2.1 Human Error

Professor James Reason defines Human Error as “a generic term to encompass all the occasions in which a planned sequence of mental or physical activities fails to achieve its intended outcome and when these failures cannot be attributed to the intervention of some chance agency” (Reason, 1991, p. 9).

Reason further distinguishes between slips, lapses, and mistakes. Slips are associated with faulty actions, where actions do not proceed as intended, e.g., misreading a display. Lapses are failures of memory, e.g., forgetting to press a switch. Slips and lapses tend to occur during routine tasks in familiar surroundings where the operator may be on “automatic pilot” or attention is captured by something other than the task in hand, e.g., a work colleague distracting the operator with a question. They are categorized as “skill-based” errors and are relatively easy to recover from because the operator will receive direct feedback that their actions have not led to the anticipated outcome.

Mistakes occur when the intended plans for action are wrong in the first place. In other words, intended actions may proceed as planned, but fail to achieve their intended outcome. There are two types of mistake “rule-based mistakes” and “knowledge-based mistakes.” Rule-based mistakes are where an incorrect diagnostic rule is applied. An example of this is where an experienced operator on a batch reactor may have learned diagnostic rules, which are inappropriate for continuous process operations. If an attempt is made to apply these rules to work out the cause of a continuous process upset, a misdiagnosis can occur, leading to an inappropriate action. There is also a tendency for people to apply strong but successful rules that they have applied in the past, even if they are not appropriate for the situation.

Knowledge-based mistakes occur when the information-processing capabilities of the operator are being tested by an unfamiliar situation that has to be worked out from first principles and there are no apparent rules or procedures to deal with the situation. Quite often, only information that is readily available will be used to evaluate the situation or people will depend on a “gut feel” that their course of action is correct, perhaps based on similar but unrelated incidents in the past. Sometimes “attention capture” occurs where the operators become focused on one small part of an overall problem, e.g., at Three-Mile Island. In other situations, operators might switch their attention between one task and another, thereby not really solving the problem.

Mistakes are difficult to detect and are more subtle, complex, and dangerous than slips. Detection may depend on someone else intervening or unwanted consequences becoming apparent.

The final type of “error” is a violation or nonconformance/noncompliance. These are considered “intentional” because the operator deliberately carries out actions that contravene the organization's policies, rules, or safe operating procedures. However, violations often tend to be well intentioned, either because their objective is to complete a task or simplify it. Fortunately, violations are very rarely conducted in order to sabotage a process or a plant.

It is important to note that violations can occur due to both internal and external pressures on the operator (i.e., pressure to get a task done on time, which can come from the individual or it can come from perceived pressures from supervisors and managers). Violations can be routine, situational, optimizing, or exceptional.

Routine violations refer to when violations become the norm, i.e., what is normally done in the workplace, learned by others therefore becoming embedded as the way of doing things. They are usually shortcuts taken to get the job done more quickly, more efficiently, or more easily. Unless these types of violation are monitored and controlled, the organization can develop a culture that tolerates violations. Ways of counteracting routine violations are through good supervision, proper training (with explanations of why certain procedures are in place), good procedures and work practices, and, as a final measure, behavioral safety programs, which coach to reinforce the correct behavior and challenge and change incorrect behavior.

Situational violations tend to occur when there is a gap between what the rules or procedures say should be done, and what is actually available in order to get the job done. For example, a lack of trained and competent staff to conduct a task or lack of procedural clarity can lead to a situational violation. This can often occur when management are unaware of what resources are required, when procedures are out of date, or when there has been a cost-cutting program and staff have been made redundant, thus leading to reduced manning levels. Obviously, the same measures that are applied to manage routine violations can be used to manage situational violations.

Optimizing violations refer to when individuals carry out an activity for personal gain or simply for “kicks,” e.g., seeing how far they can go by testing the system to its limits. However, organizations often provide incentives such as bonuses for meeting production targets, which can encourage “organizational” optimizing violations. If brought out into the open through incident/near miss reporting programs and good communication up and down the organizational hierarchy, these types of violation can help to identify measures that can be taken to improve both production and safety within the organization.

Exceptional violations occur when there is an unusual or unanticipated situation where no rules or procedures apply or where the rules/procedures cannot be applied. Perhaps the most poignant example of an exceptional violation can be seen during the Piper Alpha disaster, where personnel had been told that jumping off the platform into the sea was not survivable. In reality, many of those who jumped into the sea that night did survive unlike those who stayed on the platform and made their way to the muster point in the accommodation block as the procedures and their training dictated where they perished.

This example serves to remind us that human beings do not always follow rules and procedures blindly but are capable of interpreting and adapting to situations and solving problems in situ. This inherent behavioral flexibility and adaptability is what keeps us safe in a complex and constantly changing environment, an issue that we will return to later in the chapter.

