Serious Incident Prevention: How to Sustain Accident-Free Operations in Your Plant or Company

CH00ppi-x 4/10/02 12:48 PM Page i

Serious Incident Prevention

How to Achieve and Sustain Accident-Free Operations in Your Plant or Company

CH00ppi-x 4/10/02 12:48 PM Page ii

CH00ppi-x 4/10/02 12:48 PM Page iii

Serious Incident Prevention How to Achieve and Sustain Accident-Free Operations in Your Plant or Company SECOND EDITION

THOMAS E. BURNS

an imprint of Elsevier Science Amsterdam Boston

London San Diego

New York San Francisco

Oxford

Paris Singapore

Tokyo Sydney

CH00ppi-x 4/10/02 12:48 PM Page iv

Gulf Professional Publishing is an imprint of Elsevier Science. Copyright © 2002, Elsevier Science (USA). All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher. Recognizing the importance of preserving what has been written, Elsevier Science prints its books on acid-free paper whenever possible. Library of Congress Cataloging-in-Publication Data Burns, Thomas, 1946Serious incident prevention : how to achieve and sustain accident-free operations in your plant or company / Thomas E. Burns.—2nd ed. p.cm. Includes bibliographical references and index. ISBN 0-7506-7521-7 (alk. paper) 1. Industrial safety. 2. Accidents—Prevention. I. Title. T55 .B83 2002 658.3’82—dc21 2001058497 British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library. The publisher offers special discounts on bulk orders of this book. For information, please contact: Manager of Special Sales Elsevier Science 225 Wildwood Avenue Woburn, MA 01801–2041 Tel: 781-904-2500 Fax: 781-904-2620 For information on all Gulf Professional Publishing publications available, contact our World Wide Web home page at: http://www.gulfpp.com 10 9 8 7 6 5 4 3 2 1 Printed in the United States of America

CH00ppi-x 4/10/02 12:48 PM Page v

Dedicated to America’s unsung heroes: Men and women who help prevent tragic events before they occur through their daily commitment to the prevention of serious, high-consequence incidents.

CH00ppi-x 4/10/02 12:48 PM Page vi

DISCLAIMER The information contained in this publication consists of facts, concepts, principles, and other information for developing and implementing a strategy for preventing serious incidents. This information is intended to provide general guidance in the development of effective safety-management processes. The information presented is not specific to the operations of any company, facility, unit, process, system, or equipment, and neither the author nor publisher assumes any liability for its use. The information provided in this publication is not a substitute for company, facility, or unit-specific operating and maintenance procedures, checklists, equipment descriptions, safety practices, etc. DO NOT attempt to operate any facility, unit, process, system, or equipment based solely upon the information provided in this publication.

...................................................... DISCLAIMER Preface ................................................................

ix

1 The Improvement Challenge .........................

1

Serious Incidents of the Past ........................................

3

References ...................................................................

18

2 The Barriers to Improvement ........................

21

A Focus on Today’s Problems .....................................

22

Limited Employee Involvement ....................................

22

Inadequate Measurement and Feedback .....................

23

Inadequate Recognition ...............................................

24

Limited Line Organization Ownership ..........................

25

Limited Personal Experience ........................................

25

Misguided Optimism .....................................................

26

Overcoming the Barriers ..............................................

27

References ...................................................................

28

3 A Proven Process Improvement Model ........

29

Process Model For Serious Incident Prevention ..........

32

References ...................................................................

36

4 Management Commitment and Leadership .........................................................

37

Achieving and Sustaining Effective Leadership ...........

40

Achieving a Common Focus ........................................

42

Allocation of Resources ................................................

43

Knowledge of Results ...................................................

43

Reinforcement of Performance ....................................

44

Decisions Consistent with Objectives ...........................

44

Commitment and Leadership - Closing Thoughts ........

46

References ...................................................................

47

5 Employee Involvement ...................................

48

Synergy ........................................................................

50

Prison Break Exercise ..................................................

52

Teamwork .....................................................................

53

An OSHA Perspective on Employee Participation .......

54

Leveraging the Power of Employee Involvement .........

55

References ...................................................................

59

Employee Involvement on Teams ................................

60

6 Employee Involvement - Developing Teamwork ...........................................................

60

Effective Teamwork Techniques ..................................

61

References ...................................................................

67

7 Understanding the Risks ...............................

68

Do Managers Understand the Risks? ..........................

69

Small Boat Operation: An Illustration of Risks ..............

71

Understanding More Complex Risks ............................

72

A Systematic Process of Risk Identification .................

74

Understanding the Role of Human Error ......................

76

Classifying and Prioritizing Risks ..................................

78

Understanding the Risks - A Prerequisite for Success ........................................................................

81

References ...................................................................

82

Managing Similar Risks with Varying Levels of Success ........................................................................

83

8 Identifying the Critical Work ..........................

83

Beyond Regulatory Compliance ...................................

86

Identifying Critical Work ................................................

87

Causal Factors for Serious Incidents ...........................

88

Critical Work for a Tank Car Loading Operation ...........

89

Sustaining Performance ...............................................

91

A Systematic, Knowledge-Based Approach .................

93

Process Safety Management Standard ........................

94

References ...................................................................

95

9 Identifying the Critical Work Management of Change ....................................

96

Unplanned Changes .....................................................

97

Planned Changes .........................................................

99

Management of Change in the Serious Incident Prevention Process ......................................................

101

References ...................................................................

102

10 Establishing Performance Standards .........

103

Corporate/Company Standards ....................................

105

Facility/Operating Level Standards ..............................

106

Explicit and Implicit Standards .....................................

108

Standards - A Prerequisite for Measurement, Feedback, and Accountability ......................................

109

References ...................................................................

110

11 Measurement and Feedback .......................

111

Performance Accountability ..........................................

113

Performance Measurement for Critical Work ...............

113

Feedback and Its Linkage to Reinforcement ................

120

Elevating the Visibility of Critical Work .........................

121

Characteristics of Effective Measurement and Feedback Systems .......................................................

122

Measurement Systems .................................................

122

Feedback Systems .......................................................

123

Types of Measurement and Feedback Systems ..........

124

Safety Performance Indexing .......................................

124

Essential to the Process ...............................................

125

References ...................................................................

125

12 Measurement and Feedback - Safety Performance Indexing .......................................

126

Establishing a Safety Performance Index for Prevention of Serious Incidents ....................................

127

References ...................................................................

140

Reinforcement ..............................................................

141

13 Reinforcement and Corrective Action ........

141

Corrective Action ..........................................................

148

Addressing Causal Factors ..........................................

148

Responding to Red Flags .............................................

149

References ...................................................................

152

14 Improving and Updating the Process .........

153

Shared Vision ...............................................................

155

Organizational Learning ...............................................

156

Employee Involvement .................................................

156

Transforming Concepts to Actions ...............................

157

References ...................................................................

158

Management Commitment and Leadership .................

159

15 Applying the Process Model - A Case Study ...................................................................

159

Implementing Other Process Elements ........................

161

Chemical Handling Department Team .........................

162

Chemical Handling Department Pipeline Operations ...

167

Chemical Handling Department: Tank Storage Operations ....................................................................

178

Chemical Handling Department: Warehouse Operations Team ..........................................................

179

Manufacturing Department - Serious Incident Prevention Processes ..................................................

182

HSE - Serious Incident Prevention Processes .............

183

QMI Site Management Team: Serious Incident Prevention ....................................................................

187

Benefits Achieved from the Serious Incident Prevention Process ......................................................

189

References ...................................................................

189

16 Responding to the Challenge ......................

190

Keys for Successful Implementation ............................

192

Taking the Step Forward ..............................................

194

References ...................................................................

195

Index ...................................................................

197

CH00ppi-x 4/10/02 12:48 PM Page ix

Preface Riding a wave is easy; starting a wave is a much more ambitious task. My objective for the first edition of Serious Incident Prevention, published in 1999, was to start such a wave. The book communicated a vision for breakthrough levels of improvement in the prevention of serious incidents through safety management processes that incorporate the critical elements required for success. The old approach tends to focus on compliance with OSHA, DOT, EPA, or other regulatory requirements as the primary basis for an effective process. The new wave recognizes the critical need for increasing employee involvement and ownership, developing improved measures and feedback systems, improving the quantity and quality of recognition, and incorporating other proven performance management principles into the safety management process. It is satisfying to see that the ripples have started to grow in number and strength. Line managers, safety professionals, and others are showing increased understanding and appreciation for the need to take a more effective, systematic approach in preventing serious incidents. Programs previously focused on regulatory compliance are being adjusted to include other critical actions required for success. Feedback from industry and other organizations continues to reinforce that the same performance management principles that have proven effective in improving quality

ix

CH00ppi-x 4/10/02 12:48 PM Page x

and other key organizational performance indicators are the key to achieving and sustaining improved safety results. My 28-year career with Eastman Chemical Company involved managing safety-related risks from the perspective of both operations management positions and as Eastman’s Texas Division Safety Director. During my career with Eastman, company honors included winning the Malcolm Baldrige National Quality award, STAR recognition through OSHA’s Voluntary Protection Program (VPP), and receipt of the Texas Chemical Council’s prestigious “Best in Texas” award. The serious incident prevention process model, as presented in this publication, was developed through the merging of proven performance management principles with sound risk management practices that include the lessons learned during my nearly three decades of experience. The eight-element safety management model has proven effective for all organizational levels—top management through first-level operating teams. It is a model for operational excellence—a proactive, team-based approach for sustaining serious incident free operations. Managers tend to be energized by a limited number of events—typically, either by a crisis or by proactive recognition of a significant opportunity. While a crisis emits alarm signals that cannot be ignored, opportunities are not as easy to detect. The objective of this publication is to clearly communicate the significant opportunity for improvement and to provide a systematic, straightforward approach for development and implementation of more effective safety management processes. With the catastrophic consequences of serious incidents, initiation of management action is clearly preferable in the opportunity stage rather than in the crisis stage that accompanies the occurrence of an incident. For organizations ready to recognize and act upon opportunity, the chapters that follow provide a vision and road map for a safer, more prosperous future. Thomas Burns, PE, CSP SIP Management Systems, Inc. / Quality Safety Edge PO Box 3743 Longview, Texas 75606 (903) 238-9360

x

CH01pp001-020 4/10/02 12:49 PM Page 1

C H A P T E R

1

The Improvement Challenge Our individual perspectives are shaped by past experiences. Two serious incidents involving fatalities and major property damage occurred during the early years of my career. These tragedies left me with a clear understanding of the need for more effective serious incident prevention processes. I’ve also come to understand that much of the work necessary to sustain incident-free operations is of low visibility—often performed in the trenches of the organization. It is a paradox that this low-visibility work has profound implications for the organization’s highest-priority performance indicators, including profitability, customer satisfaction, safety, environmental performance, and public image. My career with Eastman Chemical Company began in 1969 with an assignment as a process improvement engineer in Eastman’s Texas Division polyethylene manufacturing facility in Longview. Eastman had operated high-pressure polyethylene reactor lines since the mid-1950s. However, as with many chemical plants of that era, the polyethylene plant did not always run smoothly. Full understanding and control of the manufacturing process was still evolving at the time I joined the company. Employees new to the polyethylene facility were often on the listening end of stories repeated by plant operators. Many stories were of past incidents that had potential to be major events, but through a phenomenon

1

CH01pp001-020 4/10/02 12:49 PM Page 2

2

■

Serious Incident Prevention

known as “Eastman luck” were mitigated without significant consequences. Having heard the stories of past near misses, I immediately thought of the polyethylene unit when my apartment shook in the early morning of February 25, 1971. It was the day “Eastman luck” ended. To researchers the event is now simply a line item on a long list of worldwide vapor cloud explosions in the past half-century: 25 Feb. 1971 . . . Longview, Texas . . . Polyethylene facility . . . ethylene (450 kg) . . . 0.5 tonnes TNT . . . 10% Yield . . . $17.5M Property Damage (1991 Value) . . . 3 Dead Leak from 12mm pipe connection to large pipe at 275 Mpa. Three explosions occurred. Second was worse. Some confinement by barricades and building around alleyway. Explosion felt 9.6 km away.1

To those directly involved, the magnitude of this 1971 incident was sobering, and its occurrence, despite the vigilance of a committed management team, made a lifelong impression. Such events raise doubts about human capabilities to successfully control technology. With improved management processes, however, Eastman’s polyethylene manufacturing units have now completed more than a quarter century without a major incident. Rather than “war stories,” new employees now hear success stories of improvements in product quality, equipment reliability, customer satisfaction, and safety. After completing three years as a process improvement engineer, I began a supervisory assignment with responsibilities for the polyethylene warehousing and shipping functions. The assignment served as an introduction to the challenges of sustaining manual handling operations in an injury-free manner. The experience continually reinforced the inadequacy of simply exhorting workers to “be more careful.” I quickly developed and have continued to maintain a favorable bias towards minimizing hazards through improving the process. I was later transferred to Eastman’s polypropylene manufacturing facility as manager of the polypropylene processing unit. During this assignment, another major incident occurred at the Texas Division site—further reinforcing the need for more effective incident prevention processes. This time, the incident involved an ethylene release from the ethyl alcohol manufacturing unit:

CH01pp001-020 4/10/02 12:49 PM Page 3

The Improvement Challenge

■

3

15 Oct. 1976 . . . Longview, Texas . . . Ethyl alcohol facility . . . ethylene . . . $26.1M Property Damage (1991 Value) . . . 1 Dead Failure of mixing nozzle led to jet of ethylene directed into courtyard between control room, process structure and pipe rack. Ignition by heaters 45 m away. Control room destroyed. Pipe breakage led to ensuing fire damage.2

During my years as safety director, major changes occurred in the chemical industry. The Bhopal, India, incident in 1984 triggered numerous initiatives, including OSHA special emphasis programs targeted for chemical facilities (ultimately leading to the OSHA Process Safety Management standard), the establishment of Chemical Manufacturers Association Responsible Care initiatives, and more active EPA involvement in process safety issues. Despite the many opportunities to learn from past incidents and additional regulatory actions, serious injuries continue to occur on a much-too-frequent basis.

Serious Incidents of the Past News reports of failures to sustain safe operations have a special impact on individuals with responsibilities for preventing serious incidents. Reactions to the initial reports can vary from disdain to empathy, depending upon the initial details provided. ■

■

■

After experiencing a major incident resulting in multiple fatalities and property damage in excess of $200 million, a facility spokesperson made the following statement: “It’s been a relatively safe plant. We’ve had numerous safety awards over the years. This is just devastating.”3 A press release following the occurrence of an explosion at another company emphasized that OSHA had conducted seven facility inspections, all with zero violations, in the months preceding the incident.4 A report from the National Transportation Safety Board indicated that the crash of a commercial plane departing from a Houston airport was caused by failure to reinstall 47 screws in the plane’s tail section following maintenance.5 One year later, another flight by the airline required an emergency landing due to excessive vibration.

CH01pp001-020 4/10/02 12:49 PM Page 4

■

4

■ ■

■

■

■

Serious Incident Prevention

Investigators found the cause to be another failure to reinstall wing screws.6 In Hamlet, North Carolina, 25 people died in a chicken processing plant fire because designated emergency exit doors were locked.7 In Houston, Texas, an inadequately trained night clerk silenced the switchboard buzzer indicating the need to activate the hotel’s fire alarm system because “the noise annoyed him.” Ten people were killed and 30 injured in the blaze.8 In Dallas, Texas, three construction workers died when a crane collapsed. At the time of collapse, the workers were positioned along the crane boom approximately 12 stories above the ground. After removing an 80-foot section from the front of the boom, the workers apparently failed to remove the proper number of concrete counterweights to keep the structure in balance prior to swinging the boom.9 In a Florida hospital, doctors mistakenly amputated the left leg of a diabetic instead of the right leg as scheduled. With corrective surgery, the patient became a double amputee. Eleven days later in the same hospital, a patient died when a respiratory technician unhooked the wrong patient.10 At a major university, 12 students died and dozens of others were injured when a massive bonfire of traditional but suspect design collapsed during construction.11

Since the mid-1980s, industry and many service organizations have made great strides in improving performance in key areas including product quality, customer service, productivity and cost control. Progress has often been driven out of necessity to recapture market share and improve profitability in the face of fierce competition. Performance management principles including teamwork, empowerment, employee participation, measurement, feedback, and positive reinforcement of individuals and teams have been a cornerstone of the improvement process. Is the progress in preventing serious safety-related incidents consistent with the breakthrough levels of improvement achieved in other key performance areas? Evidence indicates that progress has been less than stellar. For example, a 30-year analysis of 100 large property damage losses occurring in the hydrocarbon-chemical industry (Figures 1-1 and 1-2) indicates that the frequency of incidents has remained high compared to long-term historical levels. It is clear that breakthrough levels of improvement have not been achieved. Serious incidents have continued to occur and impact key company performance areas: safety, financial performance, employee relations, customer service, and company image.

CH01pp001-020 4/10/02 12:49 PM Page 5

The Improvement Challenge

■

5

Distribution of Incidents by 5 Year Intervals 35 31 30 25 19

Number 20 of Incidents 15

18

17

9

10 6 5 0 67-71

72-76

77-81

82-86

87-91

92-96

5 Year Interval

FIGURE 1-1. An analysis of 100 large hydrocarbon-chemical industry property damage losses: 1967–1996. From J&H Marsh & McLennan, Inc.12

Total Dollar Losses (1996 Dollars)

$2.83

$3.00

$2.50

$2.00 $1.48 $1.34

$1.50 Losses (Billions)

$1.04 $1.00 $0.39

$0.44

67-71

72-76

$0.50

$0.00 77-81

82-86

87-91

92-96

5 Year Interval

FIGURE 1-2. An analysis of 100 large hydrocarbon-chemical industry property

damage losses: 1967–1996. From J&H Marsh & McLennan, Inc.13

CH01pp001-020 4/10/02 12:49 PM Page 6

■

Serious Incident Prevention

Fatal Injuries

6

FIGURE 1-3. Annual number of fatal occupational injuries. Bureau of Labor

Statistics16

The analysis, involving losses originating primarily from fires and explosions, indicates an average loss of $76 million per incident for property damage alone—excluding the costs of business interruption, fines, penalties, employee injuries, liability claims and other expenses. Many of the incidents resulted in business interruption losses that far exceeded the total for property damage, with one single incident resulting in a business interruption loss totaling $700 million.14 Although the analyses in Figures 1-1 and 1-2 are focused on the chemical, oil refining, and gas processing industries, the opportunities for improvement in preventing serious incidents are not limited to any specific industry or business. For example, as illustrated by Figure 1-3, the rate of fatal occupational injures for all private businesses showed little improvement during the decade of the 1990s.15 Although OSHA delights in empha20 18 16 14 12 10 8 6 4 2 0

17.5 15.9 14.4

14.3

14.9

18.2

15.6 14.2

14.2

14.4

1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 FIGURE 1-4. Rail yard accident rate per 1 million yard-switching miles 1991–2000.

From U.S. Department of Transportation, Federal Railroad Administration17

CH01pp001-020 4/10/02 12:49 PM Page 7

■

The Improvement Challenge

60 50

7

54 46 42

40

40

40

40

42

34 28

30 20 10 0

1991 1992 1993 1994 1995 1996 1997 1998 1999 FIGURE 1-5. Large-loss fires that caused $5 million or more in property damage, 1991–1999 adjusted to 1990 dollars.18

sizing that workplace fatalities are now about 60 percent lower than the 14,000 annual fatalities occurring when the agency was enacted in 1971, the trend of the 1990s clearly indicates that the performance of businesses in preventing fatalities is stuck on a plateau.

43%

Mechanical Failure

21%

Operational Error

14%

Not Known

Process Upset

11%

Natural Hazard

5%

Design Error

5%

Sabotage/Arson

1% 0%

5%

10%

15%

20%

25%

30%

35%

40%

45%

PERCENT OF LOSSES FIGURE 1-6. Causes of hydrocarbon-chemical industry property damage losses: 1967–1996. From J&H Marsh & McLennan, Inc.19

CH01pp001-020 4/10/02 12:49 PM Page 8

8

■

Serious Incident Prevention

NOT KNOWN 14%

LESS CONTROLLABLE 6%

CONTROLLABLE 80%

FIGURE 1-7. Analysis of causes for large hydrocarbon/chemical property damage losses 1967–1996.

The rail industry provides another example of where there has been no improvement, and in fact an increasing rate of fatalities. As illustrated by Figure 1-4, the rate of rail yard accidents, including serious injury and property damage incidents, has increased from 14.4 accidents per million yardswitching train miles in 1991 to 18.2 accidents in 2000—an increase of about 26 percent. The lack of significant improvements in the prevention of large-loss fires, despite great strides in fire-fighting technology, is yet another example of the need for improved management processes. Figure 1-5 illustrates that the number of fires causing $5 million or more in property damage has remained relatively flat even when adjusted for inflation. Certainly, there is ample evidence, based on fatality rates, property damage, and other performance indicators, that an improved, more effective approach is needed to reduce serious incidents. Although the “all accidents are preventable” theme is often repeated by managers, the degree to which management control can prevent serious incidents is a valid question. Are such incidents truly uncontrollable, or do their paths typically include opportunities for prevention through proactive actions? An evaluation of hydrocarbon-chemical property damage losses20 indicates causes that are generally controllable account for about 80 percent of past serious incidents (Figures 1-6 and 1-7). These generally controllable causes include mechanical failure (43 percent), operational error (21 percent), process upsets (11 percent), and design error (5 percent). The categories of natural hazards and sabotage, which might be considered

CH01pp001-020 4/10/02 12:49 PM Page 9

The Improvement Challenge

■

9

relatively uncontrollable, have accounted for only about 6 percent of past incidents. Causes of the remaining incidents included in the study—14 percent of the total—are not publicly known. Certainly, safety professionals and line managers can attest to the fact that most common injuries, including serious injuries, are preventable. Accident investigations continually reinforce that injuries and other incidents have preventable causes, with many resulting from failures to adhere to the most basic of accident prevention principles. Table 1-1 summarizes probable causes of past serious incidents involving various types of facilities and businesses. An analysis of these past incidents confirms that in nearly all cases they could have been prevented or their consequences minimized through effective implementation of any number of actions considered to be fundamental for the type of operation in which the incident occurred. For example, preventative actions applicable to past petrochemical incidents include many safety practices fundamental to that industry—effective maintenance permit systems, piping system isolation techniques, lock-out procedures, operator training, preventative maintenance, inspections, audits, process hazard analyses, checklists, testing of critical instrumentation, redundant features in design of equipment, and conducting emergency drills.

Louisiana USA 1993 (22)

Sodegaura, Japan 1992 (23)

Known Consequences

A fire occurred after naphtha was released from a pipe that was being replaced. At the time of the naphtha release and fire, workers were positioned on scaffolding with limited means of escape.

Fatalities: 1 Injuries: 46 OSHA fine: $400,000

An intense fire occurred after a 6˝ diameter elbow ruptured and released hydrocarbons. The sustained heat caused other pipes in the unit to rupture resulting, in additional fires.

Property damage: $65 M Operating unit down one year

During startup, an exchanger leaked. Explosion occurred as bolts were being tightened to stop the leak.

Property damage: $161 M

Probable Cause

Inadequate isolation and depressurization of pipe containing naphtha

Potential Preventative Actions

Effective pipe isolation procedures Effective management systems for maintenance work: ■ Evaluation of hazards ■ Increased management over-

sight Improved safety auditing procedures Piping elbow was made of carbon steel instead of the chrome alloy steel required by the design specifications.

Effective process to ensure installation of piping consistent with design specifications Effective corrosion/erosion inspection process Sprinkler systems to minimize spread of fire

Exchanger not adequately secured prior to startup

Proper securement of vessel Procedure to leak test prior to startup Prompt shutdown when leak initially discovered

Serious Incident Prevention

Refineries California USA 1999 (21)

Incident Description

■

Location and Year (References)

CH01pp001-020 4/10/02 12:49 PM Page 10

10

TABLE 1-1 Analysis of Serious Incident Causes and Preventative Actions

Effective corrosion/erosion inspection program

Louisiana USA 1991 (25)

During fluidic catalytic cracking (FCC) unit startup, superheated oil was introduced to vessel thought to be empty but which contained water. A steam explosion occurred rupturing vessel and starting fire that engulfed FCC unit.

Fatalities: 6 Property damage: $23 M Business interruption: $44 M OSHA settlement: $6 M

Drain valve at bottom of vessel improperly closed during shutdown, allowing water to unknowingly accumulate.

Effective checklist for shutdown and startup of FCC unit Policy limiting valve operation to designated personnel Operator & maintenance personnel training

Texas USA 1991 (26)

A fire occurred in a crude unit due to seal failure on pump. Before pump could be shut down and isolated, heat of fire resulted in additional releases that spread fire.

Property damage: $25 M Business interruption: $76 M

Pump seal failure Lack of prompt shutdown and isolation

Double-seal pumps Heat-activated and/or remote-operated pump shutdown and valve isolation

Pennsylvania USA 1990 (27)

During manual draining of water from a debutanizer system in an FCC unit, LPG was suddenly released. The unit operator reportedly panicked and left the plant without closing the valve. The release continued and a fire and explosion occurred.

Property damage: $26.3 M

Inadequate drain system design

Double block & bleed drain system design to limit flow potential Capability for activation of valve from remote location Monitoring system for detection of water level in vessel Operator training

Louisiana USA 1988 (28)

During normal operation of an FCC unit, internal corrosion caused failure of 8˝ carbon steel elbow, resulting in release of hydrocarbons and vapor cloud explosion.

Property damage: $254 M 5,200 off-site property damage claims reported

Localized internal corrosion

More effective internal corrosion detection program

CH01pp001-020 4/10/02 12:49 PM Page 11

Erosion/corrosion in elbow

11

Property damage: $78 M

■

Explosion occurred following 6˝ carbon steel elbow rupture and release of hydrocarbon & hydrogen mixture.

The Improvement Challenge

California USA 1992 (24)

Potential Preventative Actions Process to ensure proper repair of pressure vessels including procedures, training, and controls. Effective process to detect corrosion and other deterioration of process vessels.

An operator was in the process of closing a valve to isolate a leak from a 6˝ horizontal crack at weld on a column. The crack spread to 24˝, and the column experienced total failure. Propane released at 200 psig propelled most of the 20-ton vessel 3,500´, where it toppled a 138KV power transmission tower. An explosion and major fire resulted.

Fatalities: 17 Lost workday injuries: 14 Property damage: $191 M

OSHA cited a failure to apply recognized welding procedures in previous repair of the vessel. Deficiencies included lack of post-weld treatment and inadequate inspection practices.

Two explosions in rapid succession occurred at a facility manufacturing explosive boosters for the mining industry. The explosions were initiated when a mixing blade was left embedded overnight in base mix for the explosive boosters in a large mixing pot. The solidified explosives in the pot detonated when the mixer blade was reactivated the next morning.

Fatalities: 4 Injuries: 6 Property damage: Plant destroyed

Inadequate process hazard analysis Inadequate training programs Inadequate operating procedures Insufficient separation distances between operations Inadequate inspection and auditing program

More comprehensive process hazards analysis Written operating procedures specific to process Effective communications Explosives training and safety programs Management-of-change Process Periodic assessments and audits Increased separation between facilities

A laminated shell reactor in a urea manufacturing unit exploded after an improperly welded bracket resulted in a carbonate leak and corrosion of the outer containment vessel. Reportedly,

Property damage: $25 M Business interruption: $20 M

Improper weld Inadequate monitoring of weep holes for early detection of leakage

More effective welding inspection/quality assurance program More effective process for periodically monitoring and reporting status of weep holes

CH01pp001-020 4/10/02 12:49 PM Page 12

Louisiana USA 1992 (32)

Probable Cause

Serious Incident Prevention

Chemical Facilities Nevada USA 1998 (31)

Known Consequences

■

Illinois USA 1984 (29, 30)

Incident Description

12

Location and Year (References)

CH01pp001-020 4/10/02 12:49 PM Page 13

the leak went undetected for some time because weep holes designed to detect leakage through the laminated reactor layers were not adequately checked on routine basis.

Valve mistakenly opened, which dumped reactor contents

More effective process for valve lockout and isolation of lines & vessels. More effective compliance audit system Additional training of operating and maintenance personnel, including contractors

Texas USA 1990 (36, 37)

An explosion and fire originated in a 900K gallon wastewater tank during reinstallation of a compressor used to remove hydrocarbon vapors from the tank. An oxygen analyzer falsely indicated low oxygen and caused the control system to reduce nitrogen flow. The lower rate of nitrogen flow was insufficient to prevent formation of a flammable mixture in the tank’s vapor space. The flammable mixture is believed to have ignited with startup of the compressor.

Fatalities: 17 Property damage: $12 M Business interruption: $200 M

The failure of an oxygen analyzer that inaccurately indicated low oxygen and inadequate redundancy in the nitrogen control system.

Provide redundancy for oxygen analyzers and other critical instrumentation Modify nitrogen control to ensure adequate nitrogen at all times Eliminate need for compressor Additional training for operating and technical personnel Improved calibration and test process for critical instrumentation

13

Fatalities: 23 Property damage: $675 M Business interruption: $700 M OSHA settlement: $4 M Approximately 1,000 legal claims reportedly filed.

■

During a maintenance shutdown, a large flow of ethylene was released from a high-density polyethylene reactor. An explosion occurred that destroyed two production units and caused BLEVEs of nearby tanks. Release occurred through an 8” valve that should have remained locked out in inoperable position for duration of shutdown.

The Improvement Challenge

Texas USA 1989 (33-35)

Known Consequences

Probable Cause

Potential Preventative Actions

■

A contractor accidentally cut into a 10˝ propane line at a storage terminal. Flammables from 5 underground storage caverns were released, and a large vapor cloud formed and exploded.

Property damage: $43 M

Cutting into line that contained pressure

More effective permit system for maintenance activities Process to positively identify lines/equipment prior to start of work Remote-operated emergency shutoff valves on wellheads.

Pennsylvania USA 1988 (39)

An estimated 3.9M gallons of diesel fuel spilled when a 40year-old 120´ diameter tank that had recently been reassembled suddenly ruptured during its initial filling. Approximately 750K gallons washed over dikes into the Monongahela River.

Specific loss estimate not available. Fees for cleanup and legal claims were substantial.

Failure of tank Failure to use the most stringent standard hydrostatic test practices prior to filling with diesel (tested by filling only 5´ of tank with water instead of entire tank)

More effective prestartup inspection and test practices for tanks Adequate diking

Texas USA 1992 (40, 41)

A release of hydrocarbons occurred due to an overfill of a salt dome storage cavern. A large vapor cloud and explosion resulted.

Fatalities: 3 (off-site) Property damage: $9 M Facility operating permit revoked Civil jury judgment: $143 M

Failure of system designed to automatically close valves on cavern wellhead in event of overfill. The telemetry system monitor at remote control center displayed data in a format difficult to quickly interpret.

Accurate process for monitoring cavern inventory level Periodic testing of shutdown devices An effective audit and inspection process Improved telemetry formatting of critical data

Serious Incident Prevention

Hydrocarbon Storage Terminals Texas USA 1985 (38)

CH01pp001-020 4/10/02 12:49 PM Page 14

Incident Description

14

Location and Year (References)

Other North Carolina USA 1991 (44)

More effective process for valve lockout and isolation of lines and equipment

A heat exchanger in a liquefied natural gas plant ruptured violently due to overpressure. Investigation indicated a closed valve on a 24-inch blowdown line prevented both the safety relief valves and a pressure controller from performing their function.

Property damage: $50 M

Closed valve prevented relief valves and pressure controller from functioning.

More effective system for managing block valves in pressure relief lines More effective procedures and checklists for startup of operations

Chicken processing facility employees attempted to evacuate after a fire began in the plant’s deep-fat fryer operation. Evacuating employees found many exits either locked or blocked.

Fatalities: 25 OSHA fine: $810,000 Plant owner sentenced to 20year prison term

Locked and blocked exits Leak from hydraulic lines

Evacuation plan Employee training Emergency drills Inspections to ensure open and unblocked exits Process hazard analysis of hydraulic system

15

Isolation valve opened prematurely

■

Property damage: $250 M Business interruption: $750 M

The Improvement Challenge

Bontang, Indonesia 1983 (43)

After changing a leaking seal on an LPG pump, plant personnel were in the process of tightening a flange after removing an isolation blind on the pump’s suction line. LPG product began leaking from the flange and formed a vapor cloud that resulted in a series of explosions. Investigation indicated a motor-operated isolation valve in the suction line was open instead of closed, allowing LPG to reach the unsecured flange.

CH01pp001-020 4/10/02 12:49 PM Page 15

Gas Processing Plants Mexico 1996 (42)

Alaska USA 1994 (46)

A 987-foot tanker ran aground on a reef spilling 11M gallons of crude oil from the tanker’s ruptured hull. Implementation of effective cleanup efforts was slow to develop, and approximately 1,200 miles of coastline were ultimately affected.

Ohio USA 1990 (47)

At a resin manufacturing plant, operators were cleaning a reactor between batches of resin. Solvent was pumped into the bottom of the reactor as part of the cleaning process. The residual heat caused the solvent to vaporize and over-pressure the reactor. Hot vapors were released through the reactor rupture disc and formed a vapor

Screws missing from tail section

Effective maintenance procedures, including inspection process More effective accountability system for parts and fasteners removed Training of maintenance personnel

Multiple causes including: Tanker allowed to veer off course Low level of emergency preparedness: a) response barge too small and inadequately equipped with adequate length of boom b) response team inadequately trained

Establish effective policy for other vessels to escort tankers Improve emergency plan, conduct drills and audit preparedness Provide adequate emergency response equipment. Ensure effectiveness of alcohol/drug testing program

Flammable solvent introduced into hot reactor

Procedure to cool reactor prior to introduction of solvent Substitution of less flammable solvent (or elimination of need for solvent) Improved vent system to eliminate potential vapor accumulation in building.

Fatalities: 14 Loss of plane

Punitive damages: $5 billion (ordered September 1994) Paid to Alaska fishermen for immediate losses: $287 M Settlement on criminal charges filed by state and federal government: $1.02 billion Paid for cleanup: $2.1 Billion Property damage: $23 M Other losses not known.

Potential Preventative Actions

Serious Incident Prevention

A commuter plane went into a severe nosedive and crashed when a de-icer boot on the tail section apparently came loose during flight. Company officials confirmed that 43 screws were removed from the tail section during maintenance and were not reinstalled, due to an oversight.

Probable Cause

■

Texas USA 1991 (45)

Known Consequences

CH01pp001-020 4/10/02 12:49 PM Page 16

Incident Description

16

Location and Year (References)

CH01pp001-020 4/10/02 12:49 PM Page 17

cloud in the reactor building. The cloud contacted an ignition source and an explosion occurred. Florida USA 1995 (48)

During surgery to amputate one leg of a diabetic, doctors mistakenly removed the left leg instead of the right. Correction left the patient a double amputee.

Failure of hospital quality assurance process Unnecessary amputation and death Liability claims Damage to reputation and image

Develop and implement an effective patient accountability and quality assurance process

The Improvement Challenge ■

17

CH01pp001-020 4/10/02 12:49 PM Page 18

18

■

Serious Incident Prevention

The analysis of past serious incidents supports the contention of author and petrochemical process safety expert Trevor Kletz, who states: It might seem to an outsider that industrial accidents occur because we do not know how to prevent them. In fact, they occur because we do not use the knowledge that is available.49

References 1. J. A. Davenport and E.M. Lenoir, “A Survey of Vapor Cloud Explosions, Second Update,” Proceedings of the 26th Annual Loss Prevention Symposium, American Institute of Chemical Engineers (1992): 13–15. 2. Ibid. 3. D. Jackson, “Pampa Plant Deciding When and Whether It Will Reopen,” Dallas Morning News, 16 November 1987, 1A, 4A. 4. G. Morris, “New Details Emerge as Carbide Fights OSHA Fine,” Chemical Week, 15 January 1992, 16. 5. “Missing Screws Caused ‘91 Commuter Plane Crash, NTSB Says,” Dallas Morning News, 22 July 1992. 6. “Missing Wing Screws Cited in Aborted Flight,” Dallas Morning News, 23 December 1992, 1A, 30A. 7. “Report on Fire at NC Food Plant Sent to Prosecutor,” Dallas Morning News, 7 September 1991, 3A. 8. M. Reeves, “Clerk Turned Off Alarm, Official Says,” Dallas Morning News, 7 March 1982, 1A, 7A. 9. T. J. Meyer, “Crane Collapse Kills 3, Hurts 1,” Dallas Morning News, 26 April 1987, 1A, 28A. 10. D. Sharp, “Errors Renew the Call for Doctor Review,” USA Today, 27 March 1995, 1. 11. H. Petroski, “Vanities of the Bonfire,” Professional Safety, July 2001, 20–24. 12. D. G. Mahoney, ed., Large Property Damage Losses in the HydrocarbonChemical Industries, A Thirty-Year Review, 17th ed. (Risk Control Consulting, a division of J&H Marsh & McLennan Inc., formerly M&M Protection Consultants: 1997), 1–46. 13. Ibid. 14. Ibid. 15. Bureau of Labor Statistics, Census of Fatal Occupational Injuries, Industry by Year, 1992–1999. 16. Ibid. 17. U.S. Department of Transportation, Federal Railroad Administration, Rail Yard Accident Rate per 1 Million Switching Miles, 2000.

