Food Control 20 (2009) 223229

Contents lists available at ScienceDirect

Food Control
journal homepage: www.elsevier.com/locate/foodcont

Fault tree analysis on handwashing for hygiene management

Aeri Park, Seung Ju Lee *
Department of Food Science and Technology, Dongguk University, Seoul 100-715, Republic of Korea

a r t i c l e

i n f o

a b s t r a c t
FTA (fault tree analysis) of the handwashing process was performed to investigate the causes for faults in hygiene management. The causes were deductively identied as the events causing every possible hazard by constructing a fault tree. The fault tree was constructed in a hierarchical structure with a single top event (occurrence of faults in hand washing), seven intermediate events, and fteen basic events connected by a Boolean operator AND gate, or an OR gate. Qualitative analysis on the fault tree yielded minimal cut sets, structural importance, and common cause vulnerability. Quantitative analysis yielded simulation of the nal top event fault, cut set importance, item importance, and sensitivity. Those factors are basically a measure to represent the priority order of the basic events causing the top event. The critical basic events turned out to be human errors in hand manipulation in terms of scrubbing the palms, backs, ngers, and ngertips of the hands, as well as failure to use hygienic towels for hand drying due to not using disposable paper towels and unhygienic storage of the towels. The priority order of the basic events was consistent between the qualitative and quantitative analyses. Consequently, we found that FTA, with qualitative and quantitative analyses, was a good alternative approach to hazard analysis in HACCP system implementation. 2008 Elsevier Ltd. All rights reserved.

Article history: Received 1 October 2007 Received in revised form 17 April 2008 Accepted 5 May 2008

Keywords: FTA (fault tree analysis) Handwashing Qualitative/quantitative analyses HACCP Critical control point

1. Introduction Food safety management is a primary concern related to the problem of foodborne illness in food processing, storage, distribution, and consumption. If a contamination above the criteria is found in foods, even though the foods are best in terms of consumer preference, functional properties, and nutritional value, the foods value is degraded. To prevent such contamination, several food safety systems have been applied to facilitate hygienic control in food-oriented work elds, such as HACCP (hazard analysis and critical control point), SSOP (sanitation standard operating procedure), and GMP (good manufacturing practices) (Amoa-Awua et al., 2007; Lee, Jang, & Choi, 1999; Roberto, Brando, & Silva, 2006; Snyder, 1991; Yoo & Kim, 2000). Still, however, there are shortages pertaining to the practical efciency of these systems, so new methods have been developed to make up for the weak points. For instance, a lack of quantitative analysis on determining CCPs (critical control points) in the HACCP (hazard analysis and critical control points) system could be covered by QMRA (quantitative microbiological risk assessment) (Bahk, Todd, Hong, Oh, & Ha, 2007; Domnech, Escriche, & Martorel, 2007; Hoornstra, Northolt, Notermans, & Barendsz, 2001; Im & Lee, 2006; Im, Lee, & Lee, 2007). Recently, FTA (fault tree analysis) was introduced as a

* Corresponding author. Tel.: +82 2 2260 3372; fax: +82 2 2260 3372. E-mail address: Lseungju@dongguk.edu (S.J. Lee). 0956-7135/$ - see front matter 2008 Elsevier Ltd. All rights reserved. doi:10.1016/j.foodcont.2008.05.001

good alternative approach to HACCP implementation (Bertolini, Rizzi, & Bevilacqua, 2007; Park, Lee, & Hong, 2007). FTA is a systems analysis technique for protection against hazards which would be the additional method in HACCP. The history of FTA shows that it was founded in 1962, in the missile launching safety control system, and since that time, FTA has been applied in numerous industrial working elds requiring extremely safe systems (Center for Chemical Process Safety, 1989; Ericson, 2005). In comparison with HACCP, FTA has the advantage of identifying CCPs qualitatively or quantitatively, resulting in increased efciency for managing the CCPs (Bertolini et al., 2007; Coudert & Madre, 1994). A great advantage is to make the events some errors in actions or object failures (e.g. scrubbing the palms of the hands, lathering soap, proper autoclave operation, the availability of hygienic mixing blade, etc.), rather than process-scale components (e.g. handwashing, sanitation, sterilization, mixing, etc.). The CCPs of the basic events may be smaller in scale, or perhaps more detailed, real, and actual in practice than the CCPs of the processscale components. In HACCP, on the other hand, the CCPs are given mostly as process-scale components that practically split to more events and sets of many basic events. In general, the basic events in HACCP are controlled according to safety prescriptions without a priority order in their management. Eventually, in HACCP, implementation of the control of CCPs requires further treatments to manage the basic events belonging to the CCPs. Therefore, FTA, which can identify the basic events with the high risk priorities, would be a supplementary tool to facilitate the practice of CCP

