SPE 111699 Integration of HSE Tools Leading to Better Leadership Action and System Improvements

W.T. Peuscher, M.D.C de Wit, and R. Bryden, Shell International E&P

Copyright 2008, Society of Petroleum Engineers This paper was prepared for presentation at the 2008 SPE International Conference on Health, Safety, and Environment in Oil and Gas Exploration and Production held in Nice, France, 1517 April 2008. This paper was selected for presentation by an SPE program committee following review of information contained in an abstract submitted by the author(s). Contents of the paper have not been reviewed by the Society of Petroleum Engineers and are subject to correction by the author(s). The material does not necessarily reflect any position of the Society of Petroleum Engineers, its officers, or members. Electronic reproduction, distribution, or storage of any part of this paper without the written consent of the Society of Petroleum Engineers is prohibited. Permission to reproduce in print is restricted to an abstract of not more than 300 words; illustrations may not be copied. The abstract must contain conspicuous acknowledgment of SPE copyright.

Abstract Shell has, over the years, built up a comprehensive suite of HSE tools for incident prevention and analysis. Tools like Bowtie diagrams, Hearts and Minds and Tripod incident analysis have been presented separately at previous SPE conferences (Reference 8-19). Now these tools have matured, approaches will be presented for integrated application of these tools, which results in greatly enhanced benefits. For incident analysis Tripod Beta theory has been used to improve the deep understanding of underlying causes of incidents. The widespread use of Bowtie diagram's to develop management systems with barriers to prevent incidents has made it logical to link failed barriers in the bowtie diagrams for a particular type of hazard to the Tripod Beta analysis of incidents. This leads to a more thorough analysis with more opportunities for learning. Tripod Beta theory has been used for years within Shell International Exploration and Production as investigation method, but in recent years the Tripod Beta incident analysis methodology has been updated to link the underlying causes towards human behaviour models, resulting in more focused approach towards the human error. Therefore the immediate and underlying causes are better understood in relation to human behaviour. This new update of the Tripod beta theory (with the improved human behaviour model) is interesting in a number of areas: What can leaders practically do in preventing incidents on the workplace via leadership behaviour? Where should organizations focus their attention at preventing incidents? How can the Hearts and Minds tools be effectively applied once trends in incidents causation are established in the area of human behaviour elements?

This paper describes the thinking process, practical application and the outcome of the integration of Tripod beta and the Hearts and Minds concepts. Introduction Often a lot of time is spent on the investigation and analysis parts of incidents. This process is quite structured. However another essential part in the incident review process is designing the recommendations. In terms of spending efforts effectively, this process to arrive at recommendations is essential. If the wrong recommendations are developed on basis of a sound investigation and analysis, a lot of time is wasted and more importantly reoccurrence is not prevented. The recommendations from these incident reviews should therefore also have a component that influences human behaviour through leadership actions. Research and major accident investigations have shown the importance of focusing on culture and leadership behaviour (references 20 and 21).

SPE 111699

Tripod Beta Incident Causation theory Various incident causation theories exist. The one used in Shell International Exploration and Production is the Tripod Beta causation theory (reference 6). The theory is illustrated in Figures 1-3. Incidents occur when inadequate or absent barriers fail to prevent the events that lead to undesirable consequences. The barriers can be of different types e.g. related to design, systems, procedures, equipment etc. The barriers are put in place and kept in place by people with the competence to do so, in line with standards and specifications. Incidents happen when people make errors and fail to keep the barriers functional or in place e.g. people doing the wrong thing or people not doing what they should do. The steps in an incident investigation are to identify: The chain of events from the cause of harm to the outcome; the undesirable consequences The barriers that should have stopped the chain of events The reason for failure of each of the barriers Most incident investigation techniques deal with the chain of events and the barriers that failed. Often this results in only addressing immediate causes of failure; the symptoms rather than the underlying cause. Few techniques deal systematically with the analysis of the reasons for failure of the barrier and development of actions addressing the underlying causes. The ability to do this is what differentiates Tripod Beta from many other techniques (reference 23) Figure 1. Incident causation

