Rigzone | 12 September 2016

Offshore Norway Rigs Could Require Safety Modifications

Floating oil and gas rigs offshore Norway could require safety modifications following a fatal incident on the Norwegian Continental Shelf in December last year, according to DNV GL.

Floating oil and gas rigs offshore Norway could require safety modifications following a fatal incident on the Norwegian Continental Shelf in December last year, according to DNV GL. Credit: Rigzone.

One person was killed and four injured when the COSLInnovator was struck by a wave on 30 December, damaging its living quarters in the process. The wave struck the unit on the port side of the front bulkhead of the forward box girder and smashed 17 windows, the Petroleum Safety Authority Norway reported earlier this year.

In order to prevent similar incidents occurring in the future, several companies, including DNV GL, teamed up to find out exactly what happened during the event, what improvements are needed, and how to implement these improvements.

So far, issues have been raised surrounding air gaps, which comprise the distance between the underside of a rig’s lowest deck and the highest wave crest. Certain rigs that classify as having a negative air gap could be made to undergo some changes.

Hydrocarbon Processing | 7 September 2016

Review of the Chemical Safety Board Report on the 2010 Tesoro Refinery Fire

On 2 April 2010, a catastrophic fire occurred within the naphtha hydrotreating unit in the Tesoro refinery in Anacortes, Washington. An internal investigation by Tesoro personnel was issued on 21 July 2011. The US Chemical Safety Board (CSB) released a draft report for public comments in January 2014. The final CSB report, including recommendations, was issued in May 2014, more than 4 years after the incident that resulted in the tragic loss of seven lives.

The resulting CSB recommendations will improve industry safety performance only if the true root causes of the incident are discovered and if appropriate recommendations are developed and implemented by other sites. This work critically reviews the CSB analysis of this incident and several of its resulting recommendations. The review is based on information contained in the CSB report and backup information available on the CSB website; the online text of the Tesoro internal incident investigation report; and the author’s 40-plus years of experience in the petroleum refining industry, including extensive research and development and troubleshooting experience in various aspects of hydroprocessing.

As detailed in both the Tesoro and CSB reports, the immediate cause of the fire was a catastrophic rupture of the shell of one of six feed effluent heat exchangers in the naphtha hydrotreating unit. The rupture released a combustible vapor cloud that autoignited. Subsequent analyses revealed that the shell had been weakened by high-temperature hydrogen attack (HTHA), a damage mechanism well-known to the industry. API Recommended Practice 941 (RP941) provides guidance in material selection to minimize the potential for HTHA. These recommendations are based on experimental studies of materials under simulated laboratory conditions and industry reports of material damage under actual operating conditions.

Based on heat exchanger model simulations, the CSB report concluded that the regions of damage within the heat exchanger shell generally operated at conditions that should not have been susceptible to HTHA, according to API RP941. The CSB report recommended alterations to the material selection criteria included in API RP941, commonly referred to as the Nelson curve. The CSB report also recommended increased industry regulatory oversight, including changes to the process hazard analysis (PHA) system. Several critical deficiencies in the CSB report that led to erroneous conclusions and recommendations are highlighted here.

Rigzone | 31 August 2016

Upstream Oil, Gas Companies Keep Exploring Benefits of UAVs

Exxon Mobil Corp.’s recent use of drones, or unmanned aerial vehicles (UAVs), to help monitor the effect of their offshore operations on whales is one example of how upstream oil and gas companies are continuing to explore the potential that drones hold for upstream operations.

Drones have been used to inspect infrastructure at heights, keeping workers out of harm’s way. Source: Cyberhawk Innovations.

In March, ExxonMobil conducted a 2-week research program offshore Santa Barbara, California, in which it utilized UAVs with shore-based cameras and satellites to scout for whales. By testing these advanced remote detection technologies, ExxonMobil aims to improve upon current detection systems for identifying marine mammals, company spokesperson Ashley Smith Alemayehu said.

Oil and gas companies have been using drones for nearly 6 years now, embracing the health and safety advantages of drones vs. traditional inspection methods, Philip Buchan, commercial director at UK-based Cyberhawk Innovations Limited, said.

FuelFix | 30 August 2016

Federal Offshore Chief Calls for Urgency in Bolt Failure Inquiry

The federal government’s top offshore drilling regulator said on 29 August that regulators and the oil and gas industry need to figure out why bolts are failing on undersea equipment used in offshore drilling “sooner rather than later.”

