You must log in to edit PetroWiki. Help with editing

Content of PetroWiki is intended for personal use only and to supplement, not replace, engineering judgment. SPE disclaims any and all liability for your use of such content. More information


Human factors: Difference between revisions

PetroWiki
Jump to navigation Jump to search
No edit summary
No edit summary
Line 1: Line 1:
Replace this text with a brief (3-4 lines) introduction to what is covered on this page.
==Human factors==
In July 2012, SPE held a two-day summit on human factors to create a common understanding of the strategic challenges for the oil and gas E&P industry, to identify what is known and unknown in the field, and to explore possible actions to accomplish the needed change indicated by the U.S. National Commission on the Deepwater Horizon Oil Spill and Offshore Drilling report. Attendees created a technical report based on the discussions and conclusions at the summit as a guideline on the human factors risks in E&P operations and what can be done to reduce those risks and increase safety.  
In July 2012, SPE held a two-day summit on human factors to create a common understanding of the strategic challenges for the oil and gas E&P industry, to identify what is known and unknown in the field, and to explore possible actions to accomplish the needed change indicated by the U.S. National Commission on the Deepwater Horizon Oil Spill and Offshore Drilling report. Attendees created a technical report based on the discussions and conclusions at the summit as a guideline on the human factors risks in E&P operations and what can be done to reduce those risks and increase safety.  


Members of the summit decided that the industry must move to an organizational culture in which process safety is as well managed as personal safety. In civil aviation, a series of major accidents led to the introduction, mandatory requirement, and acceptance of human factors methodologies. Similarly, the nuclear power industry identified and acted upon the concept of its safety culture after a small number of major incidents. The E&P industry must try to achieve a similar breakthrough by confronting the human factor as an issue in process safety both onshore and offshore.  
Members of the summit decided that the industry must move to an organizational culture in which process safety is as well managed as personal safety. In civil aviation, a series of major accidents led to the introduction, mandatory requirement, and acceptance of human factors methodologies. Similarly, the nuclear power industry identified and acted upon the concept of its safety culture after a small number of major incidents. The E&P industry must try to achieve a similar breakthrough by confronting the human factor as an issue in process safety both onshore and offshore.  


===Process and Scope===
==Process and Scope==
In preparation for the summit, the steering committee developed the following list of six topics to act as a springboard for discussion:
In preparation for the summit, the steering committee developed the following list of six topics to act as a springboard for discussion:


Line 16: Line 13:
:6. Information Technology (IT):  IT faces many challenges regarding what information to present to individuals and teams. Moreover, it is often unclear in its support, appearing to be confrontational or confusing.
:6. Information Technology (IT):  IT faces many challenges regarding what information to present to individuals and teams. Moreover, it is often unclear in its support, appearing to be confrontational or confusing.


===Human Factors Risks in the E&P Industry===
==Human Factors Risks in the E&P Industry==
   
   
In the context of process safety, the term “human factors” refers broadly to factors that can lead to the loss of standards of consistently reliable human performance that are part of an organization’s defenses against process safety incidents.
In the context of process safety, the term “human factors” refers broadly to factors that can lead to the loss of standards of consistently reliable human performance that are part of an organization’s defenses against process safety incidents.
Line 48: Line 45:
These three issues underpin the others in that without an effective base in these, progress on the others is unlikely to be achieved. They are discussed in more detail in Sections 3, 4, and 5.
These three issues underpin the others in that without an effective base in these, progress on the others is unlikely to be achieved. They are discussed in more detail in Sections 3, 4, and 5.


====Leadership and Culture====
===Leadership and Culture===


Creating and maintaining a safety culture that includes shared values, attitudes, beliefs, and expectations that emphasize the critical importance of safety across an organization is dependent on leadership. The decisions, actions, and statements made by leaders, the reward and incentive structures that leaders implement, the way leaders behave and interact with people throughout the organization, and the decisions and actions they take to balance safety against commercial imperatives directly determine the attitude to safety within an organization.
Creating and maintaining a safety culture that includes shared values, attitudes, beliefs, and expectations that emphasize the critical importance of safety across an organization is dependent on leadership. The decisions, actions, and statements made by leaders, the reward and incentive structures that leaders implement, the way leaders behave and interact with people throughout the organization, and the decisions and actions they take to balance safety against commercial imperatives directly determine the attitude to safety within an organization.
Operators and regulators who adopt an attitude that compliance to regulations and procedures will automatically lead to safety and ignore the key role played by leadership in setting and reinforcing norms and motivations are unlikely to create a culture that provides the necessary foundation for strong process safety assurance.
Operators and regulators who adopt an attitude that compliance to regulations and procedures will automatically lead to safety and ignore the key role played by leadership in setting and reinforcing norms and motivations are unlikely to create a culture that provides the necessary foundation for strong process safety assurance.


====Perception of Risk and Decision-Making====
===Perception of Risk and Decision-Making===


Awareness and assessment of risk (and decisions made based on those assessments) occur at all levels of an organization. They are made in private, removed from the consequence of the assessments and decisions, with no direct exposure to hazards or risk, and by operational staff with direct exposure to hazards. Such assessments are almost always made in the presence of uncertainty. The Key Performance Indicators (KPIs) that senior managers select are indicators of how they perceive the risks and demonstrate their commitment to managing them.
Awareness and assessment of risk (and decisions made based on those assessments) occur at all levels of an organization. They are made in private, removed from the consequence of the assessments and decisions, with no direct exposure to hazards or risk, and by operational staff with direct exposure to hazards. Such assessments are almost always made in the presence of uncertainty. The Key Performance Indicators (KPIs) that senior managers select are indicators of how they perceive the risks and demonstrate their commitment to managing them.
Much is known from scientific research about the psychology of how irrationality and cognitive biases lead to poor risk assessment and decision-making. Practical and simple solutions can be created to counter these biases, with significant improvements in decision-making. This knowledge, while widely available, is not generally being applied within the oil and gas industry.
Much is known from scientific research about the psychology of how irrationality and cognitive biases lead to poor risk assessment and decision-making. Practical and simple solutions can be created to counter these biases, with significant improvements in decision-making. This knowledge, while widely available, is not generally being applied within the oil and gas industry.


====Communication of Risk====
===Communication of Risk===


Assessment of risk and decisions about the prioritization of risk are made throughout oil and gas operations and across companies. When senior officials make assessments, they set expectations about the risks involved in making operational decisions. Such assessments influence the way individuals perceive the risk associated with their work. Emphasizing Lost Time Injuries (LTIs) over major accident hazard controls leads organizations towards prioritizing occupational risks over major process disaster risks.
Assessment of risk and decisions about the prioritization of risk are made throughout oil and gas operations and across companies. When senior officials make assessments, they set expectations about the risks involved in making operational decisions. Such assessments influence the way individuals perceive the risk associated with their work. Emphasizing Lost Time Injuries (LTIs) over major accident hazard controls leads organizations towards prioritizing occupational risks over major process disaster risks.
Line 64: Line 61:
Particularly critical is sensitivity to “weak signals” that risks have increased. Everyone involved in safety-critical operations needs to be sensitive to such weak signals and report the change in risk profile to their immediate leaders. Effective communication of risk, and continuous re-appraisal and shared awareness of risk throughout an organization, can be achieved by developing a culture of “chronic unease” that encourages a high awareness and sensitivity to risk and minimizes the potential for complacency.
Particularly critical is sensitivity to “weak signals” that risks have increased. Everyone involved in safety-critical operations needs to be sensitive to such weak signals and report the change in risk profile to their immediate leaders. Effective communication of risk, and continuous re-appraisal and shared awareness of risk throughout an organization, can be achieved by developing a culture of “chronic unease” that encourages a high awareness and sensitivity to risk and minimizes the potential for complacency.


====Human Factors in Design====
===Human Factors in Design===


Often, incident investigations show that problems with the design or application of the interface between people and technology causes a loss of reliable human performance, an issue which is sometimes called “design-induced human error.” Systems that recognize human error and can stop it before it causes serious consequences must be designed.
Often, incident investigations show that problems with the design or application of the interface between people and technology causes a loss of reliable human performance, an issue which is sometimes called “design-induced human error.” Systems that recognize human error and can stop it before it causes serious consequences must be designed.
Line 70: Line 67:
The oil and gas industry can learn much from aviation, nuclear power, and defense when it comes to improving human factor engineering. But the oil and gas industry faces specific challenges that can make it difficult to apply the same design processes and standards that have worked in those industries. Specific standards and processes are being developed to fit the needs of the oil and gas industry.  
The oil and gas industry can learn much from aviation, nuclear power, and defense when it comes to improving human factor engineering. But the oil and gas industry faces specific challenges that can make it difficult to apply the same design processes and standards that have worked in those industries. Specific standards and processes are being developed to fit the needs of the oil and gas industry.  


====Individual and Team Capacity====
===Individual and Team Capacity===


Individual and team capacity means ensuring that people expected to perform safety-critical activities are capable of doing so. The foundation of process safety is the availability, capability, capacity, and attitude of individuals and teams to do what is expected.
Individual and team capacity means ensuring that people expected to perform safety-critical activities are capable of doing so. The foundation of process safety is the availability, capability, capacity, and attitude of individuals and teams to do what is expected.
Line 77: Line 74:
Team leaders need to have the interpersonal skills to effectively draw on the knowledge and experience of everyone on the team who may contribute to safe operations, without allowing differences in personality or authority to inhibit communication or prevent sharing of critical information.
Team leaders need to have the interpersonal skills to effectively draw on the knowledge and experience of everyone on the team who may contribute to safe operations, without allowing differences in personality or authority to inhibit communication or prevent sharing of critical information.


====Collaborative and Distributed Team Working====
===Collaborative and Distributed Team Working===


Oil and gas operations rely on communication and collaboration between different groups of people, often located in different locations and working on different scales in terms of the time between their input and the potential for an incident. Assurance of human performance on safety-critical activities, particularly in real-time operations, depends on highly effective, often real-time, collaboration and communication across these distributed teams.
Oil and gas operations rely on communication and collaboration between different groups of people, often located in different locations and working on different scales in terms of the time between their input and the potential for an incident. Assurance of human performance on safety-critical activities, particularly in real-time operations, depends on highly effective, often real-time, collaboration and communication across these distributed teams.
Line 83: Line 80:
Control of the risk to human performance begins with each team’s awareness of the contribution the team makes to front-line operational safety. Team members need to know what is required of them and the risk and potential consequences if they do not provide the support required. Intentional effort and established mechanisms (technological, organizational, procedural, legal, and commercial) is required to support and encourage effective distributed team operations.
Control of the risk to human performance begins with each team’s awareness of the contribution the team makes to front-line operational safety. Team members need to know what is required of them and the risk and potential consequences if they do not provide the support required. Intentional effort and established mechanisms (technological, organizational, procedural, legal, and commercial) is required to support and encourage effective distributed team operations.


====Commercial and Contractual Environment====
===Commercial and Contractual Environment===


Oil and gas operations are carried out in a complex commercial and contractual environment. Ventures can involve many partners, all with different priorities, cultures, ways of working, and legal responsibilities. These factors can lead to inconsistencies and conflicts in risk assessment and decision-making, breakdowns in communication of safety-related information, and increased risks to the ability of people to perform safety-critical activities effectively.
Oil and gas operations are carried out in a complex commercial and contractual environment. Ventures can involve many partners, all with different priorities, cultures, ways of working, and legal responsibilities. These factors can lead to inconsistencies and conflicts in risk assessment and decision-making, breakdowns in communication of safety-related information, and increased risks to the ability of people to perform safety-critical activities effectively.
Line 89: Line 86:
Adequate control of these issues requires each stakeholder to be aware of the contribution he/she makes to ensuring safety-critical human performance and to commit to support of activities designed to reduce risk. It also requires a clear focus and line of sight by the operating partner on assurance of safety-critical human activities.
Adequate control of these issues requires each stakeholder to be aware of the contribution he/she makes to ensuring safety-critical human performance and to commit to support of activities designed to reduce risk. It also requires a clear focus and line of sight by the operating partner on assurance of safety-critical human activities.


