Meet Your Tutor

Debjyoti Biswas is an Approved Tutor of the OTHM Level 6 International Diploma in Occupational Health and Safety Qualification and a CertIOSH Member. His teaching approach connects Level 6 knowledge with practical workplace application, evidence-based judgement, leadership and professional development.

What Is Reliability?

Let us begin with one easy question:

If you ask a machine, alarm, pump or complete safety system to do its job, how confident are you that it will perform correctly without failing?

That confidence—expressed as a probability—is reliability.

Required function
The exact job the item must perform. A fire pump must deliver water; a gas detector must detect gas.

Stated conditions
The real environment and duty: temperature, pressure, dust, workload, operating mode and maintenance condition.

Specified time
The period for which successful operation is required—for example, a 100-hour mission or an emergency demand.

Without failure
The item completes the required function without stopping, leaking, giving a false signal or becoming unavailable.

Probability
The answer is normally written between 0 and 1, or as a percentage from 0% to 100%.

Reliability = Probability that an item performs its required function, under stated conditions, for a specified time, without failure

Now apply that idea to a complete system.

A system is a group of connected parts—equipment, power, controls, information, people and procedures—working together. System reliability asks whether the complete required function succeeds.

One safety function may depend on detection, decision, warning and action. Failure of a required link can prevent the complete system from protecting people.

Explore One Safety Function—One Step at a Time

Imagine a gas-release protection system. Select each part to understand its job.

The DB HSE Emergency-Protection System

Watch how the same scene gives us nine different questions

Why Do HSE Professionals Need These Calculations?

Statements such as “the machine fails frequently” or “the alarm is usually reliable” are opinions. Reliability calculations convert operating, failure and repair records into evidence that can be compared, investigated and improved.

Understand Every Symbol Before Calculating

Select a symbol to see what it means and where it is used.

Explore Each Reliability Calculation

Choose a calculation, change the figures and examine how the result and interpretation respond.

Mean Time Between Failures — MTBF

Mean means average. MTBF is the average operating time between one failure and the next failure of repairable equipment.

MTBF = T ÷ N

T = total operating time
N = number of failures

Why it is relevant

• Compares the reliability of machines or operating periods.
• Supports preventive-maintenance planning.
• Shows whether failures are becoming more frequent.
• Provides evidence for investigating deterioration or repeated component failure.

Important interpretation

A higher MTBF is generally better. A falling MTBF—such as 1,000 → 600 → 300 hours—means failures are occurring more frequently and should be investigated.

Live MTBF calculator

Total operating time, T (hours) Number of failures, N

See the complete worked example

1. Record total operating time: T = 5,000 hours.
2. Record failures: N = 10.
3. Divide 5,000 by 10.
4. MTBF = 500 hours.
5. Interpretation: the machine operated for an average of 500 hours between failures.

MTBF trend inspector

Enter MTBF values from oldest to newest

What can make MTBF fall?

Equipment deterioration, ageing parts, ineffective maintenance, overloading, poor lubrication, incorrect operation, harsh conditions or repeated failure of the same component. Use maintenance records, failure reports and operating evidence to test these possibilities.

Reliability of a Parallel System — R_p

R_p is pronounced “R sub p”. The subscript p means parallel. A parallel system contains backup or redundant components and continues to operate if at least one independent component remains functional.

R_p = 1 − [(1 − R₁)(1 − R₂) …]

R_p = parallel-system reliability
1 − R = probability that a component fails

Why it is relevant

Redundancy may improve the reliability of fire pumps, emergency generators, ventilation, alarms, communication systems and emergency shutdown arrangements.

Common-cause failure

Two backups are not fully independent if they share the same electrical supply, fuel source, control panel, cooling system, room or maintenance error.

Live parallel-system builder

Component reliabilities as percentages

Combined Interpretation Dashboard

These figures describe different aspects of the same machine. One figure alone does not provide a complete reliability assessment.

Use Calculations for Failure Tracing

Move From a Number to a Defensible Judgement

Four Ways to Analyse Performance

Compare Two Performance Periods

Change the data. The tool calculates MTBF, MTTR, λ, availability, R(t) and F(t), then explains the direction of change.

One Indicator Can Mislead

Start With a Clearly Defined Failure Event

Select the Result That Changed

Twelve Steps From Function to Verification

Select each step. A competent investigation may move back and forth as new evidence appears.

Do Not Stop at the First Technical Explanation

Find the Component Dominating the Failure Record

Human, Organisational, Common-Cause and Hidden Failures

Recurring Pump-Seal Failure: Before and After

Verification: the recalculated results support the conclusion that the actions improved performance. Continue monitoring to confirm that the improvement is sustained and has not introduced another risk.

What the Calculations Can and Cannot Prove

Reliability Case Studies

Compressor comparison

Compressor A operates for 12 months without failure. Compressor B requires repair every six weeks.