Human error can be seen as a consequence or outcome of our performance limitations, and we regularly make errors on an everyday basis. Even highly trained and competent individuals working in control rooms and on maintenance tasks within the chemical process industries are error-prone, but fortunately, most errors are captured before they develop into something more serious. There are a number of challenges facing the human factors specialist. One challenge is to design plant, equipment, and systems, which make the chance of human error very low or As Low As Reasonably Practicable (ALARP), i.e., at a point where the costs are not so prohibitive that the benefits are seriously undermined. Another challenge is to identify where human error is most likely to occur, what type of error might occur, and what is the likelihood of it occurring. A third challenge is to measure human error and identify what factors make it more likely to occur (the so-called PIFs). Finally, once error has occurred, it would be of interest how these errors are identified and recovered from.

The remainder of this chapter covers how these many challenges can be identified and overcome. Due to the diverse and extensive nature of the human factors subject matter, not all of the factors identified by the HSE or other international bodies will be reported here. Those areas in which the author has relevant knowledge and expertise will be the main focus of attention. As a result, most of the discussion will be centered on human performance issues and will cover individual and organizational factors, since these are the areas in which the author has conducted most of her research. Ergonomics and Human Factors Engineering, particularly regarding workplace design, human–machine interaction, and characteristics of the working environment, are not areas that the author is familiar with and therefore will only be discussed in passing. Nevertheless, it is worth noting that “Designing for Humans” (Noyes, 2001) is an important exercise and can potentially prevent the development of many of the human performance issues that will be discussed in this chapter.

2.2 Measuring and Managing Human Error

In a paper prepared for presentation at the Institute of Chemical Engineers (IChemE) XX Hazards symposium in April 2008, Visscher of the US Chemical Safety Board presented summaries of investigations of some of the 50 chemical-related incidents in the United States since 1998. In his conclusions, he notes that many of the incidents occurred in facilities where chemicals are stored and used for other purposes rather than at chemical processing companies per se. He also observes that the controls and safeguards that rely on human judgment and reliability are revealed as a particular area of vulnerability and that management should focus on these issues in their operations. Furthermore, Visscher reports that the major accidents that have occurred at the larger companies have highlighted the important role of corporate leadership and oversight in assuring process safety integrity. Corporate leadership and oversight and the important role they play in maintaining safety are explored later on in this chapter.

The chemical process industries use a number of techniques for measuring and managing human error/human failure. The Center for Chemical Process Safety (CCPS) (1994) has produced a set of guidelines for preventing human error in process safety, to which the interested reader is referred.

This section will only deal with a few of these techniques, but it is also to remember that it is difficult to estimate when and where human failure is likely to occur and the most effective way to prevent errors is to focus on managing the PIFs in general. Thorough and detailed incident investigation, with a strong focus on human and organisational factors, is important to identify which PIFs should be focused on in order to prevent further incidents. In the author's experience the following PIFs are the most commonly identified contributory factors in major accidents: poor design, poor procedures, lack of supervision, fatigue, poor safety climate/culture and lack of safety leadership, and underinvestment by senior management in safety improvements.

2.3 Human Reliability Analysis

Human factors specialists attempt to measure the likelihood of human error in predetermined situations through HRA and Human Error Probability (HEP). HRA techniques are used to support the minimization of risks associated with human failure. They are both quantitative (e.g., HEP) and qualitative (e.g., safety critical task analysis (SCTA)) in nature; however the application of quantitative techniques can be difficult due to the fact that HEPs in particular are often used without sufficient justification. In particular, new processes and new technologies will not have sufficient data available to generate HEPs. SCTA (see Energy Institute, 2011) considers the impact that PIFs can have on the likelihood of error, which will be affected by job and organizational factors such as design of plant and equipment, the quality of procedures, and the time available to get the job done. Using HEPs without task context can therefore lead to inaccuracies in analysis.

Henderson and Embrey (2012) produced guidance for the Energy Institute on Quantified Human Reliability Analysis (QHRA) (see Energy Institute, 2012), in order to reduce instances of poorly developed or executed analyses. These authors recommend an eight-stage Generic HRA process as follows:

1. Preparation and problem definition

2. Task analysis

3. Failure identification

4. Modeling

5. Quantification

6. Impact assessment

7. Failure reduction

8. Review

Bow-tie diagrams have become a popular way of illustrating how initiating and response failures can occur. For example, Henderson and Embrey (2012) use the following figure to show how different human failures can affect the initiation and mitigation and escalation of a hypothetical event (see Fig. 1).

From a practical point of view, a number of factors can undermine the validity of an HRA. As a starting point, the analyst will need a thorough understanding of the task and the environment it is conducted in. Therefore, the input of skilled and experienced operators will be required. A walk-through of the tasks and subtasks involved in the activity at the location and/or a detailed talk-through of the tasks and subtasks in a task analysis workshop is necessary. It is important to understand which PIFs might be exerting an influence in the actual working situation. Also if any HEPs have been imported (usually from a general database if such a database exists), the rationale from including these HEPs must be clearly articulated. It is normal practice to use a set of guidewords to identify the potential failures.