====Workload Transition====
===Workload Transition===


“Workload transition” refers to situations when people are expected to transition quickly from “normal” operations (typically stable situations with a relatively low workload) to “abnormal” or emergency situations, with extremely high workload and significant challenges, particularly mental ones. Proper planning and preparation needs to recognize the critical role that human factors can play in ensuring successful transition into these emergency response situations.
“Workload transition” refers to situations when people are expected to transition quickly from “normal” operations (typically stable situations with a relatively low workload) to “abnormal” or emergency situations, with extremely high workload and significant challenges, particularly mental ones. Proper planning and preparation needs to recognize the critical role that human factors can play in ensuring successful transition into these emergency response situations.


====Assurance of Safety-Critical Human Activities====
===Assurance of Safety-Critical Human Activities===


The use of automation in oil and gas operations has increased dramatically over recent decades. However, the global industry still depends on people at all levels of operations to perform activities that are fundamental and critical to safe and environmentally sustainable operations and will continue to do so for the foreseeable future. Reliance on human behavior and performance can be either direct (such as performing a valve line-up correctly, responding to alarms, or detecting and diagnosing causes of abnormality) or indirect (such as inspection or maintenance of safety-critical elements).
The use of automation in oil and gas operations has increased dramatically over recent decades. However, the global industry still depends on people at all levels of operations to perform activities that are fundamental and critical to safe and environmentally sustainable operations and will continue to do so for the foreseeable future. Reliance on human behavior and performance can be either direct (such as performing a valve line-up correctly, responding to alarms, or detecting and diagnosing causes of abnormality) or indirect (such as inspection or maintenance of safety-critical elements).
Line 99: Line 96:
The term “Workload Transition” to refer to this issue is borrowed from a project carried out by the US National Research Council on behalf of the US Army and published by the National Academy Press in 1993 as “Workload Transition: Implications for Individual and Team performance”.
The term “Workload Transition” to refer to this issue is borrowed from a project carried out by the US National Research Council on behalf of the US Army and published by the National Academy Press in 1993 as “Workload Transition: Implications for Individual and Team performance”.


====Investigating and Learning from Incidents====
===Investigating and Learning from Incidents===


Researchers, human factors professionals, and others with a professional interest in human performance and major incidents across many sectors believe that real learning from incidents is hindered by a tendency to “blame the human,” or to treat “human error” as an acceptable explanation for an incident. Despite the best efforts of many companies, investigation tools and techniques to identify underlying human and organizational causes, and routine investigation of incidents to understand why human performance fails, going “beyond human error” is still relatively uncommon in the oil and gas industry. The key is to pursue a deeper understanding of why “human error” occurs, especially the organizational/cultural factors that “set up” the human for failure.
Researchers, human factors professionals, and others with a professional interest in human performance and major incidents across many sectors believe that real learning from incidents is hindered by a tendency to “blame the human,” or to treat “human error” as an acceptable explanation for an incident. Despite the best efforts of many companies, investigation tools and techniques to identify underlying human and organizational causes, and routine investigation of incidents to understand why human performance fails, going “beyond human error” is still relatively uncommon in the oil and gas industry. The key is to pursue a deeper understanding of why “human error” occurs, especially the organizational/cultural factors that “set up” the human for failure.


===Leadership and Culture===
==Leadership and Culture==


Recent analyses of major process accidents (including NASA’s Challenger, Columbia, and Hubble accidents; BP’s Texas City accident; and the banking crisis) have implicated the culture of those organizations. Looking further back reveals accidents in which high-hazard activities were allowed even though people knew they could have done better. Because nothing had gone wrong in the past, the high-hazard activities were accepted as the norm. In addition, many recent high-hazard well control events occurred with operating staff choosing to ignore, or accept as nonthreatening, danger signs they had been trained to observe. Such acceptance is essentially cultural.
Recent analyses of major process accidents (including NASA’s Challenger, Columbia, and Hubble accidents; BP’s Texas City accident; and the banking crisis) have implicated the culture of those organizations. Looking further back reveals accidents in which high-hazard activities were allowed even though people knew they could have done better. Because nothing had gone wrong in the past, the high-hazard activities were accepted as the norm. In addition, many recent high-hazard well control events occurred with operating staff choosing to ignore, or accept as nonthreatening, danger signs they had been trained to observe. Such acceptance is essentially cultural.
Line 109: Line 106:
The safety culture challenge is creating and maintaining an organizational culture that no longer allows things to happen when, in hindsight, it is clear that something should have been done. Establishing such a culture begins at the top of the organization, but the distance from executives at the top to the hazards is often great and involves multiple decisions by individuals at many levels. This distance also means that executives’ beliefs about the safety culture of their organization may not always correlate with what is happening on the ground.
The safety culture challenge is creating and maintaining an organizational culture that no longer allows things to happen when, in hindsight, it is clear that something should have been done. Establishing such a culture begins at the top of the organization, but the distance from executives at the top to the hazards is often great and involves multiple decisions by individuals at many levels. This distance also means that executives’ beliefs about the safety culture of their organization may not always correlate with what is happening on the ground.


====Definition of Process Safety Culture====
===Definition of Process Safety Culture===


Safety culture has been defined in many ways, but the definitions are usually too abstract for the oilfield, which makes discussion difficult. Organizational culture can be defined either in abstract terms of values, beliefs and attitudes, or in practical terms (i.e. “how we do things around here”). Culture reflects attitudes in an organization that are cooperatively shared by all stakeholders, including workforce and management. When safety is a priority, the stakeholders believe that high levels of safety performance are feasible and desirable. A process safety culture requires more than attention to personal safety. It requires the existence of organizational behaviors, a level of continued awareness of the dangers associated with even simple activities, and the ability to assess alternatives in the face of conflicting goals and inadequate information.
Safety culture has been defined in many ways, but the definitions are usually too abstract for the oilfield, which makes discussion difficult. Organizational culture can be defined either in abstract terms of values, beliefs and attitudes, or in practical terms (i.e. “how we do things around here”). Culture reflects attitudes in an organization that are cooperatively shared by all stakeholders, including workforce and management. When safety is a priority, the stakeholders believe that high levels of safety performance are feasible and desirable. A process safety culture requires more than attention to personal safety. It requires the existence of organizational behaviors, a level of continued awareness of the dangers associated with even simple activities, and the ability to assess alternatives in the face of conflicting goals and inadequate information.
Line 115: Line 112:
The five-step Oil and Gas Producers Association (OGP) ladder (5) describes how a safety culture may range from Pathological – or hardly interested in safety at all – up to Proactive and Generative, where beliefs and behaviors support safety. People may want and support safety, but not believe that it is completely achievable in the face of production and profit pressures. More advanced cultures, such as the proactive and generative, are typically less vulnerable and more resilient.
The five-step Oil and Gas Producers Association (OGP) ladder (5) describes how a safety culture may range from Pathological – or hardly interested in safety at all – up to Proactive and Generative, where beliefs and behaviors support safety. People may want and support safety, but not believe that it is completely achievable in the face of production and profit pressures. More advanced cultures, such as the proactive and generative, are typically less vulnerable and more resilient.


====Measurement of Safety Culture====
===Measurement of Safety Culture===


Measurement tools for safety culture often focus on personal rather than process safety attributes. In personal safety, the dangers, causes, and prevention of accidents is fairly obvious. Properly conducted hazard analyses, measurement of change (MOC) procedures, etc. required by a safety case or a process safety management system can identify the dangers, causes, and possible prevention of accidents.
Measurement tools for safety culture often focus on personal rather than process safety attributes. In personal safety, the dangers, causes, and prevention of accidents is fairly obvious. Properly conducted hazard analyses, measurement of change (MOC) procedures, etc. required by a safety case or a process safety management system can identify the dangers, causes, and possible prevention of accidents.
Line 126: Line 123:
What people do after measurement is as critical as measurement itself. Actions involve discovering what needs to be done, implementing changes, and generalizing to generic training. These actions are some, but not all, the ways to demonstrate double-loop learning that goes further than discovering individual problems and fixing them in a single feedback loop to identifying systemic issues and acting on addressing them organization-wide.
What people do after measurement is as critical as measurement itself. Actions involve discovering what needs to be done, implementing changes, and generalizing to generic training. These actions are some, but not all, the ways to demonstrate double-loop learning that goes further than discovering individual problems and fixing them in a single feedback loop to identifying systemic issues and acting on addressing them organization-wide.


====Experience in Other High-Hazard Industries====
===Experience in Other High-Hazard Industries===


Other industries, particularly commercial aviation, the nuclear industry, and mining, have developed strong process safety cultures. The nuclear industry, through the United Nations International Atomic Energy Agency (IAEA), set up activities to understand and ensure development of safety cultures after the Three Mile Island and the Chernobyl disaster. The mining industry had a summit meeting on safety in 2005 after a large number of accidents.
Other industries, particularly commercial aviation, the nuclear industry, and mining, have developed strong process safety cultures. The nuclear industry, through the United Nations International Atomic Energy Agency (IAEA), set up activities to understand and ensure development of safety cultures after the Three Mile Island and the Chernobyl disaster. The mining industry had a summit meeting on safety in 2005 after a large number of accidents.
Line 132: Line 129:
Aviation relies on a highly regulated international environment. For example, the International Civil Aviation Authority (ICAO), a UN organization, developed the ICAO Standards and Recommended Practices, which have the status of international treaties. Civil aviation has achieved success even though its Safety Management System (SMS) was only made mandatory for airlines in 2009. The culture of commercial aviation expects and invests in high levels of discipline, professionalism, training, and regulation. For example, failure to pass annual medical and technical tests results in grounding, regardless of the seniority of staff. To achieve the current level of safety performance, a special culture had to be developed that supported a challenge to authority and a deeply embedded personal interest in safety.
Aviation relies on a highly regulated international environment. For example, the International Civil Aviation Authority (ICAO), a UN organization, developed the ICAO Standards and Recommended Practices, which have the status of international treaties. Civil aviation has achieved success even though its Safety Management System (SMS) was only made mandatory for airlines in 2009. The culture of commercial aviation expects and invests in high levels of discipline, professionalism, training, and regulation. For example, failure to pass annual medical and technical tests results in grounding, regardless of the seniority of staff. To achieve the current level of safety performance, a special culture had to be developed that supported a challenge to authority and a deeply embedded personal interest in safety.


====Assurance of Safety Culture Improvement in Organizations====
===Assurance of Safety Culture Improvement in Organizations===


Safety culture is a complex concept that is a process of continuous improvement that is evolutionary rather than once-and-for-all. Culture surveys form one tool for the assessment of the culture, but they cannot be relied on by themselves because the measurement depends on honest and truthful responses. Surveys are of most value when they are repeated and changes to cultural norms and expectations can be tracked over time.
Safety culture is a complex concept that is a process of continuous improvement that is evolutionary rather than once-and-for-all. Culture surveys form one tool for the assessment of the culture, but they cannot be relied on by themselves because the measurement depends on honest and truthful responses. Surveys are of most value when they are repeated and changes to cultural norms and expectations can be tracked over time.
One major area for assessment is leadership behavior. Successful leadership behaviors regarding personal safety can be translated into equivalent behaviors for process safety. Leaders can be trained in what behaviors have the most impact on process safety. Before making visits and inspections, leaders can know what to look for, ask for, and how to understand the answers. While such approaches can never be technically fool proof, and leaders can be misled, the activity itself sends a clear message about what the leader prioritizes.
One major area for assessment is leadership behavior. Successful leadership behaviors regarding personal safety can be translated into equivalent behaviors for process safety. Leaders can be trained in what behaviors have the most impact on process safety. Before making visits and inspections, leaders can know what to look for, ask for, and how to understand the answers. While such approaches can never be technically fool proof, and leaders can be misled, the activity itself sends a clear message about what the leader prioritizes.


