Quantification of Occupational Safety Risk in a Boiler Area through Integration of Quantitative Fault Tree Analysis and HIRADC: A Case Study in the Creamer Industry

Abstract

The boiler area is among the most hazardous workplaces in manufacturing because it simultaneously involves thermal energy, high pressure, and electrical energy. Applications of Fault Tree Analysis (FTA) in the Indonesian occupational safety literature commonly stop at the qualitative level, serving as a cause-mapping tool that yields neither event probabilities nor a measurable control priority ranking. This study aims to quantify occupational accident risk in the boiler area of PT Sehat Alam Segar by integrating quantitative FTA with Hazard Identification, Risk Assessment, and Determining Control (HIRADC). Fifty-three basic events across three top events were quantified by converting a frequency-anchored likelihood scale into per-exposure probabilities, then evaluated using two fault tree structures: an all-OR structure (Model A) and a defence-in-depth structure incorporating AND gates (Model B). Model A overestimated event frequency by 9.6–65.8 times relative to actual incident data for 2024–2025, whereas Model B remained within a factor of 1.49–1.86 and showed no significant difference from the actual data (Poisson test, p = 0.061 and p = 1.000). Model B top event probabilities were 1.044 × 10⁻¹ per steam-line maintenance job, 1.221 × 10⁻⁴ per operating day (4.36 × 10⁻² per year), and 1.245 × 10⁻² per electrical job. Fussell–Vesely analysis showed that human and management factors contributed 51.6% of structural importance. The HIRADC control design based on the ISO 45001:2018 hierarchy reduced the mean risk score from 8.79 to 3.83 (Wilcoxon signed-rank, Z = 6.360; p < 0.001; r = 0.874), eliminated all Extreme-category events, and was estimated to lower top event probabilities by factors of 17–266. This reduction is a model-based estimate rather than a post-implementation measurement. These findings confirm that a fault tree structure which does not represent protective layers yields systematically erroneous risk estimates.