Sei sulla pagina 1di 4

SPE 86595

Integrating Organisational Safety and Human Factors


Patrick Hudson, SPE, Leiden University, Gerard van der Graaf & Robin Bryden Shell Exploration and Production

Copyright 2004, Society of Petroleum Engineers Inc.


taken more than one at a time, of failures to run the business
This paper was prepared for presentation at The Seventh SPE International Conference on well.
Health, Safety, and Environment in Oil and Gas Exploration and Production held in Calgary,
Alberta, Canada, 29–31 March 2004. As will be described below this work led to the
This paper was selected for presentation by an SPE Program Committee following review of
development of a model for organisational accidents, known
information contained in a proposal submitted by the author(s). Contents of the paper, as as either Tripod or the Swiss Cheese model, and the
presented, have not been reviewed by the Society of Petroleum Engineers and are subject to
correction by the author(s). The material, as presented, does not necessarily reflect any posi- development of tools for accident analysis and prevention
tion of the Society of Petroleum Engineers, its officers, or members. Papers presented at SPE
meetings are subject to publication review by Editorial Committees of the Society of Petroleum
based on that model. The model has subsequently become a
Engineers. Electronic reproduction, distribution, or storage of any part of this paper for com- world standard in a wide variety of industries. The
mercial purposes without the written consent of the Society of Petroleum Engineers is prohib-
ited. Permission to reproduce in print is restricted to a proposal of not more than 300 words; organisational model was aimed specifically at systemic
illustrations may not be copied. The proposal must contain conspicuous acknowledgment of factors and was deliberately intended to divert attention away
where and by whom the paper was presented. Write Librarian, SPE, P.O. Box 833836,
Richardson, TX 75083-3836, U.S.A., fax 01-972-952-9435. from individuals.
More recently attention has returned to individual human
Abstract factors with a research program aimed at discovering how to
Since 1985 psychologists have been working to understand get people to be intrinsically motivated for good HSE
and manage the human factor in Health, Safety and behaviours. This was translated within Shell Exploration and
Environment in Oil and Gas Exploration and Production. This Production into the development of a culture of HSE and, as
work has led to the development of a model for organisational the Hearts and Minds program. Although the Hearts and
accidents, known as either Tripod or the Swiss Cheese model, Minds program was a natural follow on from the original
and the development of tools for accident analysis and Tripod work, it has become clear that the existence of two
prevention based on that model that has subsequently become apparently different programs concentrating upon behavioural
a world standard in a wide variety of industries. The factors has led to confusion in the field. People appear to
organisational model was aimed specifically at systemic assume that Hearts and Minds is a replacement for Tripod,
factors and was intended to divert attention away from when in fact it forms an extension and improvement, covering
individuals. More recently attention has returned to individual factors left aside in the initial work. This paper represents an
human factors with a research program aimed at discovering attempt to resolve this confusion and explain how the two
how to get people to be intrinsically motivated for good HSE programs are related to one another.
behaviours. This was translated into the development of a
culture of HSE and, as the Hearts and Minds program, is also Why do accidents happen?
supported by a variety of tools. The classical view of how an accident happens is still that one
Because the two approaches, organisational and individual, or more individuals do, or fail to do, something that is the
appear very different, this can lead to confusion and the belief direct cause of the accident. A train driver goes through a red
that one set of tools replaces the other. This paper sets out the light; a car driver loses control of the wheel or fails to see a
wider underlying theory and show how the two models are child on a crossing; an electrician works on a piece of
part of a larger approach to understanding the human factor equipment that, despite clear instructions to the contrary, is
and how it can be managed in hazardous industries. electrically live with voltage; a professional pilot lands on a
taxiway rather than the runway next to it. In all these cases it
Introduction appears quite clear who is to blame, the individuals who were
Since 1985 psychologists have been working to understand negligent or who at least failed to exercise their appropriate
and help manage the human factor in Health, Safety and and required duty of care.
Environment in Oil and Gas Exploration and Production. The In this interpretation of why accidents happen, it is
original studies examined the structure of fatal accidents and always clear to those who observe and comment that the
found that, while more complicated because of the effort individual concerned, frequently the victim, possesses clear
devoted to uncovering causes, there were no extra-ordinary failings and, as such, may be regarded as having brought the
reasons that differentiated fatal accidents from any others. In consequences upon themselves. In this view bad outcomes
fact the insight gained was that the causes all appeared to be happen to ‘bad’ people, who didn’t look out, were reckless or
extremely predictable and were primarily indicative, when careless etc. this is a classic example of the Fundamental
Attribution Error, a well-known and reliable situation found
by social psychologists. When people themselves are
2 SPE 86595