====The Role of Regulation====
===The Role of Regulation===


Organizations are not always willing to take the necessary steps to improve their safety culture, but strong regulation can ensure that they take those steps. A common approach to regulation is to develop a list of prescriptive requirements, backed up by a regulatory audit or inspection with sanctions for noncompliance. The regulator must develop a comprehensive and credible list that covers the latest technologies and insights. But this approach provides no incentives for organizations to go beyond minimal compliance. It encourages a type of “compliance mentality” where management’s attitude can become, “If I am in compliance with the regulations, then I must be safe,” rather than the continual introspection on safety and dissatisfaction with performance required by a “Generative” safety culture.
Organizations are not always willing to take the necessary steps to improve their safety culture, but strong regulation can ensure that they take those steps. A common approach to regulation is to develop a list of prescriptive requirements, backed up by a regulatory audit or inspection with sanctions for noncompliance. The regulator must develop a comprehensive and credible list that covers the latest technologies and insights. But this approach provides no incentives for organizations to go beyond minimal compliance. It encourages a type of “compliance mentality” where management’s attitude can become, “If I am in compliance with the regulations, then I must be safe,” rather than the continual introspection on safety and dissatisfaction with performance required by a “Generative” safety culture.
Line 145: Line 142:
Both approaches require the regulator to apply significant sanctions in cases of noncompliance to requirements or failure to meet goals. Behind failures of either of these may be a complacent organizational culture. By ensuring an adequate and jointly agreed definition of what a safety culture looks like for both process and personal safety, regulators can support organizations taking active steps to improve their safety culture.
Both approaches require the regulator to apply significant sanctions in cases of noncompliance to requirements or failure to meet goals. Behind failures of either of these may be a complacent organizational culture. By ensuring an adequate and jointly agreed definition of what a safety culture looks like for both process and personal safety, regulators can support organizations taking active steps to improve their safety culture.


====Perception of Risk and Decision-Making====
===Perception of Risk and Decision-Making===


Workers make decisions all the time, ranging from senior executives making strategic choices to front-line personnel assessing the situation with the associated risks and making split second decisions on how to go about a task. Both types of decisions can be safety-critical. Most of the time people get it right, but sometimes decisions have regrettable consequences. This has to do with cognitive limits and biases in human decision-making, physiological factors that affect an individual’s ability to make decisions (e.g. drugs, alcohol, illness, injury, fatigue, etc.), and the organizational conditions under which decisions are made. Decisions must often be made under time pressure; with competing goals; and with inadequate, insufficient, or uncertain information or consequences.
Workers make decisions all the time, ranging from senior executives making strategic choices to front-line personnel assessing the situation with the associated risks and making split second decisions on how to go about a task. Both types of decisions can be safety-critical. Most of the time people get it right, but sometimes decisions have regrettable consequences. This has to do with cognitive limits and biases in human decision-making, physiological factors that affect an individual’s ability to make decisions (e.g. drugs, alcohol, illness, injury, fatigue, etc.), and the organizational conditions under which decisions are made. Decisions must often be made under time pressure; with competing goals; and with inadequate, insufficient, or uncertain information or consequences.
Line 151: Line 148:
Considerable scientific literature is available on why experienced, trained, and skilled people make decisions that, in hindsight, were poor. Some of this knowledge has been applied in the oil and gas industry to train people to make better decisions under challenging circumstances. However, implementation is inconsistent, and most people in the industry lack awareness of the realities and limitations of human cognition and the “tricks” the brain uses to function in the modern world. Few people in the industry have practiced decision-making in a fail-safe environment.
Considerable scientific literature is available on why experienced, trained, and skilled people make decisions that, in hindsight, were poor. Some of this knowledge has been applied in the oil and gas industry to train people to make better decisions under challenging circumstances. However, implementation is inconsistent, and most people in the industry lack awareness of the realities and limitations of human cognition and the “tricks” the brain uses to function in the modern world. Few people in the industry have practiced decision-making in a fail-safe environment.


====Decision-Making Process====
===Decision-Making Process===


Decision-making involves the entire process, from awareness of a situation, predicting what might happen, planning possible courses of action, and choosing what to do. This process is sometimes conscious and deliberate (for example, when planning a well). Rational decision-making models apply to these situations. Such models assume people systematically compare options and make rational, optimized decisions when there is sufficient time and information. Most of the time, however, decisions are made subconsciously, almost automatically; such as when driving a car or interpreting a display or chart. People then use a strategy of choosing something good enough for the moment and adapting the course of action if necessary. While this strategy is sufficient in most ordinary situations, it can be problematic in safety-critical situations.
Decision-making involves the entire process, from awareness of a situation, predicting what might happen, planning possible courses of action, and choosing what to do. This process is sometimes conscious and deliberate (for example, when planning a well). Rational decision-making models apply to these situations. Such models assume people systematically compare options and make rational, optimized decisions when there is sufficient time and information. Most of the time, however, decisions are made subconsciously, almost automatically; such as when driving a car or interpreting a display or chart. People then use a strategy of choosing something good enough for the moment and adapting the course of action if necessary. While this strategy is sufficient in most ordinary situations, it can be problematic in safety-critical situations.


====Cognitive Bias in Decision-Making====
===Cognitive Bias in Decision-Making===


Research has also shown that rational/deliberate decision-making is often affected by many types of subconscious cognitive bias. (9) An example of a cognitive bias is the confirmation bias: We perceive new information in light of what we already know and expect about the situation. From an evolutionary perspective, this makes processing information quicker, but in safety-critical situations it can lead to overlooking or reinterpreting information that does not fit what the individual believes is the situation into information that the individual believes makes better sense.
Research has also shown that rational/deliberate decision-making is often affected by many types of subconscious cognitive bias. (9) An example of a cognitive bias is the confirmation bias: We perceive new information in light of what we already know and expect about the situation. From an evolutionary perspective, this makes processing information quicker, but in safety-critical situations it can lead to overlooking or reinterpreting information that does not fit what the individual believes is the situation into information that the individual believes makes better sense.


====Perception of Risk====
===Perception of Risk===


How people perceive risk is intimately connected with how people make decisions. People systematically misunderstand probabilities, influenced by the level of control they feel they can exercise. This is particularly common in hazardous situations that are very familiar, causing people to feel in control and experience them as less dangerous than they are. The information that individuals seek out, from executives to the front line, shapes their understanding of what is critical and what controls are important. KPIs that focus on high-frequency personal outcomes, such as LTIs and reactive controls, can create a different understanding from proactive controls on process hazards. Even the way identical information is presented influences perception of risk: “Risk framing” describes a cognitive bias where, for example, people see a 90% chance of success as less risky than the same operation described as having a 10% chance of failure.
How people perceive risk is intimately connected with how people make decisions. People systematically misunderstand probabilities, influenced by the level of control they feel they can exercise. This is particularly common in hazardous situations that are very familiar, causing people to feel in control and experience them as less dangerous than they are. The information that individuals seek out, from executives to the front line, shapes their understanding of what is critical and what controls are important. KPIs that focus on high-frequency personal outcomes, such as LTIs and reactive controls, can create a different understanding from proactive controls on process hazards. Even the way identical information is presented influences perception of risk: “Risk framing” describes a cognitive bias where, for example, people see a 90% chance of success as less risky than the same operation described as having a 10% chance of failure.
Line 165: Line 162:
There are many examples of cognitive bias interfering with accurate and rational assessment of risk. Alarmingly, research has shown that most of these biases favor “hawks” (a tendency to accept higher risk) over “doves” (a tendency towards risk-aversion). This is recognized as “risky shift” and was first described by Kogan and Wallach (1967).
There are many examples of cognitive bias interfering with accurate and rational assessment of risk. Alarmingly, research has shown that most of these biases favor “hawks” (a tendency to accept higher risk) over “doves” (a tendency towards risk-aversion). This is recognized as “risky shift” and was first described by Kogan and Wallach (1967).


====Group Decision-Making Factors====
===Group Decision-Making Factors===


Groups can also affect decision-making processes. Most significant operational decisions involve groups working to an agreed position. Involving other people can be a great asset, as it brings more experience and diverse perspectives to the table. But group decision-making also presents challenges: it is slower than one individual decision-making, requires energy and resources, and leaves the ultimate responsibility unclear.
Groups can also affect decision-making processes. Most significant operational decisions involve groups working to an agreed position. Involving other people can be a great asset, as it brings more experience and diverse perspectives to the table. But group decision-making also presents challenges: it is slower than one individual decision-making, requires energy and resources, and leaves the ultimate responsibility unclear.
Line 173: Line 170:
These influences can be counteracted by using groups as an instrument to critically review a decision. In that way, groups can compensate for the limitations of individual decision-making if trained to question each other in a supportive environment.
These influences can be counteracted by using groups as an instrument to critically review a decision. In that way, groups can compensate for the limitations of individual decision-making if trained to question each other in a supportive environment.


====Situations and Decision-Making====
===Situations and Decision-Making===


The situations people find themselves in can also influence the quality of their decision-making. Time pressure, poor information presentation, ambiguity of information and conflicting goals can lead to poor decisions. In dynamic, safety-critical situations, rapid decisions may be required. Tightly coupled, complex processes may leave little or no time to explore alternatives. Also many real-world processes are nonlinear, information is uncertain, and feedback about the correctness of a decision may come too late to correct. These considerations can apply equally to organizations, leading to a loss of “organizational situation awareness,” especially with small, slow organizational changes, and mission creep. Safety-critical decisions may be especially subject to premature closure under time pressure or the perceived need to make a decision. All individuals, but especially leaders, need to be aware of factors that subtly increase the chances of making and accepting decisions that are increasingly risky.
The situations people find themselves in can also influence the quality of their decision-making. Time pressure, poor information presentation, ambiguity of information and conflicting goals can lead to poor decisions. In dynamic, safety-critical situations, rapid decisions may be required. Tightly coupled, complex processes may leave little or no time to explore alternatives. Also many real-world processes are nonlinear, information is uncertain, and feedback about the correctness of a decision may come too late to correct. These considerations can apply equally to organizations, leading to a loss of “organizational situation awareness,” especially with small, slow organizational changes, and mission creep. Safety-critical decisions may be especially subject to premature closure under time pressure or the perceived need to make a decision. All individuals, but especially leaders, need to be aware of factors that subtly increase the chances of making and accepting decisions that are increasingly risky.


====Challenges for the Industry====
===Challenges for the Industry===


The following are the challenges for the E&P industry:
The following are the challenges for the E&P industry:
Line 187: Line 184:
:• Reflect the importance of decision-making skills in the industry’s recruitment and performance development processes.
:• Reflect the importance of decision-making skills in the industry’s recruitment and performance development processes.