224

A. Park, S.J. Lee / Food Control 20 (2009) 223229

management in HACCP. Bertolini et al. (2007) suggested FTA as a new method for successfully identifying CCPs in HACCP. Meanwhile, cleaning and sanitation are well-known critical processes common in safety management areas. Handwashing, in particular, is an essential technique, so it has been addressed in both food safety and clinical settings (Clayton & Grifth, 2004; Nicolay, 2006; World Health Organization, 2005). Most food infection is caused by the cross-contamination of foods from various sources such as a food handlers hands, cooking utensils, equipment, workplace, etc. Food poisoning could be prevented to a great extent by adequate handwashing techniques (Bobeng & David, 1978; Clayton & Grifth, 2004; Savage, 1995). Hands are usually washed in two manners that include the use of soap and water or alcohol-based hand rubs (World Health Organization, 2005). Handwashing with soap is generally employed in food safety management. The procedure includes wetting the hands, lathering the soap, scrubbing the hands, turning off the water, and drying the hands; in more depth it is classied into as many as 15 steps. In addition, the use of clean water and the soaps cleaning power should be checked. This indicates that handwashing is not a simple process in practice, but rather, more complicated than one expects. Nonetheless, its practice depends only on hygiene guidelines, or a list of prescriptions, without arranging the steps in a structured and systematical order, or giving each step a priority order to control. In this study, we applied FTA to handwashing with two purposes: rst to enhance the hygienic management of handwashing in a more structured and systematic order, and second, to extend the application eld of FTA as a novel technique. All the basic events involved in handwashing were analyzed qualitatively and quantitatively with various FTA techniques, to estimate the priority order of each basic event. A hygienic management system for handwashing was built to specify the basic events causing hazards in a hierarchical conguration, and to provide the critical basic events as targets for control. 2. Materials and methods 2.1. Constructing the fault tree Generic fault tree analysis is conducted according to the procedures shown in Fig. 1 (Ericson, 2005; Vesely, Dugan, Fragole, Minarick, & Railsback, 2002). The fault tree was built as follows. First, a top event was dened and the other events in the fault tree were identied stepwise by a deductive method. In this method, a cause for a particular event is searched based on a survey, literature, or expert knowledge, and regarded as the event on the next hierarchical level. Then the cause for the next event is tried, and this proce-

dure is repeated until the basic events in the lowest hierarchical level of the tree are identied. On the tree, all events are correlated with a Boolean logic operator AND gate, or an OR gate. The AND gate, equivalent to the Boolean symbol (), represents the union of the events combined by the gate. It means that an event occurs when all the input events in the next hierarchical level combined by the gate occur. The OR gate, equivalent to the Boolean symbol (), represents the intersection of the events combined by the gate, meaning that an event occurs when any one or more of the events in the next hierarchical level combined by the gate occurs (Vesely, Goldberg, Roberts, & Haasal, 1981). Fig. 2 shows an example tree, as a portion of the whole fault tree in Fig. 3. Using this example tree instead of the whole tree, the methods in use are explained with simplicity in description. After determining the top event (C), all events involved are identied as following. The causes for the top event (C) are the primary or intermediate events (E) and (F). The causes for event (E) are sought as the several basic events (X1), (X2), and (X3), and those for event (F) are sought as another intermediate event (G) and the basic event (X4). The causes for event (G) are the basic events (X5) and (X6). Next, all the fault tree events in hierarchical structure are joined by either an AND gate or an OR gate according to their particular correlations each other. The fault tree was validated in terms of its completeness and accuracy by experts knowledgeable in safety management. In addition, a technique was used to test any logic gates in the tree (Vesely et al., 2002; Wild, 2005). The procedure is to rst replace an OR gate or an AND gate on the test by an AND gate or an OR gate, respectively. Then the attached events in the failure domain are converted to the events in the success domain. Finally, there is a test to see whether the logic with the replaced gate in the success domain is correct. If the logic in the success domain is correct, the logic on the test in the failure domain proves correct. As an example, in testing the logic of the OR gate representing the union of events (X5) and (X6) to cause the event (G), the OR gate was replaced with the AND gate. The counterparts of events (G), (X5), and (X6) in the success domain are successful in using soap adequately (Gs), successful in using soap in an appropriate amount (X5s), and successful in lathering the soap adequately (X6s). One can see that the intersection of events (X5s) and (X6s) causes event (Gs). Accordingly, it was validated that the logic of the OR gate is correct. 2.2. Qualitative analysis The factors obtained from qualitative analysis are minimal cut sets, structural importance, and common cause vulnerability (Lee, Grosh, Tillman, & Lie, 1985; Vesely et al., 1981).