Reveal the reliability interpretation

LEV performance deterioration

Capture velocity falls from 0.52 m/s to 0.28 m/s while fume concentration rises from 1.2 mg/m³ to 4.8 mg/m³.

Reveal the failure-tracing response

Test Your Understanding

What Is Risk Control?

The Risk-Assessment Process—Seven Clear Steps

Different organisations may group the stages differently. Here, we use the seven stages indicated for this learning outcome, followed by a continuous review loop. Select each step to hear the portal explain it.

Control Standards, Action Plans and Priority

Generic, Specific and Dynamic Risk Assessments

These are not three levels of quality. They are three ways of matching the assessment to the work situation.

What Do Generic, Specific and Dynamic Assessments Actually Look Like?

Think of these as three different lenses. A generic assessment establishes a reusable baseline. A specific assessment focuses that baseline on one real task, place, item, substance or person. A dynamic assessment keeps checking the live situation while work or an incident develops.

Do Not Miss Long-Term Hazards to Health

An injury hazard may produce an immediate event. Many health hazards are quieter: exposure can accumulate and illness may appear months or years later. “Nothing happened today” is not evidence that the risk is controlled.

Qualitative, Semi-Quantitative and Quantitative Assessment

The difference is how the risk is described and analysed—not how seriously the assessor takes it.

From Professional Description to Ranked Scores and Probability Models

There is no honest single-name answer to “who invented risk assessment?” People have judged danger for as long as organised work has existed. Modern methods developed gradually as industries needed decisions that were more systematic, comparable and technically defensible.

One decision may need three kinds of evidence

The methods are a progression of detail—not a competition

Qualitative thinking helps us name what may happen and judge its importance. Semi-quantitative scoring helps a group rank and compare many concerns using defined categories. Quantitative analysis estimates frequency, probability, exposure or consequence when the decision needs numerical evidence.

A major quantitative study still begins with qualitative questions: Which scenarios matter? What assumptions are credible? Who may be affected? A risk matrix still needs professional judgement. The methods often work together.

The Qualitative, Semi-Quantitative and Quantitative Assessment Workshop

We will use one scene throughout: pedestrians and forklifts interact in a busy warehouse loading area. This makes the difference easy to see—the hazard does not change, but the depth and form of the analysis changes.

Interactive Qualitative Risk-Assessment Form

A qualitative assessment uses defined words and reasoned professional judgement. It does not multiply scores. The record must explain why the likelihood, consequence and overall priority descriptions fit the evidence.

Interactive 5 × 5 Semi-Quantitative Risk Matrix

Compare the initial risk with the residual risk after proposed controls. The example bands are for learning only; an organisation must define and approve its own criteria.

A Simple Quantitative Comparison Tool

Quantitative Scenario-Frequency Calculator

This teaching model follows one event path. It estimates how often the defined harmful outcome may occur by combining an initiating-event frequency with conditional probabilities. It is useful for learning the logic of event trees; it is not a substitute for a validated QRA.

Interactive Quantitative Risk-Assessment Form

A quantitative assessment records more than a calculation. It defines the decision, scenario and model; gives every input a source and unit; shows uncertainty; compares the result with an approved criterion; and records treatment and verification.

Build a Complete Risk-Control Action

An action without an owner, date, interim measure and verification method is only an intention. Complete the fields and create a practical action-plan entry.

Meet the Six Strategies

Select a card. The portal will explain when to use it, when not to depend on it, and what a Level 6 justification should recognise.

When Each Strategy Is Most Relevant

Interactive Strategy Decision Lab

Choose a workplace situation and the strategy you think should lead the response. The tool will explain the strongest answer and supporting strategies.

Risk Reduction Must Follow the Hierarchy of Controls

When a risk cannot be avoided completely, begin with controls that act on the hazard and exposure pathway. Measures lower in the hierarchy usually depend more heavily on consistent human behaviour.

Risk Transfer—The Point Learners Must Not Miss

Build a Level 6 Justification

Use the structure Decision → Because → Evidence → Limitation → Review. This produces a learning scaffold that you should explain in your own professional words.

Analysis, Evaluation and Review—Do Not Mix Them Up

Common Errors—and the Better Approach

Can You Make and Justify the Decision?

Learn One Control Layer at a Time

The portal starts with the wider safe system of work, develops it, then moves to the more focused safe operating procedure. Only after both are clear do we connect the document family and explore the complete permit-to-work lifecycle.

DB HSE learning resource. Prepared solely by Debjyoti Biswas for teaching Unit 3, Section 2.3. This independent learning portal is not produced by OTHM and does not issue workplace authority.

A Risk Assessment Decides What Must Be Controlled; the System of Work Decides How

One Scenario, Four Stages of Control

We will use the same chemical-transfer pump throughout Section 2.3. This allows you to see how one risk picture is converted into a complete working arrangement.

