate methane level due to an improperly functioning detector 

(Activity 28). The effects of such a reading can potentially cause an 

explosion and multiple deaths if the detector gauge reads a lower methane 

concentration than is actually present or can cause an unnecessary shutdown of 

operations if the actual methane level is lower than the detector is 

indicating. The potential causes of this ELS are a lack of cues for initiation 

and performance of the detector check-out test sequence, the fact that this 

procedure is repeated many times every day, excessive task speed, and 

potentially poor environmental conditions. In consideration of this 

information, possible measures for miti gating this ELS include: (1) focusing 

worker training on the need for proper testing procedures for methane 

detectors, and (2) permanently attaching.a sign in a conspicuous location on 

each methane detector that indicates the testing and operating procedures. 

Little can be done to eliminate the excessive task speed, repetitiveness, and 

poor envi ronmental conditions, beyond informing miners of the hazards. 

However, if a particular worker refuses to follow procedures or continues to 

work excessively fast after repeated warnings, he could be removed from 

responsibility for this task and thereby eliminate his contribution to the 

ELS. The analyst continues down the task analysis table and suggests possible 

measures to eliminate or correct potential ELSs inherent in each task and step 

of mining operations. This completes the discussion of the example problem. 

Computer Adaptabi 1 i ty 

Much of the HRA procedure follows a structured and iterative format. Task 

analysis, which is the heart of the qualitative portions of HRA, follows such 

a format. It is believed that task analysis could be adapted to a userinteractive computer program for this reason. Also, the checklist of 

performance shaping factors (see Table 22) and the checklist for evaluating 

task error-likeliness (see Table 24) can be input to a computer memory and 

recalled when the analyst desires. There is no better way of gathering human 

reliabi 1 ity information than to perform the tasks under analysis personally. 

Thus, procedures such as link analysis and the task of gathering and recording 

system description information may best be performed externally to the 
computer. Furthermore, the computer has the capabi 1 ity to display only about 

one page of information at a time. It is desirable in the first three steps of 

the analysis to be able to quickly review several pages of information without 

losing the train-of-thought. This is facilitated by having the information on 

separate pages that can be seen simultaneously by the analyst. Thus, at least 

initially, it is recomnended that only portions of the HRA procedure described 

in this section be adapted to the computer. 

A conceptual user-interactive HRA computer program was developed as part 

of this study. As discussed above, a good deal of work is required before the 

analyst can sit down and initiate the computerized analysis. Link analysis is 

believed to be not readily adaptable to the computer, due to the drawing 

requi red, a1 though graphics capabi 1 i ties of current computer systems are 

improving. The analyst may wish to record the significant results from the 

link analysis in the computer memory to be recalled later in the analysis. For 

example, 1 ink analysis is particularly useful for identifying sequential errors 

(omitting or performing steps in a task in the wrong sequence). If the analyst 

identifies a likely situation where a sequential error could occur, this 

situation can be described and input to the computer memory with appropriate 

references to the link analysis flow diagram where the situation is described. 

When the analyst is performing the task analysis, the sequential errors in the 

computer memory are avai lable as the analyst desi res. 

The conceptual HRA computer program is a two-stage approach. A flow 

chart for this conceptual program is shown in Figure 15. Stage 1 is 

essentially a user-interactive aid that facilitates performance of the task 

analysis (see Steps 4 and 5 of the HRA procedure). The computer program is 

envisioned to contain a large set of questions corresponding to the columns of 

the task analysis format shown in Table 23. The computer will display these 

questions in the same logical format shown in the table. The analyst will then 

type the answers to the stated questions into the computer processor. The 

computer then stores the information in appropriate locations i n i t s memory. . In essence, the computer program serves as a guide to the analysis procedure 

and as a permanent record of the task analysis results. The computer can be 

programmed to print out the results in a format that might be useful to mine 

safety officials as a checklist of potential causes of human errors. This 

checklist is envisioned to contain the error-likely situations at the mine and 

the potential performance shaping factors and human characteristics that could 

produce ELSs. This checklist is useful for identifying changes to the mining 

system that can reduce the likelihood and consequences of human errors. It can 

also be used to convey results of the analysis to mine management. 

A further feature of the conceptual HRA computer program is the 

possibility of inputting several checklists to the computer memory. These 

check1 ists facilitate performance of the HRA by reducing the large checklists 

and statements on the checklists to a computer-useable form. In other words, 

the statements on the checklists will be indexed to allow the analyst to simply 

input an index number to the computer memory rather than the entire statement. The computer program will be able to remember which statement goes with 

each index and when displaying or printing results would search for the 

appropriate index and output the statement associated with that index. This 

scheme could be applied to the checklist of performance shaping factors (used 

in Steps 2, 4, and 5), and the checklist for evaluating task error-likeliness 

(used in Step 5). The latter checklist could be programmed directly into the 

computer software and used as a guide for performing the analytical part of the 

task analysis. The user-interactive computer software can be programmed to 

display these statements to prompt a response from the analyst. The analyst 

inputs the appropriate index for the PSFs associated with the task that could 

potentially contribute to an error-likely situation, and the computer stores 

this information in memory. The analyst can also add remarks or other findings 

as narrative statements where appropriate, such as when an adverse personal 

characteristic of a specific worker is identified. This completes the 

discussion of Stage 1 of the conceptual computer program. 