There are a number of guides to HRA (see Health and Safety Executive, 2009; Kirwan, 1994). The HSE (2009) report RR679 provides a review of human reliability assessment methods. Out of a total of 72 human reliability tools identified, the report authors considered 35 to be potentially relevant to hazardous industries such as the chemical process industries. This list was then reduced to 17 tools, most of which had only been applied in the nuclear industry. Only five of these tools were considered to have “Generic” capability, although some of the nuclear tools were considered to have wider application.

The lack of space precludes detailed discussion of all 17 HRA tools covered in RR679, and the interested reader is advised to access the report (which is available on the Health and Safety Executive website, for further details). Two of the tools are discussed here based on the fact that they are generic or have the potential to be applied more widely than in the nuclear sector: Human Error Assessment and Reliability Technique (HEART) and Technique for Human Error Rate Prediction (THERP). In addition, HEART and THERP are two of the few HRA methods that have been empirically validated (see Kirwan, 1996; Kirwan, Kennedy, Taylor-Adams, & Lambert, 1997).

2.4 Safety Critical Task Analysis

SCTA describes a process whereby the impact of potential human error on MAHs can be assessed. SCTA is an extension of Task Analysis, which is the study of the actions and mental processes an employee is expected to carry out in order to achieve a goal. Task Analysis can be used for activities such as assessing staff levels and improving training programs; however, it is not discussed in any detail in this chapter. For the interested reader, there are some excellent resources available, e.g., Kirwan and Ainsworth (1992) and Shepherd (2001). The purpose of SCTA is to identify where human failure can contribute to MAHs and can include initiating events, prevention and detection, control and mitigation, maintenance tasks, and emergency response. The process involves identifying which tasks on a site are safety critical in relation to MAHs, understanding whether human error or violations might contribute to initiating an adverse event, and understanding what preventative measures or layers of protection could be put in place to reduce the likelihood or mitigate the consequences of human failure.

A number of publications exist to support the implementation of SCTA. The Energy Institute (2011) has developed a clear set of guidance on SCTA and the UK Health and Safety Executive has produced a guidance paper for its inspectors (identifying human failures, HSE Core Topic 3), describing a seven-step approach for SCTA. This seven-step approach consists of the following:

1. Identify the main hazards—e.g., from HAZIDs, Safety Reports, or Risk Assessments.

2. Identify safety critical tasks associated with those main hazards and prioritize those tasks where there are many MAHs. Procedures and discussions with staff are the main techniques recommended.

3. Understand the safety critical tasks, i.e., who does what, when and in what sequence? Again this can be derived from procedures, checklists, interviews with staff (walkthroughs/talkthroughs), and observations of staff conducting the tasks.

4. Represent the safety critical tasks, i.e., through breakdown of the tasks in tables or diagrams in sufficient detail for further analysis.

5. List all the potential human failures and their consequences, through representing the safety critical tasks from step 4. Also, list the potential PIFs that could influence human performance for each task and consider what safety measures are already in place. The different types of human failure/error and PIFs used in SCTA are listed in Tables 2 and 3.

6. Identify any additional safety measures that could be implemented to further mitigate PIFs and the risk of human failure.

7. Review the effectiveness of the process contributes to a wider understanding of SCTA and improvements to the technique.

A common problem is that all tasks are considered to be “safety critical.” Usually, it is the operational tasks that are the focus on the SCTA, e.g., chemical offloading operations, control room operations, or blending chemicals; however, checking tasks, emergency response, and maintenance tasks might also be included.

The UK Health and Safety Executive has made SCTA a requirement for acceptance of its Control of Major Accident Hazards (COMAH) Safety Reports. Table 2 lists the human error guidewords suggested by the HSE.

4.1 Competence and Skills

Competence and skills are clearly of prime importance; however, there can be some debate about who is responsible for developing skills and competencies and keeping them up to date. Depending on the nature of the job/tasks and the skills and competencies associated with it, initial responsibility may lie with the individual or with the schools, colleges, and universities that are responsible for ensuring the people receive the necessary education. No matter what the job or tasks entail, it is safe to assume that basic numeracy and literacy skills will be required. It is up to the organization to provide an accurate job description and outline the relevant person characteristics required to carry out the job so that the right people can be selected from the outset. In the author's own experience, these job descriptions and person characteristics are sometimes inadequate and the suspicion is that the Human Resources Department has been left to write it, without any input from skilled practitioners; therefore, there is a lack of understanding of the true nature of the job and the type of person required for it. In order to recruit and retain the right people for the job roles and tasks in the organization, it is crucial that the right people are involved in writing the job description and person characteristics.

If one assumes that the right person is selected for the right job, then the organization may need to deliver some “on-the-job” training so that the new recruit can learn the tasks that he or she will be required to carry out in context. Again, in the author's experience, a school-leaver or graduate can very rarely come straight into a job and conduct their activities with the requisite level of competency; development “in role” under the tutelage of an experienced supervisor or mentor will be critical.