CH01pp001-020 4/10/02 12:49 PM Page 19

The Improvement Challenge

■

19

18. S. G. Badger and T. Johnson, “1999 Large-Loss Fires and Explosions,” NFPA Journal, November/December 2000, 80. 19. Mahoney, ed., “Large Property Damage Losses.” 20. Ibid. 21. Chemical Safety and Hazard Investigation Board, Federal Investigation of Tosco Refinery Fire Finds Flawed Management Supervision, 28 March 2001. 22. Mahoney, ed., “Large Property Damage Losses.” 23. Ibid. 24. Ibid. 25. Ibid. 26. Ibid. 27. Ibid. 28. Ibid. 29. Ibid. 30. United States of America Occupational Safety and Health Review Commission, Notice of Decision in Reference to Union Oil Company of California, Chicago Refinery, 29 December 1987. 31. Chemical Safety and Hazard Investigation Board, Investigation Report, Explosives Manufacturing Incident, Sierra Chemical Company, 2001. 32. Mahoney, ed., “Large Property Damage Losses.” 33. Ibid. 34. Phillips Petroleum Company, Phillips 66 Company’s Response to OSHA Citations, 9 May 1990, 1–10. 35. “15 People are Awarded $730,500 in Phillips Explosion Settlement,” Dallas Morning News, 24 November 1993. 36. Mahoney, ed., “Large Property Damage Losses.” 37. ARCO Chemical Company, A Briefing on the ARCO Chemical Channelview Plant July 5, 1990 Accident, January 1991. 38. Mahoney, ed., “Large Property Damage Losses.” 39. J. Prokop, “The Ashland Tank Collapse,” Hydrocarbon Processing, May 1988, 105–108. 40. National Transportation Safety Board, Pipeline Accident Report, Highly Volatile Liquids Release from Underground Storage Cavern and Explosion. Mapco Natural Gas Liquids Inc. Brenham, Texas, April 7, 1992, Notation 5779B, Washington D.C., 4 November 1993. 41. “Reopening of Salt Dome Storage Facility Blocked,” Dallas Morning News, 14 June 1994. 42. Mahoney, ed., “Large Property Damage Losses.” 43. Ibid. 44. “Report on Fire at NC Food Plant Sent to Prosecutor,” Dallas Morning News, 7 September 1991, 3A. 45. “Missing Screws Caused ‘91 Commuter Plane Crash, NTSB Says,” Dallas Morning News, 22 July 1992. 46. G. Jones, “Exxon Trial Set to Open,” Dallas Morning News, 1 May 1994, 1A, 20A.

CH01pp001-020 4/10/02 12:49 PM Page 20

20

■

Serious Incident Prevention

47. Mahoney, ed., “Large Property Damage Losses.” 48. D. Sharp, “Errors Renew the Call for Doctor Review,” USA Today, 27 March 1995, 1. 49. T. A. Kletz, Lessons from Disaster: How Organizations Have No Memory and Accidents Recur (Houston: Gulf Publishing, 1993), 1.

CH02pp021-028 4/10/02 12:49 PM Page 21

C H A P T E R

2

The Barriers to Improvement Sustaining serious incident-free operation for the long-term has proven to be elusive for many companies. Given that most incidents could have been prevented through the use of fundamental safe practices, why have companies not been more successful in preventing serious incidents? It is apparent that numerous barriers exist in sustaining incident free operations—barriers that many organizations have been unable to overcome. Maintaining the constancy of purpose needed has proven difficult. Ever-shifting forces continually shape organizational priorities and the process for allocating resources. These forces often favor highly visible projects with a payback perceived to be quick, rather than less-visible initiatives designed to ensure continuing financial success through the prevention of high-consequence accidents that are often perceived to be low probability events. As a result of the focus on shorter-term interests, the priority and resources for work required to prevent serious incidents may over time be relegated to a level where excellence is difficult to sustain. Organizational barriers that inhibit serious incident prevention include: ■ ■ ■

A focus on today’s problems Limited employee involvement Inadequate measurement and feedback 21

CH02pp021-028 4/10/02 12:49 PM Page 22

■

22 ■ ■ ■ ■

Serious Incident Prevention

Inadequate recognition Limited line organization ownership Limited personal experience Misguided optimism

A Focus on Today’s Problems Managers and other personnel tend to allocate time and resources to activities that relieve current pressures. The importance of serious incident prevention is generally recognized, but the work necessary to ensure a safe workplace is sustained may often be treated as deferrable. Unless an incident actually occurs, failure to properly execute incident prevention work may result in no undesirable consequences for personnel responsible for the work. Unfortunately, accountability actions implemented after the occurrence of a catastrophic incident do not reverse the damage done. By viewing the critical work as deferrable, managers fail to embrace what author Stephen R. Covey refers to as the “Law of the Farm”: Procrastinating and cramming don’t work on the farm. The cows must be milked daily. Other things must be done in season, according to natural cycles. Natural consequences must follow violations, in spite of good intentions. We’re subject to natural laws and governing principles—the laws of the farm and harvest. The only thing that endures over time is the law of the farm. According to natural laws and principles, I must prepare the ground, put in the seed, cultivate, weed, and water if I expect to reap a harvest.1

A manager’s daily schedule tends to fill with meetings, report deadlines, and responses to requests from superiors. Many managers simply do not consistently take the actions needed to adequately support the incident prevention process. Too often, managers find themselves majoring in responses to events that appear pressing but which make no significant contribution toward success of the organization’s mission. To sustain long-term success in the prevention of incidents, managers must assure that the allocation of their time is properly aligned with safe workplace objectives.

Limited Employee Involvement Identifying the critical work required to succeed in any key performance area is best accomplished through input from personnel responsible

CH02pp021-028 4/10/02 12:49 PM Page 23

The Barriers to Improvement

■

23

for achieving results. Organizations typically recognize employee involvement as a prerequisite for improvements in performance areas such as product quality, productivity, cost control, customer service, and injury prevention. However, the same organizations may attempt to address the prevention of high-consequence incidents with a top-down, regulatorydriven approach. Such an approach fails to achieve ownership at the important point-of-control operating level. Restricting employee involvement may also result in failure to include preventative actions known to be critical only by point-of-control personnel. Failure to actively involve employees is a barrier to achieving a common understanding throughout the organization of “how, when, and why” work critical to sustaining safe operations must be done. Without a common understanding of performance expectations or the relevance of the work, failure is a predictable outcome.

Inadequate Measurement and Feedback Teams are more likely to achieve and sustain excellent results when performance is measured and feedback is provided. Experience has validated the accuracy of the old adage, “What gets measured gets done.” However, in many organizations, measurement and feedback systems regarding the status of work necessary to sustain incident-free operations are often inadequate. As a result, operating personnel, management, and others with a need to know are not sufficiently informed and are therefore not in position to manage effectively. Most organizations maintain a strong focus on minimizing the frequency of OSHA recordable injuries. As part of an organization’s process for preventing recordable injuries, observations of work practices and the documentation of minor injuries serve as ongoing reminders of the potential for experiencing injuries. These actions also provide ongoing feedback of effectiveness for the injury prevention process. In the process to prevent serious incidents, however, measurement and feedback systems are often not as formally established for upstream indicators of potential problems. For managers who typically “manage by exception,” such lack of information about potential problems can create an unjustified overconfidence in an organization’s serious incident prevention efforts. Without knowing the status of critical work, management options to influence serious incident prevention become limited—typically to general exhortations regarding the importance of safe work. You know them well— “Safety is Number 1—Let’s make all production safe production”—and similar slogans. Such communications, when not supported by adequate

CH02pp021-028 4/10/02 12:49 PM Page 24

24

■

Serious Incident Prevention

knowledge and allocation of resources, are analogous to Covey’s description of a gardener exhorting a flower to “Grow! Grow!” while limiting the water and fertilizer to other plants in the garden.2

Inadequate Recognition Individuals tend to place priority on activities that generate potential for favorable personal recognition. Recognition perceived as certain to occur following satisfactory performance is particularly powerful in driving desired actions and results. Clearly, effective reinforcement is not possible without timely knowledge of performance. Furthermore, in the absence of meaningful recognition, it is unreasonable to expect individuals to sustain excellence for the long-term. Without accurate feedback, managers may unknowingly undercut the serious incident prevention process by reinforcing results accomplished through eliminating, short-cutting, or deferring safe work practices. A manager may favorably recognize personnel for their efforts to minimize the time required to complete a maintenance shutdown when the manager does not know that recognized safe practices were violated to save time. Misguided reinforcement, made in the absence of an accurate feedback system, can lead to a culture where performance of the work to prevent incidents is considered optional rather than an organizational value that cannot be compromised. Management bonus plans based upon organizational performance have been a part of corporate culture for many years. The expansion of bonus plans to lower levels of the organization and increasing percentages of compensation tied to such plans is a growing trend. In some organizations, the base compensation for both managers and nonmanagers is reduced and placed “at risk,” with receipt contingent upon organizational performance. Typically such plans provide a range of possible outcomes—ranging from loss of all “at risk” compensation for poor results to receipt of several times the “at risk” amount for outstanding results. The impact of bonus plans on decisions and other behaviors serves as a testimony to the power of reinforcement. The designated measures that determine the size of the bonus become the focus of attention. When significant compensation is at stake, managers can be tempted to take actions that may increase this year’s bonus, even though such actions may not be prudent from a long-term perspective. When production volume or reductions in maintenance cost are a significant part of the measurement used for the bonus calculation, for example, managers may tend to defer needed maintenance and may be tempted to push production rates too far.

CH02pp021-028 4/10/02 12:49 PM Page 25

The Barriers to Improvement

■

25

Management at all levels must continuously be aware of the potential for imprudent actions initiated to help ensure a high bonus plan payout. Despite pressures that may be created by bonus plans, managers must continuously look at the big picture and maintain a long-term perspective. Managers should be diligent in communicating the importance of serious incident prevention throughout the organization, and personal actions must be congruent with the message communicated.

Limited Line Organization Ownership It’s well recognized that achieving and maintaining outstanding safety performance is dependent upon line organization ownership. Acceptance by the line organization as full owner of the serious incident prevention process may be complicated by several factors including: (1) lack of line organization involvement in developing the process, and (2) dependence upon staff groups and contractors to conduct a significant portion of the critical work. Contractors or internal staff groups, for example, may be utilized for specialized work, such as equipment inspections, instrument calibrations, corrosion monitoring, and relief valve tests. When these conditions exist, line organizations may take a passive, partial ownership position rather than assuming a broader, more active role. When ownership is passive, members of the line organization team may lack the motivation to implement prompt corrective action when needed. When the staff group responsible for inspecting and testing the thickness of pipes and vessels falls behind schedule, only active, committed owners will take the initiative to resolve the problem. Rather than feeling a sense of urgency to take action, passive owners look at such situations as someone else’s problem to solve. When execution of critical work is dependent upon other groups, active intervention by the line organization may often be required to ensure the work is satisfactorily performed.

Limited Personal Experience An individual’s priorities are heavily shaped by past experiences. Managers often obtain experience relatively quickly in areas of responsibility such as product quality, customer service, and prevention of common injuries. Incidents affecting these areas tend to be frequent enough to introduce even relatively new managers to the consequences that occur when deficiencies are allowed to exist. However, the same managers may have no direct experience with serious incidents due to their inherent low

CH02pp021-028 4/10/02 12:49 PM Page 26

26

■

Serious Incident Prevention

frequency of occurrence. Without having experienced the consequences, managers may not have the foresight and self-motivation to maintain the disciplined approach required for sustaining serious incident-free operations. When addressing the potential for serious incidents, these managers may express limited concern because such an incident “has never happened during my career.”

Misguided Optimism Many managers share a belief in the power of positive thinking. For some, such beliefs include a fear that acknowledgment of risks or other expressions of concern may result in an undesirable self-fulfilled prophecy, or at the minimum be perceived by superiors as weak leadership. In these organizations a condition known as “groupthink” may develop where members of the group relinquish individual opinions to avoid being perceived as nonsupportive of the group. In such groups there is little room for critical questions or dialogue regarding alternate approaches. When groupthink is at work, there is a strong atmosphere to conform, dissension is unwelcome, and individual censorship is prevalent. Individuals in the group develop a belief that they couldn’t possibly be intelligent enough to question the group’s plans. It’s not surprising that in such environments, the go-ahead is often given to plans that have little chance for success—new products with no realistic chance for survival are launched, solutions not related to root causes are embraced, and the safety risks of operations are not openly addressed.3 Vernon L. Grose, a pioneer in the application of systems methodology for controlling risks, once stated: “Risk, for those committed to benefit, is like a bad dream. Aspiring to manage risks is like a wartime Marine volunteer hoping to become a supply depot sentry. It has the glamour, promotion potential, and excitement of a yawn.”4

Unfortunately, Grose’s description may be accurate within many organizations. In these organizations, serious incident prevention has not yet been established as a true organizational priority, and little recognition exists for identifying and executing the work critical to its success. The straight-ahead approach with minimal thought to “what can go wrong” may serve managers well when discharging some responsibilities. However, managers must recognize that, with the catastrophic consequences of a serious incident, optimism must be tempered with a full understanding of the risks and

CH02pp021-028 4/10/02 12:49 PM Page 27

The Barriers to Improvement

■

27

a systematic process for ensuring unacceptable risks are controlled. Even captains of “unsinkable” ships need to consider the icebergs.

Overcoming the Barriers Maintaining the conditions necessary to sustain serious-incident-free operations may be either driven or restrained by various organizational forces. One approach to achieving any objective, including safe operations, is to overwhelm it with the resources needed to drive improvement. Certainly command-and-control organizations are dependent upon the application of such resources in sufficient quantity and depth if they are to succeed. A second, more cost-effective strategy is to complement driving forces with actions that lower the intensity of restraining forces within the organization. Actions should be taken to identify barriers that are roadblocks to success, and to initiate appropriate actions that remove or lower the barriers. For a major construction project, examples of driving forces to help ensure safe work could include actions such as mandating safe work as a

RESTRAINING FORCES Conflicting Priorities Knowledge Gaps Resource Limitations Overconfidence Lack of Accountability

SERIOUSINCIDENT INCIDENT PREVENTION PREVENTION SERIOUS

Communications Policies & Procedures Employee Involvement Measurement & Feedback Training Hazard Identification Audits Recognition

DRIVING FORCES FIGURE 2-1. A force field diagram for sustaining serious-incident-free operations.

CH02pp021-028 4/10/02 12:49 PM Page 28

28

■

Serious Incident Prevention

condition of employment, developing procedures, conducting inspections, and applying disciplinary actions. All of these are important actions, but safety performance can be further enhanced through actions that reduce employee and management resistance. Ensuring employee participation in the job planning process, use of safety teams, and other actions to increase involvement, understanding, and ownership are examples of actions that reduce restraining forces. A force-field diagram, Figure 2-1, illustrates the relationship between driving and restraining forces and their importance in maintaining performance at a high level. One approach to raising the safety performance bar is to increase the intensity and number of driving forces. For example, an organization may enhance the depth or frequency of audits. A second, complementary approach involves taking actions to reduce the impact of restraining forces such as knowledge gaps and lack of accountability. In practice, many driving forces also serve to improve conditions that restrain performance. Employee involvement and training, for example, reduce performance restraints arising from limited ownership and lack of knowledge. Other forces intended to drive improvement have limited impact on restraining forces and may have very limited driving power as well. Examples of driving forces that typically have very limited impact include management exhortations, posters, and slogans. A process that strives to maximize driving forces while ignoring the need to reduce restraining forces will consume a substantial level of management’s energy. With today’s lean organizations, it’s doubtful that long-term success could be sustained with such an unbalanced, resource-intensive approach. History confirms that breakthrough achievements usually do not occur totally by chance. Even accomplishments that initially merit classification as a “miracle” are usually found upon further research to have been given a planned birth. So it is with achieving breakthrough improvements in sustaining safe operations—commitment and proactive actions are required. The barriers may be formidable, and overcoming them will require an effective process—one that not only drives improvements but that also minimizes restraining forces within the organization.

References 1. S. R. Covey, Principle-Centered Leadership (New York: Simon & Schuster, 1992), 161, 195. Excerpt used with permission. All rights reserved. 2. Ibid. 3. D. Gano, Apollo Root Cause Analysis (Yakima, Wash.: Apollonian Publications, 1999), 147. 4. V. L. Grose, Managing Risk—Systematic Loss Prevention for Executives (Englewood Cliffs, N.J.: Prentice Hall, 1987), 26.

CH03pp029-036 4/10/02 12:49 PM Page 29

C H A P T E R

3

A Proven Process Improvement Model In my career as a manager, nothing was more personally disappointing than an injury to a team member. (My active involvement in promoting safety as a line manager ultimately led to my reassignment as safety director.) For many years, my efforts resulted in rather marginal improvements in safety performance despite a strong commitment to the achievement of a safe workplace. The inability to achieve and sustain breakthrough levels of improvement became a source of frustration. Finally, in the mid-1980s a change from the traditional safety management process to a performance-management-based, behavioral approach was initiated with employees taking a leadership role. The change to a behavioral approach proved to be a milestone event that led to breakthrough improvements. The behavioral safety process remains in effect today and has been the catalyst for reducing injuries in many areas of the company by more than 80 percent. While eliminating workplace injuries is a part of a manager’s safety responsibilities, there are other requirements that are also critical to success. In addition to preventing injuries, managers must be responsible for the safety of the process, i.e., preventing property and equipment damage, production downtime, hazardous material spills, and similar incidents. Ensuring regulatory compliance and workplace security are other key performance expectations. 29

CH03pp029-036 4/10/02 12:49 PM Page 30

30

■

Serious Incident Prevention

While companies often cite their favorable OSHA injury statistics as evidence that the entire safety process is being well managed, a closer analysis indicates this approach can lead to a false sense of well-being. In reality, there is often limited correlation between an organization’s injury frequency and the fitness of the safety process that is in place for managing other responsibilities such as process safety and regulatory compliance. While there is some overlap, many differences exist in the work required for an organization’s success in each of its important safety performance areas, as illustrated by Figure 3-1. Certainly, the fact that an organization is doing a good job in eliminating slips, trips, and falls does not necessarily mean that the organization’s process for eliminating the potential for hazardous material releases is effective. These are separate processes, each with its own set of critical work that must be diligently executed for success. In addition to achieving breakthrough reductions in workplace injuries through behavioral-safety initiatives, performance management techniques have also proven effective in achieving major improvements in other areas of safety. For example, implementation of these techniques has led to major reductions in accidental releases of chemicals, hazardous material transportation incidents, and regulatory agency violations. Through actions such as measurement of upstream performance indicators, performance feedback, and positive reinforcement, workplace safety in all critical areas has been greatly improved.

RegulatoryCompliance Compliance Regulatory

Injury Prevention

Process Safety

Tasks for Safety Objectives Tasks forMeeting Meetingother Other Safety Objectives

FIGURE 3-1. Universe of tasks required to fully achieve safety performance

expectations.

CH03pp029-036 4/10/02 12:49 PM Page 31

A Proven Process Improvement Model

■

31

With the presence of conflicting priorities and other organizational barriers, a proactive, disciplined approach is required to sustain serious-incident-free operations. An effective management system is needed to help shape a new mindset—one recognizing that incident prevention is much more than simply maintaining a high level of awareness. Successful incident prevention requires an understanding of risks specific to the organization and the execution of critical work to minimize the risks. Performance management principles have been effectively applied in many organizations to improve key results. The quality management focus within these organizations has typically been on visible opportunities for improving the current year’s bottom line. Opportunities to improve performance in high visibility areas, such as product quality, cost control, and customer service, have been abundant. Many companies have also applied performance management techniques, typically in the form of behavioralsafety initiatives, to achieve breakthrough improvements in injury rates. With the quality revolution still in its infancy—or perhaps in its adolescent stage—applications of performance management principles to less visible opportunities, such as sustaining serious incident-free operations, are not as firmly established. However, it’s clear that these proven management principles have great potential for driving breakthrough performance improvements in the prevention of serious incidents—an opportunity waiting to be seized by proactive managers interested in making a true difference. Quality management process models typically have some differences in emphasis—often traceable to the quality gurus utilized by various companies. However, at their core, successful improvement models typically have many elements in common. The safety management process reviewed in the chapters that follow is a proven approach for preventing serious incidents with its core elements rooted in proven performance management processes. These core elements critical to successful safety management processes include: 1. A high level of management leadership. 2. Active employee participation in leadership roles. 3. A firm understanding of what must be managed for successful achievement of safety and other organizational objectives. 4. An accurate identification of the critical work that, when executed, will provide the conditions and practices necessary to achieve and sustain a safe workplace. 5. A common understanding of performance expectations. 6. Effective measurement and timely feedback of performance in meeting objectives.

CH03pp029-036 4/10/02 12:49 PM Page 32

32

■

Serious Incident Prevention

7. Effective reinforcement processes to help individuals and teams feel genuinely appreciated for their actions to meet or exceed performance expectations. 8. Application of a “Plan-Do-Check-Act” improvement process to ensure plans are implemented, performance monitored, and adjustments made as necessary to achieve desired results. Full application of the “Plan-Do-Check-Act” cycle (illustrated in Figure 3-2), also known as the Deming improvement cycle, helps minimize the mortality rate for new improvement initiatives.1

Process Model For Serious Incident Prevention On a global basis, progress appears relatively limited in the full application of performance management principles for ensuring the work required for serious incident prevention is sustained at high performance levels. A process model is needed that merges proven performance management techniques with sound risk-management practices. The following eight elements are essential for inclusion in an effective process for maintaining workplace conditions necessary to sustain serious-incident-free operations.

Element 1: Management Commitment and Leadership Management commitment and leadership is critical to overcoming the barriers for success and for maintaining the serious incident prevention

FIGURE 3-2. The “Plan-Do-Check-Act” continuous improvement cycle.

CH03pp029-036 4/10/02 12:49 PM Page 33

A Proven Process Improvement Model

■

33

process as a top priority throughout the organization. Ideally, the development and implementation of improved safety management processes should be driven by top management. Top management leadership helps assure that sufficient resources are available for implementation and thus increases the probability of favorable recognition for performing the required work. Nevertheless, lack of a clear upper management mandate to implement an improved incident prevention process should not be an insurmountable barrier for the supervisor who desires improvement. In fact, it is relatively common in companies of all types and sizes to find organizational units within the company that are “islands of excellence.” In these units, the leadership and commitment of the supervisor is at such a level that achievement of outstanding results is not dependent upon the boss’s strong, visible support. These managers find a way to implement an improved safety process, because it is simply “the right thing to do.” Supervisors and managers at each level of the organization need to recognize that they are considered “top management” by their subordinates, and each level of management must assume a strong leadership role. Application of the serious incident prevention process model ensures that management’s investment of time and resources will yield the desired results.

Element 2: Involve Employees Full employee involvement is essential to leveraging the organization’s limited resources, capturing vital employee knowledge, and facilitating employee ownership of the process. The full benefits of employee involvement are achieved only when employees have leadership roles in all aspects of developing, implementing, maintaining, and improving the serious incident prevention process. The process model provides effective techniques for leveraging the power of employee involvement in accomplishing the work required to prevent serious incidents.

Element 3: Understand the Risks Success in any endeavor requires knowledge of potential risks. Without a firm understanding of the risks, pitfalls are identified only after they occur, a “fly-crash-fix-fly” cycle. With the nonroutine nature of serious incidents, the focus must be on what can happen rather than what has happened in the past. The argument that a unit has been operating 10 to 20 years without problems must be granted only limited consideration in evaluating the potential for a future incident. Past incidents involving Flixboro, Bhopal, and the Exxon Valdez

CH03pp029-036 4/10/02 12:49 PM Page 34

34

■

Serious Incident Prevention

illustrate this point: The specific chain of events leading to these catastrophic incidents had not previously occurred within the company experiencing the incident. The identification of risks that can lead to incidents having serious consequences for the organization is a key element of the serious incident prevention process model.

Element 4: Identify Critical Work for Controlling the Risks The key to avoiding risk management by the “fly-crash-fix-fly” cycle is to proactively identify and execute the critical work required to effectively control risks. In today’s working environment, it is rare to find an organization where people don’t work long and hard, but organizations where people focus their work on the most important issues and tasks are a rarity as well. The serious incident prevention process model includes the identification of the critical work that the organization must focus on to successfully control major risks.

Element 5: Establish Performance Standards Once the work critical to incident-free operations is identified, performance standards are required to establish the parameters for satisfactorily executing the work. What must be done, when it will be done, and who will do it must be clearly established. Performance standards should be the product of thorough research and evaluation. Standards not providing guidance in sufficient detail may leave too much to the discretion of the performer. Such inadequate standards can result in work performance not meeting the intended objective, while overly excessive requirements increase costs without a corresponding increase in safety. Issues often arise within the organization about how frequently inspections, audits, hazard reviews, training, and other tasks should be conducted. Determining the optimum frequency for these tasks may create tension between the organization’s safety objective and other key objectives, such as cost control and productivity. The serious incident prevention process model emphasizes the need for establishing standards that are effective in both the prevention of incidents and in resource utilization.

Element 6: Maintain Measurement and Feedback Systems Identifying the critical work and developing performance expectations establishes actions critical to achieving safe operations. Unless executed ac-

CH03pp029-036 4/10/02 12:49 PM Page 35

A Proven Process Improvement Model

■

35

cording to plan, however, the organization’s efforts will simply become another initiative with “good intentions” rather than a “milestone initiative” with major benefits. Success requires that organizations develop and maintain measurement systems to monitor performance in executing the actions required to fully implement the serious incident prevention process. Effective feedback systems must be established to communicate progress on key initiatives to personnel accountable for performance. The serious incident prevention process model requires that effective measures of performance be established—measures not only of results but for upstream performance indicators, as well. Effective feedback systems must be established that keep personnel informed and allow for timely adjustments to the safety process—proactive actions taken prior to the occurrence of an incident rather than reactive actions taken after the damage has been done.

Element 7: Reinforcement and Corrective Actions People tend to sustain activities where they feel positively reinforced, either through internally generated personal satisfaction or through external reinforcement originating from family, friends, coworkers, bosses, or other sources. Neither effective reinforcement nor proactive corrective action can be carried out without knowledge of performance. The communication of such performance information requires effective measurement and feedback systems. The serious incident prevention process model utilizes measurement and feedback systems as the basis for establishing effective reinforcement and corrective actions. Reinforcement actions help ensure that employees feel genuinely appreciated when performance meets or exceeds expectations—a simple but powerful concept. In addition to making reinforcement opportunities visible, measurement and feedback of upstream performance indicators provides an early warning of potential deficiencies in the safety process and the critical opportunity to initiate preventative actions before serious incidents occur—rather than on an after-the-fact basis.

Element 8: Improve and Update the Process Like life itself, the workplace is ever changing. Changes in raw materials, equipment, facilities, organization structure, and other factors continually impact the organization and the actions required for safe operations. The serious incident prevention process model recognizes the importance of organizational changes and provides a systematic method for assuring that the actions required for incident-free operations remain current, up-to-date, and effective.

CH03pp029-036 4/10/02 12:49 PM Page 36

36

■

Serious Incident Prevention

Management Commitment and Leadership

Involve Employees

Understand the Risks

Identify Critical Work for Controlling the Risks Establish Performance Standards Maintain Measurement and Feedback Systems Reinforce and Implement Corrective Action

Improve and Update the Process FIGURE 3-3. Serious incident prevention process.

Figure 3-3 is a simplified diagram illustrating the relationship between each element of the serious incident prevention process model. The chapters that follow provide an in-depth discussion of the actions required to successfully develop and implement each process element. Together, these eight elements form a proactive, team-based process for effectively sustaining serious incident-free operations.

References 1. B. O. Paul, “How Eastman Won the Malcolm Baldrige Award—One Company’s Quality Journey,” Chemical Processing, January 1994, 38–43.

CH04pp037-047 4/10/02 12:49 PM Page 37

C H A P T E R

4

Management Commitment and Leadership Benchmarking surveys typically identify management commitment as a necessity for achieving excellent safety performance. Management’s critical role may be better described as leadership rather than simply commitment. While many managers seem committed to almost an infinite number of objectives, most managers can provide the energy, excitement, and passion needed for true leadership only for a critical few initiatives. Whether described as commitment or leadership, the message is clear— management’s role is critical in achieving and sustaining a safe workplace. Today’s managers generally recognize the importance of safety, including serious incident prevention. However, managers are usually feeling the pressure to achieve excellence in numerous key performance areas. In addition to safe operations, management’s attention is focused on productivity, product quality, customer service, and cost control. As a further complication, these objectives often seem to be in tension with one another, with the manager unable to improve performance in one area without unfavorably impacting the others (Figure 4-1). Although I have yet to meet a manager who confessed to be against safety, it’s a workplace reality that noble intentions are insufficient to accomplish desired results. Managers must demonstrate effective leadership in utilizing the organization’s finite resources to achieve all that is expected.

37

CH04pp037-047 4/10/02 12:49 PM Page 38

38

■

Serious Incident Prevention

Management Commitment and Leadership

Involve Employees

Understand the Risks

Identify Critical Work for Controlling the Risks Establish Performance Standards

Maintain Measurement and Feedback Systems Reinforce and Implement Corrective Action Improve and Update the Process Initiatives dependent upon the formation of new habits require both management leadership and an effective strategy. During the decade of the nineties, the U.S. Navy experienced a number of unfortunate incidents, including Naval Academy cheating scandals, allegations of sexual harassment, and the suicide of its top officer. Following the suicide of Admiral Jeremy Boorda, a prominent U.S. Senator stated that the Navy’s problems were nothing “that can’t be cured by good leadership.”1 Such laying of

CH04pp037-047 4/10/02 12:49 PM Page 39

Management Commitment and Leadership

■

39

Serious Incident Prevention

OTHER OBJECTIVES Cost Control Production Customer Satisfaction Environmental Performance FIGURE 4-1. The tension between organizational objectives.

blame on “lack of leadership” is common. In this context, leadership is assumed to have mystical powers—with crime, unemployment, drug use, poverty, teenage pregnancy, and workplace accidents ready to be snuffed out, if only we had true leaders in positions of responsibility. In reality, leadership is a rather vague concept requiring further definition. Leadership is more than style. Rather than simply offering words that affirm personal commitment, management must lead by identifying and taking the actions necessary to maintain the prevention of incidents as a priority objective. Leadership will be critical in transforming concepts into the specific actions required for achieving desired performance. A safety management process must be put in place that is comprehensive rather than piecemeal. The process must ensure that the ground is properly prepared; seeds are sown, growth is nourished, harvesting is on schedule, and improved methods are implemented for a more prosperous future. Peter Drucker has observed that “charisma without a program is always ineffectual.”2 Management actions must be sufficient to ensure that serious incident prevention objectives are understood and supported through all levels of the organization. Management support that is both visible and constructive is required. The following excerpt from Kaizen by Masaaki Imai illustrates the need for management action beyond mere affirmations: The president of an airline company proclaims that he believes in safety and that his corporate goal is to make sure that safety is maintained throughout the company. This proclamation is prominently featured in the

CH04pp037-047 4/10/02 12:49 PM Page 40

40

■

Serious Incident Prevention

company’s quarterly report and its advertising. Let us suppose that the department managers also swear a firm belief in safety. The catering manager says he believes in safety. The pilots say they believe in safety. The flight crews say they believe in safety. Everyone in the company practices safety. True? Or might everyone simply be paying lip service to the idea of safety? On the other hand, if the president states that safety is company policy and works with division managers to develop a plan for safety that defines their responsibilities, everyone will have a very specific subject to discuss. Safety will become a real concern. For the manager in charge of catering services, safety might mean maintaining the quality of food to avoid customer dissatisfaction or illness. In that case, how does he ensure that the food is of top quality? What sorts of control points and check points does he establish? How does he ensure there is no deterioration of food quality in-flight? Who checks the temperature of the refrigerators or the condition of the oven while the plane is in the air? Only when safety is translated into specific actions with specific control and checkpoints established for each employee’s job may safety be said to have been truly employed as a policy. Policy deployment calls for everyone to interpret policy in light of his own responsibilities and for everyone to work out criteria to check his success in carrying out the policy.3

Achieving and Sustaining Effective Leadership If leadership is critical to success, how do we achieve and sustain it? Author John C. Maxwell’s observations are directly applicable to the leadership requirements necessary for achieving and sustaining a safe workplace. Maxwell’s “Law of the Lid” accurately recognizes that an individual’s effectiveness within the organization is a product of both individual leadership ability and dedication.4 My experience indicates that, as a group, the dedication level for both line and staff personnel responsible for safety performance is already very high. There is limited capability for significantly increasing the level of dedication. Thus, the key to increasing effectiveness in achieving and sustaining safety performance for most managers is to increase their leadership abilities. Becoming an effective leader requires that individuals develop influence within the organization. Developing influence is a step-by-step process that requires commitment and an investment of personal time. Managers must work to leverage their strengths and to shore up weaknesses—much like Demosthenes, who in the third century B.C. trained by shouting above

CH04pp037-047 4/10/02 12:49 PM Page 41

Management Commitment and Leadership

■

41

the ocean roar with pebbles in his mouth to overcome a harsh, unpleasant voice and weak lungs. Demosthenes was so successful in overcoming his weakness that he went on to become one of the best-known great Greek orators of his time. Such commitment is required to provide the level of leadership needed to sustain workplace operations free of serious incidents. Leaders in safety must view everything with a leadership bias. Leaders see the possibilities and have confidence that people can effectively handle change when allowed to become involved in the process. Leaders understand the importance of goals and challenges in galvanizing individuals and teams. True leaders focus on visions and values, with the leader’s time allocated to actions that leverage his or her personal effectiveness. Many managers, particularly those who have been successful in climbing the organizational ladder, maintain a personal bias toward positive thinking. However, when working in an organization having the potential for serious incidents, a manager’s tendency toward positive thinking must be tempered with an ongoing chronic unease. The wise manager is always aware that every day is a potential bad day and that constant vigilance and critical thinking will be required for a positive outcome.5 Effective leaders recognize the importance of timing. In particular, the occurrence of significant events, either within the company or on a more global basis, can provide a valuable window of opportunity for effective action. These opportunities are often short-lived and must be seized when they occur. An opportunity during my tenure as Eastman Chemical Company’s Texas Division Safety Director illustrates the importance of taking proactive actions to facilitate management understanding of risks: In 1984, an incident in Mexico City resulted in the loss of more than 500 lives from BLEVEs (Boiling Liquid Expanding Vapor Explosions). Several large LPG storage tanks were involved.6 Shortly after this catastrophic event, a documentary videotape of the incident was obtained and a viewing scheduled for Eastman’s Texas Division senior management. This viewing, initiated by the safety organization, gave birth to a management vision for substantially reducing on-site LPG inventory. With the strong support of management, storage and distribution systems were redesigned to achieve major reductions in inventory. The total propane and propylene tanks at the site were reduced from 35 tanks to a total of 6 tanks, each with state-of-the-art safeguards. The more than 80 percent reduction in the number of LPG tanks has provided an inherently safer facility while having no undesirable effects on operations.

The simple action of scheduling a video presentation for senior management served to trigger an initiative resulting in breakthrough improve-

CH04pp037-047 4/10/02 12:49 PM Page 42

42

■

Serious Incident Prevention

ments. Management’s full understanding of the potential consequences associated with maintaining large on-site LPG inventories was a prerequisite for change. Once educated, management readily became the driving force in assuring that needed changes were made. The breakthrough improvement in reducing LPG inventory illustrates the importance of keeping management informed, and the power of an informed management team in helping make difficult changes a reality. Too often, safety professionals share information with each other, but not with the key members of line management who can provide the resources and support needed to implement changes.