Brian Salerno, director of BSEE, touring the Offshore Technology Conference in Houston in 2016. Credit: BSEE.

“We need to have the root cause before we dictate a solution,” Brian Salerno, director of the Bureau of Safety and Environmental Enforcement (BSEE), said at a news conference. “It’s in nobody’s interest to have a catastrophic failure.”

The government urgency on a problem that stretches back a decade is a result of greater awareness about the growing frequency of broken bolts that hold together critical equipment such as blowout preventers.

General Electric Oil & Gas, one of three primary suppliers, issued a global recall after its bolts on a piece of undersea equipment in the Gulf of Mexico failed in 2012, releasing more than 400 bbl of drilling fluid into the water.

That incident was reported to the government but many more were not, federal officials say, masking the extent of the problem. That will change with new rules put into place by the safety bureau this year that require the reporting of equipment failure regardless of whether pollution or worker injury occurred.

Health + Safety at Work | 30 August 2016

What Exactly Is “Safety Differently?”

If you have heard of “safety differently,” chances are you either work for Laing O’Rourke or have heard a presentation by John Green, health and safety director for its Europe hub.

Green returned to the UK in summer 2015 after 5 years in Australia, where he successfully turned ideas in the eponymous book by Australian academic Sidney Dekker into operational policy on Laing O’Rourke sites. Although the ideas have taken root at Laing O’Rourke and elsewhere—including aviation and mining—so far it has made limited impact in the construction sector.

And it’s not difficult to see why “safety differently” might be a hard sell: Essentially, it demands an end to the established culture of “zero harm” policies and a greater acceptance of accidents as part of working life. To an industry that’s adopted mottos such as “all accidents are preventable” and ”zero tolerance,” that is a blindfolded leap into an unknown filled with liability claims, bidding problems, and sleepless nights.

Green is the first to assert this does not mean throwing out the gains of the last 15 years. “It’s not a ‘new church’ because the old one is wrong. I think the principles we’re applying are solidly based [in current practice]. But they’re also for people in search of alternatives, because the old ways aren’t working. Zero harm has done a great job, but its time is done.” The clearest evidence, as he points out, is the stubbornly high fatality rate: a 5-year average of 43 between 2010–11 and 2014–15.

Facility Safety Management | 30 August 2016

New Fall Protection Standard Makes Using Equipment Easier

The revision of American National Standards Institute (ANSI) Z359.1, Safety Requirements for Personal Fall Arrest Systems, Subsystems, and Components, recently received final ANSI administrative approval. Z359.1 underwent fundamental changes from the 2007 version.

Essentially, it is a new standard with regard to technical content, not simply a revision of the requirements in the previous editions.

The (ANSI) Z359.1 Fall Protection Standard helps guide the use of fall protection to protect workers. Recognizing that the current 10-year standard was dated, theZ359 Committee that oversees the standard’s development created new substandards that address fall restraint systems, work positioning systems, rope access systems, fall arrest systems, and rescue systems. The new standard was approved by ANSI on 15 August 2016, said Thomas Kramer, vice-chairman of the Z359 Committee.

“We wrote standards for each piece of equipment to make it much easier to use,” Kramer said. “We wanted to ensure it would be a guide to the whole Z359 Fall Protection Code by establishing requirements for the performance, design, marking, qualification, instruction, training, inspection, use, and maintenance of this equipment.”

Lone Star Analysis | 24 August 2016

If Deepwater Horizon Had Been Connected to Real-Time Analytics

Offshore Energy Today | 15 August 2016

Offshore Safety Body Looks Into Total’s Martin Linge Development

Norway’s offshore safety body, the Petroleum Safety Authority (PSA), has found several nonconformities and improvement points during the audit of Total’s Martin Linge development, offshore Norway.

Martin Linge field development. Image source: Total E&P Norge.

Total E&P Norge (Total) is the operator of the Martin Linge field, located near the British part of the North Sea about 42 km west of the Oseberg field. Water depth at the area is approximately 115 m.

Martin Linge development will consist of a fully integrated fixed production platform with a steel jacket and a floating storage and offloading vessel used for oil storage.

Wells for the development will be drilled using a mobile jackup rig. The entire facility will be powered from land. Production is scheduled to start in late 2017.

The PSA said that it carried out an audit of how Total is ensuring compliance with the regulatory requirements for barriers and maintenance in the Martin Linge development project.

The audit was conducted in two parts, on 8 and 9 March at Total’s Stavanger premises and then from 14 to 16 June at the construction site at Samsung Heavy Industries in South Korea.