Once the basic skills and knowledge are acquired, there is a need for a period of on-the-job supervision to determine whether the individual is competent to carry out the assigned tasks. However, competencies should be kept up to date for example, when there are changes to the job or when there are new developments in systems, technology, legislation, or equipment. Refresher training may also be required for some tasks. Employees in the chemical industry will be trained and competent in the technical skills they require for their job, e.g., control room operations, chemical engineering, or maintenance; however, there are a set of nontechnical skills, which are widely used in other high-hazard, high-reliability industries, but do not appear to be prevalent in the chemical process industries.

4.2 Nontechnical Skills

Nontechnical skills training began in the aviation industry as far back as the 1970s, after the industry identified that many aviation accidents did not occur due to technical problems with the aircraft or the pilots’ lack of technical flying ability. Instead, flight data recorders and cockpit voice recorders identified nontechnical skills such as poor situation awareness, communication, teamwork, decision making, leadership, fatigue, and stress, as major contributors to aviation accidents. The industry therefore started to develop nontechnical skills training as part of Crew Resource Management (CRM), which has now become mandatory for all pilots and cabin crew. CRM refers to the flight crew's use of all necessary resources (systems, technology, equipment, and human) to ensure safe and efficient operation of the aircraft. Nontechnical skills are a critical part of CRM, particularly in the identification and recovery from errors (threat and error management). Nontechnical skills are generally divided into two subgroups: (1) cognitive skills (decision making, situational awareness) and (2) social skills (leadership, teamwork, and communication).

The use of simulators and Line-Oriented Flight Training (LOFT), which involves testing the crew's nontechnical skills, i.e., situation awareness, team working, decision making, in abnormal situations which have not been prebriefed, has facilitated this type of training over the decades. Test scenarios can be developed from various sources, but accident reports with a full emphasis on human factors issues are most often used. CRM and nontechnical skills are examined both in the simulator and in normal flight operations, and pilots have to keep these skills up to date in order to fly commercial aircraft. Pilots and cabin crew are also required to undertake regular refresher training.

Other sectors such as aircraft maintenance (Sian, Robertson, & Watson, 2016), maritime (STCW, 2010), nuclear (INPO, 1993), offshore production platforms (O’Connor & Flin, 2003), hospital operating theatres (Flin & Maran, 2004; Mitchell & Flin, 2008; Yule, Flin, Paterson-Brown, & Maran, 2006), and offshore well operations (Energy Institute, 2014; International Association of Oil and Gas Producers (OGP), 2014) have also adopted the principles of CRM and nontechnical skills training. It is worth noting that the development of guidance for CRM/nontechnical skills training in well operations has arisen directly as a result of the findings of the inquiries into the Deepwater Horizon disaster.

The content of CRM and associated nontechnical skills training will, out of necessity, reflect the industry in which the training is being designed and implemented (see Flin, O’Connor, & Mearns, 2002 for a review). Nonetheless, reference to the research papers and training development around these programs indicates that the subject areas of situation awareness, decision making, team working, leadership, and managing stress and fatigue are key components. Communication is considered to be the cornerstone of CRM and nontechnical skills training.

The author is not aware of CRM and nontechnical skills training in the onshore chemical process industries; however, it is likely that the components outlined earlier, particularly team working, leadership, and communication, are covered in some training programs for the industry. The importance and utility of CRM and nontechnical skills training is that it takes incidents and accidents as its starting point, and based on the detailed human factors analysis of those incidents, trains the skills that have been found to be lacking and have led to the incident occurring. It is therefore a way of “closing the loop” (Flin et al., 2002) to prevent the likelihood of human failure in the future. Through a focus on CRM and nontechnical skills, personnel can also be trained to recognize and trap errors before they develop into more series adverse events. The other interesting point about this type of training is that the aviation industry has developed and persisted with it, whereas other industries “chop and change” their training regimes to adopt whatever is fashionable at the time (the offshore oil and gas industry is a case in point). This consistency of approach means that these programs have had time to be integrated into the systems and processes of the industry and deliver the performance improvements they were designed to deliver.

Proper development of nontechnical skills training also requires sets of “behavioral markers” that can be used to identify whether employees are exhibiting the trained behaviors or not. Obviously, the development of behavioral markers will be industry specific and will require the combined skills of operational personnel (e.g., operators, engineers, maintenance staff) and human factors specialists. Performance can be assessed in training simulators if they are available or online, when the personnel will be assessed while actually conducting their tasks. Studies into the development of behavioral markers for nontechnical skills training in the aviation sector and hospital operating theaters include Flin and Martin (2001), Flin (2003), Fletcher et al. (2003), and Yule et al. (2008). CRM/nontechnical skills training courses will tend to consist of both theoretical and applied teaching.

In conclusion, nontechnical skills training provides a means by which human performance can be managed and improved. A number of safety critical industries have adopted this type of training, and it could be considered as a form of training for the chemical process industries.

4.3 The Role of Personality

The role of personality in determining safety performance has been well researched starting back in the 1950s with the idea of the “accident-prone” personality. Subsequent research and development has shown that so-called accident proneness may be a misnomer and again we find that a focus on PIFs is a more productive route to follow. Nonetheless, there are clearly individual differences in intelligence, aptitude, dexterity, skills, education, and motivation, and potential employees will tend to be selected for these characteristics rather than their personality, per se.