Achieving a Common Focus Effective leaders work to achieve a shared vision within the organization. Documenting and communicating key objectives helps the organization keep its eye on the right ball. The tendency to be distracted by hot trends is minimized. The effect of such distractions is illustrated by comments from a manager for a Midwestern equipment manufacturer: In the past 18 months, we have heard that profit is more important than revenue, that quality is more important than profit, that people are more important than profit, that customers are more important than our people, that big customers are more important than small customers, and that growth is the key to our success. No wonder our performance is inconsistent.7

Achievement of a common focus requires strong linkage between organizational units. Linkage is facilitated through ensuring that each unit’s missions, vision, performance measures, and improvement projects support those of other organizational units that are dependent upon performance. Sustaining a common focus throughout the organization requires a number of management actions. Effective communications are critical to ensure that overall company direction, measures, goals, and objectives are understood. Communications must be sufficiently in-depth to ensure that employees understand the fundamental business principles driving company initiatives. As adjustments in direction are made, the changes must be effectively communicated to all. A system of accountability helps ensure the right actions are implemented to support key organizational initiatives. This is the critical “Check” step of the “Plan-Do-Check-Act” improvement cycle. Periodic management reviews of the mission, vision, measures, goals, and improvement projects developed by subordinate teams can be an effective part of the accountability

CH04pp037-047 4/10/02 12:49 PM Page 43

Management Commitment and Leadership

■

43

process. Reviews should focus on understanding incident prevention processes in place, results achieved, identifying reinforcement opportunities, and ensuring team-to-team linkage. Sustaining a common focus throughout the organization is a challenging management responsibility. However, such alignment behind a common purpose is essential in leveraging the support of all levels of the organization needed for achieving breakthrough improvements. The benefits provide a generous return for the management time invested.

Allocation of Resources Stated objectives not backed by adequate resources ring hollow. In many organizations the landscape is dotted with the gravestones of failed initiatives that were inadequately resourced. Such failures waste the organization’s finite energy and undermine management credibility. Organizational resources of the appropriate type and quantity are essential for new initiatives to succeed. Management leadership, together with a systematic process, is required to ensure management time, staffing, training, and funding are allocated to successfully support company objectives.

Knowledge of Results Sustaining a high level of support for an initiative requires an effective measurement and feedback system. It is difficult to comprehend management tolerating a key performance objective that does not have an effective system for monitoring progress toward meeting the objective. Certainly, measurement and feedback systems are usually well established for some organizational objectives, such as profitability, productivity, and cost control. Serious incident prevention may be designated as a key objective, but that fact does not ensure appropriate measurement and feedback systems are in place to provide the performance information needed to achieve and sustain success. Managers are usually aware of a facility’s past history of incidents, but they may not be informed of current performance in executing the “upstream” work necessary to prevent future incidents. At best, managers may receive results of area safety audits. However, audits are often focused on regulatory compliance rather than effectiveness in the broader task of identifying and executing all of the work critical to preventing incidents. At worst, management’s feedback is limited to the frequency of common injuries, with no system in place for monitoring leading indicators for sustaining serious incident-free operations.

CH04pp037-047 4/10/02 12:49 PM Page 44

44

■

Serious Incident Prevention

Accurate feedback is needed to keep management informed on the deployment of safety initiatives throughout the organization. Deployment should not be assumed as a given. Unfortunately, performance of work to prevent incidents may be perceived as deferrable by line managers feeling the squeeze of time and funding constraints. Further, many managers depend upon exception reports—customer complaints, production at less than target rates, costs over budget, injury frequency higher than goal—to allocate time and resources. “Red flag” indicators of upstream deficiencies in the serious incident prevention process are often visible only to personnel at the operating point of control. However, with the severe consequences of performance failures, an effective measurement and feedback system is needed to capture, communicate, and evaluate upstream indicators of potential safety problems. Sustaining incident-free operations is dependent upon it.

Reinforcement of Performance Effective leadership requires an understanding of effective reinforcement principles. Specific actions and results that support achievement of organizational goals and objectives must be positively reinforced if we expect these actions to be sustained. However, management must diligently guard against the potential for unwanted side effects resulting from misguided reinforcement efforts. Unwanted side effects can occur when reinforcement received for supporting some objectives overpowers the perceived value of reinforcement for actions required to meet other objectives. The experience of a national pizza chain with their heavily advertised goal of delivering all pizzas within 30 minutes after receipt of the order provides an excellent case study. Performance consistent with this high visibility objective was clearly a priority for all employees—from store managers through the delivery drivers. The requirement to refund customers for late delivery provided a strong incentive to rush if necessary to meet the deadline. Reinforcement for safe driving was perhaps perceived as weak compared to the “punishment” for late delivery. From a behavioral perspective, it’s not surprising that company drivers became involved in a number of serious accidents. Following a $78 million award for one accident, involving a delivery driver who reportedly ran a red light, the company eliminated the guarantee on delivery time.8

Decisions Consistent with Objectives Much is asked of supervisors—often more than they or anyone else can actually deliver. How do these individuals cope with unrealistic expectations?

CH04pp037-047 4/10/02 12:49 PM Page 45

Management Commitment and Leadership

■

45

Supervisors look to the actions of their bosses for clues to determine what is really considered important. What questions is the boss asking? Which objectives does the boss support with his or her personal time? What subjects does the boss discuss during performance reviews? These are the initiatives that will be given priority by subordinates. Requests that are simply communicated by memorandum with no other visible management support are likely to receive minimum attention from the supervisor stretched to his or her limits. In an environment where supervisors are looking to superiors for clues to guide priority setting, management leadership and decisions have a powerful influence in shaping what is perceived as important. Decisions that skew the allocation of resources or rewards toward any one of the organization’s key objectives can create conflicts. The remaining objectives, including incident prevention, become more difficult to achieve. In many cases the perceived necessity for special focus on only a portion of an organization’s objectives may be driven by powerful external pressures—for example, the special need for cost control during industry down cycles. However, management must realize the potential pitfalls of decisions that provide support to a select few key performance areas while in effect neglecting the others. America’s space program provides ample material for case studies on the effects of management decisions and leadership on safety performance. The impact of misguided decisions is illustrated by the work to expedite the initial Apollo mission. During preparation for Apollo 1, an environment developed where intelligent individuals rationalized a dependence upon luck to prevent serious incidents rather than diligent execution of the work required to be successful. Astronauts Alan Shepard and Deke Slayton contribute many of the misguided decisions to pressure from NASA’s ultimate boss, President Lyndon Johnson.9 Widespread unrest during 1966 regarding the Vietnam War and other issues had President Johnson anxious to focus the country’s attention on a success story. Johnson’s communications to NASA were forceful in his desire for the initial Apollo mission to fly on or ahead of the February 1967 scheduled launch date. Apollo 1 was a complicated spacecraft with thousands of systems that needed to work perfectly for the mission to succeed. Like earlier capsules, the Apollo craft was equipped with a pressurization system to ensure an interior free of contaminants. The use of pure oxygen to pressurize the capsule was a design compromise made years earlier by the space administration. An inherently safer nitrogen-oxygen mixture, similar to breathing air, had been vetoed primarily because the extra containers added weight and complexity to the craft. Numerous failures had plagued the Apollo program—a primary reason the Apollo team was behind schedule. Though it was understood that pure

CH04pp037-047 4/10/02 12:49 PM Page 46

46

■

Serious Incident Prevention

oxygen creates a highly flammable environment, the problem-free history of the earlier Mercury and Gemini missions led NASA to become too complacent about the possibility of fire. In an effort to meet the flight schedule, NASA management decided to bypass an oxygen pressure test of the capsule in the unmanned mode. Instead, NASA scheduled a full dress rehearsal for January 27, 1967, with astronauts Grissom, White, and Chaffee on board. With the astronauts on board, pressuring of the capsule was initiated by discharging pure oxygen into the craft until the desired pressure of 16.7 psig was reached. Somewhere in the cabin, wiring sparked, and flames engulfed the interior of the capsule. All three of the astronauts were killed within seconds. It would be another 21 months before a manned Apollo mission would fly. Following the fire, NASA’s focus shifted from expediting the flight to identifying the root causes of the catastrophic fire. The Apollo review board’s investigation concluded that an electric arc from defective wiring was the most likely source of ignition. Numerous deficiencies related to design, engineering, manufacturing, and quality control were identified. The report criticized the NASA management team for poor management, carelessness, negligence, and failure to fully consider personnel safety. Once NASA resources were focused on building an inherently safer craft, tremendous advances were made. Many design deficiencies of the old craft were eliminated. The electrical system was redesigned, fire-resistant materials were extensively utilized, and a new escape hatch capable of being opened in three seconds was developed. Finally, the pure oxygen was replaced with a nitrogen-oxygen mixture. Twenty-one months were required to develop, implement, and test the changes needed to improve the craft. The successful ascent of the first manned Apollo on October 11, 1968, was a milestone date for NASA. The flight of the redesigned Apollo craft was superb. The intense focus on serious-incident prevention had been successful.

Commitment and Leadership— Closing Thoughts Whenever I speak with safety managers, whether new to the field or long experienced, I always talk with them about leaving some footprints behind—leaving a personal legacy of accomplishment that will be admired for decades to come. Such legacies require boldness, leadership, and commitment. Peter Drucker states it well with his rules for establishing priorities:10

CH04pp037-047 4/10/02 12:49 PM Page 47

Management Commitment and Leadership

■ ■ ■ ■

■

47

Pick the future as against the past; Focus on opportunity rather than on the problem; Choose your own direction—rather than climb on the bandwagon; and Aim high, aim for something that will make a difference, rather than for something that is “safe” and easy to do.

In any organization there are always more opportunities deserving attention than capable people to address them. In determining which opportunities to seize, managers must be biased toward true organizational priorities rather than reacting to pressures of the day. Work on daily pressure points is usually targeted at resolving or explaining yesterday’s problems. Management leadership and commitment in support of critical organizational objectives, including the prevention of serious incidents, is the key to shaping a better tomorrow.

References 1. S. Komarow, “Academy Tries to Restore a Sense of Honor,” USA Today, 23 May 1996. 2. P. F. Drucker, The New Realities (New York: Harper & Row, 1989), 109. 3. M. Imai, Kaizen—The Key to Japan’s Competitive Success (New York: Random House, 1986), 144–145. 4. J. C. Maxwell, The 21 Irrefutable Laws of Leadership (Nashville: Thomas Nelson, 1998), 1–10. 5. J. Reason, Managing the Risks of Organizational Accidents (Aldershot, Hampshire, England: Ashgate Publishing, 1997) 37. 6. B. F. Olson and J. L. de la Fuente, L.P-Gas Disaster November 1984—Mexico City (Presented at GPA Convention, San Antonio, Texas, 10–12 March 1986). 7. J. A. Byrne, “Business Fads: What’s In—And Out,” Business Week, 20 January 1986, 53. 8. “Domino’s Dropping Delivery Guarantee,” Dallas Morning News, 22 December 1993, 1A, 17A. 9. A. Shepard and D. Slayton, Moonshot—The Inside Story of America’s Race to the Moon (Atlanta: Turner Publishing, 1994), 192–221. 10. P. F. Drucker, The Effective Executive (New York: Harper & Row, 1985), 111.

CH05pp048-059 4/10/02 12:49 PM Page 48

C H A P T E R

5

Employee Involvement Most managers learn early in their careers that achieving results is often dependent upon collaboration with hourly-roll employees and other personnel having point-of-control knowledge. Experience continually reconfirms that the true experts are the individuals performing the work. Employee involvement is clearly a critical prerequisite for identifying and implementing the actions necessary to achieve and sustain a safe workplace, as well as for achieving other organizational objectives. Consider the comments of Charles Ross, operator of the Tilt-a-Whirl amusement ride for Bill Dillard Shows Inc.: I’m a master at what I’m doing. I don’t mean to brag, but facts are facts. I can take any tub and make it spin like I want. I know every pin and grease circuit in it. I’ve fallen in love with this machine. Why? I can make people happy. Making it spin for them with all that hollering going on—that makes me feel good. That’s why I stick with it. If I quit, I’d probably die.1

A line manager or safety engineer would obviously be a fool not to involve Charles Ross in any initiative designed to improve Tilt-a-Whirl

48

CH05pp048-059 4/10/02 12:49 PM Page 49

Employee Involvement

■

49

Management Commitment and Leadership

Involve Employees

Understand the Risks

Identify Critical Work for Controlling the Risks Establish Performance Standards Maintain Measurement and Feedback Systems Reinforce and Implement Corrective Action

Improve and Update the Process

safety. All companies have their Rosses, or at least those with the potential, at point-of-control positions. The detailed knowledge many individuals possess on their life’s work is incredible, and most will gladly share it. To leverage this knowledge, we must make a habit of treating employees as valuable resources rather than simply overhead costs.

CH05pp048-059 4/10/02 12:49 PM Page 50

50

■

Serious Incident Prevention

There is a strong linkage between active employee ownership and the ultimate success of any initiative. The reason we diligently maintain our yards and gardens through the hot summer is rooted in pride of ownership. These same concepts hold true in the workplace. Pride of ownership is fostered by providing opportunities for meaningful employee involvement, together with management’s willingness to entrust employees with responsibility and authority. The importance of involvement, responsibility, and buy-in is widely recognized: “Mark it down, asterisk it, circle it, underline it. No involvement, no commitment.”2 —Steven Covey, Author and Co-Chairman, Franklin Covey Co. “Get everyone in the game! With boundrylessness, speed, and stretch”3 —Jack Welch, CEO, General Electric Co. “We’ve found over and over again that the true experts in our business are the people who see it up close every day.”4 —Robert C. Crandell, Former CEO, American Airlines Inc. (in announcing the company’s purchase of a Boeing 757 with savings generated from employee ideas)

Synergy Synergy is the phenomenon that occurs when the whole is greater than the sum of the parts. The existence of synergistic outcomes, like the creation of fluffy popcorn from hard kernels and heat, is one of life’s pleasant surprises. The phenomenon makes a treasure of diversity—differences in backgrounds, personalities, talents, and points of view provide the potential for achieving greatness as a team. Maximizing the synergistic capability of an organization requires skills—management, facilitation, and people skills. The level of synergy achieved through harnessing these skills separates effective teams from those destined to underperform. The reality of synergy has been confirmed frequently in workshop settings. A typical exercise demonstrating synergy involves each individual participant performing a task capable of being objectively graded. Then, the same task (for example, a written quiz on a specific topic or variety of

CH05pp048-059 4/10/02 12:49 PM Page 51

Employee Involvement

■

51

topics) is performed as a team exercise. Both individual and team performances are then reviewed. In the absence of a total breakdown in teamwork, the quantified team score is higher than the average score of all individuals—a predictable outcome. However, with synergistic teamwork, the team score not only exceeds the individual average, but also exceeds the highest individual score—an outcome with tremendous implications for accurately identifying the actions needed for a safe workplace. Synergy, at first glance, appears to have connections with the world of magic. A more comprehensive evaluation reveals that synergy is a predictable outcome of people working together. I’ve come to appreciate that there are different forms of intelligence, and I have never met an individual who did not excel in at least one or two of them. On the other hand, it’s a rare individual who excels in the majority. In The Age of Paradox, author Charles Handy identifies and describes nine separate forms of intelligence: ■ ■

■ ■ ■

■

■

■ ■

Factual intelligence: The intelligence demonstrated by the human encyclopedia. We are envious but often bored. Analytical intelligence: The intelligence that thrives on intellectual problems and fun challenges such as crossword puzzles. People who score high on this intelligence delight in reducing complex data to more simple formulations. Linguistic intelligence: Seen in the person who speaks seven languages and can pick up another within a month. Spatial intelligence: The intelligence that sees patterns in things. Artists have it, as do mathematicians and system designers. Musical intelligence: The sort that gave Mozart his genius, but that also drives pop stars and their bands, many of whom would never have had a chance of going to college, because their scores on the first two intelligences would have been too low. Practical intelligence: The intelligence that allows young kids to take a motor bike apart and put it together again, although they might not be able to explain why in words. Physical intelligence: The intelligence or talent that we can see in sports stars, which enables some people to hit balls much better than others, to ski better, dance better, etc. Intuitive intelligence: The gift that some have of seeing things that others can’t, even if they cannot explain why or wherefore. Interpersonal intelligence: The ability to get things done with and through other people. Without this form of intelligence, great minds can be wasted.5

CH05pp048-059 4/10/02 12:49 PM Page 52

52

■

Serious Incident Prevention

Prison Break Exercise Let’s test the theory that our decisions can often benefit from the input of others. Most of us think of ourselves as having excellent analytical abilities. However, in workshop settings I have found that only about 1 in 20 people can correctly solve the exercise below when given 15 to 20 minutes to complete it. Take a few minutes to work through the exercise to evaluate your analytical ability and to determine if you could benefit from collaboration with others. Exercise Four prisoners are planning a midnight prison break. Their objective will be to cross over a nearby gorge as quickly as possible to distance themselves from the bloodhounds that will be in pursuit. A rope bridge spans the gorge, and a flashlight will be required to cross the bridge. Furthermore, the maximum capacity of the rope bridge is two people at a time. The prisoners have been able to obtain only one flashlight for the escape. The physical conditioning of the prisoners varies significantly and they estimate that the most athletic of the four can cross the bridge in 1 minute. (This prisoner is known as prisoner #1.) A second, less athletic prisoner (prisoner #2) will require 2 minutes to cross, a third prisoner (prisoner #5) will require 5 minutes, and the least mobile prisoner (prisoner #10) will require 10 minutes to cross the bridge. Given that the group only has one flashlight that must be carried for vision when crossing the bridge and that the bridge will hold a maximum of two people, determine the order in which prisoners should cross the bridge to minimize the time requirements for all four prisoners to cross the gorge. Use the worksheet below as a guideline for developing the optimum solution. Notes: (1) When two prisoners cross together the time for the two to cross will be equal to the time required for the slowest of the two prisoners. For example, if prisoners 1 and 10 cross together, the time for both to cross is 10 minutes. (2) The flashlight must be hand-carried back and forth across the gorge—no tossing of the light or other trick solutions. Prison Break Worksheet

Action Taken

______ & ________ cross bridge _______ returns with flashlight _______ & _______ cross bridge _______ returns with flashlight ______ & _______ cross bridge

Minutes Required

Cumulative Minutes Elapsed

CH05pp048-059 4/10/02 12:49 PM Page 53

Employee Involvement

■

53

My experience indicates that a large percentage of the working population can devise a plan for getting all prisoners safely across the bridge in 19 minutes. However, there is a better solution with no tricks involved, for reducing the time required for all prisoners to cross. Can you identify a better plan? If not, you are among the vast majority who could benefit from collaboration with others on the project. For those of you who identify the optimum solution of 17 minutes for all prisoners to cross— Congratulations! However, be aware that for other types of problems and projects, you may be the one benefiting from the synergy that can be achieved through teamwork with others. (A solution for the 17-minute bridge crossing is presented at the end of this chapter.)

Teamwork Effective teamwork leverages the diversity of team members to produce a synergistic output. Employee involvement and teamwork facilitate the serious-incident prevention process in a number of ways: 1. Identification of risks: Employees at the point of control and others with specialty knowledge can provide valuable input on past incidents, near misses, and improvement opportunities. 2. Identification of critical work: Point-of-control employees can provide information based upon direct observations and experiences to identify the proactive actions needed to effectively control risks. Input from employees with technical or other specialty knowledge is also critical. 3. Synergy: The involvement of individuals with diverse backgrounds and knowledge enhances the development of effective serious-incident prevention processes. Team-based, synergistic processes are much more likely to succeed than those developed exclusively by the manager. 4. Understanding the process: Employee involvement increases understanding of the serious incident prevention process. Involvement is the difference between experiencing Europe through personal travel compared to viewing someone else’s photographs. The first-hand experience provides a greater feel, sense of perspective, and understanding. Involved individuals understand the fundamental principles driving the incident prevention process and are more likely to maintain the commitment necessary to sustain performance. 5. Pride of ownership: People show polite interest in other people’s babies but reserve real commitment and personal sacrifice for raising

CH05pp048-059 4/10/02 12:49 PM Page 54

■

54

Serious Incident Prevention

their own. It’s the same with workplace initiatives. Passion is limited to initiatives where individuals are involved and feel ownership. Such commitment is critical for sustaining the long-term, task-oriented process of serious incident prevention.

An OSHA Perspective on Employee Participation The critical role of employee involvement in workplace safety is recognized by OSHA through requirements for the agency’s prestigious STAR program administered through its Voluntary Protection Program (VPP). Employee involvement is a cornerstone of the program, which is based upon the best safety and health practices found in American industry. OSHA considers employee participation to be particularly important in the following functions and activities: ■ ■ ■ ■ ■ ■

Safety observations Safety and health problem-solving groups Safety and health training of other employees Analysis of job hazards Committees that plan and conduct safety and health awareness programs Reporting of safety concerns to management.6

In addition to VPP program guidelines, OSHA has also published a document entitled Voluntary Safety and Health Program Management Guidelines. These guidelines, which are a distillation of successful safety and health management practices in the United States, identify management commitment and employee involvement as key elements for successful safety programs. Specifically, the OSHA document recognizes the value of: ■

■ ■

A worksite safety policy on safe and healthful work and working conditions stated so that all personnel understand the priority of safety and health protection in relation to other organizational objectives Clear safety goals, with plans for meeting the goals that are understood by all personnel responsible for goal achievement. Top management involvement in implementing the program.

CH05pp048-059 4/10/02 12:49 PM Page 55

Employee Involvement

■

55

■

Employee involvement in the operation of the program and in decisions that affect safety and health.

■

Assignment of responsibilities for all aspects of the program, so that managers, supervisors, and employees in all parts of the organization know what performance is expected of them.

■

Provision of adequate authority and resources to responsible parties, so that assigned responsibilities can be met.

■

Holding managers, supervisors, and employees accountable for meeting their responsibilities, so that essential tasks will be performed.

■

Annual reviews to evaluate success in meeting goals and objectives, so that deficiencies can be identified and the program and/or the objectives can be revised as needed.7

Leveraging the Power of Employee Involvement The typical organization is blessed with talented individuals waiting for the perceptive manager to provide an opportunity congruent with their personal strengths and interests. It is an eye-opening exercise to inventory the leadership roles assumed outside the workplace by an organization’s clerks, plant operators, maintenance mechanics, and technicians. Church officers, school board members, United Way leaders, small business owners, effective managers of substantial monetary investments—the workplace is filled with individuals having the initiative, skills, and intelligence to make meaningful contributions in the workplace. Figures 5-1 through 5-3 summarize results of survey responses on the subject of employee involvement from America’s largest employers.8 Results of the comprehensive survey, conducted by the U.S. General Accounting Office, confirm the power of employee involvement in helping to achieve and sustain results. Of the 934 companies surveyed, 76 percent report that employee involvement has improved organizational processes and procedures. Thus, if we manage the prevention of high-consequence incidents as a business process, we can expect favorable results from actively involving employees. In 1994, the world followed 50th anniversary proceedings for the June 6, 1944, D-Day landings with great interest. Frank Elliot, a U.S. Army corporal with the 741st Tank Battalion, was one of the many heroic casualties of the initial landings. As part of the events leading up to the D-Day

CH05pp048-059 4/10/02 12:49 PM Page 56

56

■

Serious Incident Prevention

January 11, 1944 Dearest Wife, Last night in one of my pre-dream reveries I was dreaming of an idea that was designed to revolutionize the strip steel industry. However, with the dawn of an English day the idea began to look like a drunkard’s dream (and me a teetotaler) and I have at last cast it away to the winds having first memorized the faults of the idea. I hesitate to mention the idea for fear of being scoffed at but since Firestone and Edison were both successful inventors and attributed their successes to the counsel of their wives I am going to briefly outline the idea to you. It had to do with the rolling and thinning of steel as it is done on a four high Steckle Mill of the type used at our plant. I wondered if it weren’t possible to weld a section of the sheet of steel to itself so that the strip instead of having to be run through several times could be run to the desired degree of thinness by one continual passing. I love you Frank

anniversary, the contents of Corporal Elliot’s letters, written during the months preceding his landing on Omaha Beach, were released. In one letter, Frank communicates his personal thoughts on improving the steel mill that provided his peacetime employment. Corporal Elliot’s active interest in improving his employer’s work process, despite the stresses of preparing for the imminent invasion, is a testimony to the dedication and resourcefulness of workers in a free enterprise system.12 Management must ensure that the Charles Rosses and Frank Elliots of their organization are involved, nurtured, and given responsibility. A safe and prosperous workplace is a vision that can be sustained as reality through the involvement of each and every employee.

CH05pp048-059 4/10/02 12:49 PM Page 57

Employee Involvement

■

57

Question: To what extent, if at all, is each of the following conditions currently a facilitator of employee involvement in your corporation? Percent Respondents Saying Condition Is a Great or Very Great Facilitator

Condition

Support by top management Support by middle management Training relevant to employee involvement activities Communications about employee involvement to all employees Support by first-line supervision Communication of job and business relevant information Availability of resources for employee involvement activities Decentralization of decision-making authority Employment security Third party consultation Union involvement Monetary awards for employee involvement activity

55% 39% 37% 36% 33% 33% 28% 22% 17% 13% 9% 7%

FIGURE 5-1. Conditions facilitating employee involvement. From American Productivity & Quality Center.9

Prison Break Exercise 17-Minute Solution:

Action Taken

Minutes Required

Cumulative Minutes Elapsed

1 & 2 cross bridge 1 returns with flashlight 5 & 10 cross bridge 2 returns with flashlight 1 & 2 cross bridge

2 1 10 2 2

2 3 13 15 17

CH05pp048-059 4/10/02 12:49 PM Page 58

58

■

Serious Incident Prevention

Question: To what extent, if at all, is each of the following conditions currently a barrier to employee involvement efforts?

Condition

Percent Respondents Saying Condition Is a Great or Very Great Obstacle

Short-term performance pressures Lack of a "champion" for employee involvement Lack of a long-term strategy Lack of training on employee involvement skills Unclear employee involvement objectives Lack of tangible improvements Lack of a feedback system Centralization of decision-making authority Management culture opposed to employee involvement Worsened business conditions Lack of coordination of employee involvement programs with other programs Turnover in top management

43% 26% 25% 23% 21% 20% 18% 17% 15% 14% 12% 6%

FIGURE 5-2. Barriers to employee involvement. From American Productivity & Quality Center.10

Internal Business Condition

Percent or Respondents Saying Improved at Least Some

Increased employee trust in management Improved organizational processes and procedures Improved management decision making Improved implementation of technology Improved employee safety/health Improved union-management relations Eliminated layers of management or supervision

79% 76% 74% 66% 55% 43% 38%

FIGURE 5-3. Percent indicating at least some improvement in internal business conditions as a result of employee involvement. From American Productivity & Quality Center.11

CH05pp048-059 4/10/02 12:49 PM Page 59

Employee Involvement

■

59

References 1. A. Farris, “Fair Worker Loves Job,” Arkansas Gazette; 9 October 1988, 1B, 2B. 2. S. R. Covey, The 7 Habits of Highly Effective People (New York: Simon & Schuster, 1990), 143. Excerpt used with permission. All rights reserved. 3. “GE: Just Your Average Everyday $60 Billion Family Grocery Store,” Industry Week, 2 May 1994, 13–18. Reprinted with permission. Copyright 1994 Penton Media Inc., Cleveland, Ohio. 4. R. T. Hurley, “The Truth About American Workers,” Industry Week, 3 May 1993, 37. Reprinted with permission. Copyright 1993 Penton Media Inc., Cleveland, Ohio. 5. C. Handy, The Age of Paradox (Boston: Harvard Business School Press, 1994), 203–206. 6. “Voluntary Protection Programs to Supplement Enforcement and to Provide Safe and Healthful Working Conditions Changes,” Federal Register; vol. 53, no. 133, 12 July 1988, 26344–26345. 7. “Voluntary Safety and Health Program Management Guidelines,” Fact Sheet OSHA 91-37, U.S. Department of Labor, 1 January 1991. 8. E. E. Lawler III, G. E. Ledford, Jr., and S. S. Mohrman, Employee Involvement in America: A Study of Contemporary Practice (Houston: American Productivity and Quality Center, 1989), 41–46. 9. Ibid. 10. Ibid. 11. Ibid. 12. D. Elliot, “D-Day: What it Cost,” American Heritage 45, no. 3 (May/June 1994), 64. Reprinted by permission of American Heritage magazine, a division of Forbes Inc.

CH06pp060-67 4/10/02 12:50 PM Page 60

C H A P T E R

6

Employee Involvement— Developing Teamwork The active involvement of employees at all levels of the organization is required to achieve and sustain an effective safety management process. Organizations often recognize this need by including strong references to active employee involvement and effective teamwork in the organizational vision statement. However, in reality, the effectiveness of involvement and teamwork in the workplace often falls far short of the vision. Why do efforts to involve employees in safety fall short of the organization’s stated vision? In many situations performance gaps exist because the organization does little more than state their desire for employee involvement and teamwork. A closer look often indicates the organization has given little or no thought to developing an effective strategy for achieving their objectives. Without an effective plan, employee involvement efforts will be little more than window dressing on the company vision statement—the real opportunities to leverage employee involvement and teamwork for improved safety results will be missed.

Employee Involvement on Teams One of the most practical and effective ways to channel employee involvement toward the achievement of a safer work environment is through 60

CH06pp060-67 4/10/02 12:50 PM Page 61

Employee Involvement—Developing Teamwork

■

61

the involvement of employees on formal teams. Teams can be effective in carrying out numerous types of safety initiatives, including identifying and implementing safety improvements, providing feedback to management on key safety initiatives, and helping to identify and remove barriers to improvement. Using safety teams comprised of personnel at all levels of the organization provides many benefits. A primary benefit is that participation on teams creates the employee ownership and commitment needed to carry out and sustain successful safety initiatives. As reviewed in Chapter 5, the achievement of synergy is also dependent upon effective teamwork. Without teamwork, the quality of decisions and programs suffers. A third benefit in using teams is that it expands the organization’s available resources for problem solving. Hourly-roll and other personnel not normally in the development loop for safety initiatives can make valuable contributions to the organization through their involvement on teams.

Effective Teamwork Techniques When forming a new team, care must be taken to ensure that roles of team members are understood. Clarifying roles and responsibilities helps ensure that critical items get done, overlap and duplication are minimized, and disruptive power grabbing is avoided. Roles should be clarified for members, leader(s), facilitator(s), and for other participants. Although a facilitator is not always a necessity, a trained facilitator, who is aware of what is going on in the group and possesses the expertise to make appropriate interventions, can often greatly enhance teamwork. Unfortunately, it’s not unusual for teams to reach decisions and then have individual team members criticize team decisions to coworkers. Once a team has “shot itself in the foot” in this manner, it has little chance of obtaining the full organizational support needed to meet team objectives. Such undesirable situations can be avoided by working toward a true consensus in team meetings, rather than reaching decisions by other methods, such as “the boss decides” or “majority rules.” Consensus is often confused with reaching a unanimous decision or with “majority rules.” However, making decisions by majority vote does not usually provide a situation in which team members walk away from meetings in full support of the decisions made. For example, if a decision passes on a 60-to-40 vote, 40 percent of team members are likely to leave the meeting not supporting the team’s decision. A true consensus is reached when each individual team member can affirm the following: ■

I believe you understand my point of view;

CH06pp060-67 4/10/02 12:50 PM Page 62

■

62 ■ ■

Serious Incident Prevention

I believe I understand your point of view; and Whether or not I prefer this decision, I will support it, because it was arrived at in an open and fair manner.

Some teams avoid trying to reach a consensus because they perceive it will take too much time. This effort to shorten the time required to reach decisions often backfires with the lack of consensus adding substantial time to the implementation phase for new initiatives. Reaching consensus can be expedited by team participation techniques, such as brainstorming and methods for screening and prioritizing ideas generated by brainstorming.

Brainstorming Techniques Teams often fail because input in team meetings is limited to a select few—perhaps the leader or other influential or verbose members. Effective brainstorming techniques help ensure input from all team members in generating potential solutions or other ideas for improvement. Brainstorming also helps the creative process flow and helps ensure a high level of synergy is achieved. Effective brainstorming requires adherence to the following principles: ■ ■ ■

■ ■

■

Present the situation to be brainstormed, and then allow “think time” before proceeding. Make sure everyone understands there will be no criticism of ideas as they are generated. Proceed one person at a time around the room, or in an alternate manner that ensures everyone genuinely feels an equal chance for participation. To help ensure broad participation, individuals should provide only one item during each turn before proceeding to the next person. Record all ideas. Avoid the tendency to debate ideas as they are generated. Continue rotating the opportunity to provide input until several team members start to “pass” on their turn. Then open the process to freewheeling—additional ideas generated by any member in the room. Keep the brainstorming process active until a large number of ideas are generated. Giving up too early is a common mistake. Quite often the best ideas come toward the end when team members must be more creative in identifying additional ideas not yet on the list.

Teams sometimes make the mistake of trying to eliminate brainstormed ideas as they are generated, based on the misguided thinking that keeping

CH06pp060-67 4/10/02 12:50 PM Page 63

Employee Involvement—Developing Teamwork

■

63

an “out-of-bounds” idea off the board will save time. Such an approach is inappropriate for three reasons: (1) The discussion is perceived as criticism, and team members become less likely to provide additional ideas. (2) Not recording items can harm the level of team synergy. Even ideas that are not feasible have the potential to serve as a catalyst for generating other innovative solutions that may be feasible. (3) Discussing the merits of items as they are generated increases the time required to reach a consensus rather than serving to decrease time. Effective approaches for screening and prioritizing brainstormed ideas are available that will result in any impractical ideas being quickly discarded.

Screening and Prioritizing A technique known as Pareto voting is an effective and timely method for reducing a long list of brainstormed items down to a critical few that merit further evaluation by the team. My experience has been that Pareto voting is perceived as fair and equitable by team members, thus meeting one of the critical requirements for reaching a consensus. This prioritization technique is based upon the Pareto principle, named after the Italian economist of the early 1900s who identified certain mathematical relationships related to the distribution of wealth.1 Perhaps it’s more descriptive to refer to the Pareto principle as the “principle of the critical few.” (The principle is also referred to as the 80-20 rule.) In our efforts to improve safety, we unfortunately often spend the majority of our time on the “trivial many”—the 80 percent—rather than the “critical few” items—the 20 percent that can provide the most benefits for safety programs. Effective managers leverage their finite time and resources by identifying the critical few actions having the most impact on results and then keeping the organization’s spotlight focused on these critical items. Pareto voting is a quick and effective way to separate the important from the unimportant, and it is consistent with the principle that about 80 percent of the potential benefits for an organization can be achieved by acting upon about 20 percent of the potential opportunities. For example, if we develop a list of everything that could be done to improve safety in the organization, implementing the most effective 20 percent of the actions will usually provide about 80 percent of the potential benefits. Pareto voting helps in identifying the critical few items that will provide the most benefit in a timely, accurate, and equitable manner. To illustrate the steps in Pareto voting, let’s assume that a team comprised of five employees, Susan (the team leader), Frank, Linda, Bill, and Joe, has been asked to develop a recommendation for management on how best to recognize employees in a facility for achieving all of the facility’s safety goals. The team has been asked to ensure that the dollar value of the

CH06pp060-67 4/10/02 12:50 PM Page 64

■

64

Serious Incident Prevention

recognition does not exceed $30 per employee, or a total of $15,000 for the 500-employee facility. The team leader, Susan, is well versed in use of brainstorming, prioritization methods, and other effective teamwork techniques. She understands the importance of reaching a team consensus for the recommendation that will be made to management. Susan is committed to ensuring that effective teamwork is fully achieved. The team will utilize brainstorming and Pareto voting to help ensure that the team is productive, that high-quality ideas are developed, and that all members are supportive of the team’s final recommendation to management. Frank has volunteered to record all brainstormed items on a flip chart located in front of the meeting room, and he will also take his turn in pro-

1) 2) 3) 4) 5) 6) 7) 8) 9) 10) 11) 12) 13) 14) 15) 16) 17) 18) 19) 20) 21) 22) 23) 24) 25)

$30 cash for each employee Drawing for single $15,000 prize Drawing for 15 $1000 prizes Company picnic with families invited Issue single share of company stock to each employee Jacket with appropriate patch $30 item selected by each employee from catalogue $30 of movie passes to local theater Renovate break rooms throughout facility Purchase fitness equipment for a workout room Provide $30 gift certificate to local restaurant Add $30 to each employee’s retirement account Give each employee 2 hours off with pay Air condition the manufacturing area Provide ice cream and cake for celebrations throughout facility Send a notice of appreciation from management to home of each employee Give everyone raises Bring in entertainment for a local concert for employees and their families Provide an ice chest with company logo for each employee Provide a plaque to be displayed in lobby with each employee’s name Provide a $30 gift certificate to a local department store Provide a $30 phone calling card Donate $15,000 to United Way in name of employees Cater an in-plant lunch for all employees with guest speakers Provide free tickets to NHL hockey game

FIGURE 6-1. Results of brainstorming process—list of employee reinforcement

items.