PSA said that the audit revealed a total of two nonconformities and seven improvement points.

JPT | 12 August 2016

Creating a Safety Culture: What It Is and How To Get There

Safety culture can be distilled into nine characteristics predictive of safety outcomes. By tracking performance across these characteristics, companies can measure their performance against the world’s most successful safety organizations, both within the industry and without. More importantly, they can identify gaps in their culture and breakdowns in their safety performance, thereby establishing clear goals to overcoming them and achieving safety objectives. To improve safety performance and create lasting change in organizational culture, leaders can focus on developing 10 safety-specific leadership capabilities.

A strong safety culture means more than just better injury rates. Organizations good at safety have been shown to do better across all performance areas. With improvements in safety comes greater employee commitment to company goals, more discretionary effort, better team functioning, and a healthier bottom line.

A high-functioning safety culture is defined by a clear vision from leadership that articulates actionable steps and specific behaviors leading to the desired state. When people know the goal and what is required of them to achieve it, they will not get lost in vague mandates that fail to motivate or that fall short of galvanizing individuals around safety improvement.

Culture change requires a leadership team that is committed to the vision and capable of guiding the organization through obstacles and the inevitable pushback that occurs with any initiative. Leaders can learn skills and develop capabilities that will move the organization in the desired direction and build performance across the nine culture characteristics indicative of world-class safety performance. With visible commitment to safety, leaders will gain credibility with the workforce and engage people in the process.

Culture Characteristics Predictive of Safety Outcomes
Procedural Justice. This characteristic reflects the extent to which the individual perceives fairness in the supervisor’s decision-making process. Leaders enhance perceptions of procedural justice when they make decisions characterized by consistency across people and time, lack of bias, accuracy (decisions are based on good information and informed opinion), correctability (decisions can be appealed), representativeness (the procedure reflects the concerns, values, and outlook of those affected), and ethicality.

Leader/Member Exchange. This dimension reflects the relationship the employee has with his or her supervisor. In particular, this scale measures the employee’s level of confidence that his or her supervisor will look out for his or her interests. Leaders can enhance perceptions of leader/member exchange by developing positive working relationships with their reports and getting each person to see how achieving organizational goals can be fulfilling both to the leader and to the employee.

Transformational leadership exerts influence principally through relationships with employees. In a work group, the supervisor develops relationships with each of the workers. The leader exerts influence by getting each person to see how his or her objectives support the larger objectives of the organization.

Management Credibility. Management credibility reflects the perception of the employee that what management says is consistent with what management does. Leader behaviors that influence perceptions of trustworthiness include consistency, integrity (telling the truth and keeping promises), sharing control in decision making and through delegation, communication, and benevolence (demonstration of concern).

Perceptions that a manager is competent seem to be a necessary but not sufficient basis for development of trust. That is, workers are unlikely to trust a manager who is seen as incompetent, but competence alone does not necessarily lead to trustworthiness.

Perceived Organizational Support. This characteristic describes the perception of employees that the organization cares about them, values them, and supports them. The extent to which employees believe the organization is concerned with their needs and interests strongly influences the likelihood that they will “go the extra mile.” Leaders can demonstrate organizational support by engaging in and communicating efforts that go well beyond what is required.

Perceived organization support is not the same as job satisfaction, although the two are often related. Employees who believe the organization cares about them are more likely to be satisfied. Perceived organizational support is an overall perception by employees of organizational commitment to them, whereas job satisfaction is an affective (positive/negative) response to specific aspects of the work situation (e.g., pay, physical working conditions, work schedules).

Teamwork. Teamwork measures the perceived effectiveness of work groups to function as an effective team. Group process affects whether people will talk to one another about safety, and it is directly related to safety outcomes such as level of at-risk behavior and injury reporting. It also influences perceptions of communication around safety and of organizational value for safety.

Work-Group Relations. The work-group-relations characteristic reflects the degree to which coworkers treat each other with respect, listen to each other’s ideas, help each other out, and follow through on commitments made. Work-group relations are related to supervisor fairness as well as to worker/supervisor relationships. These beliefs influence whether employees will speak up to one another about safety issues and raise safety concerns with the supervisor.

Work-group relations are affected by the leader of the group. Supportive and trustworthy behavior by the leader is likely to lead to trust among members of the group.

