4

Safety Culture and Human Systems Integration

HUMAN SYSTEMS INTEGRATION AND SAFETY CULTURE

Human-Systems Integration (HSI) is a framework in which human capabilities and limitations across various dimensions are considered in the context of a dynamic system of people, technology, environment, tasks, and other systems with the goal of achieving system resilience and adaptation, approaching joint optimization.^1,2 HSI considers human factors at the levels of the individual, team and organization.

Safety culture exists at the organizational level and is the cumulative values and attitudes of all of those in the organization. The organization reinforces specific values and attitudes through behaviors such as work rules, processes, management practices, supervision rewards, and communication. HSI takes into account various dimensions of the human system that include manpower, personnel, training, safety, human factors, survivability, and habitability. Thus, the HSI framework includes considerations of safety and at the organizational level, produces the safety culture. HSI, when done properly, can lead to an improved safety culture, but has the additional benefits of improving worker productivity and job satisfaction. This is critical because often organizations treat safety considerations as a cost of doing

___________________

¹ National Research Council, Human-System Integration in the System Development Process: A New Look (R.W. Pew and A.S. Mavor, eds.), The National Academies Press, Washington, D.C., 2007.

² D.A. Boehm-Davis, F.T. Durso, and J.D. Lee, APA Handbook of Human Systems Integration, American Psychological Association, Washington, D.C., 2015.

business; however, by doing good HSI, an organization can achieve a safer organizational culture and a more effective and satisfied workforce.

HUMAN SYSTEMS INTEGRATION AND FASTENERS

Human capabilities and limitations need to be considered in the context of the complex landscape of subsea fasteners and their employment. Humans impact and are impacted by all aspects of the system. For instance, the human who is executing the torqueing process can directly impact the integrity of the subsea installation. In addition, the size, strength, position and material composition of a fastener or stud affects the required torqueing process. Different coatings and lubricants also change the torque specified, and they do affect the ultimate fastener preload, which is in turn related to stress and the operating environment. In addition, there are also organizational impacts on torqueing stemming from the equipment, training, guidance and quality control system of the company. All of these interactions that can be affected by human variability should be taken into account when intervening to improve the human system and ultimately the entire fastener system.

Considerations of selection, training, safety, skill development, and work processes are relevant to the processes involved in manufacturing, installing, maintaining, and inspecting subsea fasteners. Personnel must be qualified to perform the job and trained to carry out processes according to defined standards and specifications. Human expertise associated with various processes and best practices need to guide the training content. Attention to these various human dimensions cannot only improve safety culture, but productivity and effectiveness of the entire system. Examples of fastener solutions that take these human dimensions into account can be found in Chapter 5.

But standards and specifications, are not sufficient. Human error is often associated with failure to follow correct procedures. However, this begs the question of whether the procedures can be followed—often people use work arounds because the procedures are flawed in some way; some procedures can doom a person to fail. Understanding the rationale for procedures and the consequences of not following procedures are also important for safety. At the same time, there may be no procedures for some critical tasks. Optimization of the work process itself to reduce the risk of unsuccessful outcomes is critical and often overlooked. Standard operating procedures regarding design, production, application, and serviceability of critical fasteners may not exist to the extent required to completely avoid fastener Failure to consider HSI issues early in system design can result in safety issues, poor system performance, and increased costs of re-design. And every system that does not check the quality of every human performed task is doomed to the irreducible error rate of humans.

HUMAN SYSTEMS INTEGRATION IN OTHER INDUSTRIES AND COUNTRIES

Most of the HSI research and development in the oil and gas offshore industry has taken place within the European oil industry, especially Norway and Great Britain.³ Flin and Slaven report research primarily conducted in the North Sea and Irish Sea, focusing on the development of the workforce (selection, training, health, management, stress, and error) with less attention to work process, larger organizational issues, and human interactions with tools and technology. Much of this work is a direct result of the Piper Alpha disaster in July of 1988 that killed 167 workers in the world’s deadliest offshore oil industry disaster.⁴

Human Systems Integration is not new and has been standard practice in multiple agencies and organizations including the Department of Defense, the Federal Aviation Administration (FAA), the Department of Energy, and NASA. The U.S. military has practiced human-centered design since safety issues became apparent with World War II aircraft. The U.S. Army, for instance, has a director-level position responsible for HSI and a service-level policy document. Of importance is the consideration of HSI in the acquisition process because changes made later in the lifecycle can be expensive as the organization becomes hampered by legacy equipment.