CH06pp060-67 4/10/02 12:50 PM Page 65

Employee Involvement—Developing Teamwork

■

65

viding specific items for the list. Susan starts the meeting by explaining the team’s charge, the process for brainstorming, and the importance of reaching a team consensus. Susan provides “think time” for each person to identify ideas for employee recognition and then proceeds with asking each person for one idea to be posted on the chart. She repeats this process until all ideas are exhausted. A listing of 25 potential reinforcement actions identified by the team is illustrated by Figure 6-1. Having the team discuss each of the 25 items and continuing the discussion until a team consensus is reached is one approach for developing a

Item 1) 2) 3) 4) 5) 6) 7) 8) 9) 10) 11) 12) 13) 14) 15) 16) 17) 18) 19) 20) 21) 22) 23) 24) 25)

$30 cash for each employee Drawing for single $15,000 prize Drawing for 15 $1000 prizes Company picnic with families invited Issue single share of company stock to each employee Jacket with appropriate patch $30 item selected by each employee from catalogue $30 of movie passes to local theater Renovate break rooms throughout facility Purchase fitness equipment for a workout room Provide $30 gift certificate to local restaurant Add $30 to each employee’s retirement account Give each employee 2 hours off with pay Air condition the manufacturing area Provide ice cream and cake for celebrations throughout facility Send a notice of appreciation from management to home of each employee Give everyone raises Bring in entertainment for a local concert for employees and their families Provide an ice chest with company logo for each employee Provide a plaque to be displayed in lobby with each employee’s name Provide a $30 gift certificate to a local department store Provide a $30 phone calling card Donate $15,000 to United Way in name of employees Cater an in-plant lunch for all employees with guest speakers Provide free tickets to NHL hockey game

FIGURE 6-2. Brainstorming process—results of Pareto voting.

Votes 1 5

4

5 2

3

1 1

1 1

CH06pp060-67 4/10/02 12:50 PM Page 66

66

■

Serious Incident Prevention

recommendation for management. Such an approach is at best a time-consuming process with many pitfalls. A more productive approach is for the team to narrow the list of 25 to the critical few items that have the most potential benefit before proceeding to more detailed discussions. The Pareto voting process is an ideal method to accomplish this objective. Since there are 25 items listed, Pareto voting rules allow each participant to have 5 votes (20 percent of 25). Figure 6-2 presents the tabulation of votes after each participant has stated his or her top five selections. My experience has been that this systematic process quickly narrows the list of potential actions down to a manageable number of items that clearly have the most support from team members. These critical few items can then be discussed and researched in more detail by the team. Since the process is an open one and viewed as fair and equitable by team members, it greatly facilitates the achievement of both quality solutions and the consensus support of team members. In this case, the voting process has identified three potential reinforcement actions for facility employees with broad support from team members: (1) a company picnic with families invited; (2) a $30 gift certificate for each employee to a local restaurant; and (3) the choice of a $30 item to be selected by each employee from a catalog. After detailed discussion of the three potential actions, the team’s ultimate recommendation is for the facility manager to mail a personal letter of congratulations to the home of each employee with a $30 gift certificate to a local restaurant enclosed. One variation of the Pareto voting technique is to provide each participant with 100 points to spend, rather than individual votes. In using the “100-points method,” it is best to provide some up-front rules of play to ensure fairness. For example, rules may be established requiring participants to spend no less than 20 points on any single item with a maximum limit of no more than 50 points on any one item. An advantage of the 100-points method is that it provides a more accurate quantification of the differences in team member support for potential choices.

The Right Team Atmosphere The right team atmosphere as described by Figure 6-3, sets the stage for teams to achieve greatness. Such an atmosphere results in an environment that team members find to be challenging and a source of positive reinforcement. It is an environment where members feel free to speak their minds, and diversity in backgrounds and areas of expertise is valued. Leaders of effective teams recognize the importance of team synergy and ownership.

CH06pp060-67 4/10/02 12:50 PM Page 67

Employee Involvement—Developing Teamwork

■

67

1. The level of trust is strong enough so that team members can act naturally with one another. 2. People strive to understand what other members of the group say and feel. 3. There is a mutual respect among team members, and diversity of opinions is valued. 4. Individuals feel free to participate fully, including expressing agreement or disagreement with the ideas of other members. 5. The entire group, rather than just the leader, feels accountable for results. 6. Members understand that constructive conflict and tension are often a necessary part of the effective teamwork process, but members are diligent in quickly extinguishing destructive criticism and actions. 7. People understand and accept that the group will have some highs and lows. 8. The team recognizes the importance of providing adequate "think time" for critical decisions. 9. The team effectively critiques itself and is committed to continually improving the teamwork process. 10. Team members effectively reinforce one another when performance expectations are met or exceeded. FIGURE 6-3. The right team atmosphere.2

References 1. Juran Enterprises, Juran on Quality Improvement Workbook, 1st ed., 1983, p. 2-2. 2. “Good Team Atmosphere,” Eastman Chemical Company Quality Management Awareness Training Manual, 1989.

CH07pp068-82 4/10/02 12:50 PM Page 68

C H A P T E R

7

Understanding the Risks Risk is a word dependent upon the context of its use for full definition. For example, the universe of risks that must be controlled to minimize total injury frequency is quite different from the specific risks that must be controlled to prevent serious, high-consequence incidents. Further, “serious incident” is a relative term with meaning dependent upon factors such as size and type of organization. For a small employer, loss of a delivery vehicle, destruction of a warehouse, or a disabling injury to a key employee may be sufficient to endanger continued profitable operations. Occurrences having severe consequences for large facilities may be limited to incidents resulting in fatalities, multiple injuries, major property damage, major business interruption, or significant impact on the public. Understanding the risks is a prerequisite for identifying the critical work necessary to control the risks. Understanding risks requires answering the questions: What can go wrong? How likely is each undesirable event? What are the potential impacts? (See Figure 7-1). Understanding risks requires in-depth knowledge of specific conditions and causal factors that could lead to serious incidents.

68

CH07pp068-82 4/10/02 12:50 PM Page 69

Understanding the Risks

■

69

Management Commitment and Leadership

Involve Employees

Understand the Risks

Identify Work for for Identify Critical Critical Work Controlling Risks the Risks Controlling the Establish Performance Standards Maintain Measurement and Feedback Systems Reinforce and Implement Corrective Action

Improve and Update the Process

Do Managers Understand the Risks? Members of an expedition climbing to the summit of Mount Everest can reasonably expect their expedition leader to have extensive past climbing experience either on Everest or one of the other major Himalayan peaks.

CH07pp068-82 4/10/02 12:50 PM Page 70

70

■

Serious Incident Prevention

PROBABILITY UNIVERSE OF POTENTIAL

CRITICAL RISKS

OUTCOMES CONSEQUENCES FIGURE 7-1. Understanding the risks.

Certainly, experience as a climber helps ensure that expedition leaders recognize and understand the unique risks of high-altitude climbing. In more traditional workplace settings, managers may reach their positions by a variety of career paths—some of which do not ensure a full understanding of the organization’s risks. Even when managers rise through the ranks within the operation where their careers began, managers are often more versed in productive rather than preventive skills. It should not be assumed that obtaining an adequate understanding of risks occurs as a natural part of the management development process. Managers with new responsibilities must be educated regarding existing risks, and all managers must be informed when significant changes occur that impact the organization from a risk perspective. In reality, staying educated on potential risks must be a neverending task for both new and experienced managers. Management may find a variety of tools useful in maintaining an understanding of the organization’s risks. Conducting periodic management briefings is one effective technique. The purpose of these presentations should be to review: (a) the basics of each operation, (b) significant risks involved, and (c) the processes in place to control the risks. In addition to educating upper management, the process provides a valuable learning experience for the presenters. Major advances in personal knowledge can result from preparations to present and prepare for questions that may arise from such briefings. Management’s process for staying informed may also include participation on selected committees and teams. For example, it may be appropriate for a senior site manager to chair the committee responsible for process safety within a petrochemical facility. Leadership by a senior manager provides the needed visibility for chemical process safety initiatives while educating the participating manager on site risks. A manager who leads a safety committee or who takes the lead on a new safety initiative often be-

CH07pp068-82 4/10/02 12:50 PM Page 71

Understanding the Risks

■

71

comes a center of influence on safety issues—exerting influence both with subordinates and members of the senior management team. Visits to operating areas within a facility can be an effective part of the management risk-education process. These visits also provide area personnel an opportunity for interactive communication with managers. Advance scheduling is the key to making management visits a reality. Without advance scheduling, well-intentioned managers will find themselves yielding to the daily pressures and rationalizing that trips to the field are deferrable to another day.

Small Boat Operation: An Illustration of Risks Consider the operation of a small fishing boat. Potential consequences from boating incidents include drowning of passengers and loss of the boat. This knowledge is of interest, but a more detailed consideration of potential accident scenarios is needed for identifying the critical work necessary to prevent incidents. In operating a boat, for example, potential scenarios leading to serious incidents include: (1) passengers falling out of the boat; (2) the boat capsizing; (3) the boat sinking due to leakage; (4) the boat sinking due to overloading; or (5) the boat being destroyed by striking another object. Expanding the consideration of risks to include specific potential causes and scenarios facilitates identification of critical work for effectively controlling hazards. For example, identification of potential boating accident scenarios leads to a conclusion that boating risks may be controlled through critical actions such as: ■ ■

■

Training passengers in boating fundamentals, the proper wearing of life jackets, and in swimming skills; Properly equipping the boat with life jackets, a sign designating maximum loading, and lights for any operation during poor visibility conditions; and Maintaining an inspection process to ensure the boat remains in fully satisfactory condition.

A boating novice would likely, on his or her initial outing, be cautious and concerned about the possibility of an accident. However, as the novice gains incident-free experience, a tendency toward complacency and blindness to hazards may develop. We find ourselves becoming desensitized to the hazards. Consider the following news report from the Atlanta Constitution:

CH07pp068-82 4/10/02 12:50 PM Page 72

72

■

Serious Incident Prevention

Sylvania—In the past, dozens of H. D. Mead’s employees on the 13,000acre Wade Plantation had gone fishing on the old dead part of the Savannah River in that brown, flat-bottom aluminum boat. Nothing out of the ordinary ever happened. On Monday, plantation hand Melvin Bates recalls, Norman Scurry had taken his cousin, Bates wife, fishing in the boat. . . . Norman—described by his boss, A.M. Hill, the plantation manager, as a “great fisherman”—had caught a mess of bream in the old river. His wife was cooking the catch on the shore in a clearing beneath moss-laden trees. . . . Some of the kids wanted to go for a ride in the old boat, which was powered by a small 3 1/2 horsepower outboard motor. On Wednesday, Bates waited with others amidst swarming gnats in the mournful humidity outside the Sylvania Funeral Home as Scurry viewed for the first time the bodies of his four children and niece, all of whom drowned Tuesday when that old boat sank in one of the worst boating disasters in Georgia history. “We’ve all been out in that boat with our kids,” said Bates, “and nothing ever happened. It goes to show you, you can be looking at death and don’t see it.” “I don’t to this minute know what happened,” said Norman Scurry. . . . “The front of the boat . . . just went straight down. Straight down. . . .” The 12-foot boat is fine for the old river—which was once part of the throbbing main channel of the Savannah. . . . But with six persons aboard, all so comfortable in their surroundings on the frolicsome family outing that they did not follow simple safety rules, it was a floating disaster. “He (Norman Scurry) told me he knew better than to put that many people in a boat at one time,” said Screven County Sheriff George F. Bazemore, “but he said since it was kids he thought it would be all right.” Neither Norman Scurry nor the children in the boat were swimmers.1

Understanding More Complex Risks Like the after-the-fact awakening to the risks involved in boating, the chemical industry experienced a period of risk discovery following a 1984 catastrophic incident in Bhopal, India. More than 2,000 people died after a release of methyl isocyanate from a chemical facility. In Congressional hearings, the statements by management responsible for the facility echoed those of individuals affected by the fatal Georgia boating accident. Although the plant had been operating for seven years, top management indicated they were not adequately informed regarding the potential risks involved with their operation.2

CH07pp068-82 4/10/02 12:50 PM Page 73

Understanding the Risks

■

73

With news of the Bhopal tragedy, I was among the safety directors and plant managers throughout the chemical industry contacted by the news media for interviews. The pressing question was, “Can it happen at any of your facilities?” In retrospect, our response indicating that our facilities could not impact the public to the same magnitude as the Bhopal incident was totally correct. It’s fair, however, to say our assessment was based on general knowledge of on-site operations rather than the results of scientific evaluations. In the months after the Bhopal catastrophe, in-depth evaluations of the potential for our operations to impact areas outside plant boundaries provided an enhanced understanding of facility risks. This improved understanding led to identification of numerous improvement initiatives— actions resulting in inherently safer facilities. The period of discovery and action following Bhopal was truly an industry-wide phenomenon, and the work done to better understand the risks was a key to the implementation of actions to more effectively control the risks. The commitment and resources required for understanding major risks involved in operating complex operations, such as a large chemical facility, are obviously much greater than for understanding the risks of operating a small boat. Complex operations, such as aviation, health care, large-scale construction, manufacturing, utility operations, refineries, pipelines, transportation operations, and chemical facilities, require a systematic approach to identify and understand risks. A petrochemical facility, for example, is typically comprised of thousands of components, all of which must function reliably, both separately and as a system. Failure scenarios with potentially serious consequences may be relatively numerous, and each must be understood in some detail. Consider, for example, a single component in a typical facility—a pump. It is not sufficient to simply understand that a pump failure can result in a release of material. Identification of the work necessary to control pump-related risks requires a full understanding of the specific failures that can occur. For example, the following conditions that can lead to pump failure must be understood and controlled: ■ ■ ■ ■

Gradual changes leading to failure due to corrosion, erosion, or other wear and tear. Changes in operating conditions that may contribute to increased corrosion or erosion. Improper installation or repair leading to failure of pump components. Misoperation, such as opening valves in the wrong sequence during startup.

CH07pp068-82 4/10/02 12:50 PM Page 74

■

74 ■

Serious Incident Prevention

Quality control deficiencies leading to installation of a pump incompatible with process requirements.

A Systematic Process of Risk Identification Identifying and understanding significant risks for a major operation or facility requires a comprehensive, systematic approach. An effective process for a petrochemical facility, for example, will generally require at least the following: ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■

Input from operating, staff, and management personnel with operational expertise Process hazard analyses A system for employees to report suspected deficiencies related to any aspect of the incident prevention process Management-of-change reviews Near-miss and accident investigations Field inspections Management briefings regarding specific serious-incident-related risks Networking through trade associations and safety groups Review of investigative reports for incidents experienced by other companies Evaluation and compliance with regulatory standards such as the OSHA Process Safety Management standard Evaluation of applicable statistical summaries and technical information regarding the causes of accidents Computer modeling or other evaluation of the range of consequences for potential incident scenarios

Maintaining an adequate understanding of risks inherent in complex operations is truly a neverending journey. The process requires perception, attention to detail, dedication, and a keen thirst for knowledge. The discipline and courage to challenge assumptions is critical. Experience confirms that rather than “what you don’t know,” the real danger is often linked to “what you think you know that isn’t so.” In traveling, the occasions where we become lost tend to be those where we are certain of the proper route— so certain that we fail to confirm the address or obtain directions. In oper-

CH07pp068-82 4/10/02 12:50 PM Page 75

■

Understanding the Risks

(Highest) 10

75

(Lowest)

0

-1

-2

10

-3

10

-4

10

-5

10

10

1 in 1

10-6

1 in 1,000,000

•

•

Missetting large valves (no status indicator except open or closed)

•

•

•

Crew reaction during disaster Technician seeing an out of calibration instrument as in tolerance

•

Selection of switch dissimilar in shape or location to desired switch

•

Missetting large manual valves (controlled by procedure, keys, chaining, etc.)

Two-person team (one does, one checks, then roles are reversed)

•

Simulated military emergency

General error of omission for items embedded in procedure

•

•

Passive inspections (general walk-around)

•

Selection of key-operated switch rather than non-key switch (does not

General error of omission (no control room display)

•

Monitor/Inspector fails to recognize initial error by operator

•

General errors of commission, eg., misread label and selected wrong switch

•

Simple arithmetic errors (without re-doing calculation on separate paper)

FIGURE 7-2. Estimates of human performance error rates. (From System Safety

2000 by J. Stephenson. Copyright 1991 by Van Nostrand Reinhold. Reprinted by permission of John Wiley & Sons Inc.)3

CH07pp068-82 4/10/02 12:50 PM Page 76

76

■

Serious Incident Prevention

ations with potential for serious incidents, assumptions made without checking it out can lead to catastrophic consequences.

Understanding the Role of Human Error Managers must have a firm understanding of the role human errors can play in serious incidents. As illustrated by Figure 7-2, estimates of human performance error rates for various tasks range from a high probability (e.g., 1 in 10) to a very low probability (e.g., 1 in 100,000). When human errors can lead to severe consequences, managers must understand the wide range of potential responses and ensure tasks are designed to facilitate correct responses. Some environments have the unfortunate characteristics of being both error inducing and unforgiving in the event an error is made. In the presence of these conditions, preventative actions must be sustained to effectively block the pathway leading to incidents with severe consequences. In petrochemical, utility, and other similar operations, conditions such as unplanned shutdowns resulting from operational upsets can create stressful, error-inducing environments. The human error accident causation model, as illustrated by Figure 7-3, confirms that preplanned, proactive actions are vital in helping ensure plants are shut down safely. Examples of proactive actions helpful in maintaining safe conditions during shutdowns include: (1) development of procedures, checklists, and other specific job aides; (2) operator training; and (3) testing and calibration of critical instrumentation. Regardless of the type of operation, the focus should be on identifying and implementing specific actions necessary for reducing the potential for incidents due to human error. Although accidents typically have multiple causes, investigations often indicate some form of human failure in the sequence of events leading to the incident. Some human errors have immediate impact on safe work and result in adverse effects leading directly to an incident. These types of errors are often committed by front-line personnel at the point-of-control and are commonly referred to as unsafe acts or “at risk” behaviors. Other types of critical human failures lead to conditions categorized as latent conditions. These types of conditions may be present for many years before they combine with at-risk behaviors and other random circumstances to lead to an incident with catastrophic consequences. Such latent conditions include poor design, gaps in supervision, training deficiencies, inaccurate procedures, faulty planning, and less-than-adequate equipment. While unsafe acts having direct adverse impact are usually committed by hands-on personnel, latent conditions are often attributable to failures in the

CH07pp068-82 4/10/02 12:50 PM Page 77

Understanding the Risks

FIGURE 7-3. Human error accident causation model.4

■

77

CH07pp068-82 4/10/02 12:50 PM Page 78

78

■

Serious Incident Prevention

upper layers of the organization. Understanding an organization’s safety risks requires an understanding of both “at-risk” actions that can directly lead to incidents and the role of latent conditions that are like hidden land mines waiting for the right circumstances to cause destruction.

Classifying and Prioritizing Risks Organizations have finite resources and must continually make decisions regarding the level of resources that will be applied to control risks. It is important that the organization classify and prioritize its risks to provide the right guidance in making these strategic decisions. Risk classification methods include those that quantify risks by means such as probability of occurrence, costs, number of expected fatalities, or other potential outcomes. Other classification methods are commonly used that provide only a qualitative description of potential consequences (e.g., catastrophic, critical, negligible) and the probability of occurrence (e.g., frequent, occasional, improbable). The Department of Defense’s Standard Practice for System Safety is provided in MIL-STD-882D, and is an example of a classification method that incorporates both qualitative and quantitative factors in the risk prioritization process. The standard utilizes four separate tables to describe and classify risks as described below.

Mishap Severity Mishap severity categories provide a qualitative measure of the most reasonable credible mishap resulting from personnel error, environmental conditions, design inadequacies, procedural deficiencies, or system, subsystem, or component failure or malfunction. Suggested mishap severity categories are shown in Table 7-1. Note: These mishap severity categories provide guidance for a wide variety of programs. However, adaptation to a particular program is generally required to provide a mutual understanding between the program manager and the developer as to the meaning of the terms used in the category definitions. Other risk assessment techniques may be used provided that the user approves them.6

Mishap Probability Mishap probability is the probability that a mishap will occur during the planned life expectancy of the system. It can be described in terms of potential occurrences per unit of time, events, population, items, or activity.

CH07pp068-82 4/10/02 12:50 PM Page 79

Understanding the Risks

■

79

TABLE 7-1 Suggested Mishap Severity Categories Based on MIL-STD-882D5

Description Criteria

Category

Environmental, Safety, and Health Result

Catastrophic

1

Could result in death, permanent total disability, loss exceeding $1M, or irreversible severe environmental damage that violates law or regulation.

Critical

II

Could result in permanent partial disability, injuries or occupational illness that may result in hospitalization of at least three personnel, loss exceeding $200K but less than $1M, or reversible environmental damage causing a violation of law or regulation.

Marginal

III

Could result in injury or occupational illness resulting in one or more lost work day(s), loss exceeding $10K but less than $200K, or mitigatible environmental damage without violation of law or regulation where restoration activities can be accomplished.

Negligible

IV

Could result in injury or illness not resulting in a lost work day, loss exceeding $2K but less than $10K, or minimal environmental damage not violating law or regulation.

Assigning a quantitative mishap probability to a potential design or procedural hazard is generally not possible early in the design process. At that stage, a qualitative mishap probability may be derived from research, analysis, and evaluation of historical safety data from similar systems. Supporting rationale for assigning a mishap probability is documented in hazard analysis reports. Suggested qualitative mishap probability levels are shown in Table 7-2.

TABLE 7-2 Suggested Mishap Probability Levels (Based on MIL-STD-882D)7 Description*

Level

Specific Individual Item

Fleet or Inventory**

Frequent

A

Likely to occur often in the life Continuously experienced of an item, with a probability of occurrence greater than 10-1 in that life

Probable

B

Will occur several times in the Will occur frequently life of an item, with a probability of occurrence less than 10-1 in that life

CH07pp068-82 4/10/02 12:50 PM Page 80

■

80

Serious Incident Prevention

TABLE 7-2 continued Suggested Mishap Probability Levels (Based on MIL-STD-882D)7 Description*

Level

Specific Individual Item

Fleet or Inventory**

Occasional

C

Likely to occur some time in the life of an item, with a probability of occurrence less than 10-2 but greater than 10-23 in that life

Will occur several times

Remote

D

Unlikely but possible to occur in Unlikely, but can reasonably the life of an item, with a be expected to occur probability of occurrence less than 10-3 but greater than 10-6 in that life

Improbable

E

So unlikely it can be assumed Unlikely to occur, but occurrence may not be experipossible enced, with a probability of occurrence less than 10-6 in that life

* Definitions of descriptive words may have to be modified based on quantity of items involved. ** The expected size of the fleet or inventory should be defined prior to accomplishing an assessment of the system.

Mishap Risk Assessment Mishap classification by severity and probability can be performed by using a mishap risk assessment matrix. This assessment allows one to assign a mishap risk assessment value to a hazard based on its mishap severity and its mishap probability. This value is then often used to rank different hazards as to their associated mishap risks. An example of a mishap risk assessment matrix is shown in Table 7-3.

TABLE 7-3 Example Mishap Risk Assessment Values (Based on MIL-STD-882D)8 Severity Probability:

Catastrophic

Critical

Marginal

Negligible

Frequent

1

3

7

13

Probable

2

5

9

16

Occasional

4

6

11

18

Remote

8

10

14

19

12

15

17

20

Improbable

CH07pp068-82 4/10/02 12:50 PM Page 81

Understanding the Risks

■

81

Mishap Risk Categories Mishap risk assessment values are often used in grouping individual hazards into mishap risk categories. Mishap risk categories may then be used to generate specific actions, such as mandatory reporting of certain hazards to management for action or formal acceptance of the associated mishap risk. Table 7-4 includes an example listing of mishap risk categories and the associated assessment values. In the example, the system management has determined that mishap risk assessment values 1 through 5 constitute “high” risk while values 6 through 9 constitute “serious” risk.

TABLE 7-4 Example Mishap Risk Categories (Based on MIL-STD-882D)9

Mishap Risk Assessment Value

Mishap Risk Category

1–5

High

6–9

Serious

10–17

Medium

18–20

Low

The above process, based on MIL-STD-882D,10 provides a systematic method for categorizing and prioritizing risks. For complex operations, such a system can be of great benefit in providing a full understanding of the organization’s risks.

Understanding the Risks—A Prerequisite for Success I once participated in a Fortune 100 company’s annual safety workshop where the corporate safety director declared that increasing compliance in the wearing of seat belts for off-the-job driving should clearly be the primary safety emphasis for the corporation. Plans were already in place to audit employee compliance as they entered company parking lots each morning and to increase awareness through actions such as a seat-belt slogan contest. Knowing that the company handled large quantities of hazardous materials and that other risks existed that could potentially lead to serious incidents, several managers in attendance voiced support for wearing seat belts,

CH07pp068-82 4/10/02 12:50 PM Page 82

82

■

Serious Incident Prevention

but at the same time vigorously questioned whether seat-belt compliance should be established as the number-one focus for the company’s safety initiatives. However, it was a case in which the corporate safety director had established a position and would not consider any reevaluation. Some months later, I read reports that the EPA had assessed this company a multimillion dollar penalty as a result of hazardous materials leaking from storage tanks. The lack of control over hazardous materials also resulted in the community’s loss of confidence in the corporation—a loss of trust that would prove difficult to recapture. While company support of seat-belt regulations is clearly important, the company’s obligation to handle hazardous materials safely and without environmental harm was clearly an issue having more potential impact on the continued long-term success of the organization. Unfortunately, such misjudgments in evaluating and acting upon risks are not rare. History is full of instances in which serious incidents have occurred because those responsible for risk management had their eyes on the wrong ball.11 Focusing on the right opportunities requires a full understanding of the risks.

References 1. D. Morrison, “The Boat’s Front ‘Just Went Straight Down,’” Atlanta Constitution, 26 July 26 1979, 1C, 3C. 2. “Tragedy Shock Waves: Carbide Chief Urges Look at Chemical Industry Safety,” Dallas Times Herald, 15 December 1984, 2A. 3. J. Stephenson, System Safety 2000: A Practical Guide for Planning, Managing and Conducting System Safety Programs (New York: Van Nostrand Reinhold, 1991), 134. 4. Center for Chemical Process Safety. Guidelines for Preventing Human Error in Process Safety (New York: AICHE, 1994), 258. Copyright 1994, American Institute of Chemical Engineers. Reproduced with permission. 5. “Standard Practice for System Safety (MIL-STD-882D),” U.S. Department of Defense, 10 February 2000, 18–20. 6. Ibid. 7. Ibid. 8. Ibid. 9. Ibid. 10. Ibid. 11. J. Reason, Managing the Risks of Organizational Accidents (Aldershot, Hampshire, England: Ashgate Publishing, 1997), 228.

CH08pp083-095 4/10/02 12:50 PM Page 83

C H A P T E R

8

Identifying the Critical Work The ability to transform concepts and slogans into specific tasks is one of the key characteristics differentiating successful organizations from those destined to underachieve. In the context of serious incident prevention, concepts and slogans must be transformed into the critical work necessary to sustain safe operations. An organization’s long-term success in preventing serious incidents will be determined by its effectiveness in identifying and executing the right preventative actions.

Managing Similar Risks with Varying Levels of Success Although many organizations have similar risks to manage, a significant variation in outcomes is common. As an illustration, governments around the world achieve varying levels of success in controlling risks related to the operation of motor vehicles. Automobiles were introduced in several countries during the same approximate time period: the late 1800s and early 1900s. In 1895, horseless carriages in the United States were limited to about 300, mostly imported. By the turn of the century, however, automobiles numbered almost 4,000 among the 76 million Americans, and 83

CH08pp083-095 4/10/02 12:50 PM Page 84

84

■

Serious Incident Prevention

Management Commitment and Leadership

Involve Employees

Understand the Risks

Identify Critical Work for Controlling the Risks Establish Performance Standards Maintain Measurement and Feedback Systems Reinforce and Implement Corrective Action

Improve and Update the Process

during the early 1900s, automobile ownership in the United States began to skyrocket. Sadly, the increase in vehicles was accompanied by a tremendous escalation in vehicle-related deaths. By the 1920s, motor vehicle fatalities had climbed to 20,000 per year. With increasing public pressure to improve traffic safety, Herbert Hoover, then Secretary of Commerce, called the first

CH08pp083-095 4/10/02 12:50 PM Page 85

Identifying the Critical Work

■

85

National Conference on Street and Highway Safety. The 1924 national conference was one of America’s initial efforts to identify and reach consensus on the critical work required to minimize traffic-related fatalities. The Uniform Vehicle Code was developed at the conference, and these guidelines became a model for traffic laws in every state.1 As time has passed, additional actions to reduce fatalities have been identified and implemented. Actions have included additional rules and regulations, driver education, improved highway design and maintenance, improved signal devices, vehicle inspection programs, driver testing and licensing, and enhancements such as seat belts. Certainly, the promulgation of rules, regulations, and design standards, together with enforcement activities, has varied significantly among countries throughout the world. As illustrated by Figure 8-1, the results in preventing fatalities have also varied widely. Bottom-line results range from 7.0 fatalities per 100,000

Fatalities Per 100K Vehicle Miles FIGURE 8-1. Highway fatalities for selected countries (from USA Today).2

CH08pp083-095 4/10/02 12:50 PM Page 86

86

■

Serious Incident Prevention

vehicle miles in Egypt to the nearly 50-fold improvement of 0.15 fatalities per 100,000 vehicle miles in Britain. With the fundamentals of vehicle operation similar in each locale, these differences in outcomes are directly related to each country’s effectiveness in identifying and implementing the work necessary to minimize fatalities. This same variation in results holds for other forms of transportation, including commercial aviation. Statistics for a recent year, indicate that the probability of commercial aviation passengers being involved in an accident resulting in at least one fatality varied by a factor of 42 among air carriers throughout the world. Flying with the carriers having the best records provided an approximate 1 in 11,000,000 probability of death or injury, while flying with the poorest performers resulted in a 1 in 260,000 probability.3 Interestingly, these wide variations in serious incidents exist despite each carrier being involved in a similar operation, the process of transporting passengers through commercial aviation.

Beyond Regulatory Compliance Even though vehicle-related fatalities in both Britain and the United States are substantially lower than in many other countries, one is hard pressed to accept the results as satisfactory. Efforts to prevent traffic-related fatalities are for the most part limited to developing and enforcing laws and regulations. As with other regulated activities, vehicle laws and regulations typically represent minimum acceptable standards. For example, it has been legally acceptable to operate a vehicle in many parts of the United States following consumption of alcohol, provided the blood alcohol level is maintained below 0.10 percent. However, sound science supports the premise that operation of high-speed equipment is prudent only at much lower blood alcohol levels. Less-than-outstanding results are predictable when preventative actions are focused primarily on regulatory compliance. A manufacturing or processing facility, for example, should not expect satisfactory long-term results if actions are limited to complying with rules promulgated by OSHA, EPA, and other agencies. A comprehensive, customized approach extending beyond compliance is essential to successfully manage risks. In evaluating probable causes of major incidents, as tabulated in Chapter 1, the need for proactive identification and execution of preventative actions is evident. Many past incidents could have been prevented through executing work considered fundamental for the type of operation experiencing the incident—fundamental actions with tremendous favorable benefits. For example, typical actions applicable to preventing serious inci-

CH08pp083-095 4/10/02 12:50 PM Page 87

Identifying the Critical Work

■

87

dents include facility inspections, testing of equipment and instrumentation, development of procedures, training, near-miss and accident investigation, emergency response drills, and effective management-of-change procedures. Few of these actions are difficult to achieve singularly, but in total comprise a comprehensive system of critical work requiring significant resources and a constancy-of-purpose to effectively manage. An effective incident-prevention process is needed to facilitate identification and diligent long-term execution of the critical work.

Identifying Critical Work The potential for achieving major improvements through the identification and execution of critical work is illustrated by the success in reducing tornado deaths within the United States. Implementation of improved forecasting and tracking technology, better warning systems, and increased public understanding of tornado risks have resulted in dramatic improvements, as illustrated by Figure 8-2. With the implementation of these improvements, the average number of annual deaths from tornadoes in the 1990s was reduced to about one-fifth the average annual rate experienced in the 1930s. Unlike the regulatory-driven approach to preventing vehicle-related fatalities, the effort to minimize tornado deaths has been driven by sound science with emphasis on solutions that add value. This successful effort demonstrates the loss prevention benefits that can be achieved through accurately identifying the critical work and then properly resourcing and executing it. 250

AVG ANNUAL DEATHS

200

150

100

50

0 1930-39

1940-49

1950-59

1960-69

1970-79

1980-89

1990-96

FIGURE 8-2. Average annual U.S. tornado deaths, 1930–1996 (from USA

Today).4

CH08pp083-095 4/10/02 12:50 PM Page 88

88

■

Serious Incident Prevention

The types of tasks that must be executed to sustain incident-free operations are dependent upon the particular risks that must be managed. In a health care facility, for example, we would anticipate the list of actions needed to control risks to include critical work for addressing areas such as toxic material control, infection control, radiation safety, asbestos management, medical waste management, blood-borne pathogen control, fire prevention, emergency preparedness, facility evacuation, elevator safety, loss of critical utilities, and prevention of violent acts. For any type of operation, an effective management process is needed that facilitates diligent execution of critical work required for success. Regardless of differences in risks, the general types of causal factors that lead to serious incidents are common to different types of facilities and operations. Critical work must be identified for controlling each of these causal factors to prevent deficiencies that could lead to a serious incident. These factors, as described below, include twelve related to human performance, six to equipment performance, and one to external causes.5

Causal Factors for Serious Incidents Human Performance: 1. Verbal communication: the spoken presentation or exchange of information 2. Written procedures and documents: the written presentation or exchange of information 3. Man-machine interface: the design of equipment used to communicate information from the plant to a person (displays, labels, etc.) 4. Environmental conditions: physical conditions of the work area 5. Work schedule: factors that contribute to the ability of the worker to perform his assigned task in an effective manner 6. Work practices: methods workers use to ensure safe and timely completion of task 7. Work organization/planning: the work-related tasks including planning, scoping, assignment, and schedule of the task to be performed 8. Supervisory methods: techniques used to directly control work-related tasks, in particular, a method used to direct workers in the accomplishment of tasks

CH08pp083-095 4/10/02 12:50 PM Page 89

Identifying the Critical Work

■

89

9. Training/qualification: how the training program was developed and the process of presenting information on how a task is to be performed prior to accomplishing the task 10. Change management: the process whereby the hardware or software associated with a particular operation, technique, or system is modified 11. Resource management: the process whereby manpower and material are allocated for a particular task/objective 12. Managerial methods: an administrative technique used to control or direct work-related plant activities, which includes the process whereby manpower and material are allocated for a particular objective Equipment: 13. Design configuration and analysis: the design layout of the system or subsystem needed to support plant operations and maintenance 14. Equipment condition: the failure mechanism of the equipment is the physical cause of failure 15. Environmental conditions: the physical conditions of the equipment area 16. Equipment specification, manufacture, and construction: the process that includes the manufacture and installation of equipment in the plant 17. Maintenance/testing: the process of maintaining components/systems in optimum conditions 18. Plant/system operation: the actual performance of the equipment or component when performing its intended function External: 19. Human or nonhuman influence outside the usual control of the company

Critical Work for a Tank Car Loading Operation The need for customized processes to address risks inherent to specific operations is apparent when comparing a health care facility to a petrochemical facility. Consider, for example, an organizational unit within a

CH08pp083-095 4/10/02 12:50 PM Page 90

90

■

Serious Incident Prevention

chemical facility responsible for loading and properly securing chemical tank cars for shipment. The loading and securement process must be carefully performed to minimize the probability of product releases during transport. Let’s assume the operators responsible for loading and securing tank cars comprise a chemical loading and shipping team. The team’s goals include zero releases resulting from improper securement or condition of chemical tank car shipments. In working toward leak-free rail shipments, the chemical loading and shipping team takes the same approach as utilized to improve results in other key performance areas. The team’s focus is on development of an improved process—a more effective process for tank car inspection and securement. To fully understand significant risks that must be controlled, the team evaluates potential scenarios and causes that can lead to chemical releases from tank cars. The team’s objective is to drive transportation incidents, controllable by the team, to zero by identifying and executing the work critical to ensuring leak-free tank car shipments. Worn manway gaskets have been the most common cause of past leaks from cars loaded by the team. However, the team recognizes that their incident prevention efforts must be broad enough to address what can occur rather than limited to what has occurred. For additional information on potential causes of incidents, the team consults with the Association of

Manway

Other Causes/Unknown

Rupture Disc

Other Top Fittings

Bottom Fittings

Safety Relief Valve

Liquid Line

Shell or Head

0

50

100

150

200

250

Number of Incidents - 1997

FIGURE 8-3. Sources of tank car nonaccident releases, United States, 1997 (from Transportation Technology Center Inc.).6

CH08pp083-095 4/10/02 12:50 PM Page 91

Identifying the Critical Work

■

91

American Railroads. The Association’s database includes Non-Accident Release incidents involving tank cars for all U.S. carriers. The information, as summarized in Figure 8-3, confirms that manways, rupture discs, other top fittings, bottom outlets, safety relief valves, and liquid fill lines, are the most frequent sources of leaks. Success in preventing future incidents will require the team to ensure that all potential causes of releases are effectively addressed. After investigation and input from all members, the improvement team identifies the specific work needed to minimize transportation incidents controllable by the team. Critical tasks identified include: 1. Documentation of the tank car inspection and securement process in a reference manual including: ■ Preloading inspection procedures and checklists ■ Procedures for inspecting and replacing gaskets ■ Proper use of tools for securement ■ Procedures for tightening and securing dome lids, plugs, caps, valves, and other connections ■ Postloading inspection procedures and checklists 2. Formal operator training including: ■ Importance of zero tank car leaks ■ Specific actions required to correctly perform each step of the documented tank car inspection and securement process ■ Tool selection and proper usage ■ Skills checks to ensure proficiency 3. An audit process involving scheduled hands-on inspections of tank car securement by members of the loading and shipping team.