Fig. 1. General procedure of fault tree analysis.

Fig. 2. Example of a fault tree diagram with the top event (C) as a portion of the whole fault tree diagram shown in Fig. 3.

A. Park, S.J. Lee / Food Control 20 (2009) 223229

225

Fig. 3. Fault tree diagram with the top event of handwashing.

The cut sets imply any sets of basic events that cause the top event, and the minimal cut sets imply only the least-needed cut sets to cause the top event. The top event (C) in Fig. 2 is expressed by Eq. (1) with the symbol () for the OR gate.

events in Eq. (3) originate from human errors. The basic events are expressed with a single common cause by adding the subscript h to the corresponding basic events as follows:

Top X1h X2h X3h X4h  X5h X4h  X6h

Top E F

where E X1 X2 X3, F X4  G, and G X5 X6. The event (F) is expressed by Eq. (2) according to the structural correlation in Fig. 2.

F X4  X5 X6

Eventually, the top event can be expressed in terms of the basic events alone.

Top E F X1 X2 X3 X4  X5 X6 X1 X2 X3 X4  X5 X4  X6 3

If there is a single common cause for the basic events within a particular minimal cut set, the minimal cut set becomes susceptible or vulnerable to the single common cause. However, if there are several common causes for the basic events within a minimal cut set, the minimal cut set is not solely susceptible to any common cause. This means that the susceptible minimal cut sets should be triggered by a single common cause, considered as the critical primary cause for fault management. Thus, the human errors must be the critical common cause for the minimal cut sets of {X1}; {X2}; {X3}; {X4, X5}; and {X4, X6}. 2.3. Quantitative analysis Quantitative analysis results in the simulation of probability, cut set importance, item importance, and sensitivity (Lee et al., 1985; Vesely et al., 1981). The minimal cut sets obtained from the qualitative analysis are evaluated quantitatively. PF (fault probability) means the occurrence likelihood of action errors or object failures. In arithmetic expression, PX1 stands for PF of the basic event (X1). The probability of the events combined by the Boolean logic operators, OR or AND gates, are used to calculate the probability of the output event in the hierarchical level by Eqs. (5) and (6) (Vesely et al., 1981).

Eq. (3) species the Boolean-indicated cut sets. In this case, the cut sets are identical to the minimal cut sets, because there are no more sets canceled out, resulting in ve minimal cut sets, i.e. {X1}; {X2}; {X3}; {X4, X5}; and {X4, X6}. The minimal cut sets are in OR () correlation, and the basic events within the minimal cut sets are in AND () correlation. Structural importance means the contribution degree of each minimal cut set to the occurrence of a top event. If the probabilities (P < 1) of occurrence of all basic events are assumed as equal, multiplication by any probability [e.g. P P = 0.0032 = 0.00009 in Eq. (6)] reduces the magnitude of the product, whereas addition by any probability [e.g. P + P = 0.003+0.003 = 0.006 in Eq. (5)] increases the magnitude of the sum. Therefore, a minimal cut set with more basic events has lesser probability, indicating a lesser degree of structural importance. The rst group of the minimal cut sets with one basic event, {X1}, {X2}, and {X3}, is higher in structural importance than the second group with two basic events, {X4, X5} and {X4, X6}. Common cause vulnerability implies the susceptibility that basic event occurrences may have to a common initiating cause. One can dene common cause categories, and impart the basic events, to one of the categories. Eventually the number of basic causes lessens to fewer of the common causes or fault origins. The basic

PX1 PX2 PXn 1

n Y 1 P Xi i1

1 1 P X1 1 PX2 1 P Xn
n X i1

PXi

n1 n X X i1 ji1

PXi PXj 5 6

1n1 PXi PXj PXn PX1  PX2  PXn

n Y i1

P Xi PX1 PX2 PXn

226

A. Park, S.J. Lee / Food Control 20 (2009) 223229

Simulation of the probability of the top event in the example fault tree is carried out by Eq. (7) that is derived from Eq. (3) by applying the principle of Eqs. (5) and (6).

and is accurate to within approximately 10% of the true probability when PXi < 0.1 (Vesely et al., 1981). 3. Results and discussion