Stage 2 of the conceptual HRA computer program is envisioned to contain 

key-word search and word processing capabi 1 ities. Since mines are constantly 

changing and expanding, the initial HRA performed on a mine is likely to become 

outdated in a short period of time. In addition, mining equipment is revised 

periodically by manufacturers to incorporate state-of-the-art features that are 

not present on older models. Therefore, the conceptual HRA computer program is 

envisioned to include capabilities that can update, revise, and modify the 

initial analysis when and where it is appropriate. To illustrate this, assume 

that an initial HRA determined that use of flame safety lamps to detect methane 

levels contributes to many error-l i kely situations. The safety official and 

mine management evaluated this situation and decided to purchase state-of-theart methane detectors to reduce the 1 ikelihood of human error in this 

situation. To update the computerized HRA, the analyst simply locates tasks 

and task steps in which methane detectors are used by utilizing the key-word 

search capabilities of the computer. He then uses the word processing 

capabilities of the computer to delete the old information and type in the 

updated information. The reader should recognize that this process is 

significantly more efficient than if the analyst were to search the large 

amount of paperwork that can result from a paper-type HRA study. 

Estimated Costs of Implementation 

Two cost estimates are developed and presented in this section; 1) costs 

for implementing a paper-type HRA study and 2) costs for a computerized HRA 

study. The costs for implementing an HRA paper-study are dominated by the 

costs of labor. It is estimated that a detailed qualitative HRA of a mining 

system would require about 2.0 man-years of safety staff labor. Assuming the 

safety staff is paid $15.00/hra, and including overheads, benefits, taxes, and 

uncertainty (unit cost estimates are developed in the final report for this 

study and the bases and assumptions will not be repeated here), total labor 

costs are estimated to be in the range of $90,000 to $120,000. The annual 

costs for updating and revising the analysis is estimated to require about 3 to 

4 man-months/yr. The total annual costs for this activity are estimated to be 

about $10-,000 to $15,00O/yr. 

The estimated costs for implementing a computerized HRA safety program 

includes capital and installation costs for the computer hardware in addition 

to the staff labor costs. Capital and installation costs for an adquate 
computer system are estimated to be about $5,000, including delivery and 

suppl i es (see final report for a survey of available microcomputer systems). 

Annual maintenance costs are assumed to be 10% per year of the initial purchase 

price. Also included in the costs for implementing this computer program are 

the costs for the safety staff to attend week-long short courses on computer 

training and safety analysis training. These costs were developed in the final 

report prepared for this study and will not be repeated here. The total fixed 

and operating costs are summarized below: 

FIXED COSTS 

Computer system purchase 

and installation . . . . . $ 5,000 

Short course attendance 

and expenses . . . .. . , $ 9,000-12,000 

Analyst's fully burdened labor costs 

Initiate program . . . . . $ 10,000-15,000 

Perform analysis , . . . $90,000-120,OO 

TOTAL • • • • • . $114,000-152,000 

OPERATING COSTS (after f i rst year) 

Computer system maintenance 

and supplies . . . . . . $ 500/yr 

Analyst's fully burdened labor costs , . $10,000-15,00O/yr 

TOTAL . . . . $10,500-15,500/yr 

The reader should recognize that the above estimated costs do not contain 

the costs for development of the computer software, It is difficult to 

estimate these costs accurately. Further, it is not known whether these costs 

wi 11 be borne by the government or the mining industry. Therefore, software 

development costs are in addition to the estimated costs for implementing the 

HRA safety program shown above. It should also be noted that since safety 

staff labor charges are included in the above estimates and since the HRA 

safety program would replace some of the safety staff's current duties, the 

actual additional costs for implementing the HRA program are lower. 
REFERENCES 

1. Cybulskis, P., et a1 . 1981. Review of Systems Interaction + Methodolo ies NUREG/CR-1896, Battel le Columbus Laboratories, Col umbus, 

2. Hammer, W. 1972. Handbook of System and Product Safety. PrenticeHall, Inc. Englewood Clitts, New Jersey. 

3, Johnson, W.G. 1973. The Management Oversight and Risk Tree - MORT, 

SAN 821-2, U,S. Atomic tnergy Commission, Washington, D.C, 

4, Jordan, W,E. 1972, "Failure Modes, Effects, and Criticality Analyses" in 

Proceedings of Annual Re1 iabi lity and Maintainabi 1 ity Symposium, San 

sco 1912, Institute of Electrical and Electronic tngineers, New 

Pork, New York, 

5. Knox, N.W. and Eicher, R,W, 1976, MORT User's Mariual , ERDA-76-45-4, 

SSDC-4, Aerojet Nuclear Co,, Idaho balls, Idaho. 

6, Lambert, H,E. 1975. Fault Trees for Decision-Making in Systems 

Analysis, UCRL-51829, Lawrence Livermore Laboratory, Livermore, 

7, McCormick, E,J, 1975. Human Factors in Engineering and Design, 4th 

ed., McGraw-Hi 11 Co,, Rew York, New York, 

8, Nertney, R.J. and Bullock, M.G. 1976, Human Factors in Design, ERDA-76- 

45-2, SSDC-2, Aerojet Nuclear Company, Idaho la1 ls, Idaho, 

9. Swain, A,D., and Guttman, H,E. 1982, Handbook of Human Reliability 

Analysis with Emphasis on Nuclear Power Plant Applications, NUREGrCRn18, Sandia National Laborator es, A1 buquerque, New Mexico, 

10, U ,S, Department of Defense 1974 Mi 1 i tary Standard, Human Engineering 

Design Criteria for Military Systems, Equipment, and Facilities, MIL-STD- 

~ZB, Washington, D.C.