Sustaining Performance The chemical loading and shipping team is confident that execution of the work identified as critical will drive the frequency of controllable transportation incidents toward zero. To help sustain long-term execution of the critical work, the team’s process includes: ■

Measurement systems for monitoring both the frequency of transportation incidents and results of tank car securement audits

CH08pp083-095 4/10/02 12:50 PM Page 92

■

92 ■ ■ ■

Serious Incident Prevention

Timely performance feedback to all team members and management Reinforcement for sustaining the tank car securement process at a high performance level Identification of root causes and implementation of appropriate corrective action when performance fails to meet expectations 4

3

NUMBER

2

1

0 1

2

3

4

5

6

7

8

9

10

MONTH

FIGURE 8-4. Chemical loading and shipping team number of transportation

incidents.

30

25

20 TOTAL CARS AUDITED

NUMBER 15

TOTAL SATISFACTORY

10

5

0 1

2

3

4

5

6

7

8

9

10

MONTH

FIGURE 8-5. Chemical loading and shipping team tank car closure audit results.

CH08pp083-095 4/10/02 12:50 PM Page 93

Identifying the Critical Work

■

93

The team of tank car loading and shipping operators is committed to remaining alert for any changes affecting tank car loading and securement and continually strives to improve the incident prevention process. Through measurement, timely feedback, and reinforcement contingent upon performance, the team knows where it stands in meeting performance expectations. The improving results for leak-free shipments and for tank car securement audits, as illustrated by Figures 8-4 and 8-5, are a major source of pride for the team.

A Systematic, Knowledge-Based Approach Through research and input from team members, the chemical loading and shipping team effectively identifies the work critical to preventing releases from tank cars. The team’s systematic, data-based approach avoids the pitfalls of identifying the wrong things to work on. Such success in accurately identifying the right critical work is less likely when a manager proceeds on “gut-feelings” without sufficient research and input from others. Consider author Philip B. Crosby’s account7 of the misguided actions taken by the coach of a mythical high school football team: Coach Smedley conducted his evaluation after losing a game by a score of 14 to 13. He reasoned that the problem was that the opposition had blocked one extra-point try while his team had blocked none. Had his team blocked two, the game would have been won 13 to 12. The team set out on an intensive practice schedule devoted exclusively to the art of blocking extra points. They practiced all week, set goals for themselves, conducted motivational meetings to keep themselves pumped up. Two games later they blocked 13 extra points. They celebrated the achievement of their target and then went on to deny their opponents dozens of extra points during the remainder of the season. They had quite forgotten that there is more to the game.

Correctly identifying the critical work is a prerequisite for success in sustaining serious-incident-free operations. A systematic, data-driven approach with input and involvement from knowledgeable individuals is required. The work identified must be sufficiently comprehensive and must be diligently executed to ensure success. Measurement, timely feedback, reinforcement, and proactive corrective action will be needed to sustain longterm performance at the level required to sustain serious-incident-free operations.

CH08pp083-095 4/10/02 12:50 PM Page 94

■

94

Serious Incident Prevention

Process Safety Management Standard The objective of OSHA’s Process Safety Management (PSM) standard is to prevent accidental releases of hazardous materials. The standard strives to meet these objectives by requiring employers to execute the critical work as outlined by the standard. The objective of the work required by the standard is to provide for the proactive mitigation or prevention of potential releases due to failures in processes, procedures, or equipment. The PSM standard has much to offer. The types of critical actions required by the standard provide a solid foundation for an effective safety process even for employers not handling hazardous materials. When compared to the eight-element serious incident prevention process, however, we find that the elements of the Process Safety Management Standard are primarily a listing of critical work to be done with little to offer in ensuring that the work is diligently executed consistent with established standards. Organizations will also find that many actions beyond PSM compliance will be required for sustained success. Thus, the elements of PSM should be considered as a subset of the universe of critical work required to achieve and sustain serious incident free operations. The actions required by the PSM standard, however, can be a very important part of the total work required to maintain safe operations. The required elements of the standard include: ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■

Employee participation Process safety information Process hazards analysis Operating procedures Training Contractors Prestartup safety review Mechanical integrity Hot work permit Management of change Incident investigation Emergency planning and response Compliance audits

The full text of OSHA PSM standards is located in the Code of Federal Regulations 29 CFR 1910.119. One of the elements of the PSM standard is

CH08pp083-095 4/10/02 12:50 PM Page 95

Identifying the Critical Work

■

95

management of change. Effective management of change has proven particularly important for the prevention of serious incidents and is discussed in more detail in the next chapter.

References 1. G. S. McClellan, ed., “Safety on the Road,” The Reference Shelf, 38, no. 1 (New York: H. W. Wilson, 1966), 16–17. 2. G. Visgaitis, “Highway Fatalities Abroad,” USA Today; 7 June 1996, 3E. Reprinted with permission. 3. J. Reason, Managing the Risks of Organizational Accidents (Aldershot, Hampshire, England: Ashgate Publishing, 1997), 191. 4. E. A. McLean, “Tornado Deaths in a Downward Spiral,” USA Today; 22 July 1997, 12A. Reprinted with permission. 5. M. Ammerman, The Root Cause Analysis Handbook (Productivity Inc., 1998), 66–67. 6. Transportation Technology Center Inc., Sources of Tank Car Non-Accident Releases, U.S., 1991–1997, 1998. 7. P. B. Crosby, Quality Without Tears—The Art of Hassle-Free Management (New York: McGraw-Hill, 1984), 112. Reproduced with permission of McGraw-Hill.

CH09pp096-102 4/10/02 12:50 PM Page 96

C H A P T E R

9

Identifying the Critical Work— Management of Change Serious-incident-free operation is the norm. Even poorly managed organizations do not typically experience such occurrences on a daily, weekly, or monthly basis. However, with the catastrophic impact of serious incidents, organizations must be committed to sustaining incident-free operation for the long term—decades rather than months or years. Managers must adopt a mindset of completing careers without serious incidents within their areas of responsibility. With serious-incident-free operation the norm, a simplistic approach toward sustaining such operations is to prevent or control the occurrence of changes. Obviously, in practice, we want some conditions to remain constant while other changes are desirable and intentionally implemented. While maintaining the status quo is not feasible, it is clear that the capability to prevent serious incidents is directly linked to effectiveness in managing both unplanned and planned changes. Two forms of change must be addressed: ■ ■

Unplanned changes Planned changes

96

CH09pp096-102 4/10/02 12:50 PM Page 97

Identifying the Critical Work—Management of Change

■

97

Unplanned Changes Entropy recognizes that, in the absence of compensating forces, all matter and systems tend toward disorder. With “change” being a potential enemy of safe operations, the presence of naturally occurring degradation is a significant concern. Changes driven by entropy are of particular concern because they occur slowly—often too slowly to be recognized by individuals who observe operations on a daily basis. Even if these changes are recognized, individuals may not have the expertise to determine when corrective action is required. In operations such as aviation, petrochemicals, construction, and health care, prompt identification and accurate evaluation of subtle workplace changes are critical to sustaining operations free of serious incidents. Changes related to naturally occurring degradation may at first glance be primarily associated with mechanical failures from forces such as friction or corrosion. A closer look confirms entropy is also at work in eroding the effectiveness of administrative processes. Major gaps in an organization’s published safety processes compared to actual implementation can develop. For example, with the passage of time, compliance with a facility’s safety permit system may degrade to where individuals routinely authorize maintenance work without conducting an adequate review of field preparations. A process dependent upon general employee awareness to detect and evaluate the significance of subtle, naturally occurring changes is inadequate. Recognizing and understanding the potential consequences of gradual changes requires a comprehensive, systematic approach. Management tools such as audits, inspections, equipment testing, instrument calibrations, procedure reviews and training are needed. Many of us have experienced the advantages of including “outsiders” in safety inspections. Rather than comparing an operation to “how it looked yesterday,” knowledgeable outsiders are more likely to compare the operation to “how it should be.” Training courses on management of change typically focus on changes that are planned and intentionally implemented. For planned changes, managers and other personnel commonly have advance knowledge prior to implementation. Management review is generally involved since approval of expenditures or other authorization is usually required. Reviews for some types of planned changes are also mandated by OSHA’s Process Safety Management Standard. Obviously, planned changes must be properly managed to prevent serious incidents. However, unplanned changes are equally as critical while often receiving less scrutiny. Examples of potential unplanned changes applicable to a chemical facility include drum filling equipment that has become unreliable in dis-

CH09pp096-102 4/10/02 12:50 PM Page 98

98

■

Serious Incident Prevention

pensing the proper quantity of material; unexpected changes in operating pressures; a noise that has developed in a pump; instrumentation that has ceased normal operation; an odor where no odor is typical; changes in operating temperature; and unexpected changes in inventory level. The burden for recognizing the occurrence of unplanned changes often falls upon individuals at the point-of-control operating level. Point-of-control personnel must be timely in communicating evidence of significant changes and in implementing corrective action. If drum-filling equipment malfunctions, members of the drumming crew may be the only individuals in position to suspend operations and initiate corrective action. However, the entire organization is dependent upon the individuals at the point of control to recognize the problem and initiate the proper response. Minimizing the consequences from unplanned changes requires individuals at the point of control to have expert knowledge of the operations for which they are responsible. Point-of-control personnel must also have a clear understanding of organizational objectives. Employees who understand organizational priorities and objectives are much more likely to take the correct action when responding to the unexpected. Expert knowledge, together with commitment to safe workplace objectives, is needed to help ensure workplace “red flags” that often accompany unplanned changes are observed and properly evaluated. While traveling to lunch with Eugene Thomas, a first-level supervisor and fishing enthusiast, I asked for advice on how to fish one of the area lakes. My past attempts to fish this lake had always ended in frustration due to the heavy underwater hydrilla fouling my lure on almost every cast. His response was an enthusiastic dissertation on the best techniques for successfully fishing the lake. Eugene detailed the procedure for rigging a “Bass Assassin” to make the lure weedless while retaining the capability to hook a high percentage of fish that strike. I was particularly impressed that his research on the rigging technique included observing a professional bass fisherman who fished with the “Assassin.” Eugene encouraged me to be more aware of the details—in particular, the locations of any openings in the underwater hydrilla. The “Assassin” should be allowed to free-fall through open pockets in the hydrilla to the lake bottom—where big bass lie in wait. Even though Eugene has developed expert-level fishing knowledge, he has remained eager to improve his knowledge and skills. He quickly detects and accurately evaluates the significance of any changes in the fishing environment—a change in wind direction, water conditions, ambient temperature, or the condition of his fishing gear. In fact, he recently shared with me that he no longer uses the “Assassin” as his main lure. “Flukes” now seem to be more successful for him.

CH09pp096-102 4/10/02 12:50 PM Page 99

Identifying the Critical Work—Management of Change

■

99

An equally high level of understanding and commitment is clearly feasible in the workplace environment where individuals earn their living. Training, communications, performance measures, feedback, reinforcement systems, and understanding of objectives are particularly critical in achieving the desired level of understanding, commitment, and effectiveness throughout the organization. I have become a true believer in the power of committed individuals and teams to make a real difference in workplace safety.

Planned Changes A Texas city recently announced that it was refunding a Wal-Mart store for an overcharge of $283,000 on its water bill. The city had replaced the store’s water meter several years earlier with a new meter that measures the volume of water usage in hundreds of gallons instead of in thousands of gallons like the old meter. The new meter functioned as designed, but after its installation the city failed to change a factor in the computer system used to calculate water bills. The system continued to assume that the number entered from the meter was in thousands of gallons rather than hundreds, resulting in the store being charged for a thousand gallons of water for every hundred gallons used.1 How fortunate that this failure to manage change did not involve life-threatening or other similar consequence. In a large organization, the frequency of planned changes can be high, with changes initiated at many different organizational levels. Even though improvement is the ultimate objective of most planned changes, some have the potential for unintended consequences not readily apparent. Introducing a new raw material into a chemical manufacturing process to reduce costs may also result in an unintended increase in process piping corrosion. Similarly, air bags installed in vehicles to protect passengers have been found to be potentially hazardous for the elderly and small children. Specific methods for evaluating planned changes prior to implementation may vary with the size and type of organization. However, each of these methods has a common objective—to ensure that planned changes involving equipment, facilities, procedures, and processes do not adversely affect employees, the public, or the environment. Systems to effectively manage change generally require documentation of the planned change, a review by appropriate technical experts and managers, pre-startup inspections of changes involving facilities or equipment, development or modification of procedures to address the changes, and employee training on the revised procedures. Several excellent publications are available that focus on effective management of planned changes. The American Chemical Society’s publication

CH09pp096-102 4/10/02 12:50 PM Page 100

100 ■

Serious Incident Prevention

A Manager’s Guide to Implementing and Improving Management of Change Systems provides an in-depth review of systems applicable for both small and large facilities.2 Facilities are encouraged to customize management-of-change systems based upon needs and resources. However, experience indicates that effective systems have several common elements, including: ■ ■ ■ ■ ■ ■

Identifying the need for change Specifying review and approval steps Conducting appropriate hazard reviews Taking action to control associated hazards Obtaining approval and authorization Implementation of approved changes.

Identification of all planned modifications or replacements not considered “replacement-in-kind” is a key management-of-change objective. This requires identifying all planned changes involving items (e.g., equipment, raw materials, procedures) that deviate from the design specification of the original item being modified or replaced. Changes that affect design specifications often lead to deviations from the normal output of a process, and the significance of these potential changes must be closely evaluated prior to authorizing implementation of a process change. The identification and review of planned changes provides an opportunity to decide if a proposed change should actually be implemented. The review process also provides the opportunity to identify any actions required to control unwanted side effects that could occur from the change. The review process must be flexible, and personnel must be trained in determining the level of evaluation required for a specific proposed change. For example, a brief review may be fully sufficient to identify the potential consequences for some planned changes, while an in-depth HAZOP (hazard and operability), or other detailed analysis, may be required for others. The level and intensity of review is typically a decision made by a designated line manager, safety professional, or other authorized individual. In reviewing planned changes, accurately identifying the potential for undesirable consequences can be very challenging. Effectiveness in conducting reviews varies among individuals due to differences in knowledge levels, analytical capabilities, and other personal factors. My experience, in fact, indicates that individuals with truly outstanding analytical skills for evaluating changes comprise only a small percentage of the workplace. The variation in individual capability increases the importance of utilizing the team concept in reviewing planned changes.

CH09pp096-102 4/10/02 12:50 PM Page 101

Identifying the Critical Work—Management of Change

■ 101

The need for thoroughness in reviewing planned changes is illustrated by an incident involving a major health care facility. The hospital initiated a planned change to utilize a new respiratory oxygen supplier. In the course of implementing the change, the supplier installed a new oxygen tank and support equipment at the facility. The new installation included a section of hose in the oxygen distribution system that apparently contained residue from a chemical compound utilized to clean the hose. Several patients requiring respiratory care died in the days following their initial exposure to the new oxygen system.3 Although the investigation did not conclusively correlate the deaths with the change in oxygen supply, the public images of both the hospital and oxygen supplier were unfavorably impacted. The point to be made is that an in-depth review is required to successfully minimize the potential for subtle, unintended problems resulting from process changes. In many facilities, processing and manufacturing operations are periodically shut down to perform equipment maintenance or modifications. The actions of shutting down the operation, managing the maintenance/modification work, and restarting the operation following completion of the work represent significant changes from the normal operating mode. Predictably, an abnormally high percentage of serious incidents have occurred during such periods. One study indicates about 24 percent of the total serious incidents in petrochemical facilities occur when the operating mode is other than normal.4 Certainly, we would expect most petrochemical operations typically to be in the “other-than-normal” mode less than 10 percent of the time. Thus, the probability of an incident occurring during a day when a facility is down for maintenance is likely to be several times higher than for a day when operations are in the normal mode. Such shutdowns for maintenance and modifications belong in a special category of planned change. Management tools such as procedures, training, contractor safety programs, and effective permit systems are particularly critical in sustaining incident-free operations during these nonroutine periods.

Management of Change in the Serious Incident Prevention Process Table 9-1 provides a listing of management tools that can be effectively utilized to manage change. The serious-incident prevention process provides an effective method for ensuring that critical work necessary to sustain serious-incident-free operations is identified and effectively executed. It is clear that this work must include actions to effectively manage change. Successful incident-prevention processes must ensure that all types of changes are effectively managed, including both unplanned and planned changes.

CH09pp096-102 4/10/02 12:50 PM Page 102

102 ■

Serious Incident Prevention

TABLE 9-1 Tools for Effectively Managing Change

Unplanned Changes Audits Inspections Equipment testing Instrument calibrations Procedure reviews Training Near-miss and hazardous-condition reporting system Documentation of acceptable operating conditions and parameters Establishment and communication of incident prevention objectives Management control systems including: ■ performance measures for serious incident prevention work ■ performance feedback ■ recognition and accountability ■ timely correction of identified problems

Planned Changes Establishment of process for advance review and authorization of changes Process hazard analysis Prestartup inspections Procedures updated for changes Training Safety permit systems Effective communications NOTE: The above listing is intended only to provide examples, and it is recognized that many other potentially effective tools are available.

References 1. M. Roark, “City Owes Wal-Mart $283,000 Refund,” Longview, Texas, Daily News, 21 July 2001, 1A. 2. J. S. Arendt, M. L. Casada, A. C. Remson, and D. A. Walker, A Manager’s Guide to Implementing and Improving Management of Change Systems (Chemical Manufacturers Association Inc., 1993). 3. “Medical Gas Supplier Restricted Further: Judge Issues Order After Deaths of 10 Veterans Exposed to Tainted Oxygen,” Dallas Morning News, 16 Nov. 1997; 28A. 4. D. G. Mahoney, ed., Large Property Damage Losses in the HydrocarbonChemical Industries, A Thirty-Year Review, 14th ed. (Risk Control Consulting, a division of J&H Marsh & McLennan Inc., formerly M&M Protection Consultants: 1992), 8.

CH10pp103-110 4/10/02 12:50 PM Page 103

C H A P T E R

10

Establishing Performance Standards

Individuals have varying ideas on what it takes to satisfactorily execute a job. Such variations can be observed in the way individuals perform tasks—maintaining a yard, studying for an exam, or performing lockout/tagout procedures. When proper execution of tasks is critical to preventing incidents having the potential for catastrophic consequences, an organization would be negligent to entrust its destiny to the whims of individual opinions regarding satisfactory performance. A consensus on acceptable standards of performance is needed within the organization. Standards must support the execution of critical work in a manner that provides a full margin of safety while utilizing resources effectively. Performance standards are a prerequisite to maintaining the operating discipline necessary for incident-free operations. What are performance standards, and what role do they play in the prevention of serious incidents? Performance standards are a means of documenting and communicating how tasks should be performed and what results need to be accomplished—they serve to define excellence. Performance standards may be either explicit or implicit, with explicit standards typically documented in written form—missions, goals, action plans, policies, and procedures. Inferred or implicit standards are equally as important in defining acceptable performance. These standards are

103

CH10pp103-110 4/10/02 12:50 PM Page 104

104 ■

Serious Incident Prevention

Management Commitment and Leadership Involve Employees

Understand the Risks

Identify Workfor for IdentifyCritical Critical Work Controlling the Controlling the Risks Risks Establish Performance Standards Maintain Measurement and Feedback Systems Reinforce and Implement Corrective Action Improve and Update the Process

often reflected in each employee’s level of awareness, discipline, and care in performing work. Actions of employees often mirror the expectations and values of their leaders.

CH10pp103-110 4/10/02 12:50 PM Page 105

Establishing Performance Standards

■ 105

Corporate/Company Standards A hierarchy of performance standards exists. At upper management levels, performance standards are typically expressed in terms of missions, visions, goals, objectives, policies, guidelines, and action plans. Input to upper management from organizational units accountable for implementation is critical. Plans and standards developed in a vacuum tend to have a high mortality rate when introduced into the workplace environment. Even technically perfect standards are doomed to resistance from individuals not having the opportunity for input in the development stage. Corporate level standards for a company might include: 1. A mission and vision statement incorporating safety objectives 2. A corporate safety policy 3. Goals and objectives to: ■ Reduce the frequency of hazardous material spills and releases by “x” percent ■ Experience zero incidents resulting in fatalities, major property damage, or impact on the public ■ Conduct process safety management audits of each facility, with at least “x” percent of facilities achieving an A-level audit score ■ Obtain OSHA VPP STAR program status for all major facilities 4. Corporate guidelines for: ■ Hazard communication ■ Hot work procedures ■ Emergency response ■ Isolation of energy sources ■ Employee training ■ Auditing of serious incident prevention processes ■ Management of change ■ Process hazards analysis ■ Accident reporting and investigation

CH10pp103-110 4/10/02 12:50 PM Page 106

106 ■ ■ ■ ■

Serious Incident Prevention

Contractor safety Mechanical integrity Facility and fixed-equipment inspections

The company safety policy documents and communicates the organization’s core values regarding safety performance. The policy should address prevention of serious incidents and protection of the public in addition to prevention of common injuries among employees and contractors. An increasing proliferation of policy statements has become a workplace reality—statements addressing safety, environmental, quality, diversity, harassment, and other issues. A growing competition has developed, not only for conference room wall space, but for comprehension in the minds of employees. A safety policy is most effective when it is developed with employee input, and is concise, easy to understand, and sufficiently comprehensive in scope.

Facility/Operating Level Standards Goals and objectives generated at each level of the organization need to be clearly documented together with action plans for achievement. Specific guidelines for execution of critical work should be established to provide criteria for excellence and promote consistency of actions. A company with multiple locations may develop guidelines applicable to all facilities or may look to each site for development of facility specific guidelines. In practice, some combination of corporate and site-specific guidelines is the norm. The importance of employee involvement in the development of standards is a constant for all levels of the organization—top management through first level. Managers and teams having the opportunity for input are more likely to proceed with support rather than resistance. A facility’s safe-practices manual can serve as an effective method for documenting many operating and maintenance-related safety standards. A safe-practices manual provides guidance for work routinely performed— guidance impacting the performance of critical work by numerous employees and contractors. Facility-wide standards must be based on sound risk-management practices. A sufficient margin of safety must be included in the standards to ensure jobs can be performed hundreds and thousands of times without creating conditions leading to a serious incident. At the facility and departmental level, managers and their teams are expected to implement actions to ensure that company goals, objectives, policies, and guidelines are fully realized. For example, compliance with a corporate guideline for process equipment inspections may require manu-

CH10pp103-110 4/10/02 12:50 PM Page 107

Establishing Performance Standards

■ 107

facturing managers to develop and implement action plans and procedures specific to each operating unit. To ensure that process equipment inspections accomplish their intended purpose, inspections must be executed in conformance with appropriate performance standards. In conducting a prestartup inspection, for example, guidelines should be developed to assign responsibility and document how the inspections will be conducted. Expectations should be established for both target levels of performance and for specific methods of performance. As one moves down the organization chart, standards need to become more specific and detailed. At the point-of-control level, operating and maintenance procedures, together with work authorization permits, are examples of the documentation needed to provide detailed guidance for the execution of critical work. Such documentation helps ensure that the numerous actions and special techniques necessary to sustain long-term success are properly performed. Reducing the frequency of accidental spills and releases is a common safety and environmental-related objective for chemical facilities and refineries. Performance standards in the form of action plans and procedures are essential in documenting critical actions needed to achieve the desired reductions. An effective action plan for reducing spills and releases should include steps to evaluate causes of past incidents, prioritize opportunities for improvement, and initiate improvement actions. Examples of operating and maintenance practices with potential for reducing hazardous material spills include: double checking the alignment and position of valves prior to starting flow, corrosion inspections, and the testing of high-level alarms on tanks. Such practices are a part of the critical work for spill reduction, and documented standards are needed to ensure expectations in performing these tasks are clearly understood. People will eventually make mistakes, and equipment will eventually malfunction. When errors or malfunctions have the potential for catastrophic consequences, standards must include redundant safeguards blocking the pathway to a serious incident. The consequences of inadequate performance standards can be devastating. In its investigative report1 of an overfilled underground hydrocarbon storage cavern, the National Transportation Safety Board concluded that inadequate performance standards were a contributing cause of the incident that resulted in three deaths. In recommending that the facility’s operating permit be revoked, a Texas State Board of Examiners concluded the cavern inventory process was inaccurate, measurement procedures unreliable, safety devices not fully operable, and employees insufficiently trained. Facilities with inadequate standards of performance are in effect dependent upon good luck for sustaining safe operations. When the consequences of failure include the release of flammable or toxic materials, performance standards dependent upon luck are clearly not sufficient.

CH10pp103-110 4/10/02 12:50 PM Page 108

108 ■

Serious Incident Prevention

Explicit and Implicit Standards Performance expectations for the execution of critical work must be documented in enough detail to prevent conditions leading to serious incidents. However, good judgment must be exercised to avoid creation of a bureaucratic management system through excessively rigid requirements. A proper balance between explicit and implicit standards must be maintained. A standard of “checking tank high-level alarms on a monthly basis” does not sufficiently describe the criteria for excellent performance. Documentation of the optimum methods for testing and calibrating the alarms is required—methods that ensure reliability of the alarm systems while utilizing resources efficiently. In establishing the required frequency for alarm tests, the consequences of failure to detect a hazardous condition must be considered together with the probabilities for both instrument malfunction and the presence of a hazardous condition. In addition to developing task specific standards, management actions must be consistent with shaping an organizational culture that tolerates nothing less than excellence in performing the work necessary for serious incident prevention. Management has the potential either to bring out the best in people or to create a culture where mediocrity is the norm. Commitment to a constancy of purpose in support of the serious incident prevention process is critical—any perception that the critical work is deferrable or optional must be avoided. Management must work toward institutionalizing the incident-prevention process so that attention to the critical details becomes a way of life. Management’s responsibilities include keeping the serious incident prevention flame burning. Documentation of detailed performance standards for all behaviors and practices required to sustain incident-free operations is impractical. A workforce must be developed that is not overly dependent upon rigorous management controls to carry out proper actions. When documented performance standards do not exist, actions of employees will be guided by their previous training, commitment, and understanding of organizational objectives. Steven R. Covey emphasizes the need for effective work practices formed through the coming together of knowledge (what to, why to), skills (how to); and desire (want to).2 To successfully sustain serious-incident-free operations, team members must be consistently willing to go the extra mile, particularly in exercising their full mental capabilities. Fear of criticism can cause individuals to rationalize a wait-and-see approach when prompt action may be required to prevent conditions from deteriorating toward a serious incident. Employee confidence in the disciplinary review process is critical—is there a management bias to blame problems on employee errors? Without confidence in the system, a ten-

CH10pp103-110 4/10/02 12:50 PM Page 109

Establishing Performance Standards

■ 109

dency toward deafness and blindness to early warning signals of potential problems may develop. The World War II attack on Pearl Harbor would likely have resulted in less tragic consequences for the United States if radar operators had promptly issued an alert after observing an unusually large blip on the radar screen. Operators apparently did not have the competence and confidence needed to properly interpret and report this “red-flag” condition. Rather than risking the possibility of sounding a false alarm on a Sunday morning, operators looked for alternate explanations and ultimately rationalized the activity as a squadron of U.S. bombers. The first wave of Japanese aircraft arrived without warning at Pearl Harbor 38 minutes later. Following the attack, deficiencies in battle readiness standards were addressed by relieving top military commanders from their assignments, but the damage at Pearl Harbor had been done.3 Employees need more than a road map for performing critical work; a compass is needed to provide direction in uncharted territory. Employees on night shift, for example, need to understand they have authority and are expected to shut down equipment as needed to maintain safe conditions. Employees are continually recalibrating their compasses based upon how they perceive management reactions to events. When employees are faced with difficult decisions regarding actions to take, factors—such as how the boss reacted the last time equipment was shut down, and the level of mutual confidence between the boss and employee—become critical. North on the compass is continually being redirected by management’s actions—including some actions subject to misinterpretation. It has been observed, for example, that if equipment is down for repairs, managers often ask their subordinates when startup will be, but the message typically heard by subordinates is, “Hurry, we’re losing money!” In these situations, employees may rationalize the taking of shortcuts, including the violation of safe work practices, in order to achieve the results they perceive to be the most important to the boss. Managers need to remember that their communications and personal reactions continually shape and reshape employee perceptions of expected performance.

Standards—A Prerequisite for Measurement, Feedback, and Accountability Standards provide benchmarks for measurement and a basis for performance feedback.

CH10pp103-110 4/10/02 12:50 PM Page 110

110 ■

Serious Incident Prevention

Standards, together with measurement and feedback systems, make accountability for the critical work feasible and are essential in helping maintain operating discipline. Without performance standards, the process model is incomplete and insufficient to sustain serious-incident-free operations.

References 1. Railroad Commission of Texas, Application of Seminole Pipeline Company to Expand the Underground Hydrocarbon Storage Facility at Brenham Salt Dome, Washington and Austin Counties, Texas; Oil and Gas Docket No. 030200582, 25 March 1994. 2. S. R. Covey, The 7 Habits of Highly Effective People (New York: Simon & Schuster 1989), 47–49. Excerpt used with permission. All rights reserved. 3. M. Carter, “Pearl Harbor—This Is No Drill,” Dallas Morning News, 1 December 1991, 36A.

CH11pp111-125 4/10/02 12:51 PM Page 111

C H A P T E R

11

Measurement and Feedback Measurement of performance compared to established standards is an essential element of the serious incident prevention process. Measurement, together with feedback of results to individuals and teams responsible for performance, provides the foundation for an effective accountability system. Measurement and feedback also facilitate the growth of employee pride, enthusiasm, and job satisfaction. Effective measurement is essential in monitoring progress in key performance areas such as product quality, financial performance, customer satisfaction, safety, and regulatory compliance. Rather than a burden imposed by management, measurement and feedback are consistent with personal needs. The sport of bowling, for instance, would have little appeal if performers had no knowledge of the pins knocked down—and knowing the score is equally important in the workplace. Measurement and feedback systems provide a source of focus and pride for point-ofcontrol personnel, serving to raise competitive instincts and promote understanding of the actions required to achieve and sustain improvements. James Dyson, founder and chairman of the United Kingdom’s Dyson Appliances Ltd., has a keen understanding of both the need for improved processes and the fundamental human need for performance feedback. While vacuuming the floor at home, Dyson noticed that his conventional

111

CH11pp111-125 4/10/02 12:51 PM Page 112

112 ■

Serious Incident Prevention

Management Commitment and Leadership

Involve Employees

Understand the Risks

IdentifyCritical Critical Work Identify Workfor for Controlling the Risks Controlling the Risks

Establish Performance Standards Maintain Measurement and Feedback Systems Reinforce and Implement Corrective Action Improve and Update the Process

vacuum cleaner seemed to be pushing dust around rather than collecting it. He was surprised to discover that the vacuum had lost a substantial amount of cleaning power despite its collection bag being less than half-full. Dyson understood the basics of “cyclones,” which are conical-shaped vessels used in industrial applications to separate dust, such as sawdust, from air used to transport the dust. His recognition of the need to change the

CH11pp111-125 4/10/02 12:51 PM Page 113

Measurement and Feedback

■ 113

process for vacuum cleaners led to development of the double-cyclone, bagless cleaner. Dyson’s revolutionary vacuum cleaner outsells its nearest competitor in the U.K. by a wide margin, and virtually all major vacuum cleaner manufacturers throughout the world now offer their versions of a bagless machine. Dyson’s genius also included an understanding of the human desire for direct feedback of results when performing tasks. Other vacuum manufacturers had historically assumed that individuals operating the machine did not want to see the accumulation of dirt and grime as it was being vacuumed. Dyson, however, realized that users do want to see the results of their work—whether it be bowling, preparing a vessel for confined space entry, or vacuuming a floor. His clear plastic, removable collection bin that shows the dirt, debris, and dog hairs being collected provides direct performance feedback to the vacuum cleaner operator and has added to the vacuum’s commercial success.1

Performance Accountability Completion of each step in a “Plan-Do-Check-Act” continual improvement cycle helps ensure that desired initiatives are successfully deployed. An effective measurement and feedback system allows managers and others accountable for performance to stay up-to-date on implementation efforts. Progress beyond the “Plan” step is dependent upon a system for measuring results and providing timely feedback to individuals and teams accountable for performance. When the consequences of failure are catastrophic, an effective process must be in place for ensuring proper implementation. Management confidence based upon anecdotal reporting, superficial inspections, or the passing of consecutive days without an incident is a false confidence.

Performance Measurement for Critical Work To illustrate an effective measurement and feedback system, consider a warehouse operation involving storage of combustible and flammable materials. Critical work to prevent serious incidents for an operation of this type would likely include: ■

Development of storage, fire prevention, and emergency response procedures

CH11pp111-125 4/10/02 12:51 PM Page 114

114 ■ ■ ■ ■ ■ ■ ■ ■ ■

■ ■

Serious Incident Prevention

Training personnel on procedures Scheduled inspections Hot work permit systems Evacuation/emergency response drills Management-of-change process Incident investigation and corrective action A hazard-reporting process Maintenance and testing of safety-related equipment including fire doors, sprinkler systems, smoke alarms, fire extinguishers, and security systems An audit process A contractor safety process

Each task critical to preventing serious incidents must be executed consistent with an appropriate performance standard. The standard should typically include a specified frequency and method for execution of the critical work. A weekly warehouse inspection, for example, may be an appropriate frequency to ensure the means-of-egress system is adequately maintained. The inspection method must be sufficient to confirm that aisles and exit doors are unblocked, emergency lights are in working order, and all other conditions conform with documented means-of-egress standards. Such standards should incorporate appropriate regulatory requirements (i.e., OSHA Subpart E—Means of Egress), and any value-adding performance requirements beyond regulatory compliance. The process utilized by the warehouse operating team for scheduling critical work, measuring performance, and providing performance feedback is documented by Tables 11-1, 11-2, 11-3, and Figure 11-1.