What Is a Safe System of Work—SSOW?

Do Not Mix Up the Document Family

The documents are connected, but they do different jobs. The level of formality should be proportionate to the risk, complexity and need for coordination.

Fifteen Stages for Developing an Effective Safe System of Work

The stages are grouped into five phases. Select a phase to explore what must happen and why.

What Is a Safe Operating Procedure—SOP?

How Is an SOP Developed?

Select each phase. The five phases contain ten connected stages: define → observe → assess → sequence → write → validate → approve → train → use → review.

Characteristics of a Strong SSOW and SOP

A good document must be technically correct and usable by the people who depend on it. These characteristics are evidence of quality—not decorative features.

How the Six Risk Strategies Shape the System of Work

These strategies are not six competing documents. They influence different decisions during development, authorisation and assurance.

Build an Educational Safe System of Work Draft

Adjust every field to your own workplace example. The output helps you understand the structure; it must be reviewed by competent people against the real workplace and applicable requirements before use.

Build an Educational Safe Operating Procedure Format

An SOP should tell the right person what to do, in what order, under which conditions, and when to stop. It should not ask the user to make undefined safety decisions during a critical step.

Tool: Put the Pump-Maintenance Controls in a Defensible Order

Use the arrow buttons to move each step. The “correct” route is the approved teaching sequence for this example; a real installation may require a different, technically validated sequence.

Permit-to-Work—PTW: Meaning, Purpose, Issue, Use, Handback and Closure

Why is a permit-to-work used?

A PTW creates disciplined communication where mistakes in plant identity, isolation, timing, coordination or handover could cause serious harm. It defines ownership, prevents incompatible simultaneous activities, records critical precautions, controls the period of work and manages the return to normal operation.

Who is involved?

Terminology varies: a site may use different role names. The essential point is that authority, competence, accountability, communication and handover cannot be vague.

The Full PTW Lifecycle—14 Phases

Select a phase to see what must happen, why it matters and what evidence should exist.

What should a complete permit form contain?

Tools: SSOW Quality Diagnostic and Review Trigger

Weak Wording Versus Defensible Wording

How to Explain 2.3 at Level 6

Can You Convert a Risk Decision Into Safe Work?

What Do “Loss” and “Causation” Mean?

Our Master Case: Forklift Contact With a Process Line

A forklift enters a congested transfer-area route, passes a damaged low barrier and contacts a valve manifold. A small chemical release occurs. The alarm operates, workers withdraw and the response team isolates the area. No model should be used to blame the driver or to assume a cause before evidence is gathered.

Accident and Incident Ratio Studies

Ratio studies arrange recorded events by consequence level. They helped organisations recognise that low-consequence events and near misses can reveal control weaknesses before a major loss occurs.

Who, when, why—and what changed?

1931 — HeinrichH. W. Heinrich published Industrial Accident Prevention: A Scientific Approach and presented the historical 1:29:300 relationship.

1959–1965 — BirdFrank E. Bird Jr.’s Lukens Steel study examined about 90,000 incidents and reported a 1:100:500 pattern.

1969 studyBird and colleagues analysed 1,753,498 accident reports from 297 companies and produced the widely taught 1:10:30:600 ratio.

Modern useThe triangle is now best treated as a prompt for reporting and investigation—not a law, prediction or promise that minor-event reduction will automatically prevent catastrophe.

Why it was created: to show that the serious injury at the top is only part of the recorded experience. Lower-consequence events may provide more frequent opportunities to discover exposure and weak controls.

How thinking changed: Bird widened the categories to include property damage and near misses. Later research showed that the shape changes with definitions, industry, severity threshold and reporting practice, and that fatal and non-fatal events can follow different causal pathways.

Historical context: DNV tribute to Frank Bird. Critical evidence: Salminen, Saari, Saarela and Räsänen (1992) and Marshall, Hirmas and Singer (2018).

Bird’s Loss-Causation Model and Multi-Causality

Bird’s expanded domino approach connects management control with basic causes, immediate causes, the incident and the final loss. Removing or strengthening an earlier “domino” can interrupt the sequence.

Multi-causality: More Than One Path Can Matter

Multi-causality rejects the idea that one unsafe act is normally a complete explanation. Several conditions may combine, interact or increase one another’s effect. Causes can exist at task, equipment, environmental, individual, supervisory and organisational levels.

The Swiss Cheese Model

James Reason described safety as several layers of defence, barrier and safeguard. Each layer can contain weaknesses—shown as “holes.” An adverse trajectory can pass through when weaknesses in different layers align.

James Reason: from human error to organisational defences

Who and when: British psychologist James Reason developed the model across the 1990s, beginning with ideas in Human Error (1990) and refining the familiar defence-layer image through the decade. Safety practitioner John Wreathall also influenced its development.