Why do people commit errors? When trying to understand why a person has done something incorrectly, people often explain it as simply human error, or as part of their personality. This is unhelpful and often wrong. To learn from the consequences of the actions of other people, and to understand why they took such actions, it is necessary to look at the bigger picture, i.e. a system perspective. There is a human behaviour model, which helps, to explain and why people act the way they do (See figures 2 and 3). In incidents people have usually acted the way they intended, they just didnt get the consequences they expected. A persons mental plan was not clear or ill conceived, resulting in a mistake and/or a violation. A barrier was broken and an incident happened. However, some actions that are based on the right plan also go wrong. These we call Slips and Lapses. A slip is when people intend to do one action but perform another one instead. When people forget to do something, this is called a lapse. Slips, lapses and mistakes are usually categorised as human error. Everybody suffers from lapses and slips but often their likelihood is increased by situations that negatively affect human functioning. Examples are tiredness, lighting and noise levels, and sudden changes to routines, illogical design. We can reduce these slips and lapses through a focus on human factors, particularly in design and reduce violations through using tools to better engage the workforce (reference 5). Usually these situations are the result of someone elses ill-conceived plan. Despite efforts to control error-enforcing situations some errors will always occur. These can create disasters if the system is dependent on few barriers in which a slip or laps causes the last remaining barrier to fail. Therefore it is essential to always make sure that there are an adequate number of effective barriers. To reduce the likelihood of incidents the focus should be on ill conceived plans because they cause barriers to fail directly through mistakes and violations. Indirectly they create situations in which slips and lapses are more likely to happen, or result in systems in which a lapse or slip cause the last remaining barrier to fail. So, intentions and plans form the basis for our acts and behaviour - our human errors.

SPE 111699

Figure 2. Taxonomy of Human Error

Figure 3. Incident causation linked to human behaviour model

Application of Tripod Beta in incident investigations. Incident investigations often follow a structured process starting with the formation of an investigation team. The team is chartered to find the immediate and underlying causes of the incident and to come forward with recommendations to prevent reoccurrence. The first stage in the investigation is fact finding, what happened During this phase hypotheses are developed. Sometimes is it clear what happened, in other cases it is totally unclear, with only the end result (like an injury or asset damage or spill) is known. It is in this stage that the first Tripod Beta trees are developed to help formulate hypotheses and to focus the investigation on key why questions. The second stage of the investigation is to validate the incident causation hypothesis. The most probable causation path is established and validated. The building and validation of the Tripod Beta tree helps this second stage. The third stage of the investigation is where the actions and recommendations are set (either through the investigation team or a separate team). In this third stage Tripod Beta will help where to focus actions: these deal with fixing the failed barriers and underlying causes. This paper describes in more detail proposals/learning how to deal with this third stage. The fourth stage is where the recommendations are implemented and learning shared with others. A separate SPE paper is focused on this area (reference 23). The Fifth stage is the review of the readiness and effectiveness of the actions taken. In case more incidents happened in the facility/company, the review of common causes and underlying causes of these incidents can provide further insight on repeated structural issues in the organisation. Overview of actions and recommendations from incident investigations. There are two types of actions: 1. Actions that deal with the broken or missing barriers. These actions generally should focused on:

SPE 111699

2.

Make the roles and responsibilities clear for the person who maintains the barrier (these roles are also called the safety critical roles), Improve the competence of the person who executes a safety critical role, Improve the guidance/procedure of doing the task/role Improve the monitoring of the critical role. An example could be related to an incident where due to corrosion, a loss of containment occurred and the investigation showed that the inspection process was inadequate. The barrier is in this case inspection of a pipeline on corrosion triggers repair; the employee doing this inspection has a safety critical role, there should be a procedure describing how to do the inspection, the person should be competent to do the inspection, a monitoring system should indicate whether the inspection is executed as per schedule. Actions that deal with the underlying causes. The underlying causes are always related to a system level issue. To provide recommendations on these underlying causes requires more firm thinking on what the action or recommendation is. There are no customer made solutions, but there are some guidelines on where to focus.

