SPE 86630
A New, Improved JSA Process Gets Enthusiastic Approval from Field Personnel
Carl Veley and Norman Ritchie, vPSI Group, LLC; E. Alan Coats and Joel Disatell, Halliburton
Copyright 2004, Society of Petroleum Engineers Inc.
This paper was prepared for presentation at The Seventh SPE International Conference on
Health, Safety, and Environment in Oil and Gas Exploration and Production held in Calgary,
Alberta, Canada, 2931 March 2004.
This paper was selected for presentation by an SPE Program Committee following review of
information contained in a proposal submitted by the author(s). Contents of the paper, as
presented, have not been reviewed by the Society of Petroleum Engineers and are subject to
correction by the author(s). The material, as presented, does not necessarily reflect any
position of the Society of Petroleum Engineers, its officers, or members. Papers presented at
SPE meetings are subject to publication review by Editorial Committees of the Society of
Petroleum Engineers. Electronic reproduction, distribution, or storage of any part of this paper
for commercial purposes without the written consent of the Society of Petroleum Engineers is
prohibited. Permission to reproduce in print is restricted to a proposal of not more than 300
words; illustrations may not be copied. The proposal must contain conspicuous
acknowledgment of where and by whom the paper was presented. Write Librarian, SPE, P.O.
Box 833836, Richardson, TX 75083-3836, U.S.A., fax 01-972-952-9435.
Proposal
Many oilfield companies require field crews to systematically
analyze safety aspects of their activities before starting to
work. Commonly, this process is called a Job Safety Analysis,
or JSA, but other labels are also used.
Recent developments in measuring safety performance
have changed the JSA process by redefining its objective. This
change is definitely for the better, and it is rapidly gaining
acceptance throughout the Gulf of Mexico petroleum industry.
A survey of Gulf of Mexico offshore production facilities
and drilling rigs showed that JSAs tend to be a tedious
formality that crews comply with only because they are
required to do so. For a typical jack-up drilling rig, adopting
this new JSA process and standard can reduce total time spent
in JSA meetings from approximately 30 man-hours per day to
less than four man-hours per day. Not only does the new style
of JSA provide significant time savings, but it is considerably
more effective in reducing the likelihood of accidents, meets
with enthusiastic approval of work crews, and provides a
powerful tool for onsite management.
Introduction
Major oil companies often require their own employees and
most contractors to use a JSA process, although the process
occasionally goes by some other name. The crux of the idea is
that crews hold a meeting before beginning any job, analyze
the job, and decide what they can do to prevent accidents
during the job.
While visiting rigs, production facilities, construction sites,
and other work areas, the authors have frequently noted a
considerable difference between perception and reality in
regard to JSAs. Company HSE departments often believe the
JSA process is being scrupulously followed and is accepted by
work crews. They may point to records and testimonies that
support that conclusion. However, outsiders who spend
enough time with a work crew to gain their confidence find
people privately confessing they see no benefit in the JSA
process and generally consider it a required but meaningless
formality. On one location, the noise level was so high that
everyone wore hearing protection outside offices and quarters.
The crews would gather, the supervisor would read a JSA
while everyone stood there unable to hear a single word. The
crew then did the job, and the supervisor filed a report that a
JSA was conducted as required by company policy. It was no
surprise to find the crews were privately scoffing at the JSA
process and viewed it a just bureaucratic harrassment.
This situation seems to be common throughout all
industry. Management sends out strongly worded orders that a
JSA will be conducted, and they get back reports that the order
was obeyed, but what actually happens has little or no effect
on the probability of accidents occurring. A better way is
needed for gauging effectiveness of a JSA program.
A JSA is valuable only to the extent to which it prevents
accidents. When JSAs are employed, most jobs do not result
in an accident. However, accidents are rare, so chances are
good that even without a JSA or other prejob safety analysis,
most jobs would still not result in an accident. How can we
prove any given JSA actually decreased the chances of
accidents occurring? This issue also applies when deciding
whether a given accident report decreased chances of that
particular accident repeating. The problem of determining the
effectiveness of these tools is amplified by official or
unofficial programs that encourage people to hide accidents or
distort records.
The authors believe an effective JSA should produce the
same corrective action that would be produced by a good
accident report. The only difference is that the JSA devises the
corrective action before, rather than after, the accident occurs.
Therefore, effectiveness of a JSA can be measured by exactly
the same process used to measure the effectiveness of
corrective actions in accident reports.1 That means an effective
JSA should be a plan, or a pre-arranged schedule of events
leading to attaining some objective. To meet this definition, a
plan must contain actions (events) that will be pre-arranged
when when they are assigned.
vPSI Definitions
JSAs. Suppose someone is replacing an electrical transformer
on a utility pole. Although electrical hazards are associated
with the actual job, totally independent hazards associated
with working at heights also exist. Both types of hazards must
be addressed in an effective JSA.
2 SPE 86630
Performing the job safely requires job skills and
knowledge of how to remove the old transformer and install
the new one. Although these skills are very important, a JSA is
not the vehicle for teaching them. The JSA should be used to
make certain that the power is positively isolated, heavy items
