Serious Incident Prevention 2E

SeriousIncident

Prevention

How to Achieve and SustainAccident-Free Operations in

Your Plant or Company

CH00ppi-x 4/10/02 12:48 PM Page i

CH00ppi-x 4/10/02 12:48 PM Page ii

SeriousIncident

Prevention

How to Achieve and SustainAccident-Free Operations in

Your Plant or Company

SECOND EDITION

THOMAS E. BURNS

Amsterdam London New York Oxford Paris Tokyo

Boston San Diego San Francisco Singapore Sydney

an imprint of Elsevier Science

CH00ppi-x 4/10/02 12:48 PM Page iii

Gulf Professional Publishing is an imprint of Elsevier Science.

Copyright © 2002, Elsevier Science (USA). All rights reserved.

No part of this publication may be reproduced, stored in a retrieval system, ortransmitted in any form or by any means, electronic, mechanical, photocopying,recording, or otherwise, without the prior written permission of the publisher.

Recognizing the importance of preserving what has been written, ElsevierScience prints its books on acid-free paper whenever possible.

Library of Congress Cataloging-in-Publication DataBurns, Thomas, 1946-

Serious incident prevention : how to achieve and sustain accident-free operations in your plant or company / Thomas E. Burns.—2nd ed.

p.cm.Includes bibliographical references and index.ISBN 0-7506-7521-7 (alk. paper)1. Industrial safety. 2. Accidents—Prevention. I. Title.

T55 .B83 2002658.3’82—dc21 2001058497

British Library Cataloguing-in-Publication DataA catalogue record for this book is available from the British Library.

The publisher offers special discounts on bulk orders of this book.For information, please contact:

Manager of Special SalesElsevier Science225 Wildwood AvenueWoburn, MA 01801–2041Tel: 781-904-2500Fax: 781-904-2620

For information on all Gulf Professional Publishing publications available, contact our World Wide Web home page at: http://www.gulfpp.com

10 9 8 7 6 5 4 3 2 1

Printed in the United States of America

CH00ppi-x 4/10/02 12:48 PM Page iv

Dedicated to America’s unsung heroes:

Men and women who help prevent tragic

events before they occur through their daily

commitment to the prevention of serious,

high-consequence incidents.

CH00ppi-x 4/10/02 12:48 PM Page v

DISCLAIMER

The information contained in this publication consists of facts, con-cepts, principles, and other information for developing and implementinga strategy for preventing serious incidents. This information is intended toprovide general guidance in the development of effective safety-manage-ment processes. The information presented is not specific to the opera-tions of any company, facility, unit, process, system, or equipment, andneither the author nor publisher assumes any liability for its use.

The information provided in this publication is not a substitute forcompany, facility, or unit-specific operating and maintenance procedures,checklists, equipment descriptions, safety practices, etc. DO NOT attemptto operate any facility, unit, process, system, or equipment based solelyupon the information provided in this publication.

CH00ppi-x 4/10/02 12:48 PM Page vi

DISCLAIMER......................................................

Preface ix................................................................

1 The Improvement Challenge 1.........................Serious Incidents of the Past 3........................................

References 18...................................................................

2 The Barriers to Improvement 21........................A Focus on Today’s Problems 22.....................................

Limited Employee Involvement 22....................................

Inadequate Measurement and Feedback 23.....................

Inadequate Recognition 24...............................................

Limited Line Organization Ownership 25..........................

Limited Personal Experience 25........................................

Misguided Optimism 26.....................................................

Overcoming the Barriers 27..............................................

References 28...................................................................

3 A Proven Process Improvement Model 29........Process Model For Serious Incident Prevention 32..........

References 36...................................................................

4 Management Commitment andLeadership 37.........................................................

Achieving and Sustaining Effective Leadership 40...........

Achieving a Common Focus 42........................................

Allocation of Resources 43................................................

Knowledge of Results 43...................................................

Reinforcement of Performance 44....................................

Decisions Consistent with Objectives 44...........................

Commitment and Leadership - Closing Thoughts 46........

References 47...................................................................

5 Employee Involvement 48...................................

Synergy 50........................................................................

Prison Break Exercise 52..................................................

Teamwork 53.....................................................................

An OSHA Perspective on Employee Participation 54.......

Leveraging the Power of Employee Involvement 55.........

References 59...................................................................

Employee Involvement on Teams 60................................

6 Employee Involvement - DevelopingTeamwork 60...........................................................

Effective Teamwork Techniques 61..................................

References 67...................................................................

7 Understanding the Risks 68...............................Do Managers Understand the Risks? 69..........................

Small Boat Operation: An Illustration of Risks 71..............

Understanding More Complex Risks 72............................

A Systematic Process of Risk Identification 74.................

Understanding the Role of Human Error 76......................

Classifying and Prioritizing Risks 78..................................

Understanding the Risks - A Prerequisite forSuccess 81........................................................................

References 82...................................................................

Managing Similar Risks with Varying Levels ofSuccess 83........................................................................

8 Identifying the Critical Work 83..........................Beyond Regulatory Compliance 86...................................

Identifying Critical Work 87................................................

Causal Factors for Serious Incidents 88...........................

Critical Work for a Tank Car Loading Operation 89...........

Sustaining Performance 91...............................................

A Systematic, Knowledge-Based Approach 93.................

Process Safety Management Standard 94........................

References 95...................................................................

9 Identifying the Critical Work -Management of Change 96....................................

Unplanned Changes 97.....................................................

Planned Changes 99.........................................................

