Download Advantages & Limitations of Behavioral Safety in Hazardous Industries and more Summaries Engineering in PDF only on Docsity!
BEHAVIOURAL SAFETY AND MAJOR ACCIDENT HAZARDS:
MAGIC BULLET OR SHOT IN THE DARK?
Martin Anderson MErgS, EurErg, MIOSH HM Specialist Inspector of Health & Safety (Human Factors) UK Health And Safety Executive
In recent years there has been an increase in the use of behaviour modification (BMod) approaches to safety. These interventions generally involve the observation and assessment of certain behaviours, usually those of front-line personnel. The rationale behind behavioural safety approaches is that accidents are caused by unsafe behaviours. These approaches are based on behaviourist theories, which can be summarised by ‘behaviour that is strongly reinforced will be maintained’.
There are reports of some successes with behaviour modification in a range of environments, including the process industries. Such approaches have a number of advantages in addition to reducing incidents, including increased communication about safety, management visibility and employee engagement.
However, these programmes tend to focus on intuitive issues and personal health and safety, ignoring low probability/high consequence risks. The author proposes that the causes of personal safety accidents may differ to the precursors to major accidents and therefore behavioural safety programmes may draw attention away from process safety. Furthermore, the tendency is to focus on individuals and fail to address management behaviour, thus excluding activities that have a significant impact on safety performance.
This paper discusses the usefulness of behaviour modification approaches, particularly in managing major accident hazards, and provides guidance for companies that may be considering embarking on such a programme.
KEYWORDS: human factors, behavioural safety, major accident hazards, safety management, COMAH
INTRODUCTION
Major accidents in the oil, gas and chemical industries are by definition high consequence and include major fires, explosions and toxic releases. They are also, thankfully, relatively infrequent. The main legislation focussing on these hazards in the UK are the Control of Major Accident Hazards Regulations 1999 – COMAH. Sites that come under these regulations are required to ‘take all measures necessary’ to manage their major accident hazards. The Hazardous Installations Directorate of the Health and Safety Executive inspect COMAH sites, assess safety reports submitted by the so-called top tier sites and investigate incidents on all major hazard sites. This paper is based upon personal experiences of regulating safety on sites that come under the COMAH regulations.
CAUSES OF MAJOR ACCIDENTS
In any incident there are usually two types of causes:
direct causes that occur immediately prior to the undesirable event; further away, either in time or space, there are underlying causes that contributed to the immediate, direct event.
Historically, many incidents and accidents in all major hazard industries were seen as the ‘fault’ of someone at the sharp end – the last person who touched the equipment. This view is less common today, particularly in incident investigations, although it is still dominant in efforts to prevent major accidents. This paper therefore argues that there exists an anomalous situation – on one hand industry increasingly recognises that incidents have underlying causes distant from the person who is directly involved; however, on the other hand, resources to prevent such incidents are often targeted at front line staff.
Reviews of reports into recent major incidents and of research examining the causes of such incidents around the globe tells us the most common causes behind these events. For example, over the years Professor Trevor Kletz has written several accessible books analysing high-profile accidents such as Bhopal, Flixborough, Piper Alpha and Seveso, aiming to show how lessons can be learnt. Discussing the focus on front line staff in reported ‘causes’ of accidents, Kletz states that:
‘Managers and designers, it seems, are either not human or do not make errors’ (Kletz 2001, p.317) 1.
Recent research by Collins and Keeley (2003)^2 shows that although the immediate causes of major incidents frequently involve ‘human error’ of operators or maintenance personnel, the reasons that these errors occurred in the first place were the responsibility of those more senior in the organisation. This research reviewed 718 loss of containment incidents randomly selected from approximately 2500 investigations. Extracts from this research make interesting reading when considering behavioural safety interventions. For example, of 110 incidents due to maintenance, only 17 were due to a failure to ensure that planned maintenance procedures were followed (a front line issue and therefore possibly candidates for a behavioural intervention), but 93 were due to a failure by the organisation to provide adequate maintenance procedures (a management issue, which would not be addressed by the majority of behavioural interventions).