The table below provides an overview of six ways to improve safety and assessment of their cost effectiveness Table 1: Ways of influencing safety at the workplace (reference 1) Way of influencing 1 2 3 4 5 6 Make the system fool-proof Tell those involved what to do Reward and punish Increase motivation and awareness Select smarter personnel Change the environment Costs High Low Medium Medium High High Effect Low Low Medium Low Medium High Overall Assessment of effectiveness Poor Medium Medium Poor Medium Good

The table data indicate that various ways of influencing could be applied, but that the most effective way to influence safety is to change the work environment. The work environment is a result of the culture created in the organisation by managers, colleagues, family, cultural environment etc. (see figure 3). Managers often are not sufficiently aware of the impact they have on this work environment. They influence the culture by what they pay attention to, decisions made and asking the right questions. An example could be: if a workgroup was able to restart operations under extreme circumstances and the manager makes a compliment about this achievement, it could be understood that continue operations is more important than how this was achieved. A better response of the manager could be well done, but did the workgroup restart the operations within the operational envelope and without breaking the rules? Therefore to change the environment and culture in an organisation, managers must set clear expectations so that enough time is spent on: Developing sound work plans, Hazard identification, What to do in case of conflicting priorities Managers demonstrating visible and felt leadership and walking the talk. How to make sound recommendations if underlying causes are established A number of central questions around what can organisations and leaders do to treat underlying causes are: What can leaders practically do to prevent incidents on the workplace via leadership behaviour? Where should organizations focus their attention to prevent incidents? How can the Hearts and Minds tools be effectively applied once trends in incident causation are established in the area of human behaviour elements? The following pre-assumptions are made: The organisation knows about their HSE culture, by using the understanding your HSE culture exercise (reference 2, 819). Leaders know about their leadership effects on safety, by running the Seeing Yourself As Others See You safety upward appraisal exercise (reference 3). In the Tripod-Beta-tree development information is obtained and listed about the type of errors employees and leaders made (by allocating per immediate cause (active failure) these error types). Error types are categorised as intended errors (violations) and unintended violations (slip, lapse, mistake reference 5) Basic Risk Factors (BRF) are defined per underlying cause (guidance is given in the Tripod Beta tool)

SPE 111699

A listing of the underlying causes (root) is obtained from the Tripod Beta tree

Once these inputs are obtained during incident investigation/analysis, the incident recommendations can be defined. Via Table 1 (reference 6) it was concluded that the recommendations have greatest effect if these affect the work conditions/environment. In Figure 4, a stream diagram is provided, which should help the action building/recommendation process. Thereafter a practical example is given for recommendation building. Figure 4: stream diagram to arrive at recommendations geared to improving the work environment.

Developing recommendations for underlying/root causes

4. Apply H&M tools 1. Factual info from incident
Listing of the underlying causes Basic risk factors of underlying causes HSE-MS ranking of underlying causes Human error types of direct and underlying causes Understanding your culture brochure Improving Supervision brochure Managing rule breaking brochure

3. Recommendations on the environment/culture

For the leader For the supervisors

2. Info on culture from

HSE culture level of organisation Leaders assessment (SYAOSY) Other incidents findings on behaviour

An example is given from incident investigations on a production site, using Tripod Beta incident investigation/analysis. The underlying causes are: Job competence of supervisors/technician was insufficient; Training was poorly organised/managed within the organisation; The asset owner allowed less qualified designers to design the unit; There were insufficient controls in the design process; Management created culture of "production first" on site The basic risk factor distribution is given in Table 2 Table 2: Basic Risk Factor scores in incident-example Basic Risk Factor Design Hardware Maintenance Housekeeping Error enforcing conditions Procedure Training Communication Incompatible goals Organisation Defences Scores in investigations 2 1 0 0 0 2 7 2 1 3 1 the

Culture of organisation was established as being Reactive (see reference 2). Seeing Yourself As Other See You (SYAOSY) tool was applied by senior manager. Feedback from the SYAOSY tool is given to the leader on walking the Talk; Informedness; Trust and Priorities. The HSE-Management system failures, identified via the Tripod Beta tree are given in Table 3.

SPE 111699

Table 3: HSE-Management System failure scores in incident-example Scores in the investigations 3 1 5

Leadership and commitment Policy and strategic objectives Organisation, responsibilities, resources, standards (including competence) Hazards and Effects Management Planning and procedures Implementation; Monitoring; Corrective actions Audit Management review

1 2 3 0 1

The Human errors found around the failed barriers in the Tripod Beta investigation is given in Table 4 Table 4: Human error scores in incident-example Scores in the investigations 2 5 2 1 7 2 1

Unintentional/understanding Unintentional/awareness Routine Situational Optimising-organisation Optimising-personal convenience Exceptional