Organizational Value for Safety. This dimension relates to perceptions of the extent to which the organization ­values safety as represented by the prioritization of safety compared to other concerns; how informed management is about safety issues; and the willingness of management to invest time, energy, or money in addressing safety issues. The higher the perceived value for safety, the more likely it is that workers will raise safety issues, work safely, and not cover up incidents and injuries.

Upward Communication. This characteristic addresses perceptions of the quality and quantity of upward communication about safety, the extent to which people feel encouraged to bring up safety concerns, and the level of comfort in discussing safety-related issues with the supervisor. The climate around communication influences the willingness of workers to speak up to one another about safety, the level of at-risk behavior, and the number of reported injuries.

Approaching Others. The approaching-others component addresses beliefs about the likelihood that workers will speak up to a coworker who they think is at risk for injury, pass along information about safety, or step up to help a coworker do a job more safely. The more likely workers are to speak up with each other, the higher the level of safe behaviors in a work group.

Approaching others is related to both leader/member exchange and the commitment of the team leader (supervisor) to safety. The quality of the relationship with the supervisor is related to the willingness of team members to speak up. If the leader values safety, the subordinate can reciprocate high-quality leader/member exchange by speaking to others about safety.

What Sets High-Performers Apart?
Experience working with companies around the world in some of the most demanding environments has led to the identification of key practices and organizational capabilities that set organizations that excel at safety apart from others. Among these practices, great safety organizations define a clear vision for safety; create a comprehensive network of communication and education across departments, levels, and sites; and gain the buy-in and commitment of employees.

Organizations that perform high in safety are created at the top by leaders who are serious about culture change, know the role they play in creating culture, and who work with their teams on a daily basis to cultivate the culture they want to see. These leaders set the tone for the entire organization, back up what they promise, and talk about safety improvement in terms of exposure reduction rather than injury. A previously published article identified 10 characteristics that distinguish great safety organizations. They are

  • Understand the real safety objectives of the organization’s leadership.

It is possible to identify, track, and measure the characteristics that make up great safety organizations. Because of this, in turn, it is possible to create a discernible and actionable path toward safety improvement across a host of cultural scales. There is no silver bullet in safety, and culture cannot be changed overnight. But, with leadership commitment starting at the executive level and extending to line leaders, a climate of change can be created that supports and sustains a truly great safety ­organization.

JPT | 10 August 2016

Service Company Explores Pathways To Make Driving Inherently Safer

In risk management, an inherently safer approach implies an attempt to eliminate, or at least reduce the severity and likelihood of, incident occurrence through careful attention to fundamental design and layout. This paper examines whether this approach can be applied and be effective in managing transportation safety concerning which, historically, most of the responsibility for safe driving has been placed on the individual driver and less on the design of the transportation system and features of the equipment.

As is often the case for change management, this undertaking was motivated by a tragic motor-vehicle accident in Saudi Arabia, which resulted in three fatalities, two employees and a third-party driver. Transportation-­management systems were implemented and in place, including a contractor-selection process, journey-management program, ­defensive-driving training, and in-­vehicle monitoring systems, but, as sometimes happens, compliance with planning and executional requirements was inadequate. The ­accident-investigation findings uncovered a number of gaps that existed in the transportation-management system and that eventually led to the catastrophic event. These revelations, coupled with the vision that “all motor-vehicle accidents are preventable,” presented an opportunity to revisit the way transportation safety was managed. The entire life cycle of the journey was reviewed and reorganized, from the planning stage of the journey to journey’s completion. Such an approach posed a challenge to the company definition of “preventability” for motor-vehicle accidents, which states that a preventable accident is a vehicle accident in which the driver could have driven (but failed to do so) in such a manner as to identify an accident-­producing situation soon enough to take reasonable and prudent action to avoid such an accident. This definition places the primary responsibility for preventing a vehicle accident on the driver and his ability to anticipate road hazards, assess the risks, and take actions to avoid the accident through the ability to challenge the process, including questioning the need or timing of the journey itself.

Instead of the instinctive quick-fix reaction of placing responsibility solely on the driver, the new perspective dictated that responsibility for preventing accidents lies with the company management and its ability to create a system that would comprehensively combine the management of all transportation aspects under one umbrella, including:

  • Human factors and driving behaviors
  • Journey management, with all necessary reviews and approvals
  • Vehicle speed and other driving characteristics
  • Vehicle condition and conformance to standards

Inherently Safe Driving-System Framework
What makes a system robust and inherently safe, and what must it look like? In the world of computer science, robustness is defined as “the ability of a computer system to cope with errors during execution” and also as “the ability of an algorithm to continue operating despite abnormalities of input or calculations.” To build a robust operating system, computer companies study many possible inputs and input combinations, program against every point of possible failure, and make the system intelligent enough to handle all possible error states. The goal for a new system is for it to be robust enough to monitor proactively (without direct involvement of humans), prevent any known or assumed compliance failures or violations, and enforce compliance during driving. The pillars of the conceptual inherently safe and robust driving system are intelligence, visibility, compliance, and proactivity, which rest on the foundation of independence and automation.