Of the incidents analysed, only 5.6% were due to procedural violations – personnel deliberately not following procedures. Collins and Keeley state that ‘the cause of any incident or accident, including loss of containment, can usually be traced back to a failure of safety management’. Similar findings were reported in early research on causes of loss of containment incidents by Bellamy et al., 1989^3.
On 25th^ September 1998, two people were killed in an explosion and fire at the Esso Longford facility in Australia, which led to severe disruption of gas supplies to the State of Victoria’s industry and retail customers for two weeks. Longford should be seen as a wake-up call for all of the world’s major hazard installations; there are many lessons to be learnt from this incident.
BP has since committed substantial resources to implementing all of the recommendations made across the Grangemouth complex and the BP group.
ARE WE MANAGING MAJOR HAZARDS?
Statistics published by the HSE show that over the past few years the number of dangerous occurrences has either remained static or worsened. In 2002/2003, three of the UK’s nine refineries had major accidents of sufficient seriousness to require notification to the European Commission.
It can thus be argued that current methods of managing major accident hazards are not successful. The review by the Institution of Engineers, Australia, evaluated the impact of the Esso Longford 1998 incident on major hazard sites and concluded that:
‘industry and its engineering and safety professionals could have learnt a great deal more from the Longford tragedy’ (2001, p.9).
LTIs AND MAJOR ACCIDENT HAZARDS ‘Safety’ on major hazard sites is frequently measured by Lost Time Injuries, or LTIs. Organisations that we inspect frequently present us with very low LTI rates and industry as a whole should be congratulated for bringing down personal injury rates to such low levels. A recent document by the International Association of Oil & Gas Producers (OGP, 2004)^7 summarises safety data provided by 36 companies operating in 74 countries around the world. It reports a LTI rate of 1.16 per million hours worked in 2003, which is around a third of the rate a decade ago.
However, several sites that have recently suffered major accidents demonstrated good management of personal safety, based on measures such as LTIs. How can this be when they have managed LTI rates to such low levels?
The reason why companies with good LTI records still have major accidents is that the causes of personal injuries and ill-health are not the same as the precursors to major accidents. A recent research project reviewed the literature on investigation and reporting systems and concluded that measures of injury or fatality rates do not provide an indication of how well major accident risks such as major fires and explosions are managed (Marsden et al., 2004)^8. Earlier work sponsored by HSE (Wright & Tinline, 1994)^9 also concluded that LTI rates are not significantly correlated with loss of containment rates (a measure of releases with major accident potential). This suggests that sites with higher or lower LTIs do not consistently have corresponding higher or lower loss of containment rates.
Measures such as LTIs are not an accurate predictor of major accident hazards and sites may thus be unduly complacent in this respect. Although a focus on personal injuries is important, it is proposed that the balance between resources addressing personal health and safety, and those addressing process safety is inappropriate. Too much focus on measures such as LTIs draws attention away from those aspects relating to major hazard safety.
‘Clearly, a safety management system that is not managing the right aspects is as effective in controlling major accidents as no system at all’ (Anderson, 2003) 10.
An influential account of the fires and explosions at Esso Longford in Australia also emphasizes management and organisational failures (Hopkins, 2000)^11. In this publication Hopkins states that:
‘Reliance on lost-time injury data in major hazard industries is itself a major hazard’.
Unfortunately, the review of lessons learnt from Longford discussed above (Nicol, 2001) suggests that lessons from the disaster appear to have focussed on traditional ‘safety’ – aimed at reducing high-frequency, low consequence personal injuries, rather than an engineering focus aimed at reducing low-frequency, high consequence catastrophes.