Ptop 1 1 P X1 1 P X2 1 PX3 1 PX4 PX5 1 PX4 PX6 7

3.1. Fault tree The fault tree was constructed as shown in Fig. 3. The top, intermediate, and basic events on the tree are listed in Table 1. The top event, fault in conducting handwashing technique adequately, is caused by two intermediate events, faults in washing hands (A) or faults in drying hands (B) (Guzewich & Ross, 1999; Larson & Lusk, 2006; World Health Organization, 2005). The top event is caused by event (A) regardless of the occurrence of event (B), and vice versa. Thus, event (A) and event (B) are combined by an OR logic gate. The event fault in washing hands (A) is caused by two intermediate events, faults in relevant actions (C) or faults in relevant objects (D). The two events independently act on the occurrence of event (A), so they are joined by an OR logic gate. Faults in relevant actions (C) is due to faults in hand manipulation (E) or faults in handling the faucet and soap adequately (F), which are combined by an OR logic gate. This means that either of the two intermediate events (E) and (F) can raise event (C). The faults in hand manipulation (E) is caused by errors in scrubbing palms and backs of hands (X1), errors in scrubbing in between and around ngers (X2), or errors in scrubbing the ngertips (X3). They contribute to the occurrence of the event (E) independently, and are therefore connected by an OR gate. The event faults in handling the faucet and soap adequately (F) is caused by errors in turning off the water with clean towels (X4) and faults in using soap adequately (G). In this case, event (F) does not always occur by either of the two events, so they are combined by an AND logic gate. This indicates that the two events (X4) and (G) should simultaneously occur to raise event (F). Faults in using soap adequately (G) is brought on by errors in using soap in the appropriate

Cut set importance (Ik) is dened as the ratio of probability of each minimal cut set to the sum of probability of all minimal cut sets, equal to the probability from the simulation of the top event, meaning the importance of each minimal cut set. Eq. (8) is used to calculate (Ik) of the minimal cut set {X1}, and Eq. (9) is used for {X4, X5}.

Ik X1 P X1 =Ptop Ik X4  X5 P X4 PX5 =Ptop

8 9

Item importance (Ie) is dened as the ratio of the probability sum of the minimal cut sets including a particular basic event (item) to the sum of the probabilities of all minimal cut sets. It also means the importance of each basic event.

Ie X1 P X1 =Ptop Ie X4 P X4 PX5 PX4 PX6 =P top 1 1 P X4 PX5 1 PX4 PX6 =Ptop

10 11

Eq. (10) is used to calculate (Ik) of the basic event (X1), and Eq. (11) is used for the basic event (X4). Sensitivity (S) is dened as the partial derivative of the probability of a top event at the probability of a particular basic event, which accounts for the importance of basic events.

SX1 oPtop =oPX1 1 SX4 oPtop =oPX4 PX5 PX6

12 13

Eq. (12) is for calculating (S) of the basic event (X1), and Eq. (13) is used for the basic event (X4). In the derivation of the derivatives, only the linear terms in Eq. (6) are considered, excluding the terms of higher order, which is the so-called rare event approximation

Table 1 Basic events or causes of faults and their probability of occurrence in handwashing Cause identicationa A C E X1 X2 X3 F X4 G X5 X6 D H X7 X8 I X9 X10 B J X11 X12 X13 K X14 X15
a b

Cause description Faults in washing hands Faults in relevant actions Faults in hand manipulation Errors in scrubbing palms and backs of hands Errors in scrubbing in between and around ngers Errors in scrubbing ngertips Faults in handling faucet and soap adequately Errors in turning off water with clean towels Faults in using soap adequately Errors in using soap in an appropriate amount Errors in lathering soap adequately Faults in the relevant objects Faults in using appropriate soap Errors in storing soap adequately Failure in the cleaning capability of the soap Faults in using clean water Failure of uncontaminated water Errors in using owing water Faults in drying hands Faults in hand manipulation Errors in working towel on the palms and backs of hands Errors in working towel in between and around ngers Errors in working towel around and under nails Faults in using clean towels Errors in using disposable paper towels Errors in storing towels adequately

PFb

0.003 0.003 0.003 0.003 0.003 0.003

0.003 0.003 0.003 0.003

0.003 0.003 0.003 0.003 0.003

AK, intermediate events; X1X15, basic events. Fault probability that cause Xi occurs.