are hoisted properly, and so forth, but it should not address
how to connect wires, check fluid levels, or secure the
transformer to the pole. Likewise, the JSA should not provide
instructions about how to use ladders, operate man-lifts, or use
fall arrest systems; rather, JSAs are the ideal system for
ensuring someone makes the appropriate inspections to be
certain those things are in place and properly used. The JSA
process should be able to detect if someone needs training, but
it should not be that training.
Accidents and Corrective Actions. An accident is an
unplanned event that has the potential for causing harm.
People often confuse an accident with its consequences. A
broken leg is not an accident; it is the result of an accident.
Near misses or incidents are commonly used misnomers items into it, transported it to the dock, put it on the boat, and
for accident. An accident does not have to result in harm to
qualify as an accident.1 Accidents can be further described as
having the following four components (Fig. 1):
Harm (injury or damage)
An unplanned event (with potential for causing
significant harm, whether harm occurred or not)
Unsafe acts of people (unsafe conditions can always be
attributed to one or more unsafe acts of people)
Root causes (the reason(s) for unsafe acts)
The authors believe that 100% of root causes can be linked
to acts of people. Typically, faulty valve may be listed as the
root cause of an accident, but that valve was designed, created,
and inspected by a person, delivered by a person, installed by
a person, and should have been checked and maintained by a
person. The faulty valve can easily be traced back to the
actions, or lack of actions, of a personthe true source of the
accident.
Reasons why people do not anticipate consequences of
their actions can be reduced to four general explanations,
namely that someone, somewhere didnt Know, Understand,
Believe, or Observe. Treating these as the four root causes of
all accidents makes analysis and prevention easier through the
KUBO-TEPA matrix.1,2,3 One element of the TEPA acronym
for basic corrective actions (Teach, Educate, Persuade, and
Assign) is best handled through the JSA process: the Assign
element. Unfortunately, as they are typically done,
conventional JSAs are weak in that regard, just as typical
accident reports do not specify effective corrective actions.
Function of JSAs
In typical JSA programs, crews are instructed to review a job
in detail before starting work, think carefully about what
accidents could happen during each step, and decide what they
need to do to prevent those accidents. Thats fine, in principle,
but take a look at how that gets put into practice.
When the authors first encountered the JSA in Fig. 2, a
crew of five men was getting ready to offload components of a
temporary crane being set up on the platform. The crew called
a prejob meeting, carefully read through the entire JSA, then
started work. Fig. 3 shows the cargo basket that the crew lifted
off the boat immediately after reviewing this JSA. It contained
the load line cable drum, a headache ball, and the main block
a total weight of over two tons. The bottom of that basket was
severely corroded, and the bottom angle iron support bent and
nearly failed just as the crane operator set the basket on the
platform deck. If a failure had occurred just seconds earlier,
the basket could have dropped its contents onto the workboat
from a height of about 85 ft.
As Fig. 3 shows, this basket was obviously in very poor
condition and should never have been used, but the JSA did
not prevent it from being picked up and exposing a boat, a
platform, several wellheads, and 11 men to very serious
unnecessary danger. No actual accident occurred, at least
according to conventional definitions, because the basket
bottom did not fail, nothing fell, no one was injured, and no
damage resulted. Several unsafe acts were performed though,
when various people chose to use that basket, loaded heavy
finally dynamically lifted it off the boat.
If the bottom had fallen out of this basket, the event would
have been an accident, whether it happened just as the basket
was setting down on the platform, or a few seconds earlier
when the basket was suspended 85 feet above the deck of a
work boat. The accident would have been exactly the same,
but the consequences would have been very different.
Whatever corrective action is appropriate for preventing
unsafe baskets from being used is independent of the
accidents consequences. Preventing the bottom from falling
out of the next basket has nothing to do with whether a
previous basket failure sank a workboat, snapped off a
wellhead and started a major fire, or simply made a little
noise. The role of the JSA is to take that corrective action,
even though the accident never occurred at all. The same
corrective action would have been required if a basket failure
had resulted in catastrophy, and like any other corrective
action, its probable effectiveness can be classified and
evaluated (Fig. 1).
The JSA in Fig. 2 had been reviewed and approved by
both contractor and oil company safety representatives. It
looked normal to them, just as, to the authors of this paper, it
looks like a JSA typical of those generally used across all
industry. But remember, this JSA did not work. It did not
prevent the crew from doing something extremely dangerous
and unnecessary.
It follows that JSAs that look normal are not working
because they do not contain corrective actions, as previously
defined.1,2 Notes and good advice are abundant, but no
specific actions are included that will become plans when
assigned. These JSAs include no evidence of a pre-arranged
schedule of events leading to attaining the objective of safely
offloading a boat.
When a JSAs objective is to produce corrective actions
that meet our definition of plan then the conventional JSA in
Fig. 2 must be modified to be more like the one in Fig. 4. In
this form, the JSA becomes a checklist to help the supervisor
supervise. Notice that Assignment D in the revised JSA would
have greatly increased the probability of the severely corroded
cargo basket being rejected.
SPE 86630
Certainly the supervisor should tell the crew what they are
about to do, but that should be a matter of a few seconds in