In summary: The organisation is reactive HSE culture; the Training is the most reoccurring Basic Risk Factor; Competence also is reflected in the HSE-MS failures; there are quite some errors due to unintentional/awareness and people making optimising errors for company benefit. For developing the recommendations, the various Hearts and Minds tools are used. Several of these tools focus attention on leaders and supervisors (SYAOSY, Improving supervision) and others focus on how to improve the HSE culture in particular (HSE-Understanding your culture, Managing Rule-Breaking The Toolkit). By reviewing the incident outcomes and suggestions from these various tools, the recommendations can be better focused on improving the work environment and also affecting the human behaviour. The actions are split in system action and work environment actions. A worked out example of a plan of action and recommendation is given below. For improving the system from a reactive to a calculative culture the following is proposed: System changes: A competence matrix system should be set up; testing of competence could be implemented; reward of those who completed competence training (reference Understanding your HSE culture brochure); Make sure o Personal responsibilities for training are clear (clear which jobs are Safety Critical and need specific competencies); o Individual consequences are clear (positive: recognition, career enhancement, coaching or negative effects: injury; criticism, disciplinary measures; o Pro-active Interventions are made (people work because the are intrinsically motivated to do so); ref winning Hearts and Mind the road map, reference 7) Work environment: Senior leader should allow time for Training e.g. kick off training sessions; ensure that in contracts competence is taken into account and valuated; allocate money in the contract for competence development etc (reference Understanding your HSE culture brochure); Senior leader should make it clear that optimising the work process for company benefit is encouraged but not if it is done by breaking the rules

SPE 111699

Supervisors: could send people on training courses, based on a training plan; supervisor could coach employees to improve work competence (Reference Improving supervision brochure)

From the Human error overview, it becomes clear that many violate rules because they think their boss likes it (optimisingorganisation-I-Can-It-Do-Better). System changes: Review whether there are incentive schemes which may encourage these violations (e.g. contractors are paid by load, so they may want to over speed to get more done) and modify these schemes to achieve no violations Review whether the rules are too difficult to follow (in Managing Rule breaking brochure, there is a checklist to find out) Work environment: Leaders o Review whether leaders send the right information to the employees on what is important and whether it is allowed to stop operations if it is unsafe (you could consider to run the SYAOSY exercise (reference 3). o Review how people are rewarded (based on production targets, or to do it safely) o Reward people who stopped and intervened if the work is unsafe. On site visits, publicly congratulate these people. o Is the leader walking the talk? E.g. are site visits cancelled regularly; is safety topic postponed to next meeting etc. Supervisors: o Make clear to employees when it is acceptable to stop work o Support crew if they follow the procedures, be aware not to reward people who violated procedures. o Make sure you as supervisor also follow the procedures o Provide feedback to crew after doing a job (reference from Improving supervision) Measuring success o In many investigation reports, the focus is on improving the system failures like additional procedures and installing other barriers. However an investigation report should at least have e.g. half of the recommendations dealing with changing the work environment. o To measure success of the actions/recommendations, a simple set of proactive measures are proposed which focus on measuring the culture change and plot the rating. For example the supervisor makes daily round and measures for example 10 jobs during the day. The supervisor list: o How many of the workers are competent (e.g. by asking the hazards in the work done) o Is the work priority clear (first do it safely) o Can the workers say in 5 words what the key controls are to manage their work etc

Conclusions 1. 2. 3. Incident investigations generate a lot of information. Often this available information is not exhaustively used for setting the recommendations. From Tripod Beta incident investigations, information is obtained on immediate causes, underlying causes, human error type, Basic Risk Factor trends. The output of the Tripod Beta investigations can be used in combination with findings from human behaviour studies (HSE culture of the organisation, Seeing yourself as others see you, Managing Rule Breaking) to arrive at system improvements and work-environment improvements In the Hearts and Mind brochures, there are many suggestions that leads to improve the work environment of an organisation. If recommendations from an incident investigation dont address the work-environment improvement, the effects of the recommendations are probably not efficient.

4. 5.