The nuclear industry began to consider human systems integration after Three Mile Island and its human factors implications. The Nuclear Regulatory Commission (NRC) has a Human Factors Information System which is a database that collects and stores reports on human performance issues in the industry. Reports are submitted by licensees (licensee event reports) and by NRC inspection. This information is used to focus efforts to improve human-system interfaces, organizational processes, training programs, procedures and inspections at each plant.

The FAA has a Human Factors Division which by FAA Order 9550.8A is a “multidisciplinary effort to generate and compile information about human capabilities and limitations and apply that information to equipment, systems, facilities, procedures, jobs, environments, training, staffing, and personnel management for safe, comfortable, and effective human performance.” Though labeled “human factors division,” the FAA considers systems and systems of systems in line with the tenets of human systems integration with the aim of supporting human performance across various aviation domains.

NASA has a Human Systems Integration Division that targets improved crew performance, safety and health in spacecraft as well as aircraft. Like the National

___________________

³ R. Flin and G. Slaven, “Introduction,” pp. 1-6 in Managing the Offshore Installation Workforce (R. Flin and G. Slaven, eds.), PennWell Books, Tulsa, Okla., 1996.

⁴ NASA, “The Case for Safety: The North Sea Piper Alpha Disaster,” NASA Safety Center Case Study, May 2013, Volume 7, Issue 4, https://sma.nasa.gov/docs/default-source/safety-messages/safetymessage-2013-05-06-piperalpha.pdf?sfvrsn=6.

Airspace System, military systems, and the nuclear industry, NASA is responsible for a complex system of systems of humans and machines in an environment that is often challenging to human performance and survival. Like the FAA, NASA not only oversees that human systems policies are enacted in new and existing systems, but conducts research to inform policies and decisions.

HSI is a reaction to issues identified in major disasters such as the Piper Alpha, Three Mile Island, or the Challenger explosion. Despite a spotty history for oil and gas in the United States including the Macondo blowout, there continues to be a gap in HSI in this industry.

GAPS IN U.S. HUMAN SYSTEMS INTEGRATION IN THE OIL AND GAS INDUSTRY

According to Flin and Slaven⁵ there had been little attention paid to HSI in oil and gas outside of Europe and apparently, the situation has not radically changed. Although safety drills are practiced broadly, there is little attention paid to HSI or human factors in U.S. standards. According to a report by the Ocean Energy Safety Institute (OESI) “the American Petroleum Institute (API) recently mandated Recommended Practice 75 (API, 2004) which incorporates directives that Human Factors should be considered, but gives no specific guidance on the appropriate steps or directions for implementation.”⁶

Also, the same OESI report states that “Currently there are few, if any, frameworks that can integrate human-centered design concepts throughout the rig design process and can identify crucial elements specific to design stages. There are also gaps in establishing examples of successful implementation and identification of the key performance indicators (KPI) and return on investment (ROI) for all of the methods presented.”⁷

The OESI report also notes gaps in the perception of risk among oil and gas workers and how workload and organization factors may affect risk perception and in turn worker performance and safety. In addition, quantitative risk assessment has failed to take into account human and organizational factors in the oil and gas industry (e.g., Macondo incident).

Given the minimal attention paid to HSI in the larger oil and gas industry, it should come as little surprise that there has been no attention paid to this aspect of subsea fasteners.

___________________

⁵ R. Flin and G. Slaven, “Introduction,” pp. 1-6 in Managing the Offshore Installation Workforce (R. Flin and G. Slaven, eds.), PennWell Books, Tulsa, Okla., 1996.

⁶ S.C. Peres, R. Bias, N. Quddus, W.S. Hoyle, L. Ahmed, J.C. Batarse, and M.S. Mannan, Human Factors and Ergonomics in Offshore Drilling and Production: The Implications for Drilling Safety, Technical Report, Ocean Energy Safety Institute, 2016, p. 8.

⁷ Ibid., p. 7.

HUMAN INTERACTIONS WITH SUBSEA FASTENERS

The lifecycle of a fastener includes processes from manufacturing, testing, and validation to operations, monitoring, and maintenance that are often discussed with minimal to no reference to a human being.⁸ For example, the significant GE H4 bolt recall was blamed on a failure of a lower tier subcontractor to use the correct standard requiring a post-electroplating bake-out procedure. But this failure was just a symptom of the fact that no process was in place to insure lower tier subcontractors were provided the information they needed, nor was any planning given to the critical need to monitor their human performance. Typical Venn diagrams⁹ depicting the fastener landscape and potential failures include interactions between materials, stress, and the environment,¹⁰ pointing out the complex interactions between these three systems, yet without reference to the complex human system that is involved in all processes throughout the life of a fastener (Figure 4.1b).