CH11pp111-125 4/10/02 12:51 PM Page 115

Measurement and Feedback

■ 115

TABLE 11-1 Warehouse Operations Serious Incident Prevention Critical Work

Critical Work

Frequency

Inspections conducted to ensure: a) no leakage from stored containers b) proper storage practices for flammable and combustibles c) sprinkler system block valves fully open d) forklifts in good condition e) facility security measures operational f) sprinkler system heads unblocked g) fire extinguishers in place, unblocked, and charged h) fire doors unblocked and in working order i) no-smoking signs posted and in good condition j) evacuation routes posted and aisles, exits, doors, signs, and lights in order k) trash contained in self-closing metal containers l) prestartup inspection for new or modified equipment

Daily Daily

Deficiencies identified on inspections are on schedule for correction

Review list minimum of once per week (some items require more frequent follow-up)

Audit to ensure plans and procedures are up-to-date and effectively implemented:

All items audited annually

Daily Daily Daily Weekly Weekly Weekly Weekly Weekly Weekly Prior to startup of new or modified equipment

a) emergency response and evacuation plan b) storage procedures c) control of ignition sources d) safety-permit procedures e) management-of-change procedures Initial and refresher training: a) fire extinguisher use b) sprinkler system trip location and activation c) reporting of fires, spills, and other emergencies d) security practices and procedures e) facility evacuation plan f) permit system to control hot work and other ignition sources

Frequencies for all critical work items: ■ Initial training for all new operators within two months of employment ■ Refresher training every two years and prior to significant changes

CH11pp111-125 4/10/02 12:51 PM Page 116

116 ■

Serious Incident Prevention

TABLE 11-1 continued Warehouse Operations Serious Incident Prevention Critical Work

Critical Work

Frequency

g) lock-out procedures for controlling hazardous energy h) lift-truck training i) proper storage practices Facility orientation and site visit for local emergency response agencies

Annual

Emergency drill

Annual

Alarm and equipment tests:

Monthly for all items

a) b) c) d) e)

smoke detectors fire alarm system evacuation alarm emergency lights security system

Process hazards analysis by cross-functional team

Every 3 years

Investigation of incidents and near-miss incidents with serious potential

Within 24 hours of occurrence

Comprehensive review and update of serious-incident prevention process

Annual

NOTE: Several technical references are available to assist in identifying the critical work necessary to prevent serious incidents in warehouse operations. Examples include: NFPA 1420, Recommended Practice for Pre-Incident Planning for Warehouse Occupancies; NFPA 30, Flammable and Combustible Liquids Code; and various insurance company publications.

CH11pp111-125 4/10/02 12:51 PM Page 117

Measurement and Feedback

■ 117

TABLE 11-2 Warehouse Operations Serious Incident Prevention (Percent Critical Work Completed on Schedule)

Month/Year: 8 / XX

Critical Work Area inspections: a) Daily checklist items b) Weekly checklist items c) New or modified equipment inspection prior to startup Deficiencies noted on previous inspections on-schedule for completion

Items Scheduled During Month?

Scheduled Items Completed?

Comments

yes yes --

yes no --

One weekly inspection missed due to heavy vacations

yes

yes

All items are onschedule for completion

Achieved A-level score on both processes audited

Audit of key processes: a) Emergency response and evacuation plan b) Storage procedures c) Control of ignitions sources d) Maintenance permit system e) Management of change

--

--

yes --yes

yes --yes

Procedures/plans up-to-date: a) Emergency response/evacuation b) Reporting of hazards c) Management of change d) Maintenance permit systems e) Proper storage practices

yes yes yes yes yes

yes yes yes yes yes

All procedures are up-to-date; one revision completed during month

yes yes yes -----

yes yes yes -----

100% attendance at all training sessions

-yes --

-yes --

Initial and refresher training: a) Fire extinguisher use b) Sprinkler system activation c) Reporting of emergencies d) Security procedures e) Facility evacuation f) Control of ignition sources g) Reporting & correction of hazards h) Energy isolation procedures i) Proper storage practices j) Lift truck operation

CH11pp111-125 4/10/02 12:51 PM Page 118

118 ■

Serious Incident Prevention

TABLE 11-2 continued Warehouse Operations Serious Incident Prevention (Percent Critical Work Completed on Schedule)

Items Scheduled During Month?

Scheduled Items Completed?

Facility orientation and site visit for local emergency response agencies

--

--

Emergency drill

--

--

yes yes yes yes yes

yes yes yes yes yes

Process hazards analysis by crossfunctional team

--

--

Investigation of incidents and “near misses”

yes

yes

Review and update of serious-incident prevention process

--

--

Critical Work

Critical alarm and instrumentation tests: a) Smoke detectors b) Fire alarm c) Evacuation alarm d) Emergency lights e) Security system

Monthly Totals:

20

12-Month Moving Average: 93% Goal for 12-Month Moving Average: 97% to 100%

19

Comments

All systems OK

Percent Completed As Scheduled: 95%

CH11pp111-125 4/10/02 12:51 PM Page 119

TABLE 11-3 Critical Work Not Completed on Schedule—Status of Follow-Up Action Item Behind Schedule

Cause

Emergency light inspections

Confusion over responsibility

Corrective action for repairing fire door found on last month’s inspection

Projected Completion Date Completed 2-1-xx

Instructions unclear to maintenance personnel on location of fire door that needs to be repaired

2-7

2-5

Evacuation training

2 operators missed due to vacations

3-24

3-24

Investigative report not yet issued on chemical spill that occurred in December

Conflicting priorities

4-7

Responsibility clarified and lights inspected

Will expedite completion

Measurement and Feedback

2-1-xx

Comments

■ 119

CH11pp111-125 4/10/02 12:51 PM Page 120

120 ■

Serious Incident Prevention

Moving average at goal level!

Congratulations! 100% 100

90

80

Lift truck trainer unavailable. Will provide “back-up.” 70

60 Monthly % 12 Month Moving Avg

50

Goal 40 1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

MONTH

FIGURE 11-1. Warehouse operations team—percent critical work complete.

Feedback and Its Linkage to Reinforcement Personnel responsible for the warehouse operation routinely receive feedback and reinforcement on the quality of services provided to warehouse customers. This ongoing feedback and reinforcement tends to ensure that warehouse activities impacting customer service receive priority—orders are promptly delivered, and inventories are replenished as needed. The feedback and reinforcement received shapes team priorities and drives efforts toward improving customer service. Feedback and reinforcement from customers for executing work necessary to sustain serious incident-free warehouse operations is typically nonexistent, however. Customers served by the warehouse are satisfied as long as services are adequate and costs are reasonable. Rather than being driven by external sources, leadership for executing serious incident prevention work must be generated internally—driven by the warehouse team together with line management. Without an effective performance measurement and feedback system, the team does not know where it stands—a situation that is somewhat like driving a car with no speedometer, fuel gauge, or maintenance records. Without knowing the past and current levels of performance,

CH11pp111-125 4/10/02 12:51 PM Page 121

Measurement and Feedback

■ 121

the team’s first indication of “loose bricks” in the safety process will likely be the occurrence of an incident. Without measurement and feedback, the warehouse team’s safety performance tends to be recognized only when a significant problem occurs— a pendulum that swings between either negative recognition or no recognition. Measurement and feedback help ensure employees are reinforced for their diligent work in executing critical serious incident prevention tasks—adding “thanks for a job well done” to work that may otherwise be perceived as thankless. Knowing the score and understanding that others appreciate their contribution provides meaning to the work for each member of the team. Employees see the impact of their efforts, and the resulting pride serves to sustain performance at high levels. Measurement and feedback systems provide the information needed for managers to effectively reinforce team members for sustaining satisfactory performance—or for ensuring corrective action is initiated when needed. Knowledge of results facilitates the identification of barriers that may impede performance. Knowing that improvements will be measured and that feedback will be provided to superiors provides incentive for managers to take on the difficult challenge of removing performance barriers. When the capability does not exist for monitoring and communicating improved results, few managers are willing to allocate the time, resources, and personal energy required for barrier bashing.

Elevating the Visibility of Critical Work The critical work to sustain incident-free operations tends to be low visibility, with neither the actual performance of the work nor the status of the work typically visible to management. It is a paradox that this low-visibility work has profound implications for the company’s highest visibility performance indicators—profits, customer service, company image, employee satisfaction, and safety. Consider the catastrophic incident at a petrochemical facility that resulted in 23 fatalities, together with loss of more than $1.5 billion in property damage and business interruption. This catastrophic incident was directly linked to apparent deficiencies in one of the low-visibility tasks critical to preventing serious incidents—that of effectively isolating piping systems to eliminate the potential for flammable releases during maintenance work.2,3 Similarly, a $21-million loss due to fire in an Iowa warehouse resulted from deficiencies in the basic tasks of controlling smoking and providing properly designed trash receptacles.4 Success in preventing serious inci-

CH11pp111-125 4/10/02 12:51 PM Page 122

122 ■

Serious Incident Prevention

dents requires attention to the old adage, “Big doors swing on little hinges.” Individuals accountable for performance must pay attention to the details— the condition of each hinge is critical.

Characteristics of Effective Measurement and Feedback Systems Processes for sustaining serious-incident-free operations must be forward looking rather than driven by after-the-fact reactions to incidents. After-the-fact knowledge cannot replace losses. Knowing that a ship has not sunk or experienced major damage during past operations has limited value in preventing or predicting future events. The seaworthiness of a ship must be judged on detailed knowledge of the crew and craft. Proactive knowledge is required to help ensure that conditions necessary to sustain incidentfree operations are consistently maintained. The focus of measurement should be on actions and conditions that directly impact serious-incident-free operations. For a ship, key areas of measurement might include the condition of the ship’s hull, the skill level of the crew, and the reliability of the navigational system. For a pipeline operation, measures should address critical factors that reflect the capability of the system to sustain incident-free operations, i.e., the condition of the pipe, cathodic protection systems, and right-of-way. While a low injury frequency is a favorable indicator of the potential for outstanding performance by both the ship and pipeline crews, an injury frequency measure does not sufficiently reflect the status of workplace conditions necessary to sustain serious-incident-free operations. While some overlap exists, prevention of common injuries and prevention of serious incidents are two separate processes and should be recognized as such.

Measurement Systems The objective of measurement is to monitor actual performance compared to expectations. Characteristics of an effective measurement system include: ■ ■

Influenceable—Performers directly influence the measured results. Meaningful—The items measured are important to the performer and organization.

CH11pp111-125 4/10/02 12:51 PM Page 123

Measurement and Feedback

■

■

■ ■

■ 123

Timely—Prompt measurement provides information on the current quality of work and allows performers to make timely adjustments as needed to improve results. Accurate and Reliable—Measurement provides data that truly reflect actual performance. The measure is objective and not easily manipulated. Sensitive to change—The measure promptly reflects significant changes in performance. Void of unwanted side effects—The measure does not promote unwanted behaviors to achieve the desired level of performance.

Feedback Systems The objective of feedback is to communicate results in a manner that facilitates sustaining satisfactory performance and improving inadequate performance. Characteristics of an effective feedback system include: ■ ■ ■ ■ ■

■ ■ ■ ■

Specific—The feedback provides specific knowledge regarding performance. Simple—Feedback is easily understandable. Visible—Feedback is effectively communicated through charts and other visual aids. Positive—Feedback is constructive rather than used as a vehicle for placing blame. Timely—Feedback is provided soon after results are generated. The linkage between results and execution of the work is maximized. Timely feedback facilitates prompt adjustment of the process as needed. Individualized—Feedback is tailored to optimize meaning for individuals and teams. Self-monitoring—Teams take the initiative to monitor their own performance and provide performance feedback to all team members. Goal-related—Feedback is specific to performance impacting organizational goals and objectives. Linkage with reinforcement and corrective action—Feedback effectively triggers reinforcement for good performance and corrective actions when improvements are needed.

CH11pp111-125 4/10/02 12:51 PM Page 124

124 ■

Serious Incident Prevention

Types of Measurement and Feedback Systems Any list of critical work necessary to sustain a safe workplace typically includes tasks that must be executed at varying frequencies. Target frequencies may range from a time span of hourly (i.e., instrument readings) to a span of several years between task performance (i.e., pressure testing or “smart-pigging” a pipeline system). The high number of tasks involved and the varying frequencies for execution can result in a system requiring effective organization for successful administration. A system of documentation, as illustrated by the tables and figures in this chapter, is useful in ensuring required tasks are effectively scheduled and executed. The system lends itself to providing effective measurement and feedback in the form of graphs and charts to individuals and teams accountable for performance. Performance monitoring for some types of work can be best accomplished through an audit process. Audits are an appropriate tool, particularly when knowledge-based judgment is required to quantify the level of performance. Audits are an excellent tool for measuring the level of policy deployment throughout an organization—for example, monitoring the level of compliance to energy isolation, hot work, or management of change standards. The focus of audits should be on ferreting out improvement opportunities and identifying other opportunities for positively reinforcing individuals and teams. When deficiencies are identified, emphasis must be on determining root causes and implementing timely corrective actions. Status reporting to management can also be an effective measurement and feedback tool. Progress reports on safety related initiatives promote self-measurement with a direct feedback loop to the performer. Management reviews of progress on key initiatives provide an appropriate “Check” step to help ensure plans are moving toward implementation.

Safety Performance Indexing A combination of different types of measurement and feedback systems, e.g., charts, audits, and status reports, will typically be needed to provide the performance monitoring and the feedback systems required to drive improvements. However, many organizations have found value in developing a single measure, or at least a limited number of measures, to reflect how the organization is progressing in achieving its safety objectives. A safety performance index utilizing a matrix that weights key performance indicators is a simple but very powerful technique that meets these needs. Safety performance indexing is discussed in detail in Chapter 12.

CH11pp111-125 4/10/02 12:51 PM Page 125

Measurement and Feedback

■ 125

Essential to the Process Measurement and feedback make good sense from many perspectives. These systems serve to continually inform key personnel of performance and to give meaning to the work for individuals responsible for executing the tasks critical to sustaining safe operations. Measurement and feedback systems document and communicate where we have been, where we are, and the direction in which we are heading. Measurement and feedback systems are congruent with human needs and are essential components of the serious incident prevention process.

References 1. M. Gottlieb, “Conventional Wisdom Be Damned,” Industry Week, 21 June 1999, 36–44. 2. D. G. Mahoney, ed., Large Property Damage Losses in the HydrocarbonChemical Industries, A Thirty-Year Review, 15th ed. (Risk Control Consulting, a division of J&H Marsh & McLennan, Inc., former M&M Protection Consultants: 1993), 3–42. 3. Phillips Petroleum Company, Phillips 66 Company’s Response to OSHA Citations, 9 May 1990, 1–10. 4. S. G. Badger, “1995 Large-Loss Fire and Explosions,” NFPA Journal, November/December 1996, 66.

CH12pp126-140 4/10/02 12:51 PM Page 126

C H A P T E R

12

Measurement and Feedback—Safety Performance Indexing Measurement and feedback systems for monitoring the status of critical actions and results are required to drive improvements needed to meet an organization’s goals and objectives. Specific measurement systems may be implemented to monitor key indicators of the safety process, such as: Percentage of critical work completed on schedule: ■ ■ ■ ■ ■ ■ ■ ■ ■

Inspections Audits Equipment testing Employee training Emergency drills Hazards analyses Operating procedure reviews Resolution of recommendations from hazard analyses, incident investigations, audits, near-miss reports, etc. Other critical work based on organization-specific risks

Results of employee safety culture surveys 126

CH12pp126-140 4/10/02 12:51 PM Page 127

Measurement and Feedback—Safety Performance Indexing

■ 127

Frequency and severity of incidents: ■ ■ ■ ■ ■

Injuries Property damage and business interruption Hazardous material releases Regulatory agency violations Other

With such a large number of parameters to consider in evaluating the success or failure of the safety mission, how can managers know if the organization’s progress is in the right direction? Utilization of the safety performance indexing technique will often be the best solution for providing this information. Safety performance indexing provides an effective method for measuring, tracking, and graphically displaying safety performance. Safety performance indexing can help the organization to: ■ ■ ■ ■ ■ ■

Focus on proactive, preventive measures rather than on measurement of after-the-fact indicators Monitor several key measures on an ongoing basis Establish appropriate improvement goals and reinforcement milestones Quantify progress in improving safety Focus the organization’s resources on the highest priority safety initiatives Provide an equitable comparison of safety performance among different organizations.1

Establishing a Safety Performance Index for Prevention of Serious Incidents The process for implementing the safety performance index is illustrated by Figure 12-1. Steps in the process include identifying key performance areas, identifying critical work and results needed to improve performance in each key performance area, identifying progress measures, establishing goals and reinforcement milestones, and tracking performance. There are several variations of the safety performance index, but each method typically utilizes a matrix that provides the capability for weighting the relative importance of each key performance area and for quantifying

CH12pp126-140 4/10/02 12:51 PM Page 128

128 ■

Identify Key Performance Areas

Serious Incident Prevention

Identify Actions and Results Needed

Identify Progress Measures

Establish Goals and Reinforcement Milestones

Track Performance

FIGURE 12-1. Steps for implementing the safety performance index.

overall performance. My extensive experience with the type of matrix shown in Figure 12-2 has been very favorable, and the performance index has proven to be a very powerful tool. As illustrated, key progress measures are listed in the first column of the matrix, the next ten columns are reserved for documenting current and desired levels of performance for each key measure, and the remaining four columns are used for recording actual performance (Value), the performance level achieved (Level), the relative weighting for each measure (Weight), and calculating a score based upon the actual performance and weighting for each measure (Score).

Safety Performance Indexing—An Example A simplified example will provide a better understanding of how the matrix is developed. Let’s assume your organization has identified five key performance areas, as listed below with a weighting factor that the implementation team has decided to assign to each area. 1. Leadership training for first-level supervisors: assigned a weighting of 20 2. Audit scores for regulatory compliance: assigned a weighting of 15 3. Timeliness in addressing corrective actions to incident investigations and hazards analyses: assigned a weighting of 20 4. Annual volume of hazardous materials spills: assigned a weighting of 25 5. Recordable injury rate: assigned a weighting of 20 (Note that the sum of the weighting factors must equal 100; in this case 20 + 15 + 20 + 25 + 20 = 100.) A first step in developing the matrix is to record the key performance areas to be measured and the weightings for each area in the matrix as shown by Figure 12-3. A next step is to identify the current level of performance and both realistic improvement goals and more visionary “stretch goals” for each progress measure. Improvement goals are those that the or-

1

2

3

Performance Level 4

5

6

7

8

9

10

Value

Calculations

Level x Weight = Score

TOTAL SCORE = FIGURE 12-2. Matrix for safety performance indexing.

CH12pp126-140 4/10/02 12:51 PM Page 129

0

Measurement and Feedback—Safety Performance Indexing

Progress Measures

■ 129

2

3

4

5

6

Calculations 7

8

9

10

Value

Level x Weight = Score

Leadership Training (%)

20

Audit Scores (%) Timeliness Corrective Action (days) Volume of Spills (lbs) Recordable Injury Rate (Injuries / 200K hrs)

15 20

25 20

TOTAL SCORE = FIGURE 12-3. Matrix for safety performance indexing with progress measures and weights.

Serious Incident Prevention

1

CH12pp126-140 4/10/02 12:51 PM Page 130

Performance Level 0

130 ■

Progress Measures

CH12pp126-140 4/10/02 12:51 PM Page 131

Measurement and Feedback—Safety Performance Indexing

Key Performance Area

■ 131

Current Performance Level 40%

Goal

Stretch Goal

85%

100%

75%

90%

100%

(3) Timeliness for Corrective Actions (average days required)

60 days

30 days

15 days

(4) Volume of Hazardous Material Spills (average lbs per month)

340 lbs.

100 lbs.

10 lbs.

6.5

3.0

1.5

(1) Leadership Training (% complete) (2) Audit Scores (%)

(5) Recordable Injury Rate (injuries per 200K hrs)

FIGURE 12-4. Documentation of key performance areas, current performance,

and goals.

ganization believes are attainable, typically within a one- or two-year period of time, while stretch goals may take longer and require additional resources to achieve. The implementation team has identified the key performance areas, current performance levels, goals, and stretch goals, as documented in Figure 12-4. Quantified information on current performance, goals, and stretch goals (an attainable vision) are then recorded in the matrix. As illustrated by Figure 12-5, the current performance level (baseline) is recorded in column 3, the goal level in column 7, and the stretch goal or vision in column 10. The design of the matrix is such that improvements, such as increasing the percentage of required training completed or decreasing the average days required for correcting action items always increase the performance levels achieved in the matrix resulting in correspondingly higher scores. A next step is to establish intermediate or sub-goals for levels 4, 5, and 6 and enter this information into the matrix in the columns between the baseline level (3) and the goal level (7). Appropriate entries for these levels may be determined by either evaluating the expected improvement from planned initiatives or by simply establishing the numbers between level 3 and 7 on a prorated basis. A simple way to accomplish the proration is to take the difference between level 3 and level 7 and increase or decrease the level by about 25 percent for each increment. For example, the difference between level 3 and 7 for “Timeliness of Corrective Action” is 30 days (60 - 30 = 30). Applying the 25-percent rule for “Timeliness of Corrective Action” and for the other key performance areas results in the entries shown in Figure 12-6. Although our intent must be to continually improve scores to above baseline levels, the matrix should also have the capability for reflecting any

1

2

3

4

5

6

Calculations 7

8

9

10

Leadership Training (%)

40

85

100

Audit Scores (%)

75

90

100

60

30

15

340

100

10

6.5

3.0

1.5

Recordable Injury Rate (Injuries / 200K hrs)

Level x Weight = Score

20 15 20

25

20

TOTAL SCORE = Baseline

Goal

Stretch Goal

FIGURE 12-5. Matrix for safety performance indexing: addition of current performance, goals, and stretch goals.

Serious Incident Prevention

Timeliness of Corrective Action (avg. days) Volume of Spills (avg. lbs per month)

Value

CH12pp126-140 4/10/02 12:51 PM Page 132

Performance Level 0

132 ■

Key Measures

Performance Level 4

5

6

7

Leadership Training (%)

40

52

63

74

85

100

Audit Scores (%)

75

78

82

86

90

100

60

52

44

37

30

15

340

280

220

160

100

10

6.5

5.6

4.7

3.8

3.0

1.5

Recordable Injury Rate (Injuries / 200K hrs)

1

2

Calculations

3

Timeliness Corrective Action (avg. days) Volume of Spills (avg. lbs per month)

0

8

9

10

Value

Level x Weight = Score

20 15 20

25

20

TOTAL SCORE = Baseline

Goal

Stretch Goal

■ 133

FIGURE 12-6. Matrix for safety performance indexing: addition of sub-goal levels 4, 5, and 6.

CH12pp126-140 4/10/02 12:51 PM Page 133

Key Measures

Measurement and Feedback—Safety Performance Indexing

s

CH12pp126-140 4/10/02 12:51 PM Page 134

134 ■

Serious Incident Prevention

performance that deteriorates to levels below the baseline. This is accomplished by assigning appropriate values to performance levels 0, 1, and 2, as illustrated by Figure 12-7. The design of the matrix provides the capability for scores continuing to increase even after the goals documented in column 7 are reached. This capability is provided by recording stretch goals in column 10 and then entering values for performance levels 8 and 9 in the appropriate columns. The team designing the matrix has flexibility in assigning these numbers, but one approach for determining values between the goal (column 7) and stretch goal (column 10) is to establish increments based on 33 percent of the difference between the values of columns 7 and 10. For example, the difference between levels 7 and 10 for “Timeliness of Corrective Action” is 15 days, and applying the 33-percent guideline results in increments of 5— in this case, a value of 25 for column 8 and 20 for column 9. The matrix with all values entered is illustrated in Figure 12-8. The matrix is now fully developed and ready for use. For illustration purposes, we will assume that a hypothetical company, Smith Industries, Inc. has developed a safety performance index matrix and is utilizing it to monitor performance on a monthly basis. Let’s assume Smith Industries has completed six months of using the system, and performance levels for the most recent month were as follows: ■ ■ ■ ■ ■

Leadership Training: 78 percent complete Audit Scores: 92 percent Timeliness of Corrective Action: 52 days Volume of Spills: 75 lbs. Recordable injury rate: 5.2 per 200,000 hours worked

To determine the monthly score, the first step is to record the monthly achievement for each key performance area in the “Value” column. For example, training is 78 percent complete, and a 78 is recorded in the value column for Leadership Training. The next step is to determine the corresponding performance level for each key measure by identifying the highest performance level fully achieved. In determining this level, no favorable rounding of numbers should be performed. For example, since the volume of spills has been reduced to 75 lbs., performance level 7 (100 lbs.) has been surpassed, but level 8 (70 lbs.) has not yet been achieved. Therefore, for “volume of spills” the actual achievement of 75 is recorded in the value column, the 100 in column 7 is circled, and the corresponding performance level of 7 is recorded in the Level column for use in calculating the score. Figure 12-9 illustrates entries of monthly performance data in

1

2

3

4

5

6

7

Leadership Training (%)

25

30

35

40

52

63

74

85

100

Audit Scores (%)

65

69

72

75

78

82

86

90

100

75

70

65

60

52

44

37

30

15

425

400

375

340

280

220

160

100

10

8.0

7.5

7.0

6.5

5.6

4.7

3.8

3.0

1.5

Timeliness Corrective Action (avg. days) Volume of Spills (avg. lbs per month) Recordable Injury Rate (Injuries / 200K hrs)

Performance Level

Calculations 8

9

10

Value

Level x Weight = Score

20 15 20

25

20

TOTAL SCORE = Baseline

Goal

■ 135

FIGURE 12-7. Matrix for safety performance indexing: addition of levels 0, 1, and 2.

Stretch Goal

CH12pp126-140 4/10/02 12:51 PM Page 135

0

Measurement and Feedback—Safety Performance Indexing

Key Measures

2

3

4

5

6

7

8

9

10

Leadership Training (%)

25

30

35

40

52

63

74

85

90

95

100

Audit Scores (%)

65

69

72

75

78

82

86

90

94

97

100

75

70

65

60

52

44

37

30

25

20

15

425

400

375

340

280

220

160

100

70

40

10

8.0

7.5

7.0

6.5

5.6

4.7

3.8

3.0

2.5

2.0

1.5

Timeliness Corrective Action (avg. days) Volume of Spills (avg. lbs per month) Recordable Injury Rate (Injuries / 200K hrs)

Performance Level

Calculations Value

Level x Weight = Score

20 15 20

25

20

TOTAL SCORE = Baseline

Goal

FIGURE 12-8. Matrix for safety performance indexing: addition of levels 8 and 9.

Stretch Goal

CH12pp126-140 4/10/02 12:51 PM Page 136

1

Serious Incident Prevention

0

136 ■

Key Measures

CH12pp126-140 4/10/02 12:51 PM Page 137

Measurement and Feedback—Safety Performance Indexing

■ 137

the Value column and the corresponding entries made in the Level column based on the highest performance level achieved. (Note the “Level” column is the third column from the right in the matrix and will be multiplied by the weighting factor to determine the score for each key performance area.) The final step in using the matrix is to calculate the scores by multiplying the Level achieved times the Weighting factor for each key performance measure and then summing the scores for each measure to calculate a total monthly safety performance score. Figure 12-10 illustrates these steps and indicates a total score of 560 for the month. An evaluation of the matrix indicates that goal levels have been achieved for audit scores and in reducing the volume of spills. Further reducing injury rate and improving the timelines of corrective actions provide the most opportunity for the team to improve their safety performance index score. Graphing the monthly scores provides visual feedback on the organization’s performance in improving safety. The monthly graph facilitates the tracking of performance trends, helps identify performance milestones that merit positive reinforcement, and provides an early warning when performance has begun to deteriorate. Feedback can be even more effective when the organization’s goal and comments on monthly performance are added to the graph of the performance index results. Figure 12-11 illustrates Smith Industries’ first six months of performance following implementation of performance indexing. The organization has increased its performance from the baseline level of about 300 to a current score of 560. The performance graph has facilitated positive reinforcement—for example, when performance surpassed 500, Smith Industries’ management visited each department to express appreciation for the outstanding work done in driving improvement from the baseline level. Safety performance indexing has proven to be a powerful measurement and feedback tool for the company, and the organization is well on its way to achieving the goals it has established. Safety performance indexing has many applications. As illustrated by the Smith Industries’ example in this chapter, the technique can be utilized to integrate an organization’s numerous key measures into a single performance measurement system. As illustrated in the case study described in Chapter 15, the safety performance index can also be utilized to calculate an overall performance level for an organization based on performance scores achieved within various units of the organization. One powerful feature of performance indexing is that it provides quantified performance data, and the availability of quantified data greatly enhances the organization’s capabilities for reinforcing performance. Reinforcement of performance is a critical component of the serious-incident prevention process, and the next chapter describes how reinforcement

2

3

4

5

6

7

8

9

10

Value

Leadership Training (%)

25

30

35

40

52

63

74

85

90

95

100

78

6

20

Audit Scores (%)

65

69

72

75

78

82

86

90

94

97

100

92

7

15

75

70

65

60

52

44

37

30

25

20

15

52

4

20

425

400

375

340

280

220

160

100

70

40

10

75

7

25

8.0

7.5

7.0

6.5

5.6

4.7

3.8

3.0

2.5

2.0

1.5

5.2

4

20

Timeliness Corrective Action (avg. days) Volume of Spills (avg. lbs per month) Recordable Injury Rate (Injuries / 200K hrs)

Performance Level

Calculations Level x Weight = Score

TOTAL SCORE = Baseline

Goal

Stretch Goal

FIGURE 12-9. Matrix for safety performance indexing: addition of values and levels for performing calculations.

CH12pp126-140 4/10/02 12:51 PM Page 138

1

Serious Incident Prevention

0

138 ■

Key Measures

0

1

2

3

4

5

6

7

8

9

10

Value

Leadership Training (%)

25

30

35

40

52

63

74

85

90

95

100

78

6

20

120

Audit Scores (%)

65

69

72

75

78

82

86

90

94

97

100

92

7

15

105

75

70

65

60

52

44

37

30

25

20

15

52

4

20

80

425

400

375

340

280

220

160

100

70

40

10

75

7

25

175

8.0

7.5

7.0

6.5

5.6

4.7

3.8

3.0

2.5

2.0

1.5

5.2

4

20

80

Timeliness Corrective Action (avg. days) Volume of Spills (avg. lbs per month) Recordable Injury Rate (Injuries / 200K hrs)

Performance Level

Calculations Level x Weight = Score

TOTAL SCORE = Baseline

Goal

■ 139

FIGURE 12-10. Matrix for safety performance indexing: calculation of monthly score.

Stretch Goal

560

CH12pp126-140 4/10/02 12:51 PM Page 139

Key Measures

Measurement and Feedback—Safety Performance Indexing

Month / Year _______________

CH12pp126-140 4/10/02 12:51 PM Page 140

140 ■

Serious Incident Prevention

Monthly Performance Graph 1000 900 800 700 600 500 Monthly Score

400

Goal

300

Stretch Goal

200

1

2

3

4

5

6

Month FIGURE 12-11. Smith Industries Safety Performance Index.

can be effectively utilized to help ensure desired performance is achieved and sustained.

References 1. Eastman Kodak Company, Safety Performance Indexing—Metrics for safety performance improvement projects, 1994.

CH13pp141-152 4/10/02 12:51 PM Page 141

C H A P T E R

13

Reinforcement and Corrective Action Reinforcement Richard Jackman, a prominent lecturer and management consultant, told a humorous story once that illustrates the power of reward systems in influencing personal actions: I was watching my dad farm, and I was helping him farm, in the late ‘30s or early ‘40s, and we were not farming very well. In fact, we were about ready to fold up farming until the government came along with a very timely program which they announced, to pay us for not farming. Now, right away, that captured our attention. And, the first phase of that program was to pay us for not raising hogs. Now, we looked at that and we said, we can handle that. And, so, we assessed our capabilities, and we made a determination that in that first year that we could not raise 200 hogs. And, so we did this, and we did it well, so well, that at the end of the first year the government sent us a check of $4,000. Now, in the second year, based on this accelerated learning curve, we decided to expand. It was time to grow. And, we made a commitment not to raise 400 hogs. But, you know, that never did work out too well.

141

CH13pp141-152 4/10/02 12:51 PM Page 142

142 ■

Serious Incident Prevention

Management Commitment and Leadership

Involve Employees

Understand the Risks

Identify Workfor for IdentifyCritical Critical Work Controlling the Controlling the Risks Risks Establish Performance Standards Maintain Measurement and Feedback Systems Reinforce and Implement Corrective Action Improve and Update the Process We had a lot of paperwork to fill out . . . it was a case of trying to grow too big too soon.1

Although Jackman’s story relates to a tangible, financially based reward system, other forms of reinforcement also serve to influence actions and attitudes. How encouraging it is when a spouse, friend, boss, or other coworker takes the time to recognize our personal actions—even a simple

CH13pp141-152 4/10/02 12:51 PM Page 143

Reinforcement and Corrective Action

■ 143

“thank you” can have a major impact. If the boss brags on our work, it makes our day. Positive reinforcement is wind for our sails, providing the support needed to sustain the constancy of purpose required for our longterm commitments. During my early years with Eastman Chemical Company, the ability to positively reinforce was not a prominent management trait. A few managers who were ahead of their time practiced it, but these pioneers were usually more popular with their subordinates than their bosses. From this baseline, I was fortunate to have participated in a cultural change leading to a workplace environment where reinforcement is graciously given and received. Such changes do not come easily, but once institutionalized, the process of reinforcement is a force multiplier in harnessing involvement and commitment. Effective reinforcement is critical in developing the organizational mindset needed to sustain high-level performance and continual improvement. The primary objective of reinforcement is to help performers feel appreciated for work well done. Reinforcement facilitates the constancy of purpose needed to sustain and continually improve performance. The focus should be on reinforcement that is sincere, specific, immediate, and personal—consistent with what is known as the SSIP rule (Table 13-1). A second important acronym to remember is PIC—behavioral research has repeatedly confirmed that reinforcement perceived by the performer to be positive, immediate, and certain (PIC) is the most effective form of reinforcement in shaping new behaviors.2 TABLE 13-1 SSIP Rule for Effective Reinforcement S: S: I: P:

Sincere Specific Immediate Personal

The reinforcement process should include both planned reinforcement for progress on key organizational objectives and other more spontaneous reinforcement that is integrated into the daily routine. Experience confirms that long-term effectiveness of the reinforcement process is enhanced through: (1) training in proper reinforcement techniques, (2) compliance with the SSIP rule, (3) an emphasis on social, nontangible reinforcement perceived to be positive, immediate, and certain, and (4) reinforcement contingent upon performance. Some managers are concerned that their actions to reinforce individuals and teams will be perceived as insincere or manipulative. These are valid

CH13pp141-152 4/10/02 12:51 PM Page 144

144 ■

Serious Incident Prevention

concerns, but compliance with the SSIP rule and other guidelines will allow the benefits of reinforcement to be realized while minimizing unwanted side effects. Delivery of reinforcement should be contingent upon performance completed rather than as a “bribe” intended to force a future outcome. Reinforcement should be specific to the achievement and, whenever feasible, based upon performance data. To avoid being perceived as insincere, individuals must conduct sufficient research to understand the achievement they intend to reinforce. Managers must also avoid harboring a hidden agenda in their reinforcement efforts. Resentment is certain if employees perceive self-promotion as the manager’s real purpose in publicizing individual or team contributions. Management should avoid over-reliance on tangible reinforcers, such as cash, gift certificates, clothing, or other items. Individuals receiving tangible awards often perceive the level of appreciation as proportional to the value of the recognition item received—“We saved the company a hundred grand; how can that be worth only a T-shirt?” Furthermore, when reinforcement is based on tangible recognition, employees are often disappointed unless the value of items received escalates over time. Individuals rationalize that if a ball cap was given for working a year without a lost-time accident, certainly two years should merit a lined jacket, and perhaps a $100 bonus for the third year. Compliance with the SSIP rule can become treacherous when reinforcement is focused on tangible items. Tangible reinforcers are often difficult to administer in a specific, immediate, and personal manner. Rather than a satisfactory experience, reinforcement initiatives can become stressful for the manager if employees begin to consider tangible reinforcement as a standard part of the compensation package with an expectation for awards to continually escalate. The “it takes big bait to catch big fish” philosophy can create havoc. In order to maximize the “payout,” individuals may rationalize massaging the data used to measure performance. Such filtering of data is a major disservice to the organization when the potential consequences of performance deficiencies include serious incidents. Tangible reinforcers, however, do have an appropriate place in reinforcement processes. In some circumstances, the prudent use of tangible reinforcers can help facilitate effective communication of the reinforcement message. For example, the serving of snacks or lunch can provide an enhanced setting for effectively communicating a message of thanks for a job well done. Reinforcers with symbolic value, such as plaques, team photographs, or ball caps can also be effective in helping communicate appreciation for performance. What is perceived as desirable reinforcement may vary among individuals and from team to team. Astute managers and team leaders should main-

CH13pp141-152 4/10/02 12:51 PM Page 145

Reinforcement and Corrective Action

■ 145

tain an ongoing awareness of what individuals and teams consider reinforcing. The most effective opportunities are often those that combine tangible and social reinforcement—for example, a gathering to celebrate significant achievements. A hamburger cookout to reinforce achievements of significant milestones can be a fun and effective setting for a celebration. With key managers planning the event and serving as wait staff and cooks, such outings help build teamwork while providing a forum for effectively reinforcing specific achievements. Other examples of social and tangible reinforcers are listed in Table 13-2. TABLE 13-2 Potential Reinforcers Social/Intangible: Expression of appreciation, recognition or praise Notations on performance measure chart Congratulatory letter, memo, or E-mail Visits by manager, team leader, or other stakeholder Recognition at meetings Newspaper articles Opportunity to represent organization Tangible:* Food: lunch, snacks, take-home items Clothing: ball caps, T-shirts, jackets Mementos Team or project photograph Trophies Plaques Gift certificates Special parking or drive-in privileges *Always to be accompanied by specific verbal or written communications related to the achievement being reinforced.