familiar jobs. Changes in the routines or special circumstances
should of course be explained, and if it is something the crew
has never done before, special training may be required; but
training is not the function of a JSA. The sole function of an
effective JSA is to implement corrective actions before an
accident occurs.
Fig. 5 shows another typical JSA that was designed to be
pulled from a file and reviewed before bleeding off gases from
high-pressure gas wells and process equipment. When this
JSA was actually used, the job supervisor read it to his crew,
then the crew performed the job, venting high-pressure gas
upwind from a diesel engine with a nonfunctional emergency
air shutoff, creating a risk of an engine explosion. (That point
was on the companys work permit checklist, which was not
completed.)
Clearly, this example is another case of a JSA that did not
work. No accident occurred, at least not in the usual sense of
the word, but an unsafe act created a major danger and was not
prevented. A revised JSA for this job is shown in Fig. 6.
Assignment 3 on the list would almost certainly have caused
the unsafe engine to be detected.
The principal shortcoming of conventional JSAs is that
they tend to list what should happen with no provision for
ensuring that those things happen.
New JSA Process
Hot work permit forms may involve many man-hours or even
man-weeks in development, but they generally only take a
minute or two to implement. Properly issuing a hot-work
permit requires a qualified person to visit the site and review a
list to confirm that appropriate assignments are made. The hot
work permit does not need to be redesigned each time it is
used, and special circumstances can easily be penciled in
when needed. That same process can be applied to JSAs.
A hot work permit does not contain instructions on how to
weld, and a JSA should not include training instructions on
how to operate cranes or any other regular job. An effective
JSA will be predesigned, just as a hot work permit is, but it
will be flexible enough to adapt to unusual conditions, and it
will lend itself to easy modification as additional hazards are
exposed.
In practice, supervisors use this new style of JSA simply as
a checklist of assignments that need to be made before starting
work. Some supervisors may want to put a crew members
name or initials in the blank when making the assignment.
Others simply use a checkmark to indicate that the assignment
was made or the action was comleted. For example, one
assignment might be: ___ will inspect fall protection gear.
The supervisor might personally handle that task or delegate it
to someone else. It doesnt really matter if the name in the
blank shows who accepted that assignment. In the unhappy
event that serious injury occurs because fall protection was not
inspected, the supervisor will ultimately be held responsible
anyway. Having that item on the checklist will help the
supervisor avoid that liability by helping make sure the
inspection does occur.
3
Spotting New Hazards
First drafts of JSAs must rely on experience. That is, people
who have done that particular job recall things they know have
gone wrong in the past and rely on their personal experiences.
Its a different matter to look for things that are not so familiar
or things that could happen that no one has thought about
before. Crew members need some sort of guidance for what to
look for when they are trying to spot unfamiliar dangers.
One commonly used system assumes that ultimately,
anything with a potential for causing injury or physical
damage must involve energy. This idea means crew members
can look for energy sources then reflect on ways that energy
could cause unexpected harm. It may not satisfy rigorous
physics definitions, but energy can be arranged into a small
number of generalized sources. One such arrangement uses six
energy sources,4 but other people have identified eight
sources, as shown in Fig. 7. This identification of these
sources has proved valuable in giving ordinary crew members
a practical guide for spotting hazards as they go about their
jobs. It is particularly useful in debriefings after a nonroutine
job, and it leads to important modifications to existing or
generic JSAs.
However a hazard or potential accident is identified, the
real secret to a successful JSA is making sure it contains actual
corrective actions and not just good advice. It is essential that
the end result of a JSA is a pre-arranged (i.e. assigned)
sequence of events (i.e. actions) that will ensure a job is done
safely.
Case History
The authors reviewed JSAs used by a variety of operators and
service companies in the Gulf of Mexico. Most of the JSAs
were similar to Fig. 2, taken from an offshore production
platform of a major oil company. This JSA is best described as
a list of good advice or points that people should keep in mind,
but it includes no provisions for ensuring any actions take
place. Closer inspection shows this JSA does not present
events that can be prearranged through assignments.
Therefore, this conventional JSA does not meet the definition
of a plan and is ineffective at preventing accidents.
The authors have traveled to various locations teaching
crews and management how to change the previously used
methods of creating corrective actions. These crews have
rewritten numerous JSAs and have found them to be easier
and more thorough, resulting in a significantly better accident-
prevention tool. So far, all of these crews have enthusiastically
approved the changes that are being made to the JSA process
and other safety measurement systems used in this industry.3
Conclusions
Because 100% of the root causes of accidents can be attributed
to acts of people, the most logical way to prevent accidents is
to correct the actions of people. The corrective actions that
result from a JSA should be specific plans that are assigned to
specific people. This method of assigning responsibilities
produces true corrective actions that help ensure a prearranged
plan takes place, effectively preventing accidents. A JSA is
valuable only to the extent to which it prevents accidents.
The new JSA process is simpler, faster, and something
crewmembers can understand, look forward to, and put into
4 SPE 86630