Notably, a very large portion of the processes involved in the fastener lifecycle are not automated, but are executed by humans. For instance, in the manufacturing process humans process the raw material, and carry out machining, heat treatment, quality control, and coating processes.

Although these processes may be associated with specifications and standards, it is the human who translates the standard to practice. It is also a human who makes decisions is areas where no specifications and standards apply. Finally, it always falls to a human to monitor, or fail to monitor, another human’s conformance with the standards. Similarly, humans play a role in every fastener process (see Table 4.1).

These processes can be further subdivided into sub-processes as has been done in Tables 4.2 and 4.3 for the manufacturing processes of steel and fasteners. Each process and subprocess requires human intervention.

___________________

⁸ R. San Pedro, “Fastenered Flange Joints in Offshore: Basic Principles and Applications,” presentation to committee on March 22, 2017.

⁹ A Venn diagram is a diagram that shows all possible logical relations between a finite collection of different sets. A typical Venn diagram consists of multiple overlapping closed curves (often circles) each representing a set.

¹⁰ F.C. Adamek, “A Historical View of Subsea Fastenering,” presentation to the Workshop on Bolting Reliability for Offshore Oil and Natural Gas Operations, April 10-11, 2017; see Figure 4.1a.

TABLE 4.1 Processes in a Fastener Life Cycle that Involve Humans

TABLE 4.2 Steel Manufacturing

TABLE 4.3 Fastener Manufacturing

THE HUMAN’S ROLE IN FASTENER FAILURES

Root cause analyses for fastener failures, if carried to the full root cause, will likely implicate the human. Armagost¹¹ reported five root cause categories associated with fastener failures:

1. Maintenance: Mistake, misuse or oversight during maintenance.
2. Procedural: Mistake, misuse or oversight during operation.
3. Quality assurance/quality control (QA/QC) manufacturing: Failure related to manufacturing.
4. Wear and tear: A component that has reached a point where it cannot perform its intended function as the result of use.
5. Human error: Errors in judgment and behavior

Clearly humans are involved in the fifth category, but are likely to also be involved in other categories as well. It is a human who is probably making the mistake or misusing equipment, or failing to provide adequate oversight. The fact that there is human involvement, however, does not justify the label “human error” as the root cause. Human errors come in many varieties. They have immediate effects (active errors) or latent with consequences are not experienced for some time.¹² They can also be characterized as slips, lapses, mistakes, and violations.¹³ They can be errors of omission in which a critical step is omitted and errors of commission in which something extra is done that is not in the procedure. Errors of commission and those with latent consequences are challenging to address. Understanding the type of error can be instrumental in intervening to prevent additional errors.

Moreover, the human needs to be considered as a complex system component, on par with the fastener environment or materials. It would not be sufficient to identify environmental error or materials error as a root cause, just as the “human error” label is not sufficient. More importantly, the label, “human error” is not an explanation that can point to any interventions other than to remove humans from the system. It is necessary to identify why the human followed the wrong procedure or made an incorrect action. This needs to be done in the context of the complex human-fastener system.

___________________

¹¹ K. Armagost, “Root Cause Failure Analysis in Support of Improved Systems Reliability,” presentation to the Workshop on Bolting Reliability for Offshore Oil and Natural Gas Operations, April 10-11, 2017.

¹² R. Gordon, “Contribution of Human Factors and Human Error to Accidents,” pp. 149-176 in Managing the Offshore Installation Workforce (R. Flin and G. Slaven, eds.), PennWell Books, Tulsa, Okla., 1996.

¹³ J. Reason, Human Error, Cambridge University Press, Cambridge, Mass., 1991.