Intelligence. This is the ability of the fleet and journey-management software to build connections independently and automatically between the movements of vehicles and applicable journey plans, run compliance checks against their approval levels, run compliance checks against driver competencies, and highlight and send any potential breaches to designated personnel for them to audit.

Visibility. This is the ability to provide accurate, real-time information on movements of vehicles, journeys being undertaken, and their associated information such as driver, vehicle, and trip progress. In addition to the operational data, which is required to monitor execution, the system is required to provide visibility of current trends in various driving aspects (e.g., at-risk driving behaviors, journey-management breaches, fleet utilization, and night driving).

Compliance. This is the ability to ensure compliance of all elements of the driving process (i.e., driver, vehicle, journey route, and plan), either before or during the journey, to the standards within the preapproved criteria. The system must be set up to prevent selection of an unfit driver or vehicle for an intended journey, and, if the journey must progress according to a preapproved route, any deviations must be identified and corrected immediately.

Proactivity. This is the ability of the system to prevent potential breaches through predetermined controls or check points. Examples of this would be the inability to select an approved light-vehicle driver for a heavy-­vehicle trip (even if a person possesses a ­commercial-vehicle driving license) or the ability to alert a driver to stop and rest at predetermined intervals.

Independence and Automation
This driving system rests upon two primary features—automation and independence. Automation is intended to minimize the human-to-system interaction, whereas independence implies freedom from operational factors that may influence the safe operation of vehicles.

Independence. Day-to-day priorities influence operational activities. Deadlines must be met, and, often, these priorities conflict with values. It takes integrity and commitment to follow the rules, but, as is commonly recognized, the human factor is often less reliable than ­others. To avoid possible conflicts of interest, provide uncompromising independence from operational factors, and provide sufficient available resources, a new department was created called the Transportation Office. The entire purpose of this department is to oversee all transportation aspects of employees and contractors in support of the company’s work activities. This office directly manages all transport vehicles, drivers, Road Journey Management Center operations, and the Journey Management Plan process, and performs regular audits of the entire system.

The Transportation Office has responsibility and full authority for final approval of any journey to take place. Even if a journey has been approved by the driver’s manager, it will still require approval from the Journey Management Center.

Automation. Fleet-Management Improvements. In-vehicle monitoring systems are used to control compliance with speed limits and to monitor and correct drivers’ behaviors (e.g., harsh braking and harsh acceleration). However, it was determined that the system could provide more proactive control points to improve the fleet-management process for earlier detection of possible noncompliance and intervention.

Improvements were made to make the system less dependent on drivers’ attitude toward their safety. The system automatically alerts and, if required, enforces the expected behavior, and it provides new data for trend analysis and required further improvements.

e-Journey Management. Making improvements in the management of drivers’ behaviors and vehicle movements was an important step toward the “zero motor-vehicle accidents” vision but was not enough to eliminate vehicular incidents. Failures in the journey execution were a common cause and were responsible for a large percentage of motor-­vehicle accidents. To address this issue, a project was created to develop a solution that focused on “management by exception” through the integration of fleet management and automated journey monitoring. This electronic system is designed to be sufficiently intelligent to run a constant monitoring of vehicle movements and verify the compliance of their execution to their preapproved conditions. If any breach is identified, the system will alert Road Journey Management Center personnel for immediate intervention.

Passive Controls. Considering the risks of possible rollovers, a decision was made to reinforce vehicles with rollover protection. All company-owned vehicles must meet international automotive safety and quality standards, including applicable safety and crush tests by manufacturers, and must be currently safe to use.

Driver Training. A competence-­management concept was adopted regarding driver training. The driver training program has been revised to address critical defensive-driving fundamentals, company-specific driving hazards, and safe-driving expectations. The Core Defensive Driving course covers 25 specific defensive-driving skills, and a student must demonstrate not only academic knowledge of the defensive-driving material but also practical mastery of the defensive-driving skills taught.