PROCESS SAFETY PERFORMANCE MEASURES
Major hazard performance indicators should relate to the control measures outlined by the site risk assessment and/or detailed in the COMAH safety report. There is a wide range of process safety indicators available and will relate to issues such as:
- Risk assessments and improvements;
- Plant and process change;
- Functioning of safety critical equipment;
- Competency and training;
- Resources (financial, staff, equipment);
- Procedures;
- Plant inspection and maintenance;
- Releases and near misses;
- Monitoring, audit and review.
For example, performance measures that relate to risk assessments and improvements would possibly include the following:
- Percentage of hazard studies completed to schedule;
- Percentage of action items completed to schedule;
- Number of outstanding action items;
- Number of major accident scenarios reviewed;
- Number of HAZOP actions not closed out;
- Completion of formal risk assessment for the top process safety risks.
However, it should be stressed that process safety management should not simply involve the counting of assessments, audits, reviews or actions etc. that have been completed, but should equally consider the quality of those activities.
ORGANISATIONAL FAILURES
It is generally accepted that organisational and management factors are implicated in incidents across all industries, from the process industry (e.g. Grangemouth, Flixborough, Piper Alpha), through transportation (e.g. Kegworth, Clapham), to finance (e.g. Barings Bank).
AVRIM2 model) assess standards of safety management on site through audit and then modify QRAs accordingly.
HOW DO MAJOR HAZARD SITES ADDRESS HUMAN FACTORS?
Despite the growing awareness of the significance of human factors in safety, particularly major accident safety, many sites do not address these issues in any detail or in a structured manner. Their focus is almost exclusively on engineering and hardware aspects, at the expense of ‘people’ issues. Those sites that do consider human factors issues rarely focus on those aspects that are relevant to the control of major hazards – they tend to focus on occupational/personal safety rather than on process safety. For example, when addressing maintenance, sites tend to focus on the safety of personnel carrying out such activities, rather than reviewing maintenance error as an initiator of incidents. Human failures in maintenance can have disastrous consequences and are a significant cause of major accidents – common failures include omitting components, using incorrect replacement components or leaving tools inside equipment.
Organisations frequently fail to recognise that there are several different types of human failures (having different causal mechanisms) and tend to focus efforts on selected control measures that have little effect on some failure types.
Where sites do address human factors they tend to focus on two aspects – training and procedures. These interventions may have a positive effect on cognitive failures (decision making errors) and some violations (understanding the reason behind rules & procedures, and better procedures, will help increase procedural compliance). However, improvements in training and procedures will have little impact on unintentional physical failures (e.g. an operator connecting a flexible hose to valve B when they meant to connect it to valve A). Engineering/hardware solutions are the key here, such as changes to valve design so that the hose only connects with valve A. It is not always the case that a human factors problem requires a human factors solution.
Furthermore, when sites claim that ‘training and procedures’ manage human factors concerns, closer inspection often reveals that these two ‘controls’ are inadequately managed. For example, in the case of the Esso Longford incident, the Report of the Royal Commission (1999) stated that there were deficiencies in both the arrangements for training and procedures:
Training: ‘At no relevant time did any programme include training with respect to the hazards associated with the loss of lean oil flow, the hazards associated with the uncontrolled flow of condensate into the rich oil stream from the absorbers, the critical operating temperatures for GP922 and GP905, the circumstances in which brittle fracture might occur or the procedures for the shutdown or start up of GP1’.
Operating Procedures Manual: ‘It did not contain any reference to the loss of lean oil flow and contained no procedures to deal with such an event. Nor did it contain any reference to GP1 shutdown or start up procedures or the safe operating temperatures for GP905 and GP922’.
One of the ways that major hazard sites address human factors is often through a behavioural safety programme and the later sections of this paper discuss the usefulness of such approaches to managing human performance in relation to major hazards.
When inspecting sites, it is sometimes claimed that a behavioural safety programme is addressing ‘human factors’. However, it should be recognised that an intervention focussing on behaviours will not address all human factors concerns. For example, operators motivated towards achieving optimal human performance will not compensate for over-riding production demands, insufficient numbers of personnel, inadequate shift patterns, inadequate process training, unclear roles/responsibilities or outsourcing of technical expertise.