Why: Reason wanted to move investigation beyond “the operator made an error.” The model asks how front-line actions combine with weaknesses created earlier by design, staffing, maintenance, supervision and organisational decisions.

How it changed: diagrams and terminology evolved between 1990 and 2000. This matters: Swiss Cheese is a family of evolving explanations, not one frozen diagram. Later safety thinking also stresses that defences interact dynamically and that a simple line through holes must not replace evidence.

Read the system approach in Reason (2000), Human error: models and management, and the historical critique in Larouzee and Le Coze (2020).

Limitation: The cheese image is a communication model, not a detailed dynamic simulation. It can oversimplify interactions unless each layer, threat, dependency, owner and performance requirement is defined with evidence.

Fault Tree Analysis and Event Tree Analysis

How structured logic entered safety analysis

Fault Tree Analysis: commonly traced to H. A. Watson at Bell Laboratories in 1962 during the Minuteman missile programme. It was created because complex systems could fail through combinations that a simple checklist might miss.

Event Tree Analysis: developed as a forward, consequence-oriented partner to fault-tree reasoning. Probabilistic risk work such as the US Reactor Safety Study, WASH-1400 (1975), helped establish combined fault-tree and event-tree methods for complex high-hazard systems.

What changed: the techniques expanded from defence and nuclear applications into aviation, process safety and other industries. Software can now evaluate very large trees, but the logic, data, dependencies and uncertainty still need competent human review.

Authoritative background: NRC Fault Tree Handbook and NRC history of WASH-1400.

The Bowtie Model

Bowtie combines fault-tree thinking on the left and event-tree thinking on the right. It places the top event—the moment control over the hazard is lost—in the centre.

A collective industrial technique—not one person’s invention

There is no single uncontested Bowtie inventor or creation date. The visual method evolved collectively from fault-tree and event-tree thinking and was progressively adopted in high-hazard industries. It became popular because a multidisciplinary team could see the complete threat–control–loss pathway on one page.

Why it is used: to connect each threat to a preventive barrier, define the loss-of-control top event, connect consequences to mitigating barriers and make critical-control ownership visible.

How it changed: modern practice adds escalation factors, escalation controls, barrier owners, performance standards and assurance evidence. A decorative “bowtie picture” without these elements is not enough for control management.

See the UK Government Bowtie overview and the Office of Rail and Road’s health-risk application.

Behavioural Root-Cause Analysis

Behavioural RCA examines what a person did and the conditions that made the behaviour understandable or likely. It should not become a search for someone to blame.

Where the ABC idea came from

Who and when: there is no single creator of “behavioural root-cause analysis.” Its ABC structure grew from twentieth-century behavioural science. Psychologist B. F. Skinner’s work on operant conditioning helped explain how consequences can strengthen or weaken behaviour.

Why safety practitioners use it: repeated behaviour often makes sense when the antecedents are clear and the immediate consequence is easier, faster or socially accepted. ABC analysis makes these influences visible.

How it changed: modern human-factors practice rejects a behaviour-only explanation. ABC evidence should be combined with task design, competence, equipment, workload, supervision, leadership, culture and organisational controls. This prevents “the worker chose badly” from becoming the false root cause.

Boundary: A fair system approach does not mean that every action is acceptable. Deliberate reckless conduct may require a just and proportionate response, but the investigation must still examine supervision, controls and organisational context.

Tool: Which Causation Technique Should Lead?

Complex investigations often combine techniques. Select the main question to see a defensible starting point.

From Raw Loss Records to Decision-Useful Evidence

Symbols Used in the Calculations

Calculate and Interpret Loss Rates

Formula conventions vary. Examples follow official explanations from the US Bureau of Labor Statistics, International Labour Organization, and UK HSE ill-health statistics guidance.

Tool: Compare Two Sites Fairly

Counts answer “how many?” Rates help answer “how many for the amount of exposure?” Use the same event definition, period and multiplier.

Trend, Moving Average and Pareto Analysis

Histogram, Pie Chart and Line Graph Laboratory

Different charts answer different questions. A chart must match the data structure; attractive graphics do not repair weak definitions or incomplete records.

Statistical Variability, Distributions, Sampling and Data Validity

Statistical variability means observations and sample results naturally differ. Validity asks whether the measure actually represents the decision question. A precise calculation from biased or incorrectly classified data is still misleading.

Why Use Quantitative Methods—and Why Not Use Them Alone?

Why Incident Investigation Remains Essential

How to Answer 3.1 and 3.2 at Level 6

Can You Connect Models, Data and Investigation?

Use Authoritative Information

This independent DB HSE explanation supports learning. Workplace decisions must use current applicable legislation, exposure limits, approved organisational criteria and competent specialist advice where required.