JPT | 9 August 2016

The Influence of Communication About Safety Measures on Risk-Taking Behavior

Risk-taking behavior is an important contributing human factor to incidents and is notoriously difficult to influence. Anecdotal evidence suggests that people have a hard-wired optimal perceived risk level. People compensate for risk-reducing measures by behaving in a riskier fashion until the desired level of risk is reached again. This study looked at the effect of the number of shields of protection and uncertainty on the risk-taking behavior of the participants.

The main aim of safety research is to identify ways to prevent accidents and to ensure the safety of workers. Human error—or, in other words, unsafe behavior—has been found to be a major cause of accidents, and its elimination, therefore, is a prime goal for improving safety. The human factor is most effectively addressed by tackling the organizational system instead of focusing on incorrect actions by individuals. An effective strategy is to increase the level of protection or the number of safety barriers. The concept of the safety barrier features most prominently in the Swiss-cheese metaphor of accident causation. The Swiss-cheese model describes accidents as being caused by unchecked hazards that are allowed to cause losses. A series of barriers is placed between the hazard and that which may be harmed. The barriers keep the hazard under control and prevent it from causing harm. However, these barriers are always less than 100% adequate and contain weaknesses or holes. The barriers, therefore, often are compared to slices of Swiss cheese. Unlike real Swiss cheese, the holes in the barriers are dynamic and open and close at random. When these holes in the barriers are aligned, a path is created, leading to a potential accident.

Intuitively, one would assume that safety improves proportionally both to the protection measures taken and to the improvements in the design of such measures. The more protective equipment given to the workers, the safer they will be, either because of a reduced risk of accident or because such measures mitigate the effects of accidents. This approach assumes that human error can arise from unintended actions such as memory lapses and attention failures. However, it can also be attributed partly to intended actions such as risk taking. The question addressed in this paper is related to the extent to which people’s risk-taking behavior was influenced by their awareness of the numerous preventive interventions in place. The pivotal issue that arises is whether people adapted their risk-taking behavior as a result of their awareness of the number, and of the effectiveness, of the barriers in place.

Risk Taking
Alteration of behavior is a recurring theme in the safety literature and is described in a variety of ways—“risk compensation,” “risk homeostasis,” or the Peltzman effect. When people feel safer, they tend to take greater risks. People do not want to reduce risk to an absolute minimum but, rather, to optimize it. People are willing to accept a certain level of risk if risky behavior (e.g., breaking a barrier in the Swiss-cheese model) comes with benefits.

There is virtually no behavior without a certain measure of risk attached to it. Therefore, the challenge is to optimize rather than to eliminate risk. This optimum, also known as the target level of risk, is the level that maximizes the overall benefit. Previous studies suggest that people constantly compare the amount of risk they perceive with their target level of risk and that they will adjust their behavior in order to eliminate any discrepancies between the two. This psychological mechanism constitutes a case of circular causality.

The mechanism is similar to a thermostat, where there are fluctuations in the room temperature but where such fluctuations are averaged over time; the temperature will remain stable unless set to a new target level. The risk homeostasis theory (RHT) transfers the homeostatic effect of a thermostat to risk behavior. RHT posits that, similar to a thermostat that has a target temperature, people have a target level of risk. People will change their behavior in order to maintain their target level of risk.

Research Questions
Previous research has given some indications that people compensate for safety measures such as barriers or shields by behaving in a riskier fashion. However, besides such anecdotal evidence, no systematic research has been carried out to consider the effect on behavior of informing people of the number of safety barriers in place for their protection. This paper sought to answer two questions:

  • Do people indeed compensate for greater layers of, or more effective, protection by behaving in a riskier fashion?
  • How do people behave when they are uncertain about the number of shields of protection?

The Experiment

Screenshot of the game.

A side-scrolling videogame was custom made for this experiment. It required the player to navigate a small spaceship through an asteroid field, with asteroids moving from right to left after materializing randomly on the y-axis. The spaceship was controlled with the arrow keys on the keyboard. The up and down keys moved the spaceship up and down, and the right and left keys increased and decreased the speed, respectively. Five different speed levels ranged from 1 (default) to 5 (maximum). The number of shields left was indicated as can be seen in Fig. 1. Whenever the ship crashed against an asteroid, the player lost a shield. This process continued until there were no shields left. A collision at that point would end the game. In circumstances where participants did not know the number of shields the ship had, a question mark was displayed in front of their spaceship. The game measured the time a player spent on each shield and the total amount of points a participant scored. Points were gained by staying alive. The faster a participant flew, the more points he or she gained per second. Such bonus points acted as an incentive for participants to increase speed in order to achieve higher scores.