A. Park, S.J. Lee / Food Control 20 (2009) 223229

227

Fig. 4. Fault tree diagram with reformed structure by minimal cut sets.

amount (X5) or errors in lathering the soap adequately (X6), leading to their combination by an OR logic gate. Faults in relevant objects (D) is caused by two intermediate events, faults in using appropriate soap (H) and faults in using clean water (I). When event (D) breaks, the two events (H) and (I) should simultaneously occur, so they are combined by an AND logic gate. The event faults in using appropriate soap (H) is due to errors in storing the soap adequately (X7) or failure in the cleaning capability of the soap (X8), resulting in their connection by an OR gate. The event faults in using clean water (I) results from failure of uncontaminated water (X9) or errors in using owing water (X10) in an OR logic correlation. The event faults in drying hands (B) arises from faults in hand manipulation (J) or faults in using clean towels (K), in an OR logic relation. The event faults in hand manipulation (J) is caused by errors in working the towel on the palms and backs of hands (X11), errors in working the towel in between and around the ngers (X12), and errors in working the towel around and under the nails (X13). It is difcult to say that only one of those causes can raise event (J), so they are in an AND logic relation. The event faults in using clean towels (K) originates from errors in using disposable paper towels (X14) or errors in storing towels adequately (X15), so they are joined by an OR gate. Consequently, the whole fault tree was constructed in an hierarchical structure that was composed of the top event, intermediate events (A)(K), and basic events (X1)(X15). The fault tree was validated according to the aforementioned methods. In the testing of the logic in the success domain (Vesely et al., 2002; Wild, 2005), all the gates shown on the tree reected correct relations between the events. Furthermore, it was conrmed by expert knowledge and a literature survey that there are no missing fault events that should be considered in the tree, and the logics in their correlations are correct (World Health Organization, 2005; Larson & Lusk, 2006; Guzewich & Ross, 1999). 3.2. Qualitative analysis The qualitative analysis of the fault tree resulted in minimal cut sets, structural importance, and common cause vulnerability. The minimal cut sets are illustrated in Fig. 4, according to the method by Eqs. (1)(3). It shows ve minimal cut sets with one basic event, six minimal cut sets with two basic events, and one minimal cut set with three basic events. The minimal cut sets are combined by an OR logic gate. If a minimal cut set is composed of more than one basic event, the basic events are joined by an AND logic gate within the minimal cut set. According to this principle of the minimal cut sets, the causes for the top event can be perceived simply as the minimal cut sets in parallel. Furthermore, the causes for a particular minimal cut set can be recognized simply by considering

all the basic events involved. Therefore, by creating the minimal cut sets, the fault tree could be converted from the original fault tree in Fig. 3 to the fault tree in the more simply structured form in Fig. 4. In structural importance evaluation, the more basic events are included in a minimal cut set, and the less the minimal cut set contributes to the occurrence of a top event. So ve minimal cut sets with one basic event, {X1}; {X2}; {X3}; {X14}; and {X15}, are higher in structural importance than those of the six with two basic events, {X4, X5}; {X4, X6}; {X7, X9}; {X7, X10}; {X8, X9}; and {X8, X10}. The minimal cut set {X11, X12, X13} was the lowest in structural importance (Table 2). This indicates that the basic events causing faults in hand manipulation (E) and faults in using clean towels (K) are CCPs (critical control points) in safety management of the handwashing process. According to research on handwashing techniques (Larson & Lusk, 2006; World Health Organization, 2005), event (E) was also emphasized as an important step. Event (K), a CCP, belongs to the hand drying steps, which agrees that a wet state is more favorable to microbiological contamination than a dry state (Patrick, Findon, & Miller, 1997). Also, it was reported that using a paper towel in hand drying is more hygienic than using hand driers or cloth towels, which are suspected as sources of pathogen cross-contamination (Ansari, Springthorpe, Sattar, Tostowaryk, & Wells, 1991; Gould, 1994). Furthermore, it was noted that the hygienic storage of paper towels and the papers quality should be factors to consider (Jumaa, 2005). Here, the attempt to qualitatively nd the events with the high risk priorities by FTA was so effective that it would be a practical approach to hazard analysis in HACCP implementation. In common cause vulnerability evaluation, human-oriented errors or material-oriented failures were designated as the origins of common cause. The human-oriented errors were based on the

Table 2 Results of qualitative analysis: structural importance and common cause vulnerability according to minimal cut sets Minimal cut sets X1 X2 X3 X14 X15 X4  X5 X4  X6 X7  X9 X7  X10 X8  X9 X8  X10 X11  X12  X13
a

Structural importance High High High High High Middle Middle Middle Middle Middle Middle Low

Common cause vulnerabilitya X1h X2h X3h X14h X15h X4h  X5h X4h  X6h X7h  X9m X7h  X10h X8m  X9m X8m  X10h X11h  X12h  X13h

h and m in subscript mean human-oriented and material-oriented, respectively.