questioned as to why bad outcomes occurred, they attribute the The model distinguishes between underlying, systemic
causes to external factors rather than internal ones. problems, called latent conditions, such as failures in design,
procedures, organisational structures, and the active errors of
Figure 1. The Swiss Cheese model, including rteferences to its the individuals at the ‘sharp end’. The model has been
original version, as developed for Shell International Petroleum
portrayed as a series of slices of defence, or barriers with
Mij, as the ‘Pathogen Model’.
holes, hence the title the Swiss
Cheese model (See Fig. 1). Holes
Some holes due may appear, become larger or
to active failures smaller, depending on local
conditions. What the model
Hazards explains well is not how we have
accidents, but why we can have
so few even when so much seems
to be wrong and why the
combinations are so incredible. It
is necessary to have all the holes
to line up for the hazards to turn
Other holes due to into an actual accident.
Losses latent conditions The insight the Swiss Cheese
model brings to such incidents,
(resident ‘pathogens’) the reason why so many major
organisations have subscribed to
Successive layers of defences, barriers, & safeguards it, is the way it directs attention
to where the real problems are,
such as the initial design, rather
This interpretation may be called the individual as than continuing to accept that those forced to use bad designs
opposed to the systemic model of accident causation (Reason, may occasionally make minor slips and pay major
1997). The systemic model is based upon the insight that a consequences.
closer scrutiny of why the people acted, or failed to act, in the
way they did inevitably leads to the uncovering of more Local conditions
underlying causes that can be seen to have led to the This is not to say that individuals have no role to play in
behaviour. For instance, if people are not trained properly, causing accidents, but that those and many other individuals
inaccurate procedures or poor ergonomic design are accepted, together make up the system that, by failing, leads to an
or communication fails, then people at the end of the accident accident and, often, the loss of lives. Individuals are to be
chain become the recipients of those organisational failures. found at the end of the accident chain, but an understanding of
When such failures lie dormant in the organisation, we speak the reasons why accidents became more likely usually adds
of latent failures or conditions. A tool such as Tripod Delta perspective. Nevertheless there are a great many factors that
can serve to identify such failures proactively, accident lie under the control of the individual and only marginally
analysis techniques such as Tripod Beta allows their under the control of the organisation. If a driver wishes to
identification from the incident data. exceed the speed limit, there is little a manager can do to stop
him; if a worker sees a hazardous situation and fails to tell his
Figure 2. A variant of the original model. Here the different indi- supervisor, no amount of managerial commitment will remedy
vidual and systemic pathways to bad outcomes are more clearly the situation until an accident provides the information.
laid out (Reason, 1997).
An HSE Management
Defences System, if effective, can help
manage a considerable proportion of
HOW? the organisational issues that the
Losses systemic model describes. Such a
Hazards system, however, is too coarse
grained to trap and eradicate
individual actions. Attitudes do not
Latent Causes lend themselves easily to
condition Unsafe acts management and it appears that at
pathways Investigation this stage in the evolution of safety
in the oil and gas industry, attitudes
Local workplace factors lag behind the organised
WHY? management of the hazards
(Hudson, 2003). What is needed to
Organizational factors ensure that the individuals play their
part in ensuring their own and their
SPE 86595 3