====Possible Solutions====
===Possible Solutions===


Developing analytical and non-analytical reasoning skills has been shown to improve the quality of decision-making, as has the use of experiential training methods. In other high-risk industries, and in a few areas of the oil and gas industry, scenario-based training has been successful, conducted either in simulators or as table-top exercises. An experienced facilitator pushes a team of people to their limits in a challenging scenario and guides their subsequent reflection and analysis to capture learning. Repeated practice is particularly important to build the team’s repertoire of behavior that can then be used under high-stress conditions.
Developing analytical and non-analytical reasoning skills has been shown to improve the quality of decision-making, as has the use of experiential training methods. In other high-risk industries, and in a few areas of the oil and gas industry, scenario-based training has been successful, conducted either in simulators or as table-top exercises. An experienced facilitator pushes a team of people to their limits in a challenging scenario and guides their subsequent reflection and analysis to capture learning. Repeated practice is particularly important to build the team’s repertoire of behavior that can then be used under high-stress conditions.
Line 193: Line 190:
To combat the biases mentioned above, organizations can develop decision reviewing procedures to support critical analysis and to actively challenge decisions. While cognitive biases will not disappear, team processes can help to compensate for what individuals may overlook. For example, team members can take turns in playing the role of “devil’s advocate,” and the leader can make a habit of asking for deviating opinions or constructive challenge. At the planning stage, more time can be invested in anticipating and assessing possible consequences and alternative courses of action. Also for these organizational processes, simulator training could be developed. In time-critical situations, simple tools are needed to support decision-making. Supervisors could encourage before-and-after action reviews as part of their daily routine.
To combat the biases mentioned above, organizations can develop decision reviewing procedures to support critical analysis and to actively challenge decisions. While cognitive biases will not disappear, team processes can help to compensate for what individuals may overlook. For example, team members can take turns in playing the role of “devil’s advocate,” and the leader can make a habit of asking for deviating opinions or constructive challenge. At the planning stage, more time can be invested in anticipating and assessing possible consequences and alternative courses of action. Also for these organizational processes, simulator training could be developed. In time-critical situations, simple tools are needed to support decision-making. Supervisors could encourage before-and-after action reviews as part of their daily routine.


====Assurance====
===Assurance===


Assurance methods need to address decision-making at three levels:
Assurance methods need to address decision-making at three levels:
Line 202: Line 199:
Possible assurance methods include documentation, procedures, MOC, and internal audits. It is important that lessons learned relate to the decision-making process rather than only the outcome of the decision. The “health status” can be assessed through regular meetings, facilitated focus groups, perception surveys and management reviews with corrective actions. Safety management systems and their assurance measures need to be tailored to the maturity of the organization.
Possible assurance methods include documentation, procedures, MOC, and internal audits. It is important that lessons learned relate to the decision-making process rather than only the outcome of the decision. The “health status” can be assessed through regular meetings, facilitated focus groups, perception surveys and management reviews with corrective actions. Safety management systems and their assurance measures need to be tailored to the maturity of the organization.


===Individual and Team Capacity===
==Individual and Team Capacity==


Most major accidents are avoidable. Proper system design and/or timely and appropriate human action can usually be shown to have been able to prevent almost all unsafe outcomes. From that perspective, it is attractive to take the attitude that “if we just had people with the right competency then everything would be okay.”
Most major accidents are avoidable. Proper system design and/or timely and appropriate human action can usually be shown to have been able to prevent almost all unsafe outcomes. From that perspective, it is attractive to take the attitude that “if we just had people with the right competency then everything would be okay.”
Line 210: Line 207:
What role should training, certification and licensing play in ensuring operational safety, and how can it support an integrated approach to delivering operational integrity? To answer this question, the industry needs to agree on (1) what it knows about the role training, certification, and licensing play in operational integrity, and (2) the questions the industry will need to answer to properly address the issue.
What role should training, certification and licensing play in ensuring operational safety, and how can it support an integrated approach to delivering operational integrity? To answer this question, the industry needs to agree on (1) what it knows about the role training, certification, and licensing play in operational integrity, and (2) the questions the industry will need to answer to properly address the issue.


====The Role of Training, Certification and Licensing====
===The Role of Training, Certification and Licensing===


The SME’s at the summit agreed upon the following list of what is known by the industry about the role of training, certification and licensing:
The SME’s at the summit agreed upon the following list of what is known by the industry about the role of training, certification and licensing:


1) Developing proper technical and nontechnical competencies is a critical part of assuring operational safety. Both are necessary, but neither alone is sufficient.
:1) Developing proper technical and nontechnical competencies is a critical part of assuring operational safety. Both are necessary, but neither alone is sufficient.
 
:
2) Generally, there is a common understanding of the technical competencies required for key job roles in our industry. Detailed definitions of technical competencies exist in job roles in some organizations. However, specific, documented, industry-wide definitions of technical competencies do not exist.
:2) Generally, there is a common understanding of the technical competencies required for key job roles in our industry. Detailed definitions of technical competencies exist in job roles in some organizations. However, specific, documented, industry-wide definitions of technical competencies do not exist.
 
:
3) The definition and development of technical competencies will need to be continually reviewed and updated due to increasing complexity of operations, technological advancements, and the demographic situation facing the industry.
:3) The definition and development of technical competencies will need to be continually reviewed and updated due to increasing complexity of operations, technological advancements, and the demographic situation facing the industry.
 
:
4) The industry has significant opportunities to improve operational integrity through improvements in nontechnical skills and behaviors.
:4) The industry has significant opportunities to improve operational integrity through improvements in nontechnical skills and behaviors.
 
:
5) No common industry agreement on the nontechnical skills needed for specific jobs exists. Nontechnical training needs to improve, particularly for handling uncertainty and abnormal events. Current training often neglects to emphasize the limits of expert judgment and intuition, and the behaviors most appropriate for preventing and responding to emergency situations.
:5) No common industry agreement on the nontechnical skills needed for specific jobs exists. Nontechnical training needs to improve, particularly for handling uncertainty and abnormal events. Current training often neglects to emphasize the limits of expert judgment and intuition, and the behaviors most appropriate for preventing and responding to emergency situations.
 
:
6) Different selection processes, wide variation of personnel and roles, the dynamic nature of many petroleum processes, and complex contractual relationships within a team mean that the many beneficial nontechnical programs that exist in other industries will require significant customization for the oil and gas industry. However, a core syllabus could define the requirements for basic nontechnical skills needed to work in most jobs in the E&P industry.
:6) Different selection processes, wide variation of personnel and roles, the dynamic nature of many petroleum processes, and complex contractual relationships within a team mean that the many beneficial nontechnical programs that exist in other industries will require significant customization for the oil and gas industry. However, a core syllabus could define the requirements for basic nontechnical skills needed to work in most jobs in the E&P industry.
 
:
7) While some issues related to competency development can be addressed within the context of a single company, because of the extensive use of contractor services and partnerships, there is a critical industry-wide component to properly addressing this challenge.
:7) While some issues related to competency development can be addressed within the context of a single company, because of the extensive use of contractor services and partnerships, there is a critical industry-wide component to properly addressing this challenge.
 
:
8) The lack of a common terminology in the area of operational integrity/process safety hampers the industry’s ability to cooperate across companies or countries.
:8) The lack of a common terminology in the area of operational integrity/process safety hampers the industry’s ability to cooperate across companies or countries.


====Open Questions Relating to Training and Competency====
===Open Questions Relating to Training and Competency===


The following are questions around key themes that will require answers.
The following are questions around key themes that will require answers.
Line 250: Line 247:
::• How can the industry most productively institute processes/practices to learn from incidents and continuously improve competency definitions and ::development?
::• How can the industry most productively institute processes/practices to learn from incidents and continuously improve competency definitions and ::development?


====Operational Control of Work====
===Operational Control of Work===


Upstream E&P worksites are often remote from the planning organization, so communication and control links are much weaker. Production operations and maintenance activities have inherent risks in the possible failure of containment barriers. Barriers containing hydrocarbons and other hazards can weaken by tolerating small internal or external changes over time or by worsening design assumptions about corrosion, unexpected fatigue loading or stress. Risks are also inherent for non-routine procedures or well operations if there are uncertainties about the condition of the plant or the characteristics of the formations.
Upstream E&P worksites are often remote from the planning organization, so communication and control links are much weaker. Production operations and maintenance activities have inherent risks in the possible failure of containment barriers. Barriers containing hydrocarbons and other hazards can weaken by tolerating small internal or external changes over time or by worsening design assumptions about corrosion, unexpected fatigue loading or stress. Risks are also inherent for non-routine procedures or well operations if there are uncertainties about the condition of the plant or the characteristics of the formations.
Line 260: Line 257:
Operational Control of Work addresses these issues. At the organizational and human factors level, it sets out the workflows, communication protocols, decision-making rights, competencies, and training programs necessary for the safe and efficient execution of operations. At the technical level, it encompasses the way designs are translated into on-site executable instructions and how the status of the operation is monitored for deviations. It provides a standard framework within which staff can be educated, trained, and assessed. Operational Control of Work focuses on raising the awareness of human factors, developing the nontechnical skills needed for effective teamwork, detecting the weak signals of insidious change, and managing change effectively in response to unexpected events.
Operational Control of Work addresses these issues. At the organizational and human factors level, it sets out the workflows, communication protocols, decision-making rights, competencies, and training programs necessary for the safe and efficient execution of operations. At the technical level, it encompasses the way designs are translated into on-site executable instructions and how the status of the operation is monitored for deviations. It provides a standard framework within which staff can be educated, trained, and assessed. Operational Control of Work focuses on raising the awareness of human factors, developing the nontechnical skills needed for effective teamwork, detecting the weak signals of insidious change, and managing change effectively in response to unexpected events.


====NASA and Integrated Operations====
===NASA and Integrated Operations===


As an example of Operational Control of Work, the NASA experience is instructive. For 40 years, the cornerstone of the US space program was a highly disciplined organization that managed complex operations and dealt with unexpected events. Mission Control was underpinned by clear, documented “Mission Rules” that defined responsibilities and boundaries within which individuals could take action up to the ultimate authority: “The Flight Director, after analysis of the flight condition, may choose to take any necessary real-time action required to ensure the safety of the shuttle and crew.”
As an example of Operational Control of Work, the NASA experience is instructive. For 40 years, the cornerstone of the US space program was a highly disciplined organization that managed complex operations and dealt with unexpected events. Mission Control was underpinned by clear, documented “Mission Rules” that defined responsibilities and boundaries within which individuals could take action up to the ultimate authority: “The Flight Director, after analysis of the flight condition, may choose to take any necessary real-time action required to ensure the safety of the shuttle and crew.”
Line 266: Line 263:
NASA is distinct because of the amount of time spent training flight crews and Mission Control personnel. This example should challenge the industry as to whether its Operational Control of Work practices are adequate for the complexity and intensity of the operations that are being undertaken by an increasingly inexperienced workforce, often with increasing degrees of remote control.
NASA is distinct because of the amount of time spent training flight crews and Mission Control personnel. This example should challenge the industry as to whether its Operational Control of Work practices are adequate for the complexity and intensity of the operations that are being undertaken by an increasingly inexperienced workforce, often with increasing degrees of remote control.


====Management of Change====
===Management of Change===


At first sight, Operational Control of Work may be viewed as merely disciplined Management of Change. As a concept, however, Operational Control of Work goes beyond Management of Change in the context of projects and engineering. It includes planning for operations in explicitly dynamic environments and being organized and capable of dealing with unexpected events, especially when the rate of change is slow.
At first sight, Operational Control of Work may be viewed as merely disciplined Management of Change. As a concept, however, Operational Control of Work goes beyond Management of Change in the context of projects and engineering. It includes planning for operations in explicitly dynamic environments and being organized and capable of dealing with unexpected events, especially when the rate of change is slow.
Line 284: Line 281:
As such, skilled Management of Change is an essential component of Operational Control of Work, but not sufficient in itself. While discrete changes can be captured by formal Management of Change processes, the concept of Operational Control of Work embraces wider issues such as “mission creep” at the strategic level. Rapid changes due to unexpected and potentially critical problems at the tactical level also occur, possibly when there is insufficient time or resources available to take a considered Management of Change approach.
As such, skilled Management of Change is an essential component of Operational Control of Work, but not sufficient in itself. While discrete changes can be captured by formal Management of Change processes, the concept of Operational Control of Work embraces wider issues such as “mission creep” at the strategic level. Rapid changes due to unexpected and potentially critical problems at the tactical level also occur, possibly when there is insufficient time or resources available to take a considered Management of Change approach.