228

A. Park, S.J. Lee / Food Control 20 (2009) 223229 Table 3 Results of quantitative analysis: cut set importance according to minimal cut sets Minimal cut sets X1 X2 X3 X14 X15 X4  X5 X4  X6 X7  X9 X7  X10 X8  X9 X8  X10 X11  X12  X13 Cut set importance (Ik) 2.0049E01 2.0049E01 2.0049E01 2.0049E01 2.0049E01 6.0148E04 6.0148E04 6.0148E04 6.0148E04 6.0148E04 6.0148E04 1.8045E06

handlers actions or decisions, and the material-oriented failures on the availability of clean water and soap with cleaning capability. The basic events were classied into two origin groups, one being X1h, X2h, X3h, X4h, X5h, X6h, X7h, X10h, X11h, X12h, X13h, X14h, and X15h, and the other being X8m and X9m (Table 2). The minimal cut sets {X1h}; {X2h}; {X3h}; {X14h}; {X15h}; {X4h, X5h}; {X4h, X6h}; {X7h, X10h}; and {X11h, X12h, X13h} have human-oriented errors as a single common cause within each set, and the minimal cut set {X8m, X9m} has material-oriented failures as a single common cause. Whereas the other minimal cut sets, {X7h, X9m} and {X8m, X10h}, have two common causes within each set. In summary, nine and one of the minimal cut sets have human-oriented errors and material-oriented failure, respectively, as a single common cause. On the other hand, two of the minimal cut sets have two different common causes, indicating they are not solely susceptible to any common cause. Hence, humans were identied as the main source to supervise with great care. This fact also suggests that an emphasis should be placed on food handler training to ensure adequate handwashing practices. 3.3. Quantitative analysis Quantitative analysis was performed to estimate the probability of top event occurrence by simulation, cut set importance, item importance, and sensitivity. First, the fault probability (PF) of the basic events should be known to calculate the above estimates. The PF generally comes in probabilities of human error and equipment failure. There are several sources of PF and the mathematical models available in other elds (Vesely et al., 1981). The PF values associated with actions are usually measured by the observation of action practices in frequency of occasions. It was reported that the average PF of human errors is 0.003 (Browning, 1980; Serra, Domenech, Escriche, & Martorell, 1999). In reality, however, the PF values available in food safety management are quite limited, so quantifying PF related to food safety by the already established principles in other elds will be necessary to more accurately implementing FTA. In this study, it was assumed that the human-oriented basic events have a PF of 0.003. Also, the PF associated with materials was assumed to be the same as that of human errors. This was because an average was not available and it was intended to make a relative comparison to any factors relevant to the quantitative analysis, depending on the structural relationships between the events on the fault tree, rather than the PF values of the individual basic events. Meanwhile, the PF of typical equipment failures was determined by component, and expressed mainly in Poissons distribution function (Vesely et al., 1981). In handwashing, it was irrelevant to any events, but in hand drying, if an electric dryer is used instead of paper towels, it should be considered. Through simulation by Eqs. (5)(7), the fault probability of the top event was computed as Ptop = 1.4963E02. This means there would be 15 faults on 1000 required occasions. If the fault probability of the basic events, PF = 0.003, is substituted with another value changing with a particular situation in a workplace, the Ptop will change. In comparison with QMRA (quantitative microbiological risk assessment), FTA leads to a nal judgment for safety management in a shorter manner than QMRA. In QMRA, the nal likelihood of illnesses by dose-response assessment is estimated from the nal cell numbers of pathogens by exposure assessment (Im & Lee, 2006; Im et al., 2007;Bahk et al., 2007; Domnech et al., 2007; Hoornstra et al., 2001), while FTA can solely achieve the nal probability of the occurrence of the top event equivalent to the likelihood of illnesses in QMRA. Cut set importance (Ik), the contribution degree or weight of each minimal cut set to the Ptop, was calculated according to Eqs. (8) and (9) (Table 3). There were three groups in ranks, the rst