References:
1 2 3 4 5 6 7 8 9 Controlling the controllable, preventing business upsets. 5th edition 2002, Global Safety Group ISBN 90-6695-140-0 HSE- Understanding your Culture (http://www.energyinst.org.uk/heartsandminds/) Seeing Yourself as Others See You (http://www.energyinst.org.uk/heartsandminds/) Improving Supervision (http://www.energyinst.org.uk/heartsandminds/) Managing Rule-Breaking The Toolkit (http://www.energyinst.org.uk/heartsandminds/) Tripod beta users guide (http://www.tripodfoundation.nl/home/downloads.html) Winning Hearts and Mind the road map (http://www.energyinst.org.uk/heartsandminds/) Van der Graaf, G.C., & Hudson, P.T.W. Hearts and Minds: The Status After 15 Years Research. Paper SPE 73941 presented at 2002 SPE Conference on HSE in Oil and Gas Exploration and Production, Kuala Lumpur, 2002 Hudson, P.T.W., Parker, & van der Graaf, G.C. The Hearts and Minds Program: Understanding HSE Culture. Paper SPE 73938 presented at 2002 SPE Conference on HSE in Oil and Gas Exploration and Production, Kuala Lumpur, 2002

SPE 111699

10

11 12 13 14

15 16

17 18 19 20 21

22 23

Aune, S., van der Wal, J., Cairns, D., & Bryden, R. Culture change and breakthrough performance: A European example Paper SPE 86841 presented at 2004 SPE Conference on HSE in Oil and Gas Exploration and Production, Calgary, 2004. Bryden, R. Getting serious about safety: Accountability and leadership - the forgotten elements Paper SPE 73940 presented at 2002 SPE Conference on HSE in Oil and Gas Exploration and Production, Kuala Lumpur, 2002 Hudson, PTW; Vuijk, M; Croes, S; Parker, D; Lawrie,M; Bryden, R, Van der Graaf, G.C.; Malone. C; Improving the quality of supervision in the Workplace. Paper SPE 86759, Calgary 2004 Hudson, P.T.W; Parker, D; Lawrie, M; Van der Graaf, G.C. and Bryden, R. How to Win Hearts and Minds: The Theory behind the Program. Paper SPE 86844, Calgary 2004. Hudson, P.T.W. , Primrose, M.J. & Cranmore, R. Diagnosis and target setting in drilling and engineering operations using Tripod-DELTA paper SPE 27294 presented at 1994 SPE Conference on HSE in Oil and Gas Exploration and Production, Jakarta, 1994 Hudson, P.T.W. & van der Graaf, G.C. The Rule of Three: Situation awareness in hazardous situations SPE 46765 presented at 1998 SPE Conference on HSE in Oil and Gas Exploration and Production, Caracas, 1998 Hudson, P.T.W., Parker, D., Lawton, R., Verschuur, W.L.G., van der Graaf, G.C. & Kalff, J. The Hearts and Minds project: Creating intrinsic motivation for HSE Paper SPE 61095 presented at 2000 SPE Conference on HSE in Oil and Gas Exploration and Production, Stavanger, 2000 Hudson, P.T.W., Parker, & van der Graaf, G.C. The Hearts and Minds Program: Understanding HSE Culture. Paper SPE 73938 presented at 2002 SPE Conference on HSE in Oil and Gas Exploration and Production, Kuala Lumpur, 2002 Sneddon, A., Mearns, K., Flin, R., & Bryden, R.. Safety and Situation Awareness in Offshore Crews Paper SPE 86592 presented at 2004 SPE Conference on HSE in Oil and Gas Exploration and Production, Calgary, 2004 Shell Exploration & Production (2003). Working Safely. Hearts and Minds EP 2003-5040, Shell International Exploration & Production B.V. Reid, H., Flin, R. Mearns, K., & Bryden, R. Influence from the top: senior managers and safety leadership. Paper SPE 111762 presented at 2008 SPE Conference on HSE in Oil and Gas Exploration and Production, Nice. Bryden, R., Flin, R., Hudson, P., Van Der Graaf, G., & Vuijk, M. (2006). Holding up the Leadership Mirror Then Changing the Reflection: The Seeing Yourself as Others See You Tool. Paper to be presented at the 8th SPE International Conference on Health, Safety, and Environment in Oil and Gas Exploration and Production, Abu Dhabi UAE, 2-4 April. EI, (2008) Guidance on investigating human factors aspects of incidents/accidents. London http://www.energyinst.org.uk/index.cfm?PageID=5 MDC de Wit and W.T. Peuscher. How Well Do Companies Embed Learning From Industrial Incidents SPE-111526 presented on SPE conference in France 2008