====Assurance of Operational Control of Work Capability====
===Assurance of Operational Control of Work Capability===


An assurance framework is an essential component to demonstrate that the system is effective. In addition to formal audits and health checks to ensure that the system is being used correctly, performance measurement is an essential aspect to ensure that Operational Control of Work delivers the desired outcomes. Appropriate Operational Control of Work KPIs must be selected carefully to ensure that the right behaviors are promoted. The KPIs should be appropriate to the E&P industry and be tailored to reflect the diversity of activity from seismic field work, drilling, and well operations through to production operations and facilities maintenance. Duplication and re-invention should be avoided.  
An assurance framework is an essential component to demonstrate that the system is effective. In addition to formal audits and health checks to ensure that the system is being used correctly, performance measurement is an essential aspect to ensure that Operational Control of Work delivers the desired outcomes. Appropriate Operational Control of Work KPIs must be selected carefully to ensure that the right behaviors are promoted. The KPIs should be appropriate to the E&P industry and be tailored to reflect the diversity of activity from seismic field work, drilling, and well operations through to production operations and facilities maintenance. Duplication and re-invention should be avoided.  
Effective deployment of nontechnical skills (leadership, communication, decision-making, teamwork, situation awareness, and stress management) is essential to proper functioning of high-reliability organizations. These aspects must play an integral part in selection, training, and assessment of those involved in Operational Control of Work.
Effective deployment of nontechnical skills (leadership, communication, decision-making, teamwork, situation awareness, and stress management) is essential to proper functioning of high-reliability organizations. These aspects must play an integral part in selection, training, and assessment of those involved in Operational Control of Work.


====The Way Ahead for Operational Control of Work====
===The Way Ahead for Operational Control of Work===


Everyone in the industry must understand:
Everyone in the industry must understand:


1) In safety-critical activity, a breach or failure of a barrier almost immediately exposes the underlying hazard situation.
:1) In safety-critical activity, a breach or failure of a barrier almost immediately exposes the underlying hazard situation.
2) Whether a mission involves potentially catastrophic safety-critical activities
:2) Whether a mission involves potentially catastrophic safety-critical activities
3) The execution plan, decision rules, and decision-making window for such activities
:3) The execution plan, decision rules, and decision-making window for such activities


====Critical Need for Improvement====
===Critical Need for Improvement===


Integrating human factors into IT development is critical because of the volume of technology and systems in the operational environment that place demands on people’s cognitive abilities. Summit participants thought that, when a process control event with major adverse outcomes occurs, the cause is usually a chain of human errors rather than a massive engineering failure. Any contribution that human-factors-optimized IT systems can make to eliminate or contain such chains of human errors can help change E&P process safety.
Integrating human factors into IT development is critical because of the volume of technology and systems in the operational environment that place demands on people’s cognitive abilities. Summit participants thought that, when a process control event with major adverse outcomes occurs, the cause is usually a chain of human errors rather than a massive engineering failure. Any contribution that human-factors-optimized IT systems can make to eliminate or contain such chains of human errors can help change E&P process safety.
The summit revealed a notable lack of significant investment in research into the complex human/machine interfaces in the E&P industry. Many questions posed were answered with, “It would be great if someone would look into that.” The risk exposure in the drilling environment, in particular, is extreme. The end goal is clear: IT systems must include the ability to recognize and support the peculiar strengths and weaknesses of humans for the two to perform effectively together, no matter if it is through enforcement or re-enforcement of human actions. In an emergency situation, such an advance in IT systems may well contribute critically to the preservation of life.
The summit revealed a notable lack of significant investment in research into the complex human/machine interfaces in the E&P industry. Many questions posed were answered with, “It would be great if someone would look into that.” The risk exposure in the drilling environment, in particular, is extreme. The end goal is clear: IT systems must include the ability to recognize and support the peculiar strengths and weaknesses of humans for the two to perform effectively together, no matter if it is through enforcement or re-enforcement of human actions. In an emergency situation, such an advance in IT systems may well contribute critically to the preservation of life.


====Aligning Technology with Human Nature====
===Aligning Technology with Human Nature===


Summit participants identified the following areas for improvement in IT design and development:
Summit participants identified the following areas for improvement in IT design and development:
Line 324: Line 321:
Another approach, adopted in the nuclear industry, is extensive safety automation systems. Unsafe levels trigger safety systems that automatically contain situations without human intervention. Such systems have clear benefits but can have high costs when an automatic shutdown is unnecessarily triggered, particularly in drilling. Drilling IT systems require more sophisticated intelligence because drilling operations can be highly dynamic. The qualitative differences between phases of drilling operations can be extreme compared to, for instance, those in a refinery.
Another approach, adopted in the nuclear industry, is extensive safety automation systems. Unsafe levels trigger safety systems that automatically contain situations without human intervention. Such systems have clear benefits but can have high costs when an automatic shutdown is unnecessarily triggered, particularly in drilling. Drilling IT systems require more sophisticated intelligence because drilling operations can be highly dynamic. The qualitative differences between phases of drilling operations can be extreme compared to, for instance, those in a refinery.


===Conclusions===
==Conclusions==


• Leadership is critical to a process safety culture. The decisions and statements made by leaders, the incentive structures that they implement, the way they interact with people throughout the organization, and the actions they take to balance safety against commercial imperatives, directly determine the attitude to safety within an organization.
:• Leadership is critical to a process safety culture. The decisions and statements made by leaders, the incentive structures that they implement, the way they interact with people throughout the organization, and the actions they take to balance safety against commercial imperatives, directly determine the attitude to safety within an organization.
• More attention needs to be given to other industries (like aviation, nuclear, and chemical processing) and how their solutions for limiting human factors risk can be adapted for the E&P industry.
:• More attention needs to be given to other industries (like aviation, nuclear, and chemical processing) and how their solutions for limiting human factors risk can be adapted for the E&P industry.
• The common regulatory approach of rules and audits for compliance provides no incentives for organizations to go beyond minimal compliance. Regulatory approaches should encourage organizations to continually assess safety performance and to be chronically dissatisfied.
:• The common regulatory approach of rules and audits for compliance provides no incentives for organizations to go beyond minimal compliance. Regulatory approaches should encourage organizations to continually assess safety performance and to be chronically dissatisfied.
• The extensive use of contractor services and partnerships adds a critical industry-wide component to addressing process safety in the E&P industry. This creates a need for a common definition of competency requirements, particularly in nontechnical skills, and a common terminology in operational integrity/process safety.
:• The extensive use of contractor services and partnerships adds a critical industry-wide component to addressing process safety in the E&P industry. This creates a need for a common definition of competency requirements, particularly in nontechnical skills, and a common terminology in operational integrity/process safety.
• Operational Control of Work offers a framework for formalizing workflows, communication protocols, decision-making rights, competencies and training programs that can address challenges inherent in remote, distributed teams.
:• Operational Control of Work offers a framework for formalizing workflows, communication protocols, decision-making rights, competencies and training programs that can address challenges inherent in remote, distributed teams.
• The extensive research into the psychology of how irrationality and cognitive bias lead to poor risk assessment and decision-making, and the practical solutions to counter these biases, should be used to improve training of people involved in safety-critical operations in the E&P industry.
:• The extensive research into the psychology of how irrationality and cognitive bias lead to poor risk assessment and decision-making, and the practical solutions to counter these biases, should be used to improve training of people involved in safety-critical operations in the E&P industry.
• Integrating human factors into IT development is critical. Significant potential exists for human-factors-optimized IT systems to make a larger contribution to eliminating or containing the chains of human errors that are usually behind major process control events.
:• Integrating human factors into IT development is critical. Significant potential exists for human-factors-optimized IT systems to make a larger contribution to eliminating or containing the chains of human errors that are usually behind major process control events.


===Recommendations to SPE===
==Recommendations to SPE==


Summit participants identified the following actions SPE could take to move the topics, conclusions, and recommendations from the summit forward in the E&P industry:
Summit participants identified the following actions SPE could take to move the topics, conclusions, and recommendations from the summit forward in the E&P industry:

Revision as of 15:24, 2 October 2014

In July 2012, SPE held a two-day summit on human factors to create a common understanding of the strategic challenges for the oil and gas E&P industry, to identify what is known and unknown in the field, and to explore possible actions to accomplish the needed change indicated by the U.S. National Commission on the Deepwater Horizon Oil Spill and Offshore Drilling report. Attendees created a technical report based on the discussions and conclusions at the summit as a guideline on the human factors risks in E&P operations and what can be done to reduce those risks and increase safety.

Members of the summit decided that the industry must move to an organizational culture in which process safety is as well managed as personal safety. In civil aviation, a series of major accidents led to the introduction, mandatory requirement, and acceptance of human factors methodologies. Similarly, the nuclear power industry identified and acted upon the concept of its safety culture after a small number of major incidents. The E&P industry must try to achieve a similar breakthrough by confronting the human factor as an issue in process safety both onshore and offshore.

Process and Scope

In preparation for the summit, the steering committee developed the following list of six topics to act as a springboard for discussion:

1. Defining the Scope of Human Factors: What are “human factors” in the context of Process Safety? Summit participants identified 10 risk areas that need to be addressed. Three of these were considered priorities that underpin the others. Three others were considered “low-hanging fruit” that would be relatively, easier to develop.
2. Safety Culture: The safety culture of organizations is often proposed as the problem and development of a culture of process safety as the solution. But these concepts need to be made accessible to the wider industry. Despite the many advantages a safety culture brings, it cannot easily be regulated; organizations have to do it themselves if they want the benefits.
3. Training and Certification: Solutions proposed often involve more training and rigorous certification. Both technical and nontechnical skills are important requirements for safe operations. The industry can look to other sectors, such as aviation, nuclear power, and defense for good examples of skills required.
4. Operational Control of Work: A new approach to management may bring in many of the human factors requirements. Operational Control of Work is an idea that goes beyond management of change (MOC) to capture the strategic and tactical deviations that, by small-scale alterations, have been found to underlie many incidents.
5. Decision-Making: Decision-making and the assessment and communication of risk lie at the core of safety management. There is a wide body of established knowledge that is highly relevant but little known in the oil and gas sector.
6. Information Technology (IT): IT faces many challenges regarding what information to present to individuals and teams. Moreover, it is often unclear in its support, appearing to be confrontational or confusing.

Human Factors Risks in the E&P Industry

In the context of process safety, the term “human factors” refers broadly to factors that can lead to the loss of standards of consistently reliable human performance that are part of an organization’s defenses against process safety incidents. The summit identified 10 human factors risks that need to be addressed in oil and gas E&P operations:

1. Leadership and Culture
2. Perception of Risk and Decision-Making
3. Communication of Risk
4. Human Factors in Design
5. Individual and Team Capacity
6. Collaborative and Distributed Team Working
7. Commercial and Contractual Environment
8. Workload Transition
9. Assurance of Safety-Critical Human Activities
10. Investigation and Learning from Incidents

While these risk areas are not independent, they are presented separately here to emphasize their individual significance and because there are differences in the actions that need to be taken and among the stakeholders that need to be engaged in addressing each one.

This list recognizes that the factors that can interfere with consistently reliable human performance under real-time operational pressures beyond the immediate operational situation including:

1. The attitudes, competencies, skills, and behaviors of front-line operators, their immediate supervisors, and management who are engaged in activities with direct and immediate potential for major accidents
2. The degree and quality of “back-office” support, including the organizational structures and commercial relationships that shape and provide technical services to front-line operational teams in their real-time decisions and actions
3. The design, maintenance, and support of the equipment and technologies (both hardware and software) used by those performing safety-critical activities
4. The commercial, organizational, and operational processes, decisions, and arrangements that may date months or years before operations began but still have a direct bearing on front-line operations

Summit participants, however, identified three issues as those organizations could feasibly prioritize immediately:

• Leadership and Culture
• Perception of Risk and Decision-Making
• Individual and Team Capacity

These three issues underpin the others in that without an effective base in these, progress on the others is unlikely to be achieved. They are discussed in more detail in Sections 3, 4, and 5.