being ve minimal cut sets (Ik = 2.0049E01), the second being six minimal cut sets (Ik = 6.0148E04), and the last being one minimal cut set (Ik = 1.8045E06). This agreed with the results from the structural importance analysis, such as the rst group {X1}, {X2}, {X3}, {X14}, {X15}; the second group {X4, X5}, {X4, X6}, {X7, X9}, {X7, X10}, {X8, X9}, {X8, X10}; and the third group {X11, X12, X13}. Item importance (Ie), the contribution degree of each basic event to the Ptop, was calculated according to Eqs. (10) and (11) (Table 4). There were four groups in rank, i.e. the rst group (Ie = 2.0049E01) X1, X2, X3, X14, and X15; the second group (Ie = 1.2029E03) X4, X7, X8, X9, and X10; the third group (Ie = 6.0148E04) X5 and X6; and the last group (Ie = 1.8045E06) X11, X12, and X13. The basic events X5 and X6 are in the lower group in rank than the basic events X4, X7, X8, X9, and X10, although they exist in minimal cut sets with two components all the same. X5 or X6 exists only in one minimal cut set for each, whereas the above basic events are in more than one minimal cut sets. If a basic event exists in more than one minimal cut set, its item importance is higher in magnitude than its cut set importance. Accordingly, it was understood that the basic events X4, X7, X8, X9, and X10 are higher in item importance than in relevant cut set importance. On the other hand, X5 and X6 are the same between the two factors. In addition, it was found that the basic events were generally graded into more levels in the item importance than in the cut set importance. Sensitivity (S), the contribution degree of each basic event to the Ptop, was calculated according to Eqs. (12) and (13) (Table 4). There were four groups in rank, i.e. the rst group (S = 1E00) X1, X2, X3, X14, and X15; the second group (S = 6E03) X4, X7, X8, X9, and X10; the third group (S = 3E03) X5 and X6; and the last group (S = 9E06) X11, X12, and X13. That is, the fact that the basic

Table 4 Results of quantitative analysis: item importance and sensitivity according to individual basic events Basic event X1 X2 X3 X4 X5 X6 X7 X8 X9 X10 X11 X12 X13 X14 X15 Item importance (Ie) 2.0049E01 2.0049E01 2.0049E01 1.2029E03 6.0148E04 6.0148E04 1.2029E03 1.2029E03 1.2029E03 1.2029E03 1.8045E06 1.8045E06 1.8045E06 2.0049E01 2.0049E01 Sensitivity (S) 1E00 1E00 1E00 6E03 3E03 3E03 6E03 6E03 6E03 6E03 9E06 9E06 9E06 1E00 1E00

A. Park, S.J. Lee / Food Control 20 (2009) 223229

229

events X1, X2, X3, X14, and X15 should be the critical control points coincided with the results from the structural importance, the cut set importance, and the item importance evaluations. As a result, we found that hand manipulation such as scrubbing the palms and backs of hands (X1), scrubbing in between and around the ngers (X2), and scrubbing the ngertips (X3), and the use of clean towels, including using disposable paper towels (X14) and storing towels adequately (X15), are important steps for safety management during the handwashing process. 4. Conclusions FTA (fault tree analysis) was applied to create a novel safety management system for the handwashing process. FTA is a method where the causes for fault events are deductively identied in structured logical manners, thus building a fault tree. The fault tree is constructed in a hierarchical structure, and includes every possible cause as the structural components. This process was split into more detailed components that are described in the tree structure, and qualitative and quantitative evaluations on the tree were achieved. Fifteen basic events, which are more than one might expect, were found to be the causes for faults in handwashing. The events on the fault tree were correlated each other, so several events were identied as critical control points. The actions of hand manipulation and using clean towels were the CCPs. Handwashing has been studied in food safety and in clinical settings with great concern, so detailed prescriptions or directions for safety management were provided in the forms of manuals, literature, etc. Yet, the contents in the materials are itemized rather than arranged with correlative connections for more effective and systematical management practice. FTA created a more structured pattern of the management system, implying its potential to enhance the current management system for the handwashing process. Through FTA, the system components split into as many as fteen basic events and were given their priority for control, resulting in a novel practical tool for the safety management of handwashing. References
Amoa-Awua, W. K., Ngunjiri, P., Anlobe, J., Kpodo, K., Halm, M., Hayford, A. E., et al. (2007). The effect of applying GMP and HACCP to traditional food processing at a semi-commercial kenkey production plant in Ghana. Food Control, 18(11), 14491457. Ansari, S. A., Springthorpe, V. S., Sattar, S. A., Tostowaryk, W., & Wells, G. A. (1991). Comparison of cloth, paper, and warm air drying in eliminating viruses and bacteria from washed hands. American Journal of Infection Control, 19(5), 243249. Bahk, G. J., Todd, E. C. D., Hong, C. H., Oh, D. H., & Ha, S. D. (2007). Exposure assessment for Bacillus cereus in ready-to-eat Kimbab selling at stores. Food Control, 18(6), 682688. Bertolini, M., Rizzi, A., & Bevilacqua, M. (2007). An alternative approach to HACCP system implementation. Journal of Food Engineering, 79(4), 13221328. Bobeng, B. J., & David, B. D. (1978). HACCP models for quality control of entree production in hospital foodservice systems. Development of hazard analysis