To test if the layers of protection and the uncertainty about their number had an impact on the risk-taking behavior of participants, an experimental design was chosen. This design allowed for the determination of causal relationships. This experiment focused on the relation between the number of shields (maximum five) and the level of risk taking. There were 104 students participating in the experiment. Participants were randomized to participate in two out of six possible sets of conditions:

  • Condition 1—Zero shields
  • Condition 2—One shield
  • Condition 3—Two shields
  • Condition 4—Three shields
  • Condition 5—Four shields
  • Condition 6—Unknown number of shields (actually four shields)

The data were analyzed, and univariate analyses of variances (ANOVAs) were used to analyze the different trends to evaluate four hypotheses.

Hypothesis 1. The average mean of speed is different for varying conditions: The higher the number of barriers to which participants are exposed, the greater the degree of risk they take in flying.

A univariate ANOVA was calculated to see if the average speed was different for the varying conditions. Condition 6 was excluded. A significant difference was found, with a significant upward linear trend. Hypothesis 1 was confirmed.

Hypothesis 2. The average mean of time spent per shield is different for varying conditions: The fewer shields participants are exposed to, the more time they spend per shield.

A univariate ANOVA was calculated to see if the average speed was different for the varying conditions. Condition 6 was excluded. A significant difference was found, with a significant downward linear trend representing the data best. In Condition 5, players spent less time per shield than in Condition 1. Hypothesis 2 was confirmed.

Hypothesis 3. In conditions of uncertainty, participants fly more slowly than in conditions where they know how many barriers they are exposed to.

A repeated-measures ANOVA with a Greenhouse-Geisser correction determined that the average speed of play throughout Condition 6 differed significantly statistically between shields. A significant upward linear trend represented the data best. Hypothesis 3 was confirmed.

Hypothesis 4. In conditions of uncertainty, participants spend more time per shield than in equivalent conditions where they know how many barriers they are exposed to.

A repeated-measures ANOVA with a Greenhouse-Geisser correction determined that the average time played per shield throughout Condition 6 did not differ significantly statistically between shields. Hypothesis 4 was not confirmed.

When participants entered the game with five shields, they played in a significantly riskier fashion than when they entered with only a single shield. This is a highly relevant finding, considering that costly risk-assessment techniques may be of little value if improvements in safety systems are outweighed by the risks introduced by changes in operator behavior. However, removing safety features might not be a very ethical move. One suggestion could be to hide protection mechanisms from the system operators until needed. This goes toward creating a feeling of uncertainty or ambiguity among workers concerning their safety, which could be accompanied by a communication strategy emphasizing this uncertainty. Putting a greater number of layers of protection in place was not rendered ineffective completely by increased risk taking. Although the limitations of this study should be recognized, organizations might reconsider the practice of giving information to their employees on the number of safety measures that are taken. Preserving ignorance among employees concerning the enhanced protection in place creates a stronger safety buffer because it reduces risk-taking behavior and improves employees’ efforts to make sure that the presumed last layer holds.

JPT | 6 August 2016

Operational Risk: Stepping Beyond Bow Ties

This paper presents the multiple-physical-barrier (MPB) approach to operational (or process) risk, an extension of the common bow-tie technique for identifying risk. Bow ties identify a variety of different types of barriers and help communicate safety principles that link causal factors and subsequent actions to a specific event. By narrowing the focus to physical barriers and by developing success paths that enable each barrier to perform its safety function, the MPB approach moves further toward a systematic approach to operational-risk management.

Introduction—Operational Risk, Bow Ties, and Physical Barriers

Example bow-tie analysis for a well kick while drilling.

Operational Risk. One of the more elusive issues in the upstream oil and gas industry is the understanding of process safety or process risk—especially how it overlaps with industrial (or personal) safety—and the types of tools needed to assess and manage it. An important part of this hinges on the role that barriers play in the analysis and what constitutes a barrier. Some companies consider training to be a barrier, others consider certain meetings to be barriers, and still others consider safety procedures themselves to be barriers. Indeed, there is scarce practical agreement between companies as to how process risk is assessed, managed, and communicated. As a result, there can be similarities, but, ultimately, no two process-risk assessments from different companies look the same.

Several different barriers are shown in the bow-tie diagram in Fig. 1. Barrier types there include the well-control program, mud checks, fill-ups, and escalation barriers.