Management of Change in the Serious IncidentPrevention Process 101......................................................

References 102...................................................................

10 Establishing Performance Standards 103.........Corporate/Company Standards 105....................................

Facility/Operating Level Standards 106..............................

Explicit and Implicit Standards 108.....................................

Standards - A Prerequisite for Measurement,Feedback, and Accountability 109......................................

References 110...................................................................

11 Measurement and Feedback 111.......................Performance Accountability 113..........................................

Performance Measurement for Critical Work 113...............

Feedback and Its Linkage to Reinforcement 120................

Elevating the Visibility of Critical Work 121.........................

Characteristics of Effective Measurement andFeedback Systems 122.......................................................

Measurement Systems 122.................................................

Feedback Systems 123.......................................................

Types of Measurement and Feedback Systems 124..........

Safety Performance Indexing 124.......................................

Essential to the Process 125...............................................

References 125...................................................................

12 Measurement and Feedback - SafetyPerformance Indexing 126.......................................

Establishing a Safety Performance Index forPrevention of Serious Incidents 127....................................

References 140...................................................................

Reinforcement 141..............................................................

13 Reinforcement and Corrective Action 141........Corrective Action 148..........................................................

Addressing Causal Factors 148..........................................

Responding to Red Flags 149.............................................

References 152...................................................................

14 Improving and Updating the Process 153.........Shared Vision 155...............................................................

Organizational Learning 156...............................................

Employee Involvement 156.................................................

Transforming Concepts to Actions 157...............................

References 158...................................................................

Management Commitment and Leadership 159.................

15 Applying the Process Model - A CaseStudy 159...................................................................

Implementing Other Process Elements 161........................

Chemical Handling Department Team 162.........................

Chemical Handling Department Pipeline Operations 167...

Chemical Handling Department: Tank StorageOperations 178....................................................................

Chemical Handling Department: WarehouseOperations Team 179..........................................................

Manufacturing Department - Serious IncidentPrevention Processes 182..................................................

HSE - Serious Incident Prevention Processes 183.............

QMI Site Management Team: Serious IncidentPrevention 187....................................................................

Benefits Achieved from the Serious IncidentPrevention Process 189......................................................

References 189...................................................................

16 Responding to the Challenge 190......................Keys for Successful Implementation 192............................

Taking the Step Forward 194..............................................

References 195...................................................................

Index 197...................................................................

Riding a wave is easy; starting a wave is a much more ambitioustask. My objective for the first edition of Serious Incident Prevention,published in 1999, was to start such a wave. The book communicated avision for breakthrough levels of improvement in the prevention of seri-ous incidents through safety management processes that incorporate thecritical elements required for success. The old approach tends to focus oncompliance with OSHA, DOT, EPA, or other regulatory requirements asthe primary basis for an effective process. The new wave recognizes thecritical need for increasing employee involvement and ownership, devel-oping improved measures and feedback systems, improving the quantityand quality of recognition, and incorporating other proven performancemanagement principles into the safety management process.

It is satisfying to see that the ripples have started to grow in numberand strength. Line managers, safety professionals, and others are show-ing increased understanding and appreciation for the need to take a moreeffective, systematic approach in preventing serious incidents. Programspreviously focused on regulatory compliance are being adjusted to in-clude other critical actions required for success. Feedback from industryand other organizations continues to reinforce that the same performancemanagement principles that have proven effective in improving quality

Preface

ix

CH00ppi-x 4/10/02 12:48 PM Page ix

and other key organizational performance indicators are the key to achiev-ing and sustaining improved safety results.

My 28-year career with Eastman Chemical Company involved manag-ing safety-related risks from the perspective of both operations managementpositions and as Eastman’s Texas Division Safety Director. During my ca-reer with Eastman, company honors included winning the MalcolmBaldrige National Quality award, STAR recognition through OSHA’sVoluntary Protection Program (VPP), and receipt of the Texas ChemicalCouncil’s prestigious “Best in Texas” award. The serious incident preven-tion process model, as presented in this publication, was developed throughthe merging of proven performance management principles with sound riskmanagement practices that include the lessons learned during my nearlythree decades of experience. The eight-element safety management modelhas proven effective for all organizational levels—top management throughfirst-level operating teams. It is a model for operational excellence—aproactive, team-based approach for sustaining serious incident free opera-tions.

Managers tend to be energized by a limited number of events—typi-cally, either by a crisis or by proactive recognition of a significant opportu-nity. While a crisis emits alarm signals that cannot be ignored, opportunitiesare not as easy to detect. The objective of this publication is to clearly com-municate the significant opportunity for improvement and to provide a sys-tematic, straightforward approach for development and implementation ofmore effective safety management processes. With the catastrophic conse-quences of serious incidents, initiation of management action is clearlypreferable in the opportunity stage rather than in the crisis stage that ac-companies the occurrence of an incident. For organizations ready to recog-nize and act upon opportunity, the chapters that follow provide a vision androad map for a safer, more prosperous future.

Thomas Burns, PE, CSPSIP Management Systems, Inc. / Quality Safety Edge

PO Box 3743Longview, Texas 75606

(903) 238-9360

x

CH00ppi-x 4/10/02 12:48 PM Page x

Our individual perspectives are shaped by past experiences. Two seri-ous incidents involving fatalities and major property damage occurredduring the early years of my career. These tragedies left me with a clearunderstanding of the need for more effective serious incident preventionprocesses. I’ve also come to understand that much of the work necessaryto sustain incident-free operations is of low visibility—often performed inthe trenches of the organization