practice. It can provide significant time savings, and it is
considerably more effective in reducing the likelihood of
accidents.
Acknowledgements
The authors thank Halliburton for their support and assistance
in publishing this paper.
References
1. Veley, C.D.: Applying a New HSE Measurement System,
paper SPE 74050 presented at the 2002 SPE International
Conference on Health, Safety, and Environment in Oil and Gas
Exploration and Production, Kuala Lumpur, Malaysia, 20-22
March.
2. Veley, C.D. et al.: Derivation, Application, and Evaluation of
the KUBO-TEPA Matrix for Generating Corrective Actions,
paper SPE 86736 presented at The Seventh SPE International
Conference on Health, Safety, and Environment in Oil and Gas
Exploration and Production, Calgary, Alberta, Canada, 29-31
March.
3. Veley, C.D. et al.: A New Method of Measuring Safety
Performance Will Soon Affect the Whole Industry, paper SPE
86741 presented at The Seventh SPE International Conference
on Health, Safety, and Environment in Oil and Gas Exploration
and Production, Calgary, Alberta, Canada, 29-31 March.
4. Safety Alert 01-20: International Association of Drilling
Contractors, http://iadc.org/alerts/2001%20Alerts/sa01-20.PDF.

DN004236
Fig. 1Accident components and prevention tools.
SPE 86630 5

Fig. 2Old style JSA case history example.

DN004348

Fig. 3Cargo basket with reel used in case history.

6 SPE 86630

Fig. 4New style JSA case history example.

SPE 86630 7

Fig. 5Old style JSA concerning bleeding off gas.

Fig. 6New style JSA concerning bleeding off gas.

8 SPE 86630

DN004347
Fig. 7List of hazards.