Although delivery of reinforcement should always follow performance, specific plans for reinforcement should be proactively developed in advance of desired achievements. A documented reinforcement plan should be included in any action plan developed to meet a key organizational goal or objective. The reinforcement plan helps ensure that, as performance milestones are reached, reinforcement is not only remembered but is timely and effective as well. Table 13-3 provides guidelines for maintaining effective reinforcement plans. Table 13-4 illustrates a serious incident prevention reinforcement plan developed and administered by a team responsible for a warehouse operation storing hazardous materials. The team’s plan provides

CH13pp141-152 4/10/02 12:51 PM Page 146

146 ■

Serious Incident Prevention

the who, what, when, and why for reinforcing achievement of performance milestones. TABLE 13-3 Guidelines for Effective Reinforcement ■ ■ ■ ■ ■ ■ ■

■

■

Reinforcement is earned—contingent upon performance Reinforcement is administered not only for results but also for actions Reinforcement is administered for both individual and team performance Reinforcement is primarily social/intangible Tangible reinforcement is utilized selectively and is generally symbolic Reinforcement is not negotiated and does not escalate Actions and results reinforced are limited to those achieved without violating organizational principles in other key performance areas Reinforcement is based upon measures that reflect true performance and are not subject to manipulation Reinforcement is consistent with the SSIP rule

TABLE 13-4 Reinforcement Plan Warehouse Operations Serious Incident Prevention Result or Action to Reinforce

Who Receives Reinforcement?

Who Delivers?

Critical work identified, performance standards developed, and SIP measure fully implemented for one month

Entire warehouse team

First-level supervisor

SIP measure sustained for 2nd and 3rd months

Warehouse team steward for measure

First-level supervisor

100% completion of critical work achieved for month

Each warehouse team member

First-level supervisor

12-month moving average above goal for at least 3 consecutive months and team in consensus to establish higher goal

Entire warehouse team

Arranged and attended by second-level supervisor

SIP process improved or updated

Individual initiating update or improvement

First-level supervisor

CH13pp141-152 4/10/02 12:51 PM Page 147

Reinforcement and Corrective Action

■ 147

In addition to following through in implementing documented reinforcement plans, managers should proactively search for evidence of outstanding performance as a part of the daily routine. Ongoing reinforcement should become a daily habit for leaders through words of thanks, a highfive, or whatever else is readily available and appropriate. Surveys often confirm that managers believe they initiate reinforcement frequently while subordinates feel reinforcement is received infrequently. This paradox is related to the pyramid shape of most organizational charts together with the trend toward wider spans of management control. A manager with twenty or more employees in his or her unit may truly reinforce subordinates on a daily or weekly basis. However, each individual may be on the receiving end on limited occasions. Thus, managers and team leaders should consider the impact of reinforcement from the perspective of individual employees. Unwanted side effects from well-intended but misguided reinforcement can create barriers to achieving the results needed for an organization to be fully successful. As an illustration, a Fortune 500 retailer enacted a commission system for its auto center workers that reduced base salaries by as much as 50 percent. Thus, for many workers the commission received for selling parts and services became more valuable than any reinforcement anticipated for satisfying customers. Later, a California probe found an average of $223 in unnecessary parts on each car serviced by the company’s auto centers. In 1992, the company publicly encouraged customers to return cars for free correction of problems. It also ran full-page advertisements in major newspapers throughout the country reconfirming its commitment to customer satisfaction.3 Like the commission-based wage system that led to dissatisfied customers, misguided reinforcement practices can undermine the integrity of a facility’s serious incident prevention process. Reinforcement practices that emphasize high production and cost reduction jeopardize the process if reinforcement is neglected for executing the work necessary to sustain incident-free operations. Clearly, production and cost-control-related reinforcement is appropriate, provided milestones are accomplished without sacrificing principles of safe operation. Reinforcement must not be skewed toward a small number of specific performance areas to the detriment of other critical areas. Maintaining the constancy of purpose necessary for serious incident-free operations requires that reinforcement be effectively administered for the work critical to safe operations. Reinforcement actions provide direct insight into a manager’s value system, priorities, and beliefs. Effective reinforcement processes help maintain the constancy of purpose required to ensure that low-visibility, but essential, serious incident prevention tasks are diligently performed. Reinforcement is an essential part of the process of watering what we want to grow.

CH13pp141-152 4/10/02 12:51 PM Page 148

148 ■

Serious Incident Prevention

Corrective Action Corrective action is universally recognized as a necessary management responsibility, but the subject seems largely ignored in “how-to-manage” publications. Perhaps the subject is considered too mundane to merit comprehensive discussion. Experience indicates, however, that corrective action is a vital part of the serious incident prevention process. An organization’s approach to corrective action significantly impacts its long-term capability for sustaining incident-free operations. Successful corrective action must be implemented proactively, prior to the occurrence of failures with major consequences. Such proactive corrective action is made feasible only through the existence of effective measurement and feedback systems for upstream indicators of performance.

Addressing Causal Factors When the organization has the right measurement systems in place, deteriorating performance in the safety process will begin to be reflected in the measurement of upstream performance indicators during the formative stages of problems. Deteriorating performance for key measures often reflects problems in one of the nineteen general categories of causal factors leading to incidents.4 These causal factors, described in more detail in Chapter 8, can be a starting point for identifying root causes of problems. Causal factors include: Human Factors: 1. Verbal communication 2. Written procedures and documents 3. Man-machine interface 4. Environmental conditions 5. Work schedule 6. Work practices 7. Work organization/planning 8. Supervisory methods 9. Training/qualification 10. Change management 11. Resource management

CH13pp141-152 4/10/02 12:51 PM Page 149

Reinforcement and Corrective Action

■ 149

12. Managerial methods Equipment Factors: 13. Design configuration and analysis 14. Equipment condition 15. Environmental conditions 16. Equipment specification, manufacture, and construction 17. Maintenance/testing 18. Plant/system operation External Factors: 19. Human or nonhuman influence outside the usual control of the company

Responding to Red Flags Near misses and red-flag observations should also serve as triggers for corrective actions. The 1996 crash of a 763-foot freighter into a New Orleans riverfront shopping center made national headlines as an apparent “freak” accident. However, investigation revealed that of the 500,000 vessel movements per year through the Port of New Orleans, about 200 vessels per year lose steering capability, with about 30 vessels making contact each year with bridges, docks, or other vessels.5 Rather than a “freak” incident, this was a serious incident waiting to happen. A performance measure that indicates unsatisfactory results is another type of red flag that must be addressed. Teams must review measures frequently to ensure early detection of unsatisfactory performance, to determine actions for correcting performance, and to ensure timely implementation of corrective actions. For example, if audit scores for performance of lock-out/tag-out procedures indicate deficiencies, the organization must act firmly and with a sense of urgency to understand and correct the problem. To do otherwise places the organization and its employees in extreme jeopardy. Minor accidents, near misses, performance deficiencies, and other red flags serve as precursors to serious incidents. An effective system must be in place to capture and evaluate these precursor events. When an early warning signal indicating the potential for a serious incident is identified, proactive and timely implementation of corrective action is clearly a challenge that must not be ignored.

CH13pp141-152 4/10/02 12:51 PM Page 150

150 ■

Serious Incident Prevention

Managers frequently talk-the-talk regarding the need to find and correct root causes. However, discussions often reveal a lack of consensus on what “finding the root cause” really means. (Root cause is often defined by texts as “the most basic reason[s] for a problem, which, if corrected, will prevent recurrence of that problem.”)6 Some managers seem interested only in tracing causes back to the point where, in the mind of the manager, a person could have taken action to prevent the incident. The incident is then classified as caused by human error, and corrective action is targeted to influence behavior. Such an approach considers only the shallowest of roots. The organization becomes dependent upon superhumans who are expected always to take the right compensating actions to circumvent conditions leading to serious incidents. When the potential consequences of a performance failure are serious, the objective must be to implement corrective actions that will remain effective for decades. Solutions must be effective even when the organization’s bottom-quartile performers are at the controls. Corrective actions must be institutionalized to withstand changes in supervision and other factors that impact an organization over the long haul. Corrective actions with staying power are usually those developed and implemented with employee input and those with a performance measurement system in place for monitoring progress. Table 13-5 summarizes guidelines for effective corrective actions. TABLE 13-5 Guidelines for Effective Corrective Actions in Sustaining Serious-Incident-Free Operations ■ ■

■ ■ ■

■

■ ■ ■

Be Proactive Promote individual/team involvement and ownership of the serious incident prevention process Investigate deficiencies reflected by critical work performance measures Investigate near misses and other “red flags” Strive for solutions not dependent upon the attention of best personnel or perfect operating/administrative controls Institutionalize corrective actions by integrating into documented procedures and processes Promote organizational mindset of continual improvement Follow through when corrective action needs are identified Be slow to fix blame, but be prepared to remove individuals from safety-critical jobs as warranted

CH13pp141-152 4/10/02 12:51 PM Page 151

Reinforcement and Corrective Action

■ 151

Organizations should always strive to implement fail-safe practices. When conducting incident investigations it must be recognized that the identification of human error is a beginning point for the investigation, not the ending point. Evidence from incident investigations supports a conclusion that serious incidents are more often the result of error-prone situations or conditions rather than error-prone people. When errors do occur they are quite often related to human conditions that are extremely difficult to control—i.e., short-lived mental states, such as preoccupation or distraction, and errors of omission that the employee did not intend to make.7 From a practical perspective, avoidance of many problems will remain dependent upon the prudent and disciplined actions of individuals at the operational point of control. Prior to loading hazardous materials, for example, tank car loaders must ensure each tank car bottom outlet valve is fully closed. Such basic requirements are part of the fundamental performance expectations for tank car loaders. In this situation, like many others in the workplace, precise action is needed on a repetitive basis to avoid high-consequence events. Failures to close bottom valves prior to starting flow should be addressed through the organization’s coaching process. The focus must be on making tasks and conditions less error-prone and on employees helping one another to develop safer work habits through behavioral-safety techniques. However, managers must also recognize that some individuals are less suited than others for performing repetitive work without errors. Thus, individuals who have been coached but retain a tendency to start flow without closing bottom valves should be isolated from safety-sensitive jobs. Corrective action, like reinforcement, is important in maintaining the constancy of purpose required to sustain serious-incident-free operations. The first objective of corrective actions should be to achieve inherently safer operations through changes that are not dependent upon perfect administrative or operating systems for success. Employees with active ownership of the incident-prevention process and managers who maintain a bias toward constructive improvements, rather than fixing blame, are factors that promote implementation of effective corrective action. When the potential consequences of performance failures are severe, the focus must be on implementing solutions capable of withstanding the passage of time. Effective management of the serious incident prevention process requires the appropriate integration of both positive reinforcement and proactive corrective action into the workplace environment.

CH13pp141-152 4/10/02 12:51 PM Page 152

152 ■

Serious Incident Prevention

References 1. R. Jackman, “Never Treat Humans Like Relations,” Proceedings: 56th Annual Southern Industrial Relations Conference (now Blue Ridge Conference on Leadership Inc.), 1975, 14–18. 2. A. C. Daniels and T. A. Rosen, Performance Management: Improving Quality and Productivity Through Positive Reinforcement (Tucker, Georgia: Performance Management Publications, 1984), 46–73. 3. “NJ Probe Targets Sears Auto Centers,” Dallas Morning News, 16 June 1992. 4. M. Ammerman, The Root Cause Analysis Handbook (Productivity Inc.: 1998), 66–67. 5. “Busy Port, Dangerous Mixture,” Dallas Morning News, 22 December 1996, 45A, 52A. 6. M. Ammerman, The Root Cause Analysis Handbook (Productivity Inc., 1998), 89. 7. J. Reason, Managing the Risks of Organizational Accidents (Aldershot, Hampshire, England: Ashgate Publishing Limited, 1997), 126–129.

CH14pp153-158 4/10/02 12:51 PM Page 153

C H A P T E R

14

Improving and Updating the Process The Los Angeles Lakers’ victory over Philadelphia in the 2001 NBA finals marked the passage of 15 years since the Boston Celtics were NBA champions. More than a decade of mediocrity followed a 30-year period during which the Celtics made 17 appearances in the NBA finals, winning 15 championships.1 The Celtics’ ultimate demise illustrates the difficulty in sustaining excellence. It is easier to get to the top than to stay there indefinitely. It is also difficult to sustain long-term excellence in our personal endeavors and in work-related objectives. A new car owner’s pride of ownership, for instance, helps sustain short-term performance in maintaining a clean car, but with the passage of time, car owners often become less diligent about washing and cleaning. A similar tendency toward complacency also exists in the workplace. However, when workplace deficiencies can lead to serious safety-related consequences, complacency must be effectively countered. A sustained focus on excellence is required. A facility’s work environment is dynamic. The critical work required to sustain serious incident-free operations is not the same today as five years previous, nor will it remain constant in the future. New equipment is brought on-line, processes are modified, the organization changes, new tools and technology become available, knowledge increases—all impact

153

CH14pp153-158 4/10/02 12:51 PM Page 154

154 ■

Serious Incident Prevention

Management Commitment and Leadership

Involve Employees

Understand the Risks

Identify Workfor for IdentifyCritical Critical Work Controlling the Risks Controlling the Risks Establish Performance Standards Maintain Measurement and Feedback Systems Reinforce and Implement Corrective Action Improve and Update the Process

an organization’s capability to sustain safe operations. Sustaining excellence requires that management processes be continually reviewed and updated. Organizational priorities must continually support improvement and updating of the serious incident prevention process. Specific actions should be targeted to sustain: (1) a shared vision for serious incident-free operations, (2) a focus on organizational learning, and (3) employee involvement and teamwork.

CH14pp153-158 4/10/02 12:51 PM Page 155

Improving and Updating the Process

■ 155

Shared Vision A shared vision serves as a beacon highlighting the direction in which to head when various organizational priorities appear to be in tension with one another. Great accomplishments, dependent upon the combined efforts of individuals, have always involved commitment to a common objective. A successful moon landing, winning a war, a sports triumph, achievement of an improved safety culture—all require a shared vision. Many managers confuse mere compliance with thier organization’s vision to the real need for commitment to the vision. Individuals who are

1. Employees at all levels of the organization are actively involved in the safety process. 2. Each person has specific responsibilities for improving safety, and each person understands their role. 3. Constructive dialogue regarding safety concerns and how to improve safety is common throughout the organization. 4. Everyone understands the safety risks involved in performing the organization’s work and the work practices required for safe performance of the work. 5. The reporting of near-misses, minor accidents, and safety concerns is valued and actively encouraged within the organization. 6. Peer pressure within the organization positively supports safe work, and employees are actively involved in developing safer work habits and improved methods. 7. Incident investigations focus on identifying and correcting root causes of accidents rather than assigning blame. 8. Valid measures of performance utilized to identify and prioritize safety improvement opportunities. 9. Employees receive feedback on the quality of work they perform in support of safety objectives. 10. Employees receive positive reinforcement for work that meets or exceeds safety performance expectations. 11. Corrective actions are initiated proactively before incidents occur rather than only after an accident or injury has occurred. 12. Supervisors visibly support safety and are active in identifying and helping employees remove barriers to safe work. 13. Employees are provided the tools, equipment, training, and other resources critical to performing tasks safely. 14. Focus is maintained at all levels of the organization on continually improving safety. 15. Safety is viewed as a fundamental value of the organization and is guided by a set of principles not to be compromised. FIGURE 14-1. Characteristics of an outstanding safety culture.3

CH14pp153-158 4/10/02 12:51 PM Page 156

156 ■

Serious Incident Prevention

merely compliant support the vision to the minimum level required to maintain a politically correct position. When managers are truly committed to a shared vision for a safe workplace, however, they will do whatever is in their power to make it happen, including the removal of barriers interfering with its achievement. Persons who are truly committed bring the energy, passion, and excitement needed for success to the table.2 Elevating safety to the status of a core organizational value requires strong management leadership and communications skills. Achieving the vision for sustaining a safe workplace requires long-term commitment and constancy of purpose. To achieve and sustain real improvement, effective communications will be required to “paint pictures” of what the organization’s culture will look like in an incident-free environment. Such pictures will include the elements of an outstanding safety culture, as described in Figure 14-1.

Organizational Learning The application of new knowledge, tools, and behaviors is a priority through all levels of the learning organization. New knowledge related to serious incident prevention is highly valued and effectively utilized to enhance the process. Organizational learning places a premium on full understanding of operating details, potential incident scenarios, causal factors, and effective preventative actions. As each year passes, the learning organization applies new knowledge to enhance its safety management process. Learning organizations realize that without individual learning, no organizational learning is possible.4 Managers of learning organizations understand the importance of a supportive environment in promoting personal growth and individual and team learning. These organizations understand that learning requires a climate where challenging the status quo is not only accepted but encouraged. Employees in a learning organization approach their safety responsibilities in the same manner as a potter, painter, or other artisan—with a lifelong commitment to continual improvement.

Employee Involvement Employee involvement helps sustain enthusiasm, pride, and commitment. Involved employees are willing to take the extra steps needed to implement improvements. Involvement is a prerequisite for generating team synergy and for transforming improvement ideas into reality. Surveys of American workers have identified “working as a team” as an essential con-

CH14pp153-158 4/10/02 12:51 PM Page 157

Improving and Updating the Process

■ 157

dition for sustaining the level of workplace enthusiasm required for an organization to excel.5 Communication upwards, downwards, and sideways is the norm in organizations that effectively involve employees. Managers in learning organizations understand the importance not only of employee involvement, but of employee leadership as well. Employees at all levels of the organization are given the opportunity for leadership roles in the serious incident prevention process. Management further supports employee involvement by providing the training, nurturing, and resources to help ensure success.

Transforming Concepts to Actions Maintaining a shared vision, organizational learning, and employee involvement are keys to sustaining an organization’s commitment to continual improvement. However, such concepts must be transformed into the specific actions required for success. A strategy for effectively improving and updating the process should include an ongoing action plan to: ■ ■ ■ ■ ■ ■ ■ ■ ■

■

Review and update the serious incident prevention process as part of the organization’s annual planning process Review the need for updating as a specific step in the facility’s management-of-change process Review the need for updating as part of each hazards analysis Review the need for updating as part of each accident, near miss, or other “red flag” investigation Promote user groups to share information among teams responsible for implementing and maintaining incident-prevention processes Nurture and support individuals willing to step forward as process champions Reinforce individual and team actions to update and improve the process Learn from others and apply the learning Train and actively involve new employees in all aspects of the serious-incident prevention process to perpetuate ownership at the pointof-control level Maintain effective “Plan-Do-Check-Act” management control systems

Updating and improving the serious incident prevention process over the long-term requires leadership and commitment. An organization having

CH14pp153-158 4/10/02 12:51 PM Page 158

158 ■

Serious Incident Prevention

the potential for serious incidents must balance the desire for projecting a confident image with a mindset of never being fully satisfied in the search for safer methods. All in the organization must recognize the true nature of the safety war—in reality, incident prevention is a long, hard-fought guerrilla struggle with no final conclusive victory.6

References 1. J. Hassan,. 1997 Information Please Sports Almanac (Boston: HoughtonMifflin, 1997), 365. 2. P. M. Senge, The Fifth Discipline: The Art & Practice of the Learning Organization (New York: Doubleday, 1990), 218–225. 3. T. Burns, Characteristics of an Outstanding Safety Culture (SIP Management Systems Inc., 2001). Reprinted with permission. All rights reserved. 4. P. M. Senge, The Fifth Discipline: The Art & Practice of the Learning Organization (New York: Doubleday, 1990), 139. 5. J. S. McClenahen, “It’s No Fun Working Here Anymore,” Industry Week; 4 March 1991, 20–22. 6. J. Reason, Managing the Risks of Organizational Accidents (Aldershot, Hampshire, England: Ashgate Publishing Limited, 1997), 114, 214.

CH15pp159-189 4/10/02 12:51 PM Page 159

C H A P T E R

15

Applying the Process Model— A Case Study

Quality Manufacturing Inc. (QMI) is a hypothetical company that utilizes large volumes of flammable chemicals in its manufacturing processes. QMI’s manufacturing operations are supported by a chemical handling department that includes a pipeline system, tank storage operations, and warehouse facilities. QMI’s organization also includes a health, safety, and environmental (HSE) staff that provides services for the manufacturing and chemical handling areas. (See organization chart—Figure 15-1). QMI has applied the serious-incident prevention process model, as described in the previous chapters, to proactively drive the actions needed to sustain serious-incident-free operations.

Management Commitment and Leadership Exercising the management commitment and leadership necessary to maintain serious incident prevention as an organizational priority is the initial element of the process. QMI’s management effectively maintains incident prevention as a priority through actions that include: 159

CH15pp159-189 4/10/02 12:51 PM Page 160

160 ■

Serious Incident Prevention

Management Commitment and Leadership

Involve Employees

Understand the Risks

Identify Critical Work for Controlling the Risks Establish Performance Standards Maintain Measurement and Feedback Systems Reinforce and Implement Corrective Action Improve and Update the Process

■ ■ ■

Establishment of a safety policy that includes serious incident prevention as a core element. Establishment of goals and objectives that clearly support the prevention of serious incidents. Effective dialogue throughout the organization regarding safety goals, objectives, and improvement opportunities.

CH15pp159-189 4/10/02 12:51 PM Page 161

■ 161

Applying the Process Model—A Case Study

SITE MANAGER

MANUFACTURING

UNIT A UNIT “A”

UNIT B UNIT “B”

HSE

UNIT C UNIT “C”

ADMINISTRATION

PIPELINE

CHEMICAL HANDLING

TANK STORAGE

WAREHOUSE

FIGURE 15-1. Facility organization chart: Quality Manufacturing Inc.

■ ■

■

Allocation of resources consistent with the established goals and objectives. Maintaining a consistent bias toward identifying needed improvements to the process rather than fixing blame when incidents and near misses occur. Ensuring that the necessary company-wide procedures, guidelines, and programs that support serious incident prevention are established, including: ■ Hazard communication ■ Process hazards analysis ■ HSE audits ■ Management of change ■ Training ■ Emergency response planning ■ Mechanical integrity processes ■ Facility safe-work standards ■ Alcohol and drug abuse programs ■ Employee selection and hiring standards ■ Contractor safety standards

Implementing Other Process Elements The effective leadership of QMI’s management helps maintain serious incident prevention as an organizational priority. Management’s leadership

CH15pp159-189 4/10/02 12:51 PM Page 162

162 ■

Serious Incident Prevention

Site Team

Dept Team First Level Team

FIGURE 15-2. Natural unit team linkage.

is also critical in successful implementation of the remaining incident-prevention process elements. Each functional unit within QMI operates as a team, and management direction is exercised through a system of team linkage (Figure 15-2). Each team develops and maintains objectives, key performance measures, goals, and improvement projects—specific to team responsibilities but also supportive of other functional units. Teams within the manufacturing, chemical handling, and HSE departments utilize the incident-prevention process model to develop and maintain safety management processes customized for their areas of responsibility.

Chemical Handling Department Team QMI’s chemical handling department team is comprised of the superintendent of chemical handling, together with first-level supervisors responsible for each of the department’s three distinct areas of operation (Figure 15-3). Each of the three areas—pipeline, tank storage, and warehouse— have developed effective, customized processes for sustaining serious incident-free operations. Chemical Handling Department

Pipeline Operations

Tank Storage Operations

FIGURE 15-3. Chemical handling department organization.

Warehouse Operations

Performance Level

Calculations

0

1

2

3

4

5

6

7

8

9

10

Value

Level x Weight = Score

Pipeline Performance Index Score

300

350

400

450

500

600

700

800

900

950

1000

960

9

33.3

300

Tank Storage % Critical Work Completed

55

60

65

70

75

80

85

90

95

98

100

88

6

33.3

200

Warehouse % Critical Work Completed

55

60

65

70

75

80

85

90

95

98

100

96

8

Monthly Total: 12-Month Moving Average: Current Goal:

FIGURE 15-4. Chemical handling department serious incident prevention performance index.

33.3

266 766 640 >700

Applying the Process Model—A Case Study

Progress Measures

CH15pp159-189 4/10/02 12:51 PM Page 163

March, xx Month/Year _____________

■ 163

CH15pp159-189 4/10/02 12:51 PM Page 164

164 ■

Serious Incident Prevention

1000 900

Congratulations! Goal level achieved for month

800 700

Score 600 Monthly Score 500

12 Month Moving Avg Goal

400

Stretch Goal 300 1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

Month

FIGURE 15-5. Chemical handling department team serious incident prevention

performance index.

First-level supervisors, responsible for each of these operations, are also members of the departmental team led by the superintendent of chemical handling. Linkage with other departments is provided through the superintendent’s participation on QMI’s site management team led by the plant manager. The chemical handling team incorporates the customized incident-prevention processes for the pipeline, tank storage, and warehouse operations into a department-wide management system. Departmental performance is quantified utilizing safety performance indexing. The scoring matrix (Figure 15-4) provides the capability to weight each area’s performance based upon relative importance. Departmental results are charted to monitor both a monthly and 12-month moving average (Figure 15-5). A reinforcement plan (Table 15-1) is administered to reinforce individual supervisors and the entire team for sustaining high-level performance. The team focuses on reinforcement consistent with the SSIP rule—sincere, specific, immediate, and personal reinforcement. A workplace environment has evolved where individuals feel comfortable in both giving and receiving words of appreciation, as well as other forms of reinforcement. Effective reinforcement has helped maintain serious incident prevention as a priority throughout the chemical handling department.

CH15pp159-189 4/10/02 12:51 PM Page 165

Applying the Process Model—A Case Study

■ 165

TABLE 15-1 Reinforcement Plan Chemical Handling Department Serious Incident Prevention Result or Action to Reinforce

Who Receives?

Who Delivers?

Serious incident prevention process implemented in all areas

First-level supervision pipeline, tank storage and warehouse operations

Department head & team, steward for measure

Performance measure sustained for 3 months

First-level supervision

Department head

100% completion of critical work achieved in any area

First-level supervision responsible for area

Department head

Departmental goal level achieved for month

All department team members

Department head

12-month moving average sustained above goal level & new goal established

All department team members

Department head and team steward for measure

Identification/correction of red flag condition

Individual or team taking the action

Department team (in form of “red flag” note of appreciation)

The department team understands its essential leadership role and the value of effective communications. The team drives actions needed to achieve a shared vision of excellence and focuses on removing barriers that constrain performance. A commitment to continual improvement is maintained. Employees are encouraged to search for and investigate “red flags”— clues indicating possible deficiencies that could lead to a serious incident. “Red flag” conditions identified by the team are documented (Table 15-2), and a written note of appreciation (Figure 15-6) is initiated by the team to reinforce proactive detection and correction of each potentially significant problem. TABLE 15-2 Chemical Handling Department "Red Flag" Reports

Date 01/18/xx

Description

Follow-Up Action

Corrosion found under in- Corroded section of piping replaced. sulation on piping Other locations inspected and no other significant corrosion found. Follow-up inspections scheduled.

CH15pp159-189 4/10/02 12:51 PM Page 166

166 ■

Serious Incident Prevention

TABLE 15-2 continued Chemical Handling Department “Red Flag” Reports

Date

Description

Follow-Up Action

02/23/xx

Unexpectedly high level of Investigation indicated a valve leaking material detected on daily by into tank. Problem resolved before overfill of tank. inventory of Tank #3

02/27/xx

Evidence of smoking in an unauthorized area of warehouse reported by warehouse operator

Investigation indicated contract employees were violating no-smoking rules. Reviewed with contractor management who indicated the involved contract employees would be disciplined and all others reminded of smoking restrictions.

3/18/xx

Pipeline inspector on routine inspection noted third party stakes driven on pipeline right-of-way indicating plans for a future excavation.

Investigation indicated a contractor was planning to install a utility pole but had not reported plans through the one-call system. Plans for the excavation that could have damaged the underground pipeline were revised to install the pole at a new location safely removed from the pipeline route.

Chemical Handling Department

SERIOUS INCIDENT PREVENTION

To:

John Rigby_____

Date: 3/22/xx________

John – Thanks for observing and investigating the construction stakes near our pipeline Valve Station No. 2. Your actions prevented the installation of a utility pole in a location that could have damaged our pipeline. The Chemical Handling Department Team appreciates your proactive actions and commitment to safe work! Linda Smith

Robin Burns

Frank Brown

James Johnson

A Typical Note of Appreciation from Members of the Chemical Handling Department Team

FIGURE 15-6. Reinforcement for proactive actions in identifying red-flag con-

ditions.

CH15pp159-189 4/10/02 12:51 PM Page 167

Applying the Process Model—A Case Study

■ 167

The chemical handling department team plans to provide increased emphasis on the identification and evaluation of “red flag” conditions. In addition, the department has recently adopted a new goal for reducing accidental releases of hazardous materials from a current average of about 100 pounds per month to a maximum of 10 pounds per month. The team understands that “what gets measured gets done,” and it is planning to facilitate achievement of its goals for increasing the identification and reporting of “red flag” conditions and for reducing hazardous material releases by adding these two additional elements to the safety performance matrix. Figure 15-7 illustrates the team’s redesigned performance matrix that includes the addition of “red-flag” reports and hazardous material releases. The team has assigned a weighting of 10 percent to “red flag reports,” with a minimum of three reports per month required to achieve a 100 percent score. A weighting of 15 percent is assigned to the volume of hazardous material releases. The team understands that the addition of these elements to the performance matrix will enhance the team’s capability for identifying and resolving potential problems before they lead to serious incidents and will help drive significant reductions in hazardous material releases. The team has also considered the addition of other performance indicators to the matrix—audit scores, employee survey results, and recordable injury rate are potential additions that have been discussed. The team understands that the safety performance index is a flexible tool that can be shaped as needed to help achieve and sustain a safe workplace. The chemical handling department team understands the importance of serious-incident prevention and its linkage to other company objectives, e.g., customer satisfaction, financial performance, and company image. The team’s management system helps ensure that risks are understood, critical work is executed consistent with standards, reinforcement or corrective action initiated contingent upon performance, and that the incident-prevention process is continually improved and updated.

Chemical Handling Department Pipeline Operations The potential frequency for incidents involving pipeline operations is inherently low. Thus, QMI’s record of operating its pipeline for many years without a serious incident is not unexpected. Rather than depending solely upon its favorable operating experience to identify significant risks, QMI understands the need to consider the collective experience of other companies’ operating pipelines.

Performance Level

Calculations

0

1

2

3

4

5

6

7

8

9

10

Value

Pipeline Performance Index Score

300

350

400

450

500

600

700

800

900

950

1000

960

9

25

225

Tank Storage % Critical Work Completed

55

60

65

70

75

80

85

90

95

98

100

88

6

25

150

Warehouse % Critical Work Completed

65

70

75

80

85

90

95

98

100

8

200

60

96

25

55

Number Red Flag Reports

0

3

3

10

10

100

1

45

5

15

75

Volume Materials Spills (pounds)

150

1 140

120

100

2 75

50

25

10

5

3

Level x Weight = Score

Monthly Score: 12-Month Moving Average: Goal:

FIGURE 15-7. Chemical handling department serious incident prevention performance index—alternative matrix.

750 605 >700

Serious Incident Prevention

Progress Measures

CH15pp159-189 4/10/02 12:51 PM Page 168

168 ■

March xx Month/Year _____________

CH15pp159-189 4/10/02 12:51 PM Page 169

Applying the Process Model—A Case Study

■ 169

The QMI pipeline team is comprised of the first-level supervisor responsible for pipeline operations, together with all other personnel responsible for operating and maintaining the pipeline system. The team’s risk assessment includes analyzing causes of past U.S. pipeline accidents (Figure 15-8). The analysis indicates that third-party damage is the most frequent cause of pipeline incidents, followed by defective equipment or repair, external corrosion, internal corrosion, and operator error. Based upon its evaluation of risks, the team has identified the critical work necessary to sustain incident-free operations (Table 15-3). The pipeline team ensures satisfactory performance standards are in place for critical work performed by the team, staff groups, and outside contractors. Frequencies for performing tasks are established, and a system to document scheduled completion dates is maintained. A designated member of the pipeline team serves as steward for the serious-incident prevention process. The process steward coordinates the team’s completion of critical work consistent with established standards. Any work behind schedule is documented, rescheduled, and expedited to completion. The percent critical work completed as scheduled is charted (Figure 159). The chart includes monthly performance and a 12-month moving average helpful in trend analysis. The team’s improvement goal is displayed on the chart, and handwritten notes are sometimes added to facilitate feedback, reinforcement, or corrective actions. Although the team has operated for more than 10 years without a significant pipeline release, numerous reports of possible releases are received each year. These reports from members of the public are typically triggered by unusual odors in the area of the pipeline right-of-way. Fortunately, none OTHER 32% INCORRECT OPERATION 6%

3RD PARTY DAMAGE 25%

INTERNAL CORROSION 8%

EXTERNAL CORROSION 14%

DEFECTIVE EQUIPMENT OF REPAIR 15%

FIGURE 15-8. Causes of U.S. hazardous liquid pipeline accidents based on year

2000 reports to U.S. Department of Transportation.1

CH15pp159-189 4/10/02 12:51 PM Page 170

170 ■

Serious Incident Prevention

TABLE 15-3 QMI Pipeline Operations Serious Incident Prevention Critical Work Critical Work

Frequency

Third-Party Damage Prevention: a) Investigate each planned excavation near right-of-way

Prior to excavation

b) On-site monitoring of all excavation work on right-of-way

Each excavation

c) Fixed-wing aircraft aerial right-of-way patrol

Weekly

d) Inspection to ensure right-of-way marker signs in place

Monthly

e) Mowing of right-of-way

Each June & August

f) Ground level inspection of entire rightof-way

Annual

g) Navigable waterway inspections by diver

Every 5 years

Defective Equipment and Repair Prevention: Audit: ■

Management-of-change process

■

Welding certifications for authorized repair personnel

■

Contractor safety and training programs

Semi-annual audit

External Corrosion Prevention:

Monthly

a) Cathodic protection rectifier inspections

Monthly

b) Interference bond inspections

Semi-annual

c) Corrosion grid inspection

Annual

d) Cathodic protection test station survey

20% of pipeline each year

e) Close interval cathodic protection survey Internal Corrosion Prevention:

Daily

a) Monitor rate of corrosion inhibitor injection

Quarterly

b) Corrosion coupon inspections

Semi-annual

c) Piping grid inspection Prevention of Operator Errors: a) Review and update operating manual

Annual

CH15pp159-189 4/10/02 12:51 PM Page 171

Applying the Process Model—A Case Study

■ 171

TABLE 15-3 continued QMI Pipeline Operations Serious Incident Prevention Critical Work Critical Work

Frequency

Prevention of Operator Errors: cont. b) Formal pipeline operator training

c) Procedure updates for process changes

Initial training within one month of employment; refresher every 3 years and prior to significant changes Prior to implementing each change

d) Review and update training requirements

Annual

e) Ergonomic/human-factors review of control systems

Annual

f) High-pressure shutdown checks & instrument calibrations

Semi-annual

g) Audit of anti-drug and alcohol misuse program

Annual

Emergency Preparedness: a) Test remote valve operation

Monthly

b) Test low-pressure valve shutdowns

Monthly

c) Exercise and inspect manual valves

Semi-annual

d) Visit public emergency response agencies

Annual

e) Conduct emergency drill

Annual

f) Test combustible gas analyzers at pump stations

Quarterly

g) Inspect fire extinguishers

Quarterly

h) Inspect and test uninterruptible power supply units

Quarterly

i) Inspect and test relief valves

Per documented schedule

Other: a) Investigate all near misses

Each near-miss incident

b) Audit safety permit system compliance

Semi-annual

c) Conduct safety review meeting with contractors

Semi-annual

d) Process Hazards Analysis

Every 3 years

e) Confirm pipeline integrity with pressure test or smart pig

Every 10 years

f) Review and update risk assessment process

Annual

CH15pp159-189 4/10/02 12:51 PM Page 172

172 ■

Serious Incident Prevention

100

90

Moving average at Goal Level! We’ve come a long way together . . . Let’s celebrate with lunch!