HUMAN RELIABILITY ASSESSMENT AND MAJOR ACCIDENT HAZARDS
Human reliability assessment aims to identify potential human performance issues and the factors that influence performance so that human reliability can be assured. Usually this process starts with analysing the tasks that people perform and identifying potential for error using a taxonomy of error types (e.g. task omitted, task partially competed). Sometimes, attempts are made to estimate the likelihood of the potential for error.
However, most techniques and approaches currently available focus on analysing the behaviours of those personnel in direct contact with equipment, plant and technology. Little progress has been made in the assessment of failures at the design stage; or systemic, organisational and management failures that influence direct failures.
BEHAVIOURAL SAFETY APPROACHES
There has been a large uptake of these approaches over the past 15 years or so. They are based on the premise that a significant proportion of accidents are primarily caused by the behaviour of front line staff. Although these behaviours may be largely the result of attitudes, it has been shown that changing behaviours first is more effective.
There is a wide range of programmes available, but they generally involve the definition of safe/unsafe behaviours, observations of behaviours (by trained observers – either management or employees) and feedback/reinforcement of behaviours. The programmes vary in their detail, for example, according to how safe/unsafe behaviour are defined, who performs the observations, what feedback is provided to individuals (and when) and the nature of reinforcements. The success of these programmes varies widely from reductions in accident rates to no change (or even resulting in a worse situation than previously, for example due to employee disillusionment). Of four detailed case studies examined in an HSE research project, only one demonstrated a significant reduction in accident rates (Fleming & Lardner, 2001) 12. A full description of behaviour modification theory and the key elements of observation and feedback programmes is provided in Fleming & Lardner, 2002^13.
ADVANTAGES OF BEHAVIOURAL SAFETY APPROACHES
The literature and contact with sites shows that these approaches can be successful in reducing unsafe behaviours in the workplace. Due to the nature of these approaches, there are a number of other less tangible benefits, including:
Management may demonstrate their commitment to improving safety;
Management/business consultants frequently investigate management decisions and business strategies; but this expertise is rarely applied to safety. Many audits check for the presence of a system, rather the quality of the products of that system (that is, audits are often satisfied to report that a system of ‘audit and review’ exists, rather than comment on the quality of that auditing).
Secondly, interventions tend to focus on behaviours relating to personal health and safety; such as the wearing of Personal Protective Equipment (PPE), positioning of the body in relation to hazardous equipment, and issues relating to working at height (e.g. wearing of harnesses, proper use of ladders).
If successful, behavioural interventions will reduce accidents and ill-health of personnel. However, the discussion of LTIs above suggests that LTIs are not a valid indicator of how well a site is managing those aspects that are determinants of major incidents. Behavioural interventions can demonstrate improvements in the wearing of PPE, but this is of little relevance if those wearing the PPE do not have the underlying process knowledge to respond appropriately to a developing incident, or if there are insufficient operators available.
Many supporters of behavioural safety programmes state that large improvements in safety have been made in the past decade or so in engineering and safety management systems; and that new approaches are required to encourage further improvement. Addressing the behaviours of front line personnel is a welcome initiative, but only one tool available. It is inappropriate to concentrate on any one solution to managing incidents and accidents.
Although large advances have been made in engineering and safety management systems, major accidents are still occurring due to failures in these aspects. It is therefore suggested that it is not appropriate to conclude that we have ‘solved’ engineering causes of accidents, nor to assume that no further focus on management systems is required. A publication by the Step Change initiative in the offshore oil and gas industry acknowledges that:
‘addressing behaviours must not be seen as an alternative to ensuring that adequate engineering design and effective safety management systems are in place’ (Step Change, 2000, p.5) 14.
We must be aware that exaggerated claims may sometimes be made for behavioural interventions – either in their success at reducing LTI incidents or their impact on major accidents.