There is a vast literature on personality and a wide range of personality tests developed by psychologists over many decades. According to the American Psychological Association (APA, 2016), “personality” is defined as “individual differences in characteristic patterns of thinking, feeling and behaving.” The assumption is that “personality” is relatively stable and resistance to change and can be measured along a number of measurable “dimensions,” “factors,” or “traits.” The biological definition of “traits” is characteristics or attributes of an organism as expressed by genes and/or by the environment. When it comes to personality, a combination of genetics and the environment will lead to a particular trait developing in an individual. Many of the personality tests developed by psychologists are designed to identify individuals, who are suffering from clinical psychological conditions such as anxiety, depression, dementia, obsessive–compulsive disorders, and schizophrenia. From an occupational or industrial/organizational perspective, a number of personality tests exist for selection and development purposes. These tests are designed to not just measure personality but also assess aptitudes such as problem solving, social interaction, and situation judgment. One of the best-known occupational personality tests is the Myers Briggs, which assesses employees’ tendencies toward Introversion/Extraversion; Thinking/Feeling; Judging/Perceiving; and Intuition/Sensing. Results from these tests place people into one of a range of 16 different personality types, each of which has its own strengths and weaknesses. Although the Myers Briggs claims to identify 16 different personality types, most psychologists working in the area of personality testing nowadays recognize five main dimensions (i.e., the so-called Big 5, also known by the acronyms OCEAN or CANOE) with people scoring “high” to “low” on each trait:

• Openness to Experience—This personality trait reflects preferring variety in life, being attentive to inner feelings and having an active imagination, aesthetic sensitivity, and intellectual curiosity.

• Conscientiousness—Individuals who are conscientious tend to have high levels of self-discipline and are good at planning and striving to achieve long-term goals. They are often perceived as being responsible and reliable, but they can also be perfectionists and workaholics.

• Extraversion—Extraverts score highly on scales measuring sociability, assertiveness, energy, and talkativeness. By contrast, those scoring on the other end of the scale are Introverts, who enjoy spending time alone with their own thoughts and prefer solitary work and hobbies.

• Agreeableness—This trait speaks for itself. People who score highly tend to be warm, friendly, and tactful, with a positive opinion of others and are able to get along well with other people.

• Neuroticism—Neurotic individuals display the characteristics of being anxious, worried, moody, frustrated, or afraid. These characteristics are generally not considered to be conducive to good work performance; however, when it comes to risk and safety, neuroticism may have an important role to play.

The research evidence for the role of personality in industrial safety and accident involvement tends to be quite limited, with much of the literature focusing on driver personality and accident involvement rather than how personality traits affect attitudes to risk and safety in the workplace, particularly the chemical process industries. It is important to remember that any personality trait will not be exerting its influence in isolation but will also be subject to influence from the working environment (job factors) and the social environment (organizational factors) that the individual is exposed to.

4.4 Occupational Stress

No discussion of PIFs would be complete without reference to occupational stress, although where it fits within the individual, job, and organizational factors framework is a point of debate, since all these factors can be associated with the experience of occupational stress. There is an extensive literature on the subject and it is one factor that has been consistently related to accident involvement in a number of industries. Sutherland and Cooper's (1991) study on stress has already been mentioned, but there are many other studies, some of which have been conducted in the chemical process industries. The word “stress” is widely used, but occupational or job stress is specific to the workplace and arises from the conditions experienced there. Like so many human factors issues, stress will not exist in isolation from other PIFs and it can be debated as to whether occupational stress comes under the category of an individual, job, or organizational factors. In reality, it can span all three. For example, personality, lack of skills and competence, excessive workload, inadequate supervision, badly written procedures, and a poor safety climate impact on stress and therefore on the performance of both the individual and the organization. Of course, factors external to the work environment will also play a role in creating stress, for example, problems with work–life balance due to shift work or excessive overtime. Fatigue is often treated as a separate issue, but when considered within an occupational setting the author considers fatigue to be closely related to job stress, creating a vicious circle where the stress leads to tension, worry and lack of sleep, and the increase in fatigue makes it less easy to cope and therefore creates more stress. The techniques to manage both stress and fatigue are very similar and will be covered in the discussion later.

Occupational stress has been defined as the physical and psychological states that arise when an individual no longer has the resources to cope with the demands and pressures of the situation (see Michie, 2002 for a comprehensive review). It is considered to be the result of the interaction between the person and the environment. This is important to remember, since one person's “stress” may be another's “challenge”; therefore the feeling of being stressed and unable to cope is very much an individual-level phenomenon.

The causes of stress are manifold. They include factors that are intrinsic to the job such as work overload, time pressure, and poor working environment, e.g., noise, cramped conditions, lack of adequate lighting. The person's job role may also be an issue, such as role ambiguity and conflict; i.e., goals and expectations are not clear. Employees might have a poor relationship with their boss or with colleagues or they may feel that they are not being promoted quickly enough or are insecure about their job. Finally, the climate, culture, and structure of the organization may be a problem with a lack of participation in decision making, communication, and consultation.