Leadership and Culture

Creating and maintaining a safety culture that includes shared values, attitudes, beliefs, and expectations that emphasize the critical importance of safety across an organization is dependent on leadership. The decisions, actions, and statements made by leaders, the reward and incentive structures that leaders implement, the way leaders behave and interact with people throughout the organization, and the decisions and actions they take to balance safety against commercial imperatives directly determine the attitude to safety within an organization. Operators and regulators who adopt an attitude that compliance to regulations and procedures will automatically lead to safety and ignore the key role played by leadership in setting and reinforcing norms and motivations are unlikely to create a culture that provides the necessary foundation for strong process safety assurance.

Perception of Risk and Decision-Making

Awareness and assessment of risk (and decisions made based on those assessments) occur at all levels of an organization. They are made in private, removed from the consequence of the assessments and decisions, with no direct exposure to hazards or risk, and by operational staff with direct exposure to hazards. Such assessments are almost always made in the presence of uncertainty. The Key Performance Indicators (KPIs) that senior managers select are indicators of how they perceive the risks and demonstrate their commitment to managing them. Much is known from scientific research about the psychology of how irrationality and cognitive biases lead to poor risk assessment and decision-making. Practical and simple solutions can be created to counter these biases, with significant improvements in decision-making. This knowledge, while widely available, is not generally being applied within the oil and gas industry.

Communication of Risk

Assessment of risk and decisions about the prioritization of risk are made throughout oil and gas operations and across companies. When senior officials make assessments, they set expectations about the risks involved in making operational decisions. Such assessments influence the way individuals perceive the risk associated with their work. Emphasizing Lost Time Injuries (LTIs) over major accident hazard controls leads organizations towards prioritizing occupational risks over major process disaster risks.

Particularly critical is sensitivity to “weak signals” that risks have increased. Everyone involved in safety-critical operations needs to be sensitive to such weak signals and report the change in risk profile to their immediate leaders. Effective communication of risk, and continuous re-appraisal and shared awareness of risk throughout an organization, can be achieved by developing a culture of “chronic unease” that encourages a high awareness and sensitivity to risk and minimizes the potential for complacency.

Human Factors in Design

Often, incident investigations show that problems with the design or application of the interface between people and technology causes a loss of reliable human performance, an issue which is sometimes called “design-induced human error.” Systems that recognize human error and can stop it before it causes serious consequences must be designed.

The oil and gas industry can learn much from aviation, nuclear power, and defense when it comes to improving human factor engineering. But the oil and gas industry faces specific challenges that can make it difficult to apply the same design processes and standards that have worked in those industries. Specific standards and processes are being developed to fit the needs of the oil and gas industry.

Individual and Team Capacity

Individual and team capacity means ensuring that people expected to perform safety-critical activities are capable of doing so. The foundation of process safety is the availability, capability, capacity, and attitude of individuals and teams to do what is expected. Team members need to possess the technical and interpersonal skills that allow teams to work together effectively in the interests of safety. They also need to have the resources, means, and authority to communicate in a timely manner as needed.

Team leaders need to have the interpersonal skills to effectively draw on the knowledge and experience of everyone on the team who may contribute to safe operations, without allowing differences in personality or authority to inhibit communication or prevent sharing of critical information.

Collaborative and Distributed Team Working

Oil and gas operations rely on communication and collaboration between different groups of people, often located in different locations and working on different scales in terms of the time between their input and the potential for an incident. Assurance of human performance on safety-critical activities, particularly in real-time operations, depends on highly effective, often real-time, collaboration and communication across these distributed teams.

Control of the risk to human performance begins with each team’s awareness of the contribution the team makes to front-line operational safety. Team members need to know what is required of them and the risk and potential consequences if they do not provide the support required. Intentional effort and established mechanisms (technological, organizational, procedural, legal, and commercial) is required to support and encourage effective distributed team operations.

Commercial and Contractual Environment

Oil and gas operations are carried out in a complex commercial and contractual environment. Ventures can involve many partners, all with different priorities, cultures, ways of working, and legal responsibilities. These factors can lead to inconsistencies and conflicts in risk assessment and decision-making, breakdowns in communication of safety-related information, and increased risks to the ability of people to perform safety-critical activities effectively.

Adequate control of these issues requires each stakeholder to be aware of the contribution he/she makes to ensuring safety-critical human performance and to commit to support of activities designed to reduce risk. It also requires a clear focus and line of sight by the operating partner on assurance of safety-critical human activities.

Workload Transition

“Workload transition” refers to situations when people are expected to transition quickly from “normal” operations (typically stable situations with a relatively low workload) to “abnormal” or emergency situations, with extremely high workload and significant challenges, particularly mental ones. Proper planning and preparation needs to recognize the critical role that human factors can play in ensuring successful transition into these emergency response situations.

Assurance of Safety-Critical Human Activities

The use of automation in oil and gas operations has increased dramatically over recent decades. However, the global industry still depends on people at all levels of operations to perform activities that are fundamental and critical to safe and environmentally sustainable operations and will continue to do so for the foreseeable future. Reliance on human behavior and performance can be either direct (such as performing a valve line-up correctly, responding to alarms, or detecting and diagnosing causes of abnormality) or indirect (such as inspection or maintenance of safety-critical elements).

The term “Workload Transition” to refer to this issue is borrowed from a project carried out by the US National Research Council on behalf of the US Army and published by the National Academy Press in 1993 as “Workload Transition: Implications for Individual and Team performance”.

Investigating and Learning from Incidents

Researchers, human factors professionals, and others with a professional interest in human performance and major incidents across many sectors believe that real learning from incidents is hindered by a tendency to “blame the human,” or to treat “human error” as an acceptable explanation for an incident. Despite the best efforts of many companies, investigation tools and techniques to identify underlying human and organizational causes, and routine investigation of incidents to understand why human performance fails, going “beyond human error” is still relatively uncommon in the oil and gas industry. The key is to pursue a deeper understanding of why “human error” occurs, especially the organizational/cultural factors that “set up” the human for failure.

Leadership and Culture

Recent analyses of major process accidents (including NASA’s Challenger, Columbia, and Hubble accidents; BP’s Texas City accident; and the banking crisis) have implicated the culture of those organizations. Looking further back reveals accidents in which high-hazard activities were allowed even though people knew they could have done better. Because nothing had gone wrong in the past, the high-hazard activities were accepted as the norm. In addition, many recent high-hazard well control events occurred with operating staff choosing to ignore, or accept as nonthreatening, danger signs they had been trained to observe. Such acceptance is essentially cultural.

The safety culture challenge is creating and maintaining an organizational culture that no longer allows things to happen when, in hindsight, it is clear that something should have been done. Establishing such a culture begins at the top of the organization, but the distance from executives at the top to the hazards is often great and involves multiple decisions by individuals at many levels. This distance also means that executives’ beliefs about the safety culture of their organization may not always correlate with what is happening on the ground.

Definition of Process Safety Culture

Safety culture has been defined in many ways, but the definitions are usually too abstract for the oilfield, which makes discussion difficult. Organizational culture can be defined either in abstract terms of values, beliefs and attitudes, or in practical terms (i.e. “how we do things around here”). Culture reflects attitudes in an organization that are cooperatively shared by all stakeholders, including workforce and management. When safety is a priority, the stakeholders believe that high levels of safety performance are feasible and desirable. A process safety culture requires more than attention to personal safety. It requires the existence of organizational behaviors, a level of continued awareness of the dangers associated with even simple activities, and the ability to assess alternatives in the face of conflicting goals and inadequate information.

The five-step Oil and Gas Producers Association (OGP) ladder (5) describes how a safety culture may range from Pathological – or hardly interested in safety at all – up to Proactive and Generative, where beliefs and behaviors support safety. People may want and support safety, but not believe that it is completely achievable in the face of production and profit pressures. More advanced cultures, such as the proactive and generative, are typically less vulnerable and more resilient.

Measurement of Safety Culture

Measurement tools for safety culture often focus on personal rather than process safety attributes. In personal safety, the dangers, causes, and prevention of accidents is fairly obvious. Properly conducted hazard analyses, measurement of change (MOC) procedures, etc. required by a safety case or a process safety management system can identify the dangers, causes, and possible prevention of accidents. Process safety is different, often hidden in the engineering and the initial design and acceptance decisions, removed from the site of a potential incident. A problem can exist in the interaction of personal and process safety, where specific behaviors or actions are required to prevent an incident or minimize the potential for the incident to become an accident.

Stopping work is relatively easy, and usually of limited consequence for production, when the problem is personal or occupational safety. Process safety stop-work issues, in contrast, may require expensive delays and interventions. There can be competing objectives when process problems are identified, often conflicting with major commercial and production goals. Advanced process safety cultures understand the possible conflicts, face them early on, and determine the decisions as much as possible in advance, rather than waiting for incidents to occur.

Evaluations that use an interview process often require time on location and may require interviews with staff at all levels of the organization to assess the safety culture.(7) The process is somewhat subjective and does not lend itself to a pass/fail analysis. What is important is identifying weaknesses or trends and reporting them to management for correction.

What people do after measurement is as critical as measurement itself. Actions involve discovering what needs to be done, implementing changes, and generalizing to generic training. These actions are some, but not all, the ways to demonstrate double-loop learning that goes further than discovering individual problems and fixing them in a single feedback loop to identifying systemic issues and acting on addressing them organization-wide.

Experience in Other High-Hazard Industries

Other industries, particularly commercial aviation, the nuclear industry, and mining, have developed strong process safety cultures. The nuclear industry, through the United Nations International Atomic Energy Agency (IAEA), set up activities to understand and ensure development of safety cultures after the Three Mile Island and the Chernobyl disaster. The mining industry had a summit meeting on safety in 2005 after a large number of accidents.

Aviation relies on a highly regulated international environment. For example, the International Civil Aviation Authority (ICAO), a UN organization, developed the ICAO Standards and Recommended Practices, which have the status of international treaties. Civil aviation has achieved success even though its Safety Management System (SMS) was only made mandatory for airlines in 2009. The culture of commercial aviation expects and invests in high levels of discipline, professionalism, training, and regulation. For example, failure to pass annual medical and technical tests results in grounding, regardless of the seniority of staff. To achieve the current level of safety performance, a special culture had to be developed that supported a challenge to authority and a deeply embedded personal interest in safety.

Assurance of Safety Culture Improvement in Organizations

Safety culture is a complex concept that is a process of continuous improvement that is evolutionary rather than once-and-for-all. Culture surveys form one tool for the assessment of the culture, but they cannot be relied on by themselves because the measurement depends on honest and truthful responses. Surveys are of most value when they are repeated and changes to cultural norms and expectations can be tracked over time. One major area for assessment is leadership behavior. Successful leadership behaviors regarding personal safety can be translated into equivalent behaviors for process safety. Leaders can be trained in what behaviors have the most impact on process safety. Before making visits and inspections, leaders can know what to look for, ask for, and how to understand the answers. While such approaches can never be technically fool proof, and leaders can be misled, the activity itself sends a clear message about what the leader prioritizes.

The Role of Regulation

Organizations are not always willing to take the necessary steps to improve their safety culture, but strong regulation can ensure that they take those steps. A common approach to regulation is to develop a list of prescriptive requirements, backed up by a regulatory audit or inspection with sanctions for noncompliance. The regulator must develop a comprehensive and credible list that covers the latest technologies and insights. But this approach provides no incentives for organizations to go beyond minimal compliance. It encourages a type of “compliance mentality” where management’s attitude can become, “If I am in compliance with the regulations, then I must be safe,” rather than the continual introspection on safety and dissatisfaction with performance required by a “Generative” safety culture.