ADVICE FOR MAH SITES EMBARKING ON A BEHAVIOURAL INTERVENTION
Cultural or behavioural interventions will only be successful if engineering, technical and systems aspects are in place and adequately managed. Therefore, before major hazard sites embark on a behavioural safety programme, they need to ensure that they have satisfied the following conditions:
- HAZOPs, or similar, have been completed in order to identify hazards;
- The identification and management of human performance in relation to major hazards has been completed;
- The hierarchy of control has been applied to prevent the realisation of identified hazards, or minimise their consequences should they occur;
- Accurate operating procedures are available for all eventualities, including process upsets and emergencies (e.g. detailing the specific response to critical alarms);
- Operators are fully prepared to deal with all conditions, including process abnormalities. This will include identification of training needs, training, assessment, rehearsal and re-assessment. This training should include underlying knowledge of the process, so that operators can ‘troubleshoot’ - identify and respond to abnormal situations as they develop – it should not just provide the minimum knowledge required to operate the plant. This will help to manage ‘residual risk’ arising from hazards that were not identified, or effectively addressed.
- The site has the required engineering, operating and maintenance capability and experience (including appropriate staffing levels);
- Lessons have been learnt from site, company and industry experience;
- Succession planning ensures that corporate knowledge is retained;
- Safety management arrangements and risk control measures have been reviewed to ensure that they remain usable and relevant.
Once the above technical and systems issues have been addressed, the site then needs to ask whether a behaviour modification approach is the right approach at this time. Only when the above issues have been addressed can it be assumed that accidents are due to cultural or behavioural factors. In order for a behavioural intervention to prosper, there are several aspects that must be considered, including that:
- there exists an appropriate balance between production and safety;
- there is visible and real management to health and safety;
- there is management commitment and the resources to see it through;
- there is a high level of trust between management and employees;
A recent HSE report (Fleming 2001) 15 outlines a model for determining the safety culture maturity of an organisation and sets out five iterative levels for companies to sequentially progress through. It is proposed in this report that the level of safety culture maturity of an organisation should influence the choice of safety improvement techniques. It is clear that a behavioural intervention will not be successful if an organisation has not reached a certain level of ‘maturity’.
Finally, once all of the above criteria are in place, if a site decides to embark on a behavioural intervention, the following general advice may be useful (much of which also applies to other safety interventions):
- don't underestimate the resources required – it is not a one-off exercise, but a new way of working that must be maintained for any positive results to be sustained;
- don't be over-optimistic – not all interventions are completely successful in their main aim and many programmes fail the first time. High expectations may lead to later disillusionment;
- don't neglect process safety; (beware 'what gets measured gets done');
- do be clear about what you want to achieve and how you will know that you have achieved it;
- consider the main hazards and risks on the site, with reference to the safety report and/or risk assessments.
- identify tasks where people interact with these hazards in ways that could constitute significant sources of risk if human errors occur - consider maintenance and response to upsets/emergencies as well as normal operations. People may carry out a physical actions, checks, decision-making, communications or information-gathering activities. Consider how people could initiate, escalate or halt an event sequence.
- outline the key steps in these activities through talking to operators, review of procedures, job aids and training materials as well as review of the relevant risk assessment. Describe what is done, what information is needed (and where this comes from) and interactions with other people.
- identify potential human failures in these key steps by considering how tasks could be performed incorrectly. Remember that human failures may be unintentional or deliberate. Consider whether task steps could be omitted, inappropriately or partially completed, or completed at the wrong time.
- identify factors that make these failures more likely – these are known as Performance Influencing Factors, such as time pressure, fatigue, design of controls/displays and the quality of procedures. When these factors are optimal, then error likelihood will be minimized. Evaluating and improving these factors is the primary approach for maximising human reliability and minimising failures. HSE guidance provides a list of such factors.