We have already covered some of the factors that the individual will bring to the situation that contribute to feelings of being stressed. These include personality characteristics such as anxiety, neuroticism, and the Type A behavioral pattern. Factors external to the job such as family problems or life crises can be stressors, but research has shown that the main contributor to job stress tends to the organization itself and how people are being managed within that organization. Well-designed workplaces with clear roles, responsibilities, and expectations for their staff will tend to experience less work-related stress. Adequate training and competency programs, well-written procedures, an engaged workforce, and supportive supervision and management will also contribute to a reduction in stress. As is so often the case, addressing PIFs is the key to good safety performance.

The consequences of stress for the individual include physiological responses such as increased blood pressure and heart rate and behavioral responses such as increased smoking and drinking and either over- or under-eating. Needless to say, prolonged exposure to stress can have a long-term impact on both physical and mental health, e.g., coronary heart disease and depression. Researchers and medical professionals distinguish between acute and chronic stress. Acute stress is the immediate “flight or flight” response to a perceived threat, which leads to physiological changes in the body such as the release of adrenalin (associated with “butterflies in the stomach” and increased breathing rate). The body is then activated to deal with the threat either by fighting it or by running away, but in modern-day society, this is not necessarily a practical solution and so the individual starts to suffer from chronic stress, which is the prolonged exposure to stressors from the environment. It is this prolonged exposure that is considered to be dangerous and can lead to mental and physical consequences.

The consequences for the organization of chronic stress can include reduced quantity and quality of work, increased absenteeism and high turnover of staff, and reduced job satisfaction and morale. Ultimately, if employees are increasingly stressed and end up leaving, the organization's reputation might be damaged and it might find it harder to recruit personnel in the future. Of course, other potential negative consequences for both the individual and the organization are reduced levels of safety and increased accident involvement. There are many studies reporting the impact of stress on safety performance in the industrial context, although very few appear to have been conducted in the onshore chemical process industries. However as way of example, some of the studies conducted in the offshore oil and gas industry will be discussed here.

5.1 Design of Control Rooms

Control rooms provide an important safety critical barrier to MAHs in the chemical process industries; however, CROs can have a number of challenges to deal with. These challenges include having to deal with too many alarms simultaneously (alarm flooding), several safety critical tasks that have to be performed simultaneously (workload), communications equipment and display equipment positioned apart in the control room even when they need to be used together (design), and uneven workloads, with long periods of monitoring tasks interspersed with periods of high intensity when dealing with abnormal situations.

It is therefore recommended that due care is put into designing control rooms for normal, abnormal, and emergency situations. There are six main areas that require attention:

1. Layout

2. Working Environment

3. Control and Safety Systems

4. Job Organization

5. Procedures and Work Descriptions

6. Training and Competence

The Safety and Reliability Group at SINTEF (2004) developed the CRIOP methodology to contribute to “verification and validation of the ability of a control center to safely and efficiently handle all modes of operation including start-up, normal operations, maintenance and revision maintenance, process disturbances, safety critical situations and shut down” (p. 2). CRIOP is a registered trademark and stands for a scenario method for Crisis Intervention and Operability Analysis. Organizations such as Statoil and Norsk Hydro were involved in its development for the Norwegian offshore sector, and the methodology was based on interviews, user discussions, workshops, and contributions from experts.

e-Operations have been added as a seventh area in the 2004 version of CRIOP because remote control and remote operations have been a recent development for the Norwegian offshore industry. This is partly to reduce risk to personnel, since fewer people will be required to travel offshore to conduct the work. It also can be considered a cost-efficiency measure.

CRIOP works on the basis of checklists and scenarios. The checklists used in design and operations are based on a “best practice,” including standards and guidelines such as ISO11064, EEMUA 191, and IEC 61508. The Norwegian Petroleum Directorate regulations have also been taken into account. The checklists have been laid out in a particular way for clear and easy usage. There is a checklist for each of the six areas, which comprises numbered points, e.g., 1, 1.1, 1.2, etc.; a Description, e.g., Are breaks planned/coordinated with control center tasks? Yes/No/Not Applicable; Reference to Documentation, e.g., ISO 11064-1; Comments and Recommendations and Responses.

The final stage of the CRIOP process is Scenario Analysis, which consists of Introduction, Planning, Participants, Duration, Group discussions, Documentation, Number of Scenarios, Organizational Learning, and Framework. This is followed by the identification of actors who will be involved in the events making up the scenario. Observations are made of how the events of the scenario are enacted and interpreted including planning and decision making and action/execution. A checklist of PIFs (referred to as Sociotechnical factors in CRIOP) is used in the scenario analysis. Actions plans are developed from the outcomes of the scenario analysis with the implication that management implements these action plans.