Bow-Tie Analysis. Bow-tie analysis has been widely used in the offshore oil and gas industry as a technique for communicating safety issues and safety control measures. Bow-tie analysis is event based; it seeks to tie causal factors and subsequent actions to a specific event, such as a kick. Bow-tie diagrams help teams better understand the sequences that can lead to serious process or operational risks. They also identify mitigating actions that can be taken to reduce the consequences of a major event.

The MPB Approach—A Pathway to Success
The MPB approach was developed with the help of collaborations from the upstream oil and gas industry. It takes a step beyond bow ties toward a more-direct and -systematic understanding of operational risk so that operators can design their operations to be successful. In so doing, risk is systematically identified and evaluated and can be incorporated into the management system to help ensure the safety of offshore operations.

This paper posits that operational risk stems from the breech, removal, or failure to properly install or maintain a required physical barrier. If all required physical barriers are in place and effective, then there will be no operational safety incidents. If all of the cement-plug barriers, fluid-column barriers, and blowout-preventer barriers had been effective, there would not have been any of the major accident events in the Gulf of Mexico, including explosions, loss-of-well-control events, and major environmental spills. Operational risk is fundamentally about establishing and maintaining MPBs.

Physical barriers are designed, constructed, operated, and maintained to ensure that they can perform under adverse conditions. In many cases, multiple physical barriers are required so that, in case one barrier fails, another is in place to achieve the safety function (e.g., contain hydrocarbons). More broadly, the MPB approach reflects the concept that the number of physical barriers should be commensurate with the risk of the ­associated activity.

The focus of the MPB approach lies with two leading questions:

  • What are the physical barriers required for the operation at hand?
  • What is needed to ensure that these barriers succeed in meeting their safety functions?

These questions marry principles from two very different industries (nuclear and maritime). The focus on physical barriers that is foundational to the nuclear safety industry and the ability to diagram and trace how critical systems function (e.g., performance qualification standards) form a key part of training for engineers in the US Navy and the US Coast Guard. Both perspectives were adapted, and templates were developed to diagram this approach as a success path.

It is this understanding of success paths, especially when applied to the physical barriers, that paves the way toward systematically elucidating the risks. It is important to visualize what must be successful in order to understand what can fail. In effect, this approach is designed to increase operational awareness with the aim of managing operational risk more effectively.

This success-path model is straightforward and provides a number of benefits including

  • It is a systematic mechanism for getting at the root cause of operational safety risks that can lead to major accidents. The top-down approach starts at the highest levels first and then enables drill-downs to whatever level of detail is needed to identify the safety problem or match the available data.
  • It provides a risk-informed communications framework for communicating with rig workers, senior executives, regulators, and everyone in between. Rig workers can identify their roles within the success paths and readily understand how their actions are integral to maintaining the success of the barrier. At the other end of the spectrum, for example, executives are sometimes faced with making decisions regarding new technologies, and key details may not be fully understood. This approach is well-suited to bring them up to speed in many of the technical details.
  • A success-path approach enables decision makers to understand the key points required for success and then participate in the discussion about risks and safety. Further, it provides a consistent and rigorous basis for defending the decisions that have been made, whether to senior executives or third parties. The foundations of this approach have been demonstrated to hold up in legal situations.
  • It also serves as an important training tool that enables students to grasp the key operational safety issues. Each physical barrier can be systematically analyzed to provide the foundation needed to manage the operational working environment safely.

The value of the MPB approach is that it steps beyond the bow-tie analysis techniques by placing the focus directly where the risk is—namely, on the physical barriers, their safety functions, and the success paths (both automated and human) that are needed to ensure the success and safety of the operation.

The hierarchy of physical barrier, safety function, and success path is not a coincidence. This chain of cause-and-effect logic forms the basis of operational-risk management for a system, a rig, a well, or a facility. Ultimately, however, it is the role of the operational plan or management system to call out strategies for maintaining the success paths.

The MPB approach is sufficiently intuitive for everyday use yet powerful enough for large-scale integration. When it comes to process (or operational) safety on offshore oil and gas facilities, the devil is in the details, but the MPB approach guides its practitioners to find and identify those details systematically. The benefits are not only for the practitioners but also for guiding the entire operational team on a path toward intuitively understanding the safety implications of their roles and implementing a successful operation.

This approach also positions operational-risk management to be quantified at some point in the future. When reliability quantification is incorporated, the safety significance of any component, system, or set of human actions can be compared and evaluated ­numerically.