For example, torqueing to preload a fastener or stud is a task that is particularly prone to “human error” for the following reasons:

1. Different coatings lubricants, and quality of thread surface finish all change the torque required to achieve the desired fastener preload, but the current specifications do not appear to account for these differences.
2. Torqueing of flange fasteners must be done following a rather complex procedure that specifies the order in which flange fasteners are torqued and the number of torqueing passes required to attain required torque.
3. Torqueing of flange fasteners must be done a number of times around the flange, in the proper order.
4. From a design perspective, torqueing is an inaccurate method for preloading fasteners due to:
   1. Manufacturing tolerances of threads.
   2. Uncertainty about whether the actual friction during torqueing is accurately predicted by the friction factor assumed when calculating the required make-up torque.
   3. Absent observing the torqueing procedure directly, there appears to be little use of technologies that could be used to check if adequate preload on the bolt has been, in fact, obtained.

In tasks like this the human can be set up to fail to achieve the desired result. It may be, for instance, impossible to follow the established procedure that is poorly written or overly complex. In other words, other parts of the system are impacting human performance. For example, there is no standard torque training or competency assessment available for workers on the rig or the shop floor who perform torqueing. Or, better yet, a new method of measuring preload as discussed elsewhere in this report has yet to be instituted. Interestingly, the 2012 National Academy of Engineering (NAE)/National Research Council (NRC) report Macondo Well Deepwater Horizon Blowout: Lessons for Improving Offshore Drilling Safety also notes that education and training of offshore drilling personnel needs to be expanded.¹⁴ It is important to note that training alone will not eliminate human error in the face of distractions such as time pressure. Training is also not a solution for poor design. An API workgroup established a “Torque Action Plan” that reviewed the specification of the torqueing process (e.g., attending to the number of passes to final torque). Their recommendation to ensure torqueing was done correctly was to have a supervisor removed from his/her normal duties to verify

___________________

¹⁴ National Academy of Engineering (NAE)/National Research Council (NRC), Macondo Well Deepwater Horizon Blowout: Lessons for Improving Offshore Drilling Safety, The National Academies Press, Washington, D.C., 2012.

that any crew performing torqueing is doing it correctly.¹⁵ Putting a second human on a task to supervise work that is too difficult for the first does not seem like the best solution to the problem. There is no assurance that a supervisor is any more competent (i.e., trained) to perform or oversee a torqueing operation. Additionally, what other risks will be introduced by removing the supervisor from his/her normal duties? Instead, directly addressing the issues associated with torqueing difficulty to improve the process would be more likely to succeed. Alternatively, some version of the installation quality technique recommended by the Research Council on Structural Connections (RCSC) should be considered. This technique required that an engineer of record approve the installation technique and the required installation quality steps. Additionally, a trained inspector is required onsite to perform torqueing calibrations and to monitor crews performing bolt torqueing.¹⁶

In general, in cases of human error, the “error” needs to be considered in light of the larger system including the larger human system. In all the processes involved in the fastener lifecycle there is also input from teams of humans and entire organizations. For example, industry standards, specifications, and recommended practices are developed from teams comprised of representatives from various types of companies in one or more industries. Their development is likely impacted by team dynamics as much as by technology.

TEAM ISSUES

Seldom do individuals work alone. Fastener processes are complex and require the work of multiple individuals. For instance, inspection of subsea fasteners on drilling risers is undertaken every 3 days by a crew of eight people who control a remotely operated vehicle. Teamwork can be highly effective. But can also be a contributor to systems failures when there are failed team processes such as poor communication and coordination, lack of shared knowledge, and role confusion.¹⁷ There are some specific challenges for teamwork in the world of subsea fasteners. Multiple disciplines must coordinate design, manufacturing, operation, and maintenance. Additionally, these processes must be coordinated across multiple organizations, including operators, drilling contractors, BOP original equipment manufacturer (OEM), and fastener manufacturers. Communication across multidisciplinary teams can be difficult, but is especially challenging in the oil and gas industry due to contractual obligations and legal risk mitigation. Experienced field

___________________

¹⁵ T. Fleece, BP, “Mitigating BOP Failures,” presentation at the Workshop on Bolting Reliability for Offshore Oil and Natural Gas Operations, April 11, 2017.

¹⁶ Research Council on Structural Connections, Specification for Structural Joints Using High Strength Bolts, Chicago, Ill., August 1, 2014.

¹⁷ E. Salas, N.J. Cooke, and M.A. Rosen, On teams, teamwork and team performance: Discoveries and developments, Human Factors 50:540-547, 2008.

workers may not share perspectives of scientists and engineers. On the other hand, sharing information about fastener performance, failures, and near misses across different disciplines and organizations is needed to promote a safety culture. Other team issues include handoffs (a shift handoff being the cause of the Piper Alpha disaster)¹⁸ or crew changes that can result in significant risk of system failure. Work left incomplete by one crew could go unnoticed by the next if there is no formal procedure for handoffs.