- manage the failures using the hierarchy of control (i.e. considering eliminating the hazard, prior to assuring human performance through engineering measures such as interlocks, or optimising Performance Influencing Factors).
- manage error recovery – should an error occur, ensure that it can be identified (either by the person who made the error or someone else such as a supervisor) and recovered from.
CONCLUSIONS
As with the unhealthy focus on LTIs, there is a danger that behavioural modification programmes may draw resources and attention away from process safety issues. The author has recognised above the many benefits of behavioural interventions and does not wish to damage support for interventions that have a positive effect on health and safety. However, organisations embarking on such programmes are asked to retain a balanced approach between personal and major accident safety, and to consider whether a behavioural intervention is right for their company at this time.
The key messages from this paper are:
(i) behavioural modification interventions are only one aspect of ‘human factors’, (ii) these programmes are only one tool in the safety practitioners toolbox, (iii) know the limits of such interventions, and (iv) prepare the ground before attempting such an intervention.
In conclusion, behavioural safety approaches have their place in the management of health and safety on major accident hazard installations and so they are not merely a ‘shot in the dark’. However, there are no ‘magic bullets’ in health and safety. The key is to adopt a balanced range of approaches, tailored to the specifics of the site.
REFERENCES
(^1) Kletz, T. (2001). Learning from accidents. Butterworth-Heinemann Ltd, Oxford. ISBN 0
7506 4883 X (^2) Collins, A. & Keeley, D. (2003). Analysis of onshore dangerous occurrence and injury data
leading to a loss of containment. HSL seminar paper, May 2003. (^3) Bellamy, L.J. et al., (1989). Evaluation of the human contribution to pipework and inline
equipment failure frequencies. HSE Contract Research Report CRR15, HSE Books (^4) Dawson, D. & Brooks, B. (1999). Report of the Longford Royal Commission: The Esso
Longford Gas Plant Accident. Melbourne: Government Printer for the State of Victoria. (^5) Nicol, J. (2001). Have Australia’s major hazard facilities learnt from the Longford disaster?:
An evaluation of the impact of the 1998 ESSO Longford explosion on the petrochemical industry in 2001. The Institution of Engineers, Australia. ISBN 085825 738 6 (^6) HSE (2003). BP Grangemouth: Major incident investigation report. 18th (^) August 2003.
Available on HSE website at www.hse.gov.uk (^7) OGP (2004). OGP Safety performance indicators 2003. International Association of Oil &
Gas Producers, Report No. 353, June 2004. (^8) Marsden, S., Wright, M., Shaw J., & Beardwell, C. (2004). The development of a health and
safety management index for use by business, investors, employees, the regulator and other stakeholders. Research Report RR217. HSE Books, ISBN 0 7176 2834 5. (^9) Wright, M.S. & Tinline, G. (1994). Further development of an audit technique for the
evaluation and management of risk. HSE Contract Research Report CRR66, HSE Books (^10) Anderson, M. (2003). Human factors and COMAH: A regulator’s perspective. ‘Process
Safety: Fulfilling Our Responsibilities’. Conference proceedings, Hazards XVII Symposium. pp 785 - 792 (^11) Hopkins, A. (2000). Lessons from Longford: The Esso Gas Plant Explosion. CCH Australia
Ltd, ISBN 1 86468 422 4 (^12) Fleming, M. & Lardner, R. (2001). Behaviour modification programmes: establishing best
practice. Offshore Technology Report 048. HSE Books, ISBN 0 7176 1920 6. (^13) Fleming, M. & Lardner, R. (2002). Strategies to promote safe behaviour as part of a health
and safety management system. HSE Contract Research Report CRR430, HSE Books, ISBN 0 7176 2352 1 (^14) Step Change (2000). Changing minds: a practical guide for behavioural change in the oil
and gas industry. (^15) Fleming, M. (2001). Safety culture maturity model. Offshore Technology Report 049. HSE
Books, ISBN 0 7176 1919 2.