In conclusion, CRIOP provides a method whereby the full complement of human factors issues can be addressed through a systemic, applied enactment of events within process industry-specific scenarios, particularly involving the all important control room at the center of operations.

5.2 Procedures

In the author's personal experience in over 25 years as an academic and consultant, frontline workers in the chemical process industries constantly raise the usability of procedures as an issue. This is particularly the case for maintenance personnel, who seem to be largely ignored when it comes to procedural usability. One of the main complaints raised in questionnaires and focus groups with frontline workers is that “engineers,” who never visit the worksite to understand the context in which those procedures are to be used, write the procedures. Furthermore, work as “planned” rarely fits exactly with work as “executed,” with the exception of the simplest of tasks. This means that frontline workers constantly have to adapt and adjust the procedures to use in order to achieve their work objectives. When this happens, the new way of working can gradually become the “norm” and drift away from the original intent of the procedure. New recruits observe, copy, and conduct their work in the new way, thereby being “normalized” by the more experienced workers, who may have forgotten what the correct procedure is. Another problem with procedures is that they can grow “arms and legs” and become lengthy and unwieldy. This often occurs in response to accidents and incidents, where a new section (or sections) is incorporated to prevent such an incident happening again.

It is important to clarify what is meant by the word “procedures.” This term can mean different things to different people, depending on their role in the organization. The Business dictionary (http://www.businessdictionary.com) refers to a procedure as “A fixed, step-by-step sequence of activities or course of action (with definite start and end points) that must be followed in the same order to correctly perform a task.” Repetitive procedures are called routines, but there are also method statements/specifications and work instructions. A method specification is described as a “Statement of requirements that prescribes a method of achieving a desired standard, instead of prescribing the standard itself.” Method statements are likely to be used by designers, engineers, or managers. A work instruction is “A description of the specific tasks and activities within an organization. A work instruction in a business will generally outline all of the different jobs needed for the operation of the firm in great detail and is a key element to running a business smoothly.” In the author's experience, frontline workers are usually operating according to work instructions but often with reference to higher order procedures. In addition, they have to comply with rules and regulations. A rule is defined as “an authoritative statement of what to do or not to do in a specific situation, issued by an appropriate person or body. It clarifies, demarcates, or interprets a law or policy.” A regulation is “a principle or law (with or without the coercive power of law) employed in controlling, directing or managing an activity, organization or system.” It goes without saying that rules and regulations are the province of managers and leaders, but the expectation is that they are understood and followed throughout the whole organization.

Frontline workers will be expected to work according to a set of procedures or work instructions. The procedures might be generalized to a number of different tasks and situations, but the work instructions will be specific to the tasks being conducted on a day-to-day basis. Work instructions tend to be relatively clear and straightforward, but procedures can often be seen as lengthy and ambiguous. In order to help with the process of writing clear and concise procedures the UK Health and Safety Executive has produced guidance to preparing procedures in their Human Factors Briefing Note No. 4. The Major Accident Prevention Policy (MAPP) should describe how procedures should be developed, reviewed, revised, and publicized. In particular, COMAH sites should have a procedure for writing procedures, which should cover which tasks require procedures, how detailed those procedures should be, how to keep them up to date, and how to ensure compliance with procedures. It is also important that procedures are reviewed on a regular basis through consultation with users, walkthroughs of the procedures during actual work tasks, and identification of “informal” procedures or “workarounds.” Analysis of incidents in which noncompliance with procedures has been identified as a causal factor is also recommended. Table 4 outlines a procedural checklist developed by the HSE.

The HSE guidance recommends using task analysis to fully understand how a job is actually done, including the identification of hazards and whether a procedure is the best way of controlling the hazard. As noted earlier, it is important to involve the people who actually do the task in writing the procedure. They will have the most realistic view of how the task is done (as compared to managers who may have a view on how the task should be done). Those who use the procedures can also advise on how and why the procedure might not be complied with (i.e., anticipate potential violations) and can also advise on the best wording and style of layout to use. Finally, involving the frontline workforce in developing procedures ensures ownership of the procedure and therefore more motivation and commitment to actually using the procedure in the way it is intended.

Other advice covers training in the procedure, including the training of contractors. This will ensure workers are familiar with the content and can point out any errors or impracticalities. It is important that contractors are familiar with the terminology used and that the needs of novice users are taken into account. Finally, make sure that procedures can be found quickly and easily on the organizational system.

Proper management of procedures is also important. Keep checking that they are being used properly and if not, find out why. Workers may have found an easier way to complete the task, but there new method might entail some inherent risk. On the other hand, the new way of doing things might be both more efficient and safer. Make sure that there is a system for capturing problems and that any problems are dealt with as quickly as possible. If a problem cannot be dealt with efficiently, then an explanation is required as to why.

Managers should plan for any changes to the task due to changes in equipment or the methods used. If it is not possible to change the procedure quickly and get people trained up in it, then temporary working instructions or extra supervision may be required. Procedures should be controlled. This often occurs by an instruction that the procedure is uncontrolled if printed (for example, only procedures accessed from the company website are controlled). Finally, a log should be kept of who is responsible for the procedure and any out-of-date procedures should be disposed of.