An alternative method of regulation by goal-setting relies on organizations to identify and set their requirements. Organizations that develop performance goals are more likely to “buy into” and practice the behaviors and be the most informed on how to apply them in specific instances. A regulator that sets goals and audits the organization’s processes and compliance with its self-set goals can better cooperate with the organization to identify weaknesses and encourage improvements. This is especially true if the regulator concentrates on continuous improvement and coaching to influence behaviors rather than relying on legal sanctions alone.

Both approaches require the regulator to apply significant sanctions in cases of noncompliance to requirements or failure to meet goals. Behind failures of either of these may be a complacent organizational culture. By ensuring an adequate and jointly agreed definition of what a safety culture looks like for both process and personal safety, regulators can support organizations taking active steps to improve their safety culture.

Perception of Risk and Decision-Making

Workers make decisions all the time, ranging from senior executives making strategic choices to front-line personnel assessing the situation with the associated risks and making split second decisions on how to go about a task. Both types of decisions can be safety-critical. Most of the time people get it right, but sometimes decisions have regrettable consequences. This has to do with cognitive limits and biases in human decision-making, physiological factors that affect an individual’s ability to make decisions (e.g. drugs, alcohol, illness, injury, fatigue, etc.), and the organizational conditions under which decisions are made. Decisions must often be made under time pressure; with competing goals; and with inadequate, insufficient, or uncertain information or consequences.

Considerable scientific literature is available on why experienced, trained, and skilled people make decisions that, in hindsight, were poor. Some of this knowledge has been applied in the oil and gas industry to train people to make better decisions under challenging circumstances. However, implementation is inconsistent, and most people in the industry lack awareness of the realities and limitations of human cognition and the “tricks” the brain uses to function in the modern world. Few people in the industry have practiced decision-making in a fail-safe environment.

Decision-Making Process

Decision-making involves the entire process, from awareness of a situation, predicting what might happen, planning possible courses of action, and choosing what to do. This process is sometimes conscious and deliberate (for example, when planning a well). Rational decision-making models apply to these situations. Such models assume people systematically compare options and make rational, optimized decisions when there is sufficient time and information. Most of the time, however, decisions are made subconsciously, almost automatically; such as when driving a car or interpreting a display or chart. People then use a strategy of choosing something good enough for the moment and adapting the course of action if necessary. While this strategy is sufficient in most ordinary situations, it can be problematic in safety-critical situations.

Cognitive Bias in Decision-Making

Research has also shown that rational/deliberate decision-making is often affected by many types of subconscious cognitive bias. (9) An example of a cognitive bias is the confirmation bias: We perceive new information in light of what we already know and expect about the situation. From an evolutionary perspective, this makes processing information quicker, but in safety-critical situations it can lead to overlooking or reinterpreting information that does not fit what the individual believes is the situation into information that the individual believes makes better sense.

Perception of Risk

How people perceive risk is intimately connected with how people make decisions. People systematically misunderstand probabilities, influenced by the level of control they feel they can exercise. This is particularly common in hazardous situations that are very familiar, causing people to feel in control and experience them as less dangerous than they are. The information that individuals seek out, from executives to the front line, shapes their understanding of what is critical and what controls are important. KPIs that focus on high-frequency personal outcomes, such as LTIs and reactive controls, can create a different understanding from proactive controls on process hazards. Even the way identical information is presented influences perception of risk: “Risk framing” describes a cognitive bias where, for example, people see a 90% chance of success as less risky than the same operation described as having a 10% chance of failure.

There are many examples of cognitive bias interfering with accurate and rational assessment of risk. Alarmingly, research has shown that most of these biases favor “hawks” (a tendency to accept higher risk) over “doves” (a tendency towards risk-aversion). This is recognized as “risky shift” and was first described by Kogan and Wallach (1967).

Group Decision-Making Factors

Groups can also affect decision-making processes. Most significant operational decisions involve groups working to an agreed position. Involving other people can be a great asset, as it brings more experience and diverse perspectives to the table. But group decision-making also presents challenges: it is slower than one individual decision-making, requires energy and resources, and leaves the ultimate responsibility unclear.

Evidence also suggests that individuals will go along with group decisions because they want to be accepted. Social pressure can lead to riskier decisions than each individual would have made alone. Those who are more vocal or have more status can have a disproportionate influence on the decision, causing those with more technical expertise to feel less confident about their judgments or prevent them from being heard.

These influences can be counteracted by using groups as an instrument to critically review a decision. In that way, groups can compensate for the limitations of individual decision-making if trained to question each other in a supportive environment.

Situations and Decision-Making

The situations people find themselves in can also influence the quality of their decision-making. Time pressure, poor information presentation, ambiguity of information and conflicting goals can lead to poor decisions. In dynamic, safety-critical situations, rapid decisions may be required. Tightly coupled, complex processes may leave little or no time to explore alternatives. Also many real-world processes are nonlinear, information is uncertain, and feedback about the correctness of a decision may come too late to correct. These considerations can apply equally to organizations, leading to a loss of “organizational situation awareness,” especially with small, slow organizational changes, and mission creep. Safety-critical decisions may be especially subject to premature closure under time pressure or the perceived need to make a decision. All individuals, but especially leaders, need to be aware of factors that subtly increase the chances of making and accepting decisions that are increasingly risky.

Challenges for the Industry

The following are the challenges for the E&P industry:

• Recognize the nature and limitations of human decision-making as it affects oil and gas operations, and the impact that cognitive bias can have on assessment of risk and decision-making in both real-time and in back-office activities.
• Gain more familiarity with existing knowledge on decision-making and risk awareness.
• Identify and implement training protocols, methods, and review procedures that reduce the adverse effect of cognitive biases.
• Review the effectiveness of initiatives in reducing errors in safety-critical decisions.
• Reflect the importance of decision-making skills in the industry’s recruitment and performance development processes.

Possible Solutions

Developing analytical and non-analytical reasoning skills has been shown to improve the quality of decision-making, as has the use of experiential training methods. In other high-risk industries, and in a few areas of the oil and gas industry, scenario-based training has been successful, conducted either in simulators or as table-top exercises. An experienced facilitator pushes a team of people to their limits in a challenging scenario and guides their subsequent reflection and analysis to capture learning. Repeated practice is particularly important to build the team’s repertoire of behavior that can then be used under high-stress conditions.

To combat the biases mentioned above, organizations can develop decision reviewing procedures to support critical analysis and to actively challenge decisions. While cognitive biases will not disappear, team processes can help to compensate for what individuals may overlook. For example, team members can take turns in playing the role of “devil’s advocate,” and the leader can make a habit of asking for deviating opinions or constructive challenge. At the planning stage, more time can be invested in anticipating and assessing possible consequences and alternative courses of action. Also for these organizational processes, simulator training could be developed. In time-critical situations, simple tools are needed to support decision-making. Supervisors could encourage before-and-after action reviews as part of their daily routine.

Assurance

Assurance methods need to address decision-making at three levels:

1. The individual level of those working in safety-critical situations.
2. The procedures for reviewing decision-making and decision support initiatives at the planning stage.
3. The strategic decisions about the design, operation and effectiveness of the entire safety management system.

Possible assurance methods include documentation, procedures, MOC, and internal audits. It is important that lessons learned relate to the decision-making process rather than only the outcome of the decision. The “health status” can be assessed through regular meetings, facilitated focus groups, perception surveys and management reviews with corrective actions. Safety management systems and their assurance measures need to be tailored to the maturity of the organization.

Individual and Team Capacity

Most major accidents are avoidable. Proper system design and/or timely and appropriate human action can usually be shown to have been able to prevent almost all unsafe outcomes. From that perspective, it is attractive to take the attitude that “if we just had people with the right competency then everything would be okay.”

The reality is that training and competency alone will not assure operational integrity. Training, certification and licensing are necessary but not sufficient. Adherence to the principles of safe design and appropriate safety management systems are critical to the prevention of major accidents. Training, and more importantly, competency development in the larger sense, certainly plays an important part. Operational integrity is always affected by the knowledge, skill and behaviors of those who are relied on to operate, maintain and support critical systems.

What role should training, certification and licensing play in ensuring operational safety, and how can it support an integrated approach to delivering operational integrity? To answer this question, the industry needs to agree on (1) what it knows about the role training, certification, and licensing play in operational integrity, and (2) the questions the industry will need to answer to properly address the issue.

The Role of Training, Certification and Licensing

The SME’s at the summit agreed upon the following list of what is known by the industry about the role of training, certification and licensing:

1) Developing proper technical and nontechnical competencies is a critical part of assuring operational safety. Both are necessary, but neither alone is sufficient.
2) Generally, there is a common understanding of the technical competencies required for key job roles in our industry. Detailed definitions of technical competencies exist in job roles in some organizations. However, specific, documented, industry-wide definitions of technical competencies do not exist.
3) The definition and development of technical competencies will need to be continually reviewed and updated due to increasing complexity of operations, technological advancements, and the demographic situation facing the industry.
4) The industry has significant opportunities to improve operational integrity through improvements in nontechnical skills and behaviors.
5) No common industry agreement on the nontechnical skills needed for specific jobs exists. Nontechnical training needs to improve, particularly for handling uncertainty and abnormal events. Current training often neglects to emphasize the limits of expert judgment and intuition, and the behaviors most appropriate for preventing and responding to emergency situations.
6) Different selection processes, wide variation of personnel and roles, the dynamic nature of many petroleum processes, and complex contractual relationships within a team mean that the many beneficial nontechnical programs that exist in other industries will require significant customization for the oil and gas industry. However, a core syllabus could define the requirements for basic nontechnical skills needed to work in most jobs in the E&P industry.
7) While some issues related to competency development can be addressed within the context of a single company, because of the extensive use of contractor services and partnerships, there is a critical industry-wide component to properly addressing this challenge.
8) The lack of a common terminology in the area of operational integrity/process safety hampers the industry’s ability to cooperate across companies or countries.

Open Questions Relating to Training and Competency

The following are questions around key themes that will require answers.

1. Common Standards:
• Should the industry agree to define measurable guidelines for common technical competencies? If so how?
• Should the industry agree to define measurable guidelines for common non-technical16 competencies? If so how?
• Should a common basic training syllabus be defined so that new hires with little to no experience will have a base education that is accepted and
understood by the employers in the E&P industry? If so, how?
• Should the industry agree to adhere to agreed common measurable guidelines? If so how?
2. Certification and/or Licensing:
• What is the role of industry vs. company-specific certification and/or licensing to verify/ensure necessary competencies?
• What is the best way to achieve cross-industry cooperation?
3. Sharing Best Practices
• How can best practices for training, development, and certification/licensing be most productively shared across the industry (between companies ::and across regions)?
• How can learnings from nontechnical training programs of leading safety performance E&P companies and other industries (aviation, nuclear, ::military, and marine) be most productively transferred to the petroleum industry?
• How can the industry most productively institute processes/practices to learn from incidents and continuously improve competency definitions and ::development?

Operational Control of Work

Upstream E&P worksites are often remote from the planning organization, so communication and control links are much weaker. Production operations and maintenance activities have inherent risks in the possible failure of containment barriers. Barriers containing hydrocarbons and other hazards can weaken by tolerating small internal or external changes over time or by worsening design assumptions about corrosion, unexpected fatigue loading or stress. Risks are also inherent for non-routine procedures or well operations if there are uncertainties about the condition of the plant or the characteristics of the formations.

For many E&P process-safety-critical activities, essential engineering support may not be immediately available, which can create unique problems. There will be either a production delays while a support team assembles to address the issue, or a compromise to safety if the on-site team attempts to resolve the matter. This stands in stark contrast to many critical downstream activities, notably plant turn-around, that are planned to the finest detail in recognition that delays are costly and that unexpected events must be dealt with efficiently. In these cases, an engineering team is on site and dedicated to operation support.