colleagues’ safety is an advanced HSE culture. This is the goal environment impinges upon the individual within an
of the Hearts and Minds Program, to fill in the lacunae. organization. They may reflect the organisational HSE culture
and they may reflect the extent to which the organisation
HSE Culture provides the necessary systemic requirements for the exercise
An HSE Management System, no matter how well of good practice. Finally they are influenced by the immediate
implemented, can only provide a minimal guarantee of situations that people find themselves in. Figure 4 shows how
performance. It is necessary to have a culture within which the behaviour can be influenced by a wide variety of factors,
values of Health, Safety and the Environment are held high in including management and colleagues, but also a wide variety
order for that system to flourish, otherwise the implementation of personal influences as well as the immediate situation.
will remain at the level of the mechanical application. An We can distinguish three major components out of this
advanced HSE culture provides the environment in which an discussion:
HSE-MS can achieve its full effect. This will involve all in • Values
the organization delivering what they are capable of. • Beliefs
Managers and supervisors must create as safe a workplace as • Actions
they can, must train and equip the workforce to ensure that the
work is performed properly. But, this is a two-way street, and At the topmost level we have values, such as the HSE values
workers must also complete their part of the deal. They must we espouse, but there are other values as well, such as being
act safely, inform about hazardous conditions and apply profitable. These values are acquired primarily from society,
themselves. If they find this difficult, they may need to be family and friends and only marginally from the much later
helped. exposure to the particular values of an organisation. If our
values are in some way poor, it is unlikely that we will
normally behave in ways we call good practice. An
GENERATIVE individual whose values are not well aligned with those of
HSEis how we do business round
here
an organisation will, however, inevitably be discovered and
is rarely likely to last long. While values are often talked
about, they rarely form a real source of problems.
PROACTIVE
we work on the problems that we still The next level is that of belief, and it is here that many
find
Increasingly of the problems arise. Our attitudes are formed by the
informed combination of our values and beliefs and, if they are in
CALCULATIVE conflict, then we may have a problem. We may have good
we have systems in place to manage
all hazards values about HSE and about the necessity to make profits
and to produce, but these values are essentially unordered,
REACTIVE each one stands on its own and does not interfere with the
Safety is important, we do a lot every
time we have an accident others – People’s ability to hold conflicting values is
Increasing Trust remarkable but ever-present. What resolves and orders
Accepting Accountability these values is our beliefs, and it is here that most of the
PATHOLOGICAL
who cares as long as we
’re not caught attitudinal problems arise. If we hold safety and production
or profit both high, but simultaneously believe that safety
costs money, eroding profits, the safety may be given a
Figure 3. The HSE Culture maturity ladder. lower priority. If we believe that things won’t go wrong as
long as we are in control, a very common belief, then safety
The Hearts and Minds program is aimed at identifying and values can be put on the back burner while we achieve some
developing an advanced HSE culture. As part of the program a other goal that is driven by a different value. Therefore
number of tools have been developed to help individuals and holding exemplary values is not a guarantee that outcomes
teams to operate more effectively. These tools are intended to will always be perfect; beliefs can easily intervene to change
identify where systemic problems may still lie; for instance, priorities.
when rules are being broken, which procedures is it and are Finally circumstances may get in the way even if values
the problems due to the procedures or the people? and beliefs are well aligned. Our ability to act may be severely
The HSE maturity ladder (Fig. 3) has a mid-point, the curtailed by systemic and organisational problems. If
Calculative, at which systemic thinking dominates and the role equipment is impossible to work with, procedures are
of the individual is minimal. As the culture improves towards inaccurate, the time made available to perform the work
the Generative there is more latitude for individual initiative necessitates short cuts, then good practice may still be in
and, therefore, more need to support the individual to ensure jeopardy, despite our best attitudes.
that they can do their best.
Conclusion
Good practice We can now see how the systemic and the individual
All the models describe how good outcomes, the expression of approaches line up, and how programs such as Tripod and
good practice, can be generated and countered by a variety of Hearts and Minds are consistent with each other. Tripod, with
factors. These may be broadly cultural, as the total its concentration upon systemic issues, concentrates upon the
4 SPE 86595

level of actions. It was necessary to solve the problems in this


area first because having good attitudes can now be clearly
seen as a necessary but not a sufficient cause of good practice.
Hearts and Minds impacts primarily on the level of beliefs and
we can see that all the tools change attitudes primarily by
altering people’s beliefs about themselves, their work and the
hazards they face. The answer to those who ask whether the
one is not just a replacement for the other is now obvious, they
are both part of a more complete whole, in which technical
and behavioural capabilities and problems come together. It is
only by taking such a unified approach that we can expect to
reach the next level of HSE performance we aspire to.

References

Hudson, P.T.W. (2003) Applying the lessons of high-risk industries


to medicine. Quality and Safety in Health Care,
Reason, J.T. (1997) Managing the Risks of Organizational Accidents.
Aldershot: Ashgate

Figure 4. A model relating the sources of values and beliefs to


action.

Management

Colleagues
Slips &
Regulator
Lapses
Public
Outcome
NGO’s Intention Behaviour
Gap / plan / action
Family
Power
Friends

Neighbours

Religious leaders

Potrebbero piacerti anche