critical control point models. Journal of the American Dietetic Association, 73(5), 524529. Browning, R. L. (1980). The loss rate concept in safety engineering. New York: Marcel Dekker. Center for Chemical Process Safety (1989). Guidelines for chemical process quantitative risk analysis. New York: American Institute of Chemical Engineers. Clayton, D. A., & Grifth, C. J. (2004). Observation of food safety practices in catering using notational analysis. British Food Journal, 106(3), 211227. Coudert, O., & Madre, J. C. (1994). Metaprime: An interactive fault-tree analyzer. IEEE Transaction on Reliability, 43(1), 121127. Domnech, E., Escriche, I., & Martorel, S. (2007). Quantication of risks to consumers health and to companys incomes due to failures in food safety. Food Control, 18(11), 14191427. Ericson, C. A. (2005). Hazard analysis techniques for system safety. Hoboken: WileyInterscience. pp. 183221. Gould, D. (1994). The signicance of hand-drying in the prevention of infection. Nursing times, 90(47), 3335. Guzewich, J., & Ross, M. P. (1999). Interventions to prevent or minimize risks associated with bare-hand contact with ready-to-eat foods. Available from http://www.cfsan.fda.gov/$ear/rterisk.html. Hoornstra, E., Northolt, M. D., Notermans, S., & Barendsz, A. W. E. (2001). The use of quantitative risk assessment in HACCP. Food Control, 12(4), 229234. Im, M. N., & Lee, S. J. (2006). Application of fuzzy math simulation to quantitative risk assessment in pork production. Korean Journal of Food Science and Technology, 38(4), 589593. Im, M. N., Lee, S. J., & Lee, K. G. (2007). Quantitative risk assessment modeling for Staphylococcus aureus in Sushi. Food Engineering Progress, 11(2), 7783. Jumaa, P. A. (2005). Hand hygiene: Simple and complex. International Journal of Infectious Diseases, 9(1), 314. Larson, E., & Lusk, E. (2006). Evaluating handwashing technique. Journal of Advanced Nursing, 53(1), 4653. Lee, S. Y., Jang, Y. S., & Choi, H. J. (1999). Current status and further prospect on HACCP implementation in Korea (specially on catering). Food Industry and Nutrition, 4(3), 1426. Lee, W. S., Grosh, D. L., Tillman, F. A., & Lie, C. H. (1985). Fault tree analysis, methods, and applications A review. IEEE Transaction on Reliability, 34(3), 194203. Nicolay, C. R. (2006). Hand hygiene: An evidence-based review for surgeons. International Journal of Surgery, 4(1), 5365. Park, A., Lee, S. J., & Hong, K. W. (2007). Fault tree analysis on utensil washing for food safety management. Food Engineering Progress, 11(3), 208215. Patrick, D. R., Findon, G., & Miller, T. E. (1997). Residual moisture determines the level of touch-contact-associated bacterial transfer following hand washing. Epidemiology and Infection, 119(3), 319325. Roberto, C. D., Brando, S. C. C., & Silva, C. A. B. (2006). Costs and investments of implementing and maintaining HACCP in a pasteurized milk plant. Food Control, 17(8), 599603. Savage, R. A. (1995). Hazard analysis critical control point: A review. Food Reviews International, 11(4), 575595. Serra, J. A., Domenech, E., Escriche, I., & Martorell, S. (1999). Risk assessment and critical control points from the production perspective. International Journal of Food Microbiology, 46(1), 926. Snyder, O. P. (1991). HACCP in the retail food industry. Dairy, Food and Environmental Sanitation, 11(2), 7381. Vesely, W., Dugan, J., Fragole, J., Minarick, J., & Railsback, J. (2002). Fault tree handbook with aerospace applications. Washington, DC: NASA Ofce of Safety and Mission Assurance. Vesely, W. E., Goldberg, F. F., Roberts, N. H., & Haasal, D. F. (1981). Fault tree handbook. Washington, DC: Nuclear Regulatory Commission. Wild, A. (2005). The synergistic twins: Fault trees and success trees. Proceedings of the Annual Reliability and Maintainability Symposium, 445450. World Health Organization (2005). WHO guidelines on hand hygiene in health care (advanced draft): A summary. Available from http://www.who.int/entity/ patientsafety/events/05/HH_en.pdf. Yoo, H. C., & Kim, J. W. (2000). Development of generic HACCP model for practical application in mass catering establishments. Journal of Korean Society of Food and Cookery Science, 16(3), 232244.