6.1 Safety Climate and Safety Culture

Safety climate and safety culture deserve a lengthy section in this chapter, reflecting both their complexity and the academic and practitioner interest shown in these concepts. They are particularly important because public inquiries into most major accidents involving highly hazardous materials have found a distinct lack of safety culture (or climate) to be one of the underlying factors contributing to the accident.

There are numerous research articles and book chapters available, describing how to measure both safety culture and safety climate and demonstrating their relationship with safety performance. Although used interchangeably, the history and etiology of the two concepts is very different and ultimately the concepts reflect two different but overlapping aspects of organizational safety in high-hazard industries such as the chemical industry.

6.2 Leadership and Management for Safety

There has long been a focus on what constitutes effective leadership and management in organizational settings, with a multitude of books, chapters, research articles, consultancy reports, training programs, and theories espousing and promoting the value of good leadership and management skills to ensure the success of an organization. While the general area of leadership and management has been well researched and reported, there has been less focus on the skills, knowledge, and attitudes that leaders and managers require to “lead and manage” for safety. The argument could apply that it would be same set of attributes that are required for good general leadership and management; however, there is something different about the motivational drivers for safety performance compared to other organizational performance metric such as balance sheets, turnover, and productivity. The one major difference (in this author's opinion) is that with safety “nothing happens.” Safe performance is the expectation and the norm. “Unsafe” performance is usually presented as occupational accident statistics that have an impact on individual lives but less of an impact on the overall organization and many lives. Major process incidents can lead to multiple fatalities of both employees and the general public and considerable damage to the plant and environment, e.g., Bhopal, Flixborough, Texas City. As has been clearly demonstrated for accidents such as Texas City and Deepwater Horizon, reductions in lost-time injuries are not a reliable indicator of how well major hazards are being managed. The organization must be set up to prevent all forms of harm and the driving force for this state of affairs must be senior management, who set the overall direction and ethos for the organization. The key role of senior management in setting and promoting the safety culture of the organization has been demonstrated in most of the research on the subject (Health and Safety Executive, 2003; International Association of Oil and gas producers, 2013; Prior, 2003).

The following sections consider the role of safety leadership at all levels of the management chain from supervisors and team leaders, through middle managers to CEO and Board level. Leadership and management are closely related, with managers planning, organizing, and maintaining the structure and systems of the organization and leaders inspiring and motivating the workforce to achieve organizational goals (of which safety is one of many). A successful business depends on having people with both qualities in the ranks of its management teams. Much of the research on leadership and management for safety has been focused at the supervisor level, but Public Inquiries into major accidents have identified that culpability ultimately lies at senior management level and this accountability is now recognized in legislation, for example, in the UK HSE's Corporate Manslaughter and Corporate Homicide Act 2007. The UK HSE has also published guidance in support of this legislation: “Leading health and safety at work, Actions for directors, board members and organizations of all sizes” (HSE, 2013). Other guidance exists in the form of a Best Practice Guide from the Chemical Industries Association’s “Process safety leadership in the chemical industry” and the International Association of Oil and Gas Producers “Shaping safety culture through safety leadership” (OGP, 2013). Finally, the UK HSE has published an extensive review of the literature on effective leadership behaviors for safety (Health and Safety Executive, 2012).

In a review paper for leadership in healthcare, Flin and Yule (2004) present an excellent overview of some of the main findings generated by research into safety leadership behavior at the supervisor, middle management, and senior management levels, with a focus on Multifactor Leadership theory otherwise known as Transactional/Transformational Leadership theory (Bass, 1998; Bass & Avolio, 1990). Transactional leadership refers to the “exchange” type of relationship that normally occurs between an individual and their superior. In other words, the supervisor/manager set goals or targets, which are then rewarded when they are achieved (and perhaps punished when they are not). The most common styles of Transactional leadership are “Management by exception” (i.e., only intervening when goals/targets are not being achieved) and “Contingent reward” (reinforcement for achieving goals). Transformational leadership is believed to “augment” Transactional leadership and consists of four components:

1. Idealized influence—Transformational leaders act as role models for their followers, embodying vision into action.

2. Individualized consideration—Transformational leaders attend to each follower's needs, attending to individual strengths and development.

3. Inspirational motivation—Transformational leaders inspire followers to go beyond their level of comfort by linking purpose and meaning and driving people forward.

4. Intellectual stimulation—Transformational leaders encourage innovation and creativity as well as critical thinking and problem-solving skills among followers.

Bass and Avolio (1990) have demonstrated that Transformational leadership style improves employee job satisfaction, organizational commitment, and workplace performance, and recent research has demonstrated that it has also has a positive impact on the safety behavior of subordinates. Flin and Yule (2004) point out that the style of leadership for safety will vary according to management level within the organization, but ultimately both styles of leadership will be apparent depending on the situation. The following sections discuss safety leadership at the supervisory, middle management, and senior management levels.