The industry has little protocol for the workflows, communication protocols, decision-making rights, competencies, and training programs that guide people involved in remote activities. In most cases, practices evolved over time. They are seldom documented or part of formal training, but are passed down across successive generations of workers. Within a company, practices may vary significantly between worksites, even within the same region.

Operational Control of Work addresses these issues. At the organizational and human factors level, it sets out the workflows, communication protocols, decision-making rights, competencies, and training programs necessary for the safe and efficient execution of operations. At the technical level, it encompasses the way designs are translated into on-site executable instructions and how the status of the operation is monitored for deviations. It provides a standard framework within which staff can be educated, trained, and assessed. Operational Control of Work focuses on raising the awareness of human factors, developing the nontechnical skills needed for effective teamwork, detecting the weak signals of insidious change, and managing change effectively in response to unexpected events.

NASA and Integrated Operations

As an example of Operational Control of Work, the NASA experience is instructive. For 40 years, the cornerstone of the US space program was a highly disciplined organization that managed complex operations and dealt with unexpected events. Mission Control was underpinned by clear, documented “Mission Rules” that defined responsibilities and boundaries within which individuals could take action up to the ultimate authority: “The Flight Director, after analysis of the flight condition, may choose to take any necessary real-time action required to ensure the safety of the shuttle and crew.”

NASA is distinct because of the amount of time spent training flight crews and Mission Control personnel. This example should challenge the industry as to whether its Operational Control of Work practices are adequate for the complexity and intensity of the operations that are being undertaken by an increasingly inexperienced workforce, often with increasing degrees of remote control.

Management of Change

At first sight, Operational Control of Work may be viewed as merely disciplined Management of Change. As a concept, however, Operational Control of Work goes beyond Management of Change in the context of projects and engineering. It includes planning for operations in explicitly dynamic environments and being organized and capable of dealing with unexpected events, especially when the rate of change is slow. A major risk that Operational Control of Work can address is the problem of multiple, incompatible goals. Once a plan has been agreed upon, it has to be implemented in an environment where priorities may change. Recognizing that a change is sufficiently large to be treated formally as a significant change is a challenge. The challenge is compounded when several small changes collectively make up a large change, but one that is only recognized as such after the event.

In a dynamic environment, people are expected to adapt to circumstances. Problems occur when each adaptation moves imperceptibly closer to an unacceptable situation. Mission “creep” occurs when short-term gains, possibly subjected to a Management of Change process, move the process away from the original design goals. Each solution to a goal conflict may be safe and sensible alone, but unless managed, the mission may stray into unplanned territory, a process that may be too subtle for those involved to notice. Analyses of a number of major incidents in different high-hazard industries have been shown to result from such a “drift into danger.”

The major challenge in managing change is awareness of weak signals of insidious change and how to react to them. The monitoring aspect of Operational Control of Work is crucial to detecting subtle changes and weak signals. This must be combined with a formal escalation procedure to ensure that warnings of irregularities are dealt with effectively and rapidly.

The necessary skills, characterized by the notion of “chronic unease,” are acquired through training and experience and must be instilled at two levels:

• Proficiency in understanding and recognizing changes
• Ability of teams to deal with change

More advanced safety cultures are sensitive to small but important changes, flagged by weak signals, and attentive to the opinions of subject matter experts, no matter their rank. Such organizations are skilled at developing and implementing processes with consideration to a wider range of potential conditions and complications than other organizations. Generally, those closest to the action become biased in favor of achieving the goal and downplay risks. The closer to the workface, the more decision-making should be rule-based rather than risk-based.

As such, skilled Management of Change is an essential component of Operational Control of Work, but not sufficient in itself. While discrete changes can be captured by formal Management of Change processes, the concept of Operational Control of Work embraces wider issues such as “mission creep” at the strategic level. Rapid changes due to unexpected and potentially critical problems at the tactical level also occur, possibly when there is insufficient time or resources available to take a considered Management of Change approach.

Assurance of Operational Control of Work Capability

An assurance framework is an essential component to demonstrate that the system is effective. In addition to formal audits and health checks to ensure that the system is being used correctly, performance measurement is an essential aspect to ensure that Operational Control of Work delivers the desired outcomes. Appropriate Operational Control of Work KPIs must be selected carefully to ensure that the right behaviors are promoted. The KPIs should be appropriate to the E&P industry and be tailored to reflect the diversity of activity from seismic field work, drilling, and well operations through to production operations and facilities maintenance. Duplication and re-invention should be avoided. Effective deployment of nontechnical skills (leadership, communication, decision-making, teamwork, situation awareness, and stress management) is essential to proper functioning of high-reliability organizations. These aspects must play an integral part in selection, training, and assessment of those involved in Operational Control of Work.

The Way Ahead for Operational Control of Work

Everyone in the industry must understand:

1) In safety-critical activity, a breach or failure of a barrier almost immediately exposes the underlying hazard situation.
2) Whether a mission involves potentially catastrophic safety-critical activities
3) The execution plan, decision rules, and decision-making window for such activities

Critical Need for Improvement

Integrating human factors into IT development is critical because of the volume of technology and systems in the operational environment that place demands on people’s cognitive abilities. Summit participants thought that, when a process control event with major adverse outcomes occurs, the cause is usually a chain of human errors rather than a massive engineering failure. Any contribution that human-factors-optimized IT systems can make to eliminate or contain such chains of human errors can help change E&P process safety. The summit revealed a notable lack of significant investment in research into the complex human/machine interfaces in the E&P industry. Many questions posed were answered with, “It would be great if someone would look into that.” The risk exposure in the drilling environment, in particular, is extreme. The end goal is clear: IT systems must include the ability to recognize and support the peculiar strengths and weaknesses of humans for the two to perform effectively together, no matter if it is through enforcement or re-enforcement of human actions. In an emergency situation, such an advance in IT systems may well contribute critically to the preservation of life.

Aligning Technology with Human Nature

Summit participants identified the following areas for improvement in IT design and development:

1. Make a step-change improvement in how IT systems are developed:
• Implement an integrated, multidisciplinary development process involving human factors as an integral part of the initial design to make IT systems more human-error-resilient.
• Take quality assurance and MOC processes in IT systems development to the next level.
2. Use a mental models approach to IT systems design:
• Design IT systems to reflect the optimal mental model that is taught, not training built around the systems.
• Align IT systems to support CRM (a successful approach from aviation) or other such risk-based mental models to strengthen and solidify training, ::skills, and competency development.
3. Design intelligent IT systems that expand the cognitive capacities of the operational environment under critical conditions:
• Address the complexity of current E&P operational environments that require people to cope with a highly complex technology environment even under critical, time-pressured conditions. (Research in other fields, such as aviation and the chemical process industry, has demonstrated that such expectations set people up for failure, with potentially disastrous consequences.)
• Provide intelligent supporting systems that can reason with lots of data. To address drilling operations, existing technologies need to be adapted:
o Uncertainty in drilling is often high. User interface design needs to indicate when data are significantly unreliable.
o Operational people should be able to press an “I disagree” button on an IT system and receive rationale for its conclusions, ideally expressed in natural language. Intelligent IT systems can thus become training tools that are improved through human feedback.
o Pull in a lot more risk-critical data from design tools into the operational (intelligent) environment.
o Intelligent systems that reason with a multitude of data can easily convert it to information and track low-probability, high-consequence failure :::modes. This is an area in which IT systems excel, even if such failure modes consist of complex interactions unfolding over longer time periods. For :::such problems, the failure rate of the human working memory is high.

Another approach, adopted in the nuclear industry, is extensive safety automation systems. Unsafe levels trigger safety systems that automatically contain situations without human intervention. Such systems have clear benefits but can have high costs when an automatic shutdown is unnecessarily triggered, particularly in drilling. Drilling IT systems require more sophisticated intelligence because drilling operations can be highly dynamic. The qualitative differences between phases of drilling operations can be extreme compared to, for instance, those in a refinery.

Conclusions

• Leadership is critical to a process safety culture. The decisions and statements made by leaders, the incentive structures that they implement, the way they interact with people throughout the organization, and the actions they take to balance safety against commercial imperatives, directly determine the attitude to safety within an organization.
• More attention needs to be given to other industries (like aviation, nuclear, and chemical processing) and how their solutions for limiting human factors risk can be adapted for the E&P industry.
• The common regulatory approach of rules and audits for compliance provides no incentives for organizations to go beyond minimal compliance. Regulatory approaches should encourage organizations to continually assess safety performance and to be chronically dissatisfied.
• The extensive use of contractor services and partnerships adds a critical industry-wide component to addressing process safety in the E&P industry. This creates a need for a common definition of competency requirements, particularly in nontechnical skills, and a common terminology in operational integrity/process safety.
• Operational Control of Work offers a framework for formalizing workflows, communication protocols, decision-making rights, competencies and training programs that can address challenges inherent in remote, distributed teams.
• The extensive research into the psychology of how irrationality and cognitive bias lead to poor risk assessment and decision-making, and the practical solutions to counter these biases, should be used to improve training of people involved in safety-critical operations in the E&P industry.
• Integrating human factors into IT development is critical. Significant potential exists for human-factors-optimized IT systems to make a larger contribution to eliminating or containing the chains of human errors that are usually behind major process control events.

Recommendations to SPE

Summit participants identified the following actions SPE could take to move the topics, conclusions, and recommendations from the summit forward in the E&P industry:

1. Form a Technical Section on human factors to bring together specialists and interested parties to create programs, workshops, and conferences on :issues identified during the summit that need more discussion or industry education. Provide staff resources to help the group accomplish these tasks. :(Note: SPE formed the Human Factors Technical Section in August 2012. Any SPE member can join at http://www.spe.org/network/technicalsections.php.) (Reference)
2. Establish a discussion list server to extend debate on questions raised, to develop answers and to share best practices. (Note: The SPE Human :Factors Technical Section site includes a discussion board the alerts members by email when new postings are made.)
3. Provide information on Operational Control of Work in HSE publications, workshops, and conferences to drive evolution and acceptance of the :concept. Use these forums to build consensus on the definition of Operational Control of Work, the protocols and workflows, the choice of performance :metrics to drive the required behaviors, the taxonomy of nontechnical skills, and training required to underpin the discipline.
4. Provide information and benchmarking tools to address decision-making issues identified by the summit:
• Develop SPE scenario-based training to address cognitive bias for the oil and gas industry and provide it globally.
• Develop methods to share best practices and examples of the incorporation of critical peer review of decisions into procedures.
• Conduct benchmarking studies on assurance methods for decision-making processes and provide results to the industry.
• Develop an externally verified benchmarking questionnaire/self-assessment tool, including a few questions on implementation of decision-making assurance.
• Create a website on decision-making as a source for information.
o Have the Human Factors Technical Section write introductory text on decision-making and risk-taking behavior in the E&P industry. Provide explanatory text on the relevance of decision-making and the value for business (based on the Center for Chemical Process Safety (CCPS) business case for process safety)
o Provide models, case studies, and visual information (possibly as downloadable presentations). Establish a repository of case studies that demonstrate the need for operational excellence as a result of better decision-making processes.

References

Use this section for citation of items referenced in the text to show your sources. [The sources should be available to the reader, i.e., not an internal company document.]

Noteworthy papers in OnePetro

Committee, T. R. 2014. The Human Factor: Process Safety and Culture. Society of Petroleum Engineers. OnePetro

Online multimedia

Skompski, Ed. 2013. The Impact of Administrative Controls and Management Enforcement on Human Performance. http://eo2.commpartners.com/users/spe/session.php?id=10380

Thorogood, John, and Patrick Hudson. 2011. Accidents, Incidents and the Human Factor/Decision-Making in the Oilfield. http://eo2.commpartners.com/users/spe/session.php?id=7098

External links

Use this section to provide links to relevant material on websites other than PetroWiki and OnePetro

See also

Use this section for links to related pages within PetroWiki, including a link to the original PEH text where appropriate