ORGANIZATION ISSUES

There are also issues that occur at the organizational level that impact human performance and ultimately safety culture and system performance. Work and management processes vary by company and often differ across companies (rigs, operators, OEMs). Companies may be hesitant to share information related to fastener failure for liability reasons. Business decisions have been made to protect and optimize shareholder value (e.g. Deepwater Horizon) at the expense of safety, quality, and personnel. This can have a negative impact on the company’s safety culture (Safety and Environmental Management Systems; SEMS; API RP76). There needs to be an adequate balance between competition that leads to resistance in taking responsibility for a failure or near miss and cooperation that enables steps to be taken to avoid future failures. Moreover, reporting on fastener failures and near misses should be encouraged and built into the work rules as part of the safety culture. This was also recommended in the 2012 NAE/NRC report and the 2014 and 2016 QC-FIT recommendations.

The move to deep water installations has resulted in a paradigm shift regarding the conditions surrounding the fasteners. Industry, however may not have fully shifted all parameters regarding oil and gas operations. Fasteners, which are seen as off-the-shelf commodities, may be one of the design elements that went unnoticed except by the bolting specialists. It should be mentioned, however, that the oil and gas industry, through the API, has responded to recent fastener failures with an outstanding effort.

Decision makers are driven by KPIs that are sometimes not well thought out. Laws and regulations hastily written responses to bad practices can make industry less competitive. An overly-prescriptive regulatory environment can suffocate newer technological developments and applications. An alternative that should be considered is a deliberate move toward a goal-oriented regulatory system such as is practiced by Norway and the United Kingdom. The study committee that authored the 2012 NAE/NRC Macondo report also believed in the advantages of goal-oriented regulations. Contained in its report is Summary Recommendation

___________________

¹⁸ Reference Lord Cullen’s report.

6.1: “The United States should fully implement a hybrid regulatory system that incorporates a limited number of prescriptive elements into a proactive, goal-oriented risk management system for health, safety, and the environment.”¹⁹

Organizations also need to adapt to changes in the workforce such as the “great crew change” of 1986 or the workforce decline that paralleled the declining price of oil. Students stop majoring in petroleum engineering in lean times resulting in an expertise gap in the workforce. In an industry in which skills are often learned on the job and passed down through generations, there is a serious lack of skilled crew and experienced mentors when the oil economy turns around.

SUMMARY AND RECOMMENDATION

Human systems integration has not been widely considered in the U.S. oil and gas industry or has been trivialized in the analysis of past fastener failures to explanations of “human error.” Yet, the human system is integral to the fastener landscape and the processes involved in the lifecycle of a fastener. It is critical that the complex human system at all levels (i.e., individual operator, teams, and organizations) and across all dimensions (e.g., training, selection, safety) be considered within the fastener system and the interventions to reduce fastener failures and improve the safety culture. Considering fasteners within the larger system necessitates an enterprise-wide safety culture. A human systems integration perspective is required in considerations of fastener failures and the interventions to prevent failure. Examples of HSI solutions are presented in Chapter 5.

Finding: Virtually every root cause analysis of an undersea bolt or stud failure finds a human error at least as a contributing cause.

Finding: In general, human error or mistakes are often used as an explanation for failures without looking for deeper root causes or factors that lead to mistakes or worse yet, redesigning the system to insure they do not happen in the future.

Finding: There is insufficient attention to individual worker and skill development through selection, training, and work process design.

Finding: Information sharing and reporting in the oil and gas industry regarding fastener failure incidents and near misses is evolving; this is an essential activity in promoting a safety culture across the industry.

___________________

¹⁹ NAE/NRC, Macondo Well Deepwater Horizon Blowout, 2012.

Finding: Multiple organizations often have conflicting work processes and share minimal information (rigs, operators, OEMS)

Recommendation 4.1: The oil and gas industry should promote an enhanced safety culture across organizations and disciplines that is reflected in work rules and that involves encouragement at all levels of the organization to improve the reliability of subsea bolts. This would include the following:

• The creation of a dedicated organizational human systems stakeholder;
• Attention to the individual worker and skill development through training, selection and work process sign;
• Company and industry-wide sharing of best practices for collecting and disseminating information about fastener performance, failures, and near misses; and
• Assessing gaps that could be mitigated by technology developments.