Then I discovered you could hike there, and I decided to do that. One day.

Fast forward ten years, past the age of 40, and I started to think that if I was going to hike to Machu Picchu, maybe I’d better start hiking. Somewhere, anywhere. It’s not that I’d never done that sort of thing (although we call it bushwalking), just not at that scale. Day hikes in and around my local area or when on holidays, that was my limit. So after a quick decision and last-minute booking, I hiked the Overland Track in Tasmania. The guided version – basic cabins, but with showers, three-course dinners and wine. I still had to walk it though, so not quite as cushy as it sounds.

Then came hikes in New Zealand’s Fiordland. Then, Havasu Falls, a side canyon of the Grand Canyon – fitted into the week before I attended PSM training in Houston (needed to get over my jet lag before I started the training course, and it was on the way … sort of). Then the big one. The full 230km of the Larapinta Trail in the Northern Territory. All guided, all with day packs, all with everything provided.

I decided I wanted more. So I geared myself up with a multi-day pack, hiking tent and sleeping mat, and did the Jatbula trail in the Northern Territory. Still guided, but carrying everything. Loved it.

I’m not tall. Five foot, if you squint when reading the tape measure. I’m not particularly strong and I’m not super fit. But I wanted to do multi-day hikes, with a full pack, on my own. I knew I had to go lightweight.

Now, anyone who’s been to a hiking shop knows: the lighter it is, the more compact it is, the more it costs. And reducing weight can become an obsession, where you start paying serious money to shave off as little as one hundred grams. Working for myself, raising two children, single income with a mortgage – there was a limit. But I knew that if I wanted to do this (and enjoy myself), I needed to reduce weight as much as I could.

Options. Did I really need that heavier sleeping bag that would keep me warmer at low temperatures? Yes, if I was going somewhere that cold. Did I really need to carry my personal locator beacon with me on this trip? Yes, I did. Did I really need to take coffee and chocolate, and that red wine when hiking for my friend’s 40th, my 50th? Yes. I. Did.

After a while, I realised I was drawing on my experience of process safety and risk management to help me make these decisions. I was reducing the “risk” (of carrying too much, dying from hypothermia, spending too much money) so far as was reasonably practicable. Sure, I could forgo the warmer (heavier) sleeping bag, but that introduced other risks that I was not prepared to tolerate. I could forgo the coffee and chocolate, but I was definitely not prepared to tolerate that!

My professional skill – evaluating whether the cost of an additional control was grossly disproportionate to the risk reduction achieved – helped me when I was standing in those hiking shops, weighing up the cost of losing that extra hundred grams. I have geared myself up well. It was expensive, but it has been well used over the years. Now, as I get older, and still want to be hiking for many years to come, the balance of the scales has shifted. Paying the extra money if it means I can keep doing what I love is worth it now, whereas ten years ago I might not have come to the same decision.

I have been doing a lot of thinking recently about ‘so far as is reasonably practicable’ and how there is no right answer, and definitely no one solution. What is ‘grossly disproportionate’ is a moving scale. It depends on the ‘matters’ the legislation tells us we need to consider. The consequences, the likelihood, and the availability and suitability of ways to eliminate or minimise the risk. (Notice I don’t include what a person knows or reasonably ought to know. Because if you’re doing this thing – whether it’s a work activity or personal passion – you need to know, and if you don’t, you’d better find out asap.) But it also depends on our objectives, how critical this activity is to what we want to achieve, and yes, even our values.

So, I will keep hiking as long as I can. And how long that is will depend on how much I want to do it, balanced by the cost of doing it in a way that I enjoy. I don’t expect to enjoy every step, every minute, but the hike itself, that needs to be something I’d choose to do again. The red wine and chocolate at the end of a long day help with that.

So, have I ever hiked to Machu Picchu? Well, not yet, and I might never get there. But everywhere I have hiked, it all started with the cover of a single travel medicine book. Which makes me wonder, is SFAIRP any different? If the legislation never required it of us, would we have reduced risk to the level it is now? We got to where we are now because something prompted us to start. And we’re not finished yet.

This is how process safety usually happens.

Sean Brady uses the sand pile model to describe the interactions between factors contributing to a major incident in complex systems, providing a detailed analysis of the Boeing 737 MAX 8 failure1. Originally proposed by the physicist Per Bak, the model considers individual grains of sand. As they are randomly dropped onto a table, sand piles start to form. These piles of sand remain stable, growing and creating a surprisingly aesthetic montage – a desired outcome. Until. Until there is one grain of sand too many or a grain of sand falls just in the wrong place. Then everything starts tumbling down, one sand pile collapsing after another. The major incident. But which grain of sand caused it? The last one? The first one? Or all of them combined? And there is no way of knowing which grain of sand is going to be the last one.

It’s similar to the Swiss Cheese model, where the slices of cheese represent our controls, and the holes in the cheese represent defects in these controls. When the holes line up, there is no longer any barrier between the cause and the consequence. However, I think the sand pile model more intuitively represents major incidents. There is no perfection required, no perfect storm needed for everything to go horribly wrong. It’s a slow, insidious action that has become part of normal operations. Then one day, the house we’ve built tumbles down.

Or, before that happens, perhaps we sort ourselves out and go back to doing what we know we should be doing. And we don’t even perceive that we were potentially on the path to a major incident. Remaining with the analogy, we clear the table of sand and stop the grains of sand from dropping on the table.

This scenario, change setpoints to increase production to meet our targets and then put it back after the end of the year, is what we discussed in our monthly hypothetical in Process Safety People. And the ending would have been familiar to most process safety practitioners working at operating sites. It is apparent that our standards are dropping, or we’re finding ways to wiggle around our procedures, rationalising that this time, just once, it won’t matter. And we start building our sand pile.

In process safety, we often think that Chicken Little’s (or Henny Penny’s depending on where you are from) “the sky is falling”2 is alarmist, and sometimes even dismiss it as a straw man fallacy. We don’t want to be like Chicken Little, running around the site telling everyone we come across that the wiggle-room we’ve allowed ourselves is going to result in a major incident. We want steady, measured, considered analysis of the true risks.

But what if the acorn that fell on Chicken Little’s head was one of our grains of sand? What about the next one, or the one after that. Or the next day, or the day after that. Will that be the one that causes everything we’ve built to tumble down?