80

70

60 Monthly % 12 Month Avg Goal

50

40 1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

MONTH

FIGURE 15-9. Pipeline operations—percent critical work completed.

of the reports has proven to involve a release from QMI’s pipeline system, but the pipeline team understands the importance of promptly investigating each report and treating each as a potential serious incident until proven otherwise. With that objective, QMI has an established goal of having a company representative on-site at the location of each reported incident within one hour after the incident is reported. The pipeline team has established a measurement system for tracking its timeliness of responses (Figure 15-10), and the system has helped drive the percentage of one-hour responses from a baseline of less than 50 percent to a current average of 90 percent. QMI’s pipeline operations receive an annual audit by the responsible regulatory agency to determine compliance with Department of Transportation requirements. Prior to implementation of the serious-incident prevention process, the team regularly received notices of violations as a result of these compliance audits. However, execution of the critical work identified by the team has helped eliminate regulatory agency violations. The team has completed five consecutive years without a violation, and the outstanding progress is reflected by the team’s measurement system for monitoring the number of violations (Figure 15-11). The pipeline team has developed a safety performance index based upon three areas deemed essential to success: (1) percentage of critical work completed on-schedule, (2) timeliness of on-site responses to leak reports, and (3) number of regulatory agency violations. The team has assigned a weighting factor of 40 percent to the on-schedule completion of

CH15pp159-189 4/10/02 12:51 PM Page 173

■ 173

Applying the Process Model—A Case Study

Percent On-Site Responses Within One Hour

100 90 80 70 60 50 40 30 20 10 0

Quarterly Average Goal

1

2

3

4

5

6

7

8

9

Quarter FIGURE 15-10. Responses to pipeline “leak” reports.

critical work, 40 percent to timeliness of responses to leak reports, and 20 percent to prevention of regulatory agency violations. The team’s safety performance score for the most recent month, as calculated by the performance index matrix, is 760 (Figure 15-12). During the past nine months, the team has improved its safety performance score from 490 to the current level of over 700, as illustrated by Figure 15-13. This quantification of performance has provided frequent opportunities for positively reinforcing the pipeline team’s efforts, and the favorable results reflect an

4 3 2 1 0 1

2

3

4

5

6

7

Year FIGURE 15-11. Pipeline regulatory agency violations.

8

9

10

Performance Level

Calculations

0

1

2

3

4

5

6

7

8

9

10

Value

% Critical Work Completed

60

65

70

75

80

85

90

96

98

99

100

96

7

40

280

1-Hr Responses to Leak Reports

45

50

55

60

70

80

90

95

96

98

100

91

6

40

240

3

2

1

0

0

10

Regulatory Agency Violations

4

Level x Weight = Score

Monthly Total: 12-Month Moving Average: Current Goal:

FIGURE 15-12. Pipeline safety performance index.

20

200 720 650 >700

Serious Incident Prevention

Progress Measures

CH15pp159-189 4/10/02 12:51 PM Page 174

174 ■

Month /Year:_____/______ 3 xx

CH15pp159-189 4/10/02 12:51 PM Page 175

Applying the Process Model—A Case Study

■ 175

800 700 S c o r e

600 500 400 300 200 100 0 1

2

3

4

5

6

7

8

9

Month FIGURE 15-13. Pipeline safety performance index results.

TABLE 15-4 Reinforcement Plan Pipeline Operations Serious Incident Prevention Result or Action to Reinforce

Who Receives Reinforcement?

Who Delivers?

Serious incident prevention process fully developed

Pipeline team

First-level supervisor and department head

Performance measure fully implemented for one month

Process steward and other team members

First-level supervisor

100% completion of critical work achieved for month

Pipeline team

First-level supervisor

Goal for one-hour responses to “leak” reports achieved

Pipeline team

Chemical handling department team

Completion of 12 months without a regulatory agency violation

Pipeline team

Chemical handling department team

Action taken to identify and arrange for correction of “red flag” condition

Individual or team taking the action

Chemical handling department team (in form of “red flag” note of appreciation)

Moving average above goal for 3 consecutive months and new goal established

Pipeline team

Chemical handling department team

CH15pp159-189 4/10/02 12:51 PM Page 176

176 ■

Serious Incident Prevention

operation that has substantially reduced its potential for experiencing a high-consequence incident. The pipeline team reviews its performance measures on a monthly basis, and a reinforcement plan is triggered when performance milestones are achieved. When work fails to meet established standards, root causes are identified and corrected. The team focuses on removing barriers that are unfavorably impacting performance. The pipeline team’s reinforcement plan (Table 15-4) includes reinforcement both for achieving results and for actions supporting the incident prevention process. Reinforcers are primarily intangible, often consisting of notes of appreciation or verbal recognition. Celebrations have also proven to be effective reinforcement for achievement of major milestones and have helped build the team’s esprit de corps. TABLE 15-5 QMI Tank Storage Operations Serious Incident Prevention Critical Work

Critical Work Inspections conducted to monitor: a) Presence of any leakage from tanks or piping b) Tank inventories c) Nitrogen inerting system d) Sprinkler system operability e) Condition and accuracy of labels on tanks and lines f) Integrity of tank diking g) Condition of bonding and grounding h) Condition of no-smoking signs i) Condition of access for emergency response j) Fire extinguishers in-place, unblocked, and charged k) Accumulation of weeds and combustibles l) Flame arrestors: in place unplugged m) External corrosion n) Adequacy of drainage o) Integrity of floating roofs p) Internal corrosion q) prestartup inspection for new or modified equipment

Frequency Daily Daily Daily Weekly Monthly Monthly Monthly Monthly Monthly Monthly Monthly Monthly Annual Annual Annual Annual Every 3–5 years, depending upon product and past history of corrosion Prior to each startup as applicable

CH15pp159-189 4/10/02 12:51 PM Page 177

Applying the Process Model—A Case Study

■ 177

TABLE 15-5 continued QMI Tank Storage Operations Serious Incident Prevention Critical Work

Critical Work

Frequency

Deficiencies identified on inspections are on-schedule for correction

Minimum weekly review of items (some items require more frequent follow-up)

Audit to ensure plans and procedures are up-to-date and effectively implemented: a) Emergency response plan b) Operating procedures c) Maintenance procedures d) Safety permit system procedures e) Management-of-change procedures

Annual audit for all items

Initial and refresher training: a) Fire extinguisher use b) Sprinkler system location and activation c) Reporting of spills and other emergencies d) Evacuation procedures e) Permit system to control hot work and other ignition sources f) Permit system to control excavations g) Lock-out procedures for controlling hazardous energy h) Location and operation of key manual and remote operated emergency shutoff valves i) Hazard communications

For all training: ■ Initial training for all new operators within two months of employment ■ Refresher training every two years and prior to changes

Facility orientation and site visit for local emergency response agencies

Annual

Emergency drill

Annual

Equipment/instrumentation tests and calibrations: a) Prestartup leak test b) Sprinkler system flow test c) Nitrogen system instrument calibration d) Exercise emergency shut-off valves: ■ remote actuated ■ manual e) Tank level indicator calibration and alarm test f) Relief valve inspections

Prior to startup of equipment Every 3 months Every 3 months Every 3 months Annual Every 6 months As established for each relief valve

Comprehensive process hazards analysis by cross functional team

Every 3 years

Investigation of all material releases and near-miss incidents

Within 24 hours of each incident

Review and update of serious incident prevention process

Annual

CH15pp159-189 4/10/02 12:51 PM Page 178

178 ■

Serious Incident Prevention

In their daily work, team members are alert for early warning signals of potential pipeline problems. Red flag conditions, such as low cathodic protection readings and evidence of pending third-party construction work affecting the pipeline right-of-way, are proactively identified and investigated. Action is taken in the early stages to prevent development of more significant problems. The team proactively seeks new information impacting pipeline incident prevention. New knowledge is continually applied to improve the process. The team understands the severe consequences of pipeline incidents and is highly committed to sustaining incident-free operations.

Chemical Handling Department: Tank Storage Operations With responsibility for a large inventory of flammable materials, the tank storage team is well aware of the potential for serious incidents. The team has enhanced its understanding of tank storage risks through researching various publications including NFPA 30, Flammable and Combustible Liquid Code.2 Primary concerns include prevention of fires and accidental releases of material. 100

90

80

%

70 Monthly % 12 Month Moving Avg

60

Goal 50

40 1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

MONTH

FIGURE 15-14. Tank storage operations percent critical work completed.

17

CH15pp159-189 4/10/02 12:51 PM Page 179

Applying the Process Model—A Case Study

■ 179

The team’s critical work (Table 15-5) includes effective preventative actions extending well beyond regulatory requirements. Performance in executing critical work is reviewed on a monthly basis. A reinforcement plan is administered to provide appropriate recognition. The team’s commitment to safe operations is reflected by its improving performance (Figure 15-14). The team proactively reviews planned changes to ensure that they achieve their purpose without detrimental consequences. Small releases of material and other precursors to serious incidents are investigated promptly. Minor incidents are viewed as a learning opportunity, and effective actions are implemented to prevent recurrence. The team stays informed of regulatory changes and maintains operations in compliance. Annual reviews are conducted to identify improvement opportunities and help ensure the incident-prevention process remains updated.

Chemical Handling Department: Warehouse Operations Team The warehouse operations team is comprised of the first-level supervisor together with all other warehouse operating personnel. The team operates and maintains facilities for the storage of certain raw materials, manufacturing supplies, and finished products. Significant quantities of flammable and combustible materials are stored and handled. The team’s incident-prevention process focuses on ensuring actions needed to prevent and minimize the consequences of warehouse fires are identified and diligently executed. The team’s evaluation of risks specific to warehouse operations has included a review of guidelines such as NFPA’s Pre-Incident Planning for Warehouse Occupancies.3 Based upon its evaluation of risks, the team has identified the critical work necessary to sustain incident-free operations (Table 15-6). The team’s performance measurement (Figure 15-15) monitors execution of the work. Results are reviewed in team meetings, and reinforcement or corrective action initiated contingent upon performance. Team members are sensitive to the impact of changes, such as new materials, increases in inventory, and modifications to the fire protection system. Management-of-change systems are in place, and priority is maintained on keeping the incident prevention process up to date and continually improved.

CH15pp159-189 4/10/02 12:51 PM Page 180

180 ■

Serious Incident Prevention

TABLE 15-6 QMI Warehouse Operations Serious Incident Prevention Critical Work

Critical Work Inspections conducted to ensure: a) No leakage from stored containers b) Proper storage practices for flammables and combustibles c) Sprinkler system block valves fully open d) Sprinkler system heads unblocked e) Fire extinguishers in place, unblocked, and charged f) Fire doors unblocked and in working order g) No-smoking signs posted and in good condition h) Evacuation routes posted and aisles, exits, doors, signs, and lights in order i) Trash properly contained j) Forklifts in good condition k) Facility security measures operational l) Prestartup inspection for new or modified equipment

Frequency Daily Daily Daily Weekly Weekly Weekly Weekly Weekly Daily Daily Daily Prior to startup of equipment

Deficiencies identified on inspections are on-schedule for correction

Minimum weekly review of items (some items require more frequent follow-up)

Audit to ensure plans and procedures are up-to-date and effectively implemented: a) Emergency response and evacuation plan b) Storage procedures c) Control of ignition sources d) Safety permit procedures e) Management-of-change procedures f) Hazard communication procedures

All items audited annually

Initial and refresher training: a) Fire extinguisher use b) Sprinkler system trip location and activation c) Reporting of fires, spills, and other emergencies d) Security practices and procedures e) Facility evacuation plan f) Permit system to control hot work and other ignition sources

For All Training: ■ Initial training for all new operators within two months of employment ■ Refresher training every two years and prior to significant changes

CH15pp159-189 4/10/02 12:51 PM Page 181

■ 181

Applying the Process Model—A Case Study

TABLE 15-6 continued QMI Warehouse Operations Serious Incident Prevention Critical Work

Critical Work

Frequency

g) Lock-out procedures for controlling hazardous energy h) Lift-truck training i) Hazard communication Facility orientation and site visit for local emergency response agencies

Annual

Emergency Drill

Annual

Alarm tests: a) Smoke detectors b) Fire alarm system c) Security system

Monthly for all items

Process hazards analysis by cross-functional team

Every 3 years

Investigation of incidents and near-miss incidents with serious potential

Within 24 hours of occurrence

Comprehensive review and update of serious incident prevention process

Annual

Moving average at goal level!

Congratulations! 100% 100

90

80

Lift truck unavailable. Will provide “back-up.” 70

60 Monthly % 12 Month Moving Avg

50

Goal 40 1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

MONTH

FIGURE 15-15. Warehouse operations team—percent critical work completed.

17

CH15pp159-189 4/10/02 12:51 PM Page 182

182 ■

Serious Incident Prevention

Manufacturing Department— Serious Incident Prevention Processes Each of the organizational units within QMI’s manufacturing department (Figure 15-16) has developed customized serious-incident prevention processes. Each unit within the department operates as a team led by its first-level supervisor. Each first-level supervisor also serves as a member of the department team led by the superintendent of manufacturing. The manufacturing superintendent’s participation on the QMI Site Management team provides the linkage needed to sustain a common focus on key performance objectives, including maintaining incident-free operations. Each team within the manufacturing department understands the specific risks related to its operations and has identified the critical work necessary to sustain incident-free operations. Goals are established that reflect high performance expectations. Performance is monitored and reinforcement or corrective action initiated contingent upon performance. Priority is maintained on updating and continually improving serious incident prevention processes throughout the department. Each unit in the manufacturing department has identified work critical to sustaining safe operations, established performance standards, measurement and feedback systems, and has developed reinforcement plans. (Due to similarity with information developed by units within the chemical handling department, the critical work, measurement and feedback systems, and reinforcement plans developed by the manufacturing team are not included in this case study.)

Manufacturing Department

Unit A Unit “A”

Unit “B” B Unit

FIGURE 15-16. Manufacturing department organization.

Unit C Unit “C”

CH15pp159-189 4/10/02 12:51 PM Page 183

Applying the Process Model—A Case Study

■ 183

HSE—Serious Incident Prevention Processes The actions of QMI’s Health, Safety, and Environmental department significantly impact the company’s capability to sustain serious incident-free operations. The HSE department utilizes all elements of the serious incident prevention process to ensure services supporting incident-free operations are effectively provided. The team’s critical work is targeted towards minimizing both the probability and potential consequences of an incident. Table 15-7 documents the critical work identified by the HSE team. The team maintains performance measures for on-schedule completion of critical work, as illustrated by Figure 15-17, and for other key performance indicators such as rescue and fire brigade training attendance (Figure 15-18) and the results of annual surveys indicating line organization management’s satisfaction with the quality of HSE services provided (Figure 15-19). Performance measures and the status of improvement projects are reviewed each month by the team. Reinforcement and corrective actions are implemented based upon reviews of the performance measures. The HSE team’s reinforcement plan (Table 15-8) includes specific reinforcement for individuals who successfully complete special tasks, such as coordinating the annual site visit for local emergency response agencies.

Excellent Results! 100

95

Congratulations! Moving average at Goal Level.

90 Percent

One PHA behind schedule 85

MONTH 12 MONTH AVG GOAL

80

75 1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

MONTH

FIGURE 15-17. HSE percent critical work completed on schedule.

16

17

CH15pp159-189 4/10/02 12:51 PM Page 184

184 ■

Serious Incident Prevention

TABLE 15-7 QMI HSE Department Serious Incident Prevention Critical Work

Critical Work Assess serious incident prevention process compared to current and future needs: a) Conduct internal customer interviews with leaders of site management, chemical handling, and manufacturing teams to identify needs and obtain input on adequacy of HSE services provided. b) Audit quality of critical HSE services c) Assess adequacy of plans and procedures under the stewardship of HSE department: ■ Facility emergency response plan ■ EPA Risk Management Plan ■ Facility safe practices guidelines ■ Plans for emergency responder training Develop action plans and implement improvements based upon assessments Provide special training for HSE personnel: a) Process hazards analysis facilitation b) Emergency response skills for fire, spill, and medical emergencies c) Knowledge-based training for safetysensitive jobs—e.g., confined space entry, hot work, and hazard communications

Provide serious incident prevention technical support for line organizations: a) Conduct training course on process hazards recognition and incident prevention available to line personnel b) Review adequacy of technical library and publicize available resources c) Develop and implement plan for networking with other companies and outside sources d) Provide technical support for process hazard reviews, accident and near-miss investigations, area inspections, capital projects, and improvement initiatives

Frequency

Annual interview with each team leader

Annual Annual and as facility, organizational, or other significant changes occur

Action plans developed annually with monthly status review

Initial training for all new facilitators & refresher training every three years Quarterly Training for safety sensitive jobs: ■ Initial training for new HSE employees ■ Refresher training every two years and prior to implementation of significant process changes

Annual

Annual Annual with quarterly status review

Assess annually as part of interviews with leaders of the site management, chemical handling, and manufacturing teams

CH15pp159-189 4/10/02 12:51 PM Page 185

Applying the Process Model—A Case Study

■ 185

TABLE 15-7 continued QMI HSE Department Serious Incident Prevention Critical Work

Critical Work

Frequency

Schedule and coordinate site visit for local emergency response agencies

Annual

Assist site management team in planning and coordinating facility emergency drill

Annual

Maintain emergency response equipment and supplies: a) Firefighting b) Spill containment c) Rescue d) Medical e) Emergency communications equipment Investigate and/or critique: a) Each emergency response b) Accidents or near-miss incidents on jobs involving support from HSE personnel

Inspect and maintain each type of equipment and supply item consistent with documented procedures

Within 24 hours following incident

100 95 90

Percent

85 80 75 70 1

2

3

4

5

6

7

Quarter FIGURE 15-18. Rescue/fire brigade training (percent of members attending).

CH15pp159-189 4/10/02 12:51 PM Page 186

186 ■

Serious Incident Prevention

Survey Results

5 4 3 2 1 1

2

3

4

5

6

Year FIGURE 15-19. Quality of HSE services based on annual survey of line man-

agers. TABLE 15-8 Reinforcement Plan HSE Serious Incident Prevention

Result or Action to Reinforce

Who Receives Reinforcement?

Who Delivers?

Serious incident prevention process fully developed

HSE team

HSE manager

Performance measure fully implemented one month

Process steward and other team members

HSE manager

100% completion of critical work for month

HSE team

HSE manager

Twelve month moving average above goal for 3 consecutive months and new goal established

HSE team

HSE manager

Favorable comments from internal customer interviews

Individual or team as appropriate

HSE manager

Completion of annual site visit and facility emergency drill

Individuals responsible

HSE manager

Action taken to identify and arrange for correction of “red flag” condition

Individual or team taking the action

HSE team (in form of “red flag” note of appreciation)

CH15pp159-189 4/10/02 12:51 PM Page 187

Applying the Process Model—A Case Study

■ 187

HSE personnel maintain active dialogue with the manufacturing and chemical handling areas. This interaction helps team members clearly understand the risks that must be controlled and the specific HSE support required. The team’s expertise is recognized, and members are often invited to participate in improvement efforts initiated by the manufacturing and chemical handling departments. The HSE team is highly respected throughout the company, and the team is proud of its contributions and partnership role with line organizations.

QMI Site Management Team: Serious Incident Prevention The site management team is led by QMI’s plant manager, with membership that includes manufacturing, chemical handling, and HSE department heads. The site management team focuses on ensuring incident prevention processes are effectively deployed throughout the organization. The team has identified and documented its critical work for proactively impacting serious incident prevention (Table 15-9).

TABLE 15-9 QMI Site Management Team Serious Incident Prevention Critical Work

Critical Work

Frequency

Integrate serious incident prevention objectives into safety policy & communicate through organization

Annual review and update

Establish goals & performance expectations that support serious incident prevention objectives; communicate through organization

Annual review and update

Schedule line organization briefings regarding potential risks and status of the incident prevention process

Annual briefing by each department

Walk-through visit/inspection of chemical handling and manufacturing department facilities

Annual

Ensure audits of departmental serious incident prevention processes are conducted and results are reviewed

Annual

Review investigation reports for accidents and near-miss events having serious incident potential

First team meeting following occurrence

Assess the site team’s serious incident prevention process; initiate updates & improvements

Annual review with monthly review of improvement actions

CH15pp159-189 4/10/02 12:51 PM Page 188

188 ■

Serious Incident Prevention

TABLE 15-10 Reinforcement Plan Site Management Team Serious Incident Prevention

Result or Action to Reinforce

Who Receives?

Who Delivers?

Serious incident prevention process implemented in all departments

Department heads

Plant manager

Sustaining serious incident prevention process at high performance level

Department heads

Plant manager in form of merit pay increase as appropriate Plant manager in form of verbal recognition at time of: ■ Department head’s annual review with site team ■ Site team’s annual inspection of departmental facilities ■ Plant manager’s coaching sessions with department heads

Performance measures maintained by the team help identify potential problem areas within the organization, as well as opportunities for positive reinforcement. The team’s serious incident prevention reinforcement plan (Table 15-10) focuses on recognizing department heads for sustaining high levels of performance. Support of the serious incident prevention process is a key factor in annual merit reviews, and coaching is effectively utilized by the plant manager in shaping values and priorities. The team diligently supports the constancy of purpose required to sustain incident-free operations. QMI’s management team is careful to limit positive reinforcement to results achieved consistent with safe work practices. A planned seven-day maintenance shutdown was completed in six days, but an audit identified short-cutting of hot work procedures during the shutdown. Rather than initiating positive reinforcement for minimizing downtime, management focused on ensuring that the root causes of the deficient work practices were identified and corrected. Measurement and feedback systems keep the site management team informed of the facility’s fitness for sustaining serious incident-free operations. The system provides the capability for managers to drive improvements through meaningful actions.

CH15pp159-189 4/10/02 12:51 PM Page 189

Applying the Process Model—A Case Study

■ 189

The site management team recognizes that the occurrence of a serious incident represents a common point of failure on the pathway to achieving many of the organization’s key objectives, e.g., customer satisfaction, financial performance, company image, and maintaining a safe workplace. Tolerating conditions that could lead to a serious incident is clearly incompatible with QMI’s core values.

Benefits Achieved from the Serious Incident Prevention Process The improvements achieved by QMI through deployment of effective incident-prevention processes have created benefits extending well beyond safe operations. Sustaining safe operations has resulted in improved production volume, product quality, shipping date reliability, cost control, and company image, in addition to a safer workplace. The serious incident prevention process has been successfully institutionalized, helping ensure the organization will continue to keep its eye on the right ball even when changes occur in the organization. All stakeholders, including employees and their families, shareowners, customers, suppliers, and the public, are benefiting and will continue to benefit from QMI’s deployment of effective serious incident prevention processes.

References 1. Department of Transportation, Office of Pipeline Safety, Liquid Pipeline Accident Summary by Cause, 1/1/2000–12/31/2000. 2. National Fire Protection Association, Flammable and Combustible Liquids Code, 1993. 3. National Fire Protection Association, Pre-Incident Planning for Warehouse Occupancies, 1993.

CH16pp190-196 4/10/02 12:52 PM Page 190

C H A P T E R

16

Responding to the Challenge Into Thin Air: A Personal Account of the Mount Everest Disaster,1 by Jon Krakauer, describes the challenges for climbers and their expedition leaders in attempting to conquer Mount Everest. After months of training and payments of up to $65,000, a climber typically has only one try at assaulting the summit. Limitations on physical strength and supplies, such as bottled oxygen, make a restart unfeasible once the march to the summit begins from the expedition’s highest elevation camp. Prior to starting the climb to the summit, most Mount Everest expedition leaders establish a firm turnaround time for all members of the expedition. If the summit has not been reached by the specified time (typically 2 p.m.), climbers and guides have instructions to turn around and descend the mountain. Compliance with this guideline helps ensure a climber’s bottled oxygen and other supplies are sufficient, and that the climber is able to safely return to the protection of camp by nightfall. Predictably, “summit fever” often strikes both climbers and their expedition leaders. Enforcement of the turnaround time becomes difficult, particularly when the summit is in sight. Turning around represents major disappointment for climbers who have sacrificed physically and financially to position themselves in sight of the mountaintop, and who may be looking at their last chance to achieve their personal goal. For expedition

190

CH16pp190-196 4/10/02 12:52 PM Page 191

Responding to the Challenge

■ 191

leaders, the percentage of clients who reach the summit is a key performance measure—a measure impacting reputation and the size of client fees. Under such pressures, the turnaround time has often been ignored when the summit is in sight—and deaths have occurred. In more standard workplaces, few decisions are as dramatic as the decisions involving enforcement of the turnaround time on Mount Everest. Nevertheless, key decisions are made every day that affect an organization’s capability to sustain incident-free operations. Individuals making these decisions are faced with the challenges of fully satisfying both the short- and long-term needs of bosses, subordinates, shareholders, and the public, as well as personal needs. The desire for achievement and recognition can create “workplace fevers” that rival “summit fever” in intensity. Ever-present forces tend to focus management’s attention on reacting to ongoing, daily problems in the workplace. The proactive actions needed to address longer-term issues may be sacrificed in such an environment. With the severe potential consequences of serious incidents, it’s vital that an effective management process be in place to maintain the constancy of purpose needed for sustained incident-free operations. The need for excellence is clear. Companies throughout the world have demonstrated the effectiveness of performance management techniques in achieving breakthrough levels of performance. Efforts have typically focused on improving performance in areas that are highly visible to management, such as cost control, productivity, product quality, customer service, and prevention of common injuries. Similar performance breakthroughs are feasible in executing the work necessary to prevent serious incidents resulting in fatalities, property damage, business interruption, hazardous material releases, regulatory violations, damage to company image, and other losses. The merging of proven-quality management techniques with sound risk-management practices provides the basis for a proactive process to achieve these breakthroughs. Overcoming the barriers to sustaining safe operations requires a comprehensive management process. Inclusion of the following elements in the process will help ensure effectiveness: ■ ■ ■ ■

Management leadership in maintaining serious incident prevention as a top organizational priority Emphasis on employee involvement, teamwork, and empowerment Understanding of the organization’s significant risks Accurate identification of the critical work necessary to control the risks

CH16pp190-196 4/10/02 12:52 PM Page 192

192 ■ ■ ■ ■ ■

Serious Incident Prevention

Standards for performing the critical work Measurement and feedback systems for monitoring and communicating performance in executing critical work Reinforcement and corrective action contingent upon performance A systematic method for continually updating and improving the serious-incident prevention process

Keys for Successful Implementation Successful implementation of the serious incident prevention process will require more than good intentions—a sound plan and the commitment to transform concepts into actions is a necessity. Each of the eight-elements must be firmly in place to ensure that the process is successfully implemented and that the desired results are achieved. In planning for implementation of the serious incident prevention process, organizations may decide to proceed with a full facility-wide implementation or a more focused pilot effort in one or more units within a facility. A facility-wide implementation has the obvious advantage of ensuring that the entire facility benefits from the improved process in the shortest practical time frame. A facility-wide approach is particularly appropriate if implementation of the improved incident prevention process is actively endorsed and supported by the organization’s top management. Even when top managerial support exists, it may be advantageous to implement the improved safety management process on a pilot basis in selected units of a facility or company. The resources required for such a pilot effort will be less intensive compared to implementation on a broader scale. The focusing of resources will help assure that the initial effort is well organized and that the desired results are achieved. Getting the implementation effort off to a good start is essential for generating the enthusiasm and encouragement needed to ensure that other organizational units will be receptive to adopting this more effective management process. In selecting specific organizational units for participation in a pilot program, managers should remember that the serious incident prevention process is applicable not only to operating units but also to HSE departments and top-level management teams. To help ensure that initial implementations achieve levels of improvement that will shine as a beacon to others, management should strongly consider initial implementations in units where there is the most concern for the occurrence of a serious incident. Such concern may be based upon the following factors:

CH16pp190-196 4/10/02 12:52 PM Page 193

Responding to the Challenge

■ ■ ■ ■ ■

■ 193

History of incidents Frequency of near misses Low safety audit scores High level of risk inherent to the unit’s operations Other key indicators

Priority for implementation may also be given to units led by individuals who have earned the reputation as “safety champions” for their leadership in implementing safety improvement initiatives. Inclusion of these high-performance units in a pilot program will assure that the initial implementation is supported with the proper leadership and that the initiative is received as credible in the eyes of others. Regardless of implementation on a facility-wide or a pilot-program basis, leaders must ensure the actions necessary for success are taken. Experience confirms that implementation plans should include the following actions: ■ ■

■ ■ ■ ■ ■

■ ■

Identify, encourage, and recruit employees for leadership roles Form implementation teams comprised of employees responsible for the critical work and other individuals with special expertise valuable to the team Provide training for implementation teams Consider the need for team facilitators Consider the need for a steering team Ensure that “Plan-Do-Check-Act” steps are in place Conduct communications meetings led by the implementation team to introduce the serious incident prevention process to all affected employees Include management’s visible participation and endorsement in the communications meetings Follow the plan, maintain constancy of purpose, continue to involve employees, and continually strive for improvement

An approach that includes the above actions will maximize the probability of a successful implementation. This approach recognizes that individuals responsible for the critical work must be involved in leadership roles in developing and implementing the serious incident prevention process. Providing training on the elements of the serious incident prevention process and teamwork skills will be helpful in keeping the team on track

CH16pp190-196 4/10/02 12:52 PM Page 194

194 ■

Serious Incident Prevention

and achieving effective teamwork. Resourcing the team with a trained facilitator and the formation of a steering team will provide guidance and help assure that teams function efficiently and remain on the proper course. After the serious incident prevention process is developed, the implementation team should take the lead in communicating the new process to coworkers. Effective communications can be accomplished by scheduling special meetings where hourly-roll and other implementation team members take leadership roles in communicating the improved safety management process to their coworkers. The objective of these kick-off meetings is to educate all employees regarding the need for an improved process, how the new process works, why it will be successful, the responsibilities of each team member, and the benefits to be gained from implementation. The list of critical work items, performance standards, and measurement and feedback systems should be discussed in sufficient detail to achieve a common understanding of the new safety-management process. Participation of one or more top-level managers in the communications meetings to endorse the implementation team’s work will help facilitate successful implementation. Following roll-out of the newly developed serious incident prevention process, the ongoing involvement of all affected employees will remain critical to achieving and sustaining high levels of performance. Periodic reviews to evaluate each of the eight process elements will help keep the process fine-tuned and up-to-date. In striving for continual improvement, managers must be diligent in maintaining the constancy of purpose and visible support needed for long-term success.

Taking the Step Forward Implementation of a more effective safety management process can be one of the most value-adding and personally satisfying initiatives possible during a management career. Providing the leadership for implementation of the eight-element serious incident prevention process will provide major benefits to the organization for decades to come. It is the type of positive, long-lasting change that legacies are made of. It is time for more leaders to take the step forward. Breakthrough performance is needed to further drive serious incidents toward extinction. Managers must look beyond the daily pressures inherent in their jobs to implement more effective processes for the prevention of incidents. Seriousincident-free operation provides major benefits for all—employees and their families, shareowners, customers, suppliers, and the public.

CH16pp190-196 4/10/02 12:52 PM Page 195

Responding to the Challenge

■ 195

References 1. J. Krakauer, Into Thin Air: A Personal Account of the Mount Everest Disaster (New York: Doubleday, 1997), 259–280.

CH16pp190-196 4/10/02 12:52 PM Page 196

Indexpp196-198

4/17/02

10:54 AM

Page 197

Index

A Apollo I, 45–46 Association of American Railroads, 90–91 Automobile safety (see motor vehicle safety) Aviation safety, 86

B Barriers to improvement, 27–28 Behavioral-safety, 29–31, 44, 143 Bhopal, India, 3, 33, 72–73 Bill Dillard Shows, Inc., 48 BLEVE, 41 Bonfire incident, 4 Boorda, Jeremy, 38 Boston Celtics, 153 Brainstorming, 62–66

C Case study, 159–189 Causal factors, 88–89, 148–152 Chaffe, Roger, 46

Chemical incidents (see hydrocarbonchemical Computer modeling, 74 Consensus, 61–62 Corrective action, 35, 148–152, 192 Covey, Stephen R., 22, 50, 108 Crandell, Robert C., 50 Critical work, 34, 83–102, 113–121, 159–181, 191 Crosby, Philip B., 93

D D-Day, 55 Deming improvement cycle, 32–33, 42–43 Demosthenes, 40–41 Department of Defense, 78 Drucker, Peter, 39, 46–47 Dyson, James, 111–113

E Eastman Chemical Company, 1–3, 41, 143 Elliot, Frank, 55–56

197

Indexpp196-198

4/17/02

198 ■

10:54 AM

Page 198

Serious Incident Prevention

Employee involvement, 22–23, 33, 48–59, 54–55, 60–67, 94, 154–156, 191 Survey results, 55, 57–58 EPA, 3, 86

F Fatality rates, 6–7 Feedback (see Measurement and feedback) Fire incident rates, 7–8 Flixboro, 33 Fly-crash-fix-fly cycle, 33–34 Force-field diagram, 27

G Grissom, Virgil, 46 Grose, Vernon L., 26

H Handy, Charles, 51 HAZOP, 100 Hoover, Herbert, 84 HSE incident prevention process, 183–187 Human error, 75–78, 88, 148, 150–151 Causation model, 77 Estimates of rates, 75 Hydrocarbon–chemical industry incidents, 4–15, 101

I Imai, Masaaki, 39 Intelligence, types of, 50–51 Islands of excellence, 33

J Jackman, Richard, 141–142 Johnson, Lyndon, 45

M Management by exception, 23 Management commitment and leadership, 32–33, 37–47, 159–161, 165, 191–194 Management of change, 96–102, 161 Planned changes, 96, 99–102 Unplanned changes, 96–99, 101–102 Maxwell, John, 40 Measurement and feedback, 23–24, 34–35, 109–140, 159–181, 192 Safety performance indexing, 124, 126–140, 163–168, 173–174 Mexico City incident, 41 MIL-STD-882D, 78–81 Mishap probability, 78–80 Mishap risk assessment, 80–81 Mishap risk categories, 81 Mishap severity, 78–79 Misguided optimism, 26–27 Motor vehicle safety, 83–86 Highway fatalities, 85

N NASA, 45–46 National Transportation Safety Board, 3, 107 NBA (National Basketball Association), 153 Near misses, 74, 102, 116, 118, 149, 171 NFPA codes, 178, 179

O Organizational focus, 42–43, 154 Organizational learning, 154–156 OSHA, 3, 6, 30, 54–55, 74, 86, 94–95, 114 Process Safety Management, 74, 94–97 Voluntary Protection Program (VPP), 54 Voluntary Safety and Health Program Management Guidelines, 54–55

K Kaizen, 39 Kletz, Trevor, 18 Krakauer, Jon, 190

L Law of the Farm, 22 Law of the Lid, 40 Line ownership, 25 Los Angeles Lakers, 153

P Pareto principle (voting), 63–66, Pearl Harbor, 109 Performance management, 29–32 Performance standards, 34, 103–110, 192 Corporate/company standards, 105–106 Explicit standards, 108–109 Facility/operating standards, 106–107 Implicit standards, 108–109

Indexpp196-198

4/17/02

10:54 AM

Page 199

Index

PIC, 143 Pipeline operations, 162–178 Plan-Do-Check-Act, 32–33, 42–43, 113, 124, 157, 193 Port of New Orleans, 149 Prison break exercise, 52–53, 57

Q Quality management, 31

R Rail yard incidents, 6–8, Recognition (see also reinforcement and feedback), 24–25 Red flags, 44, 53, 98, 149–151, 157, 165–167, 175, 178 Refinery incidents (see hydrocarbonchemical) Reinforcement, 32, 35, 44, 137, 141–147, 165–166, 175–176, 183–186, 188 Reinforcement Plans, 143–146, 165, 175–176, 186, 188 Social Reinforcement, 143–146 Tangible Reinforcement, 143–146 Resource allocation, 43 Responsible Care, 3 Risks Definition, 68 Identification and understanding, 33–34, 68–82, 83–87, 167–187, 191 Root causes, 148, 150, 176

S Safety culture, 155–156 Safety performance indexing (see measurement and feedback)

■ 199

Shared vision, 154–156 Shepard, Alan, 45 Site-management incident prevention process, 187–189 Slayton, Deke, 45 SSIP Rule, 143–144, 146, 164 Storage terminal incidents (see hydrocarbon-chemical) Summit Fever, 190–191 Synergy, 50–54 Systems Safety, 78–81

T Tank car loading, 89–93, 151 Tank storage operations, 162–167, 176–179 Team atmosphere, 66–67 Teamwork, 53–54, 60–67, 154–156, 162, 191 The Age of Paradox, 51 Thomas, Eugene, 98 Tornado safety, 87

U U.S. Navy, 38 Universe of safety tasks, 30

V Valdez, 33 Vapor cloud explosion, 2

W Wal-mart, 99 Warehouse operations, 114–121, 162–167, 179–182 Welch, Jack, 50 White, Edward, 46

Indexpp196-198

4/17/02

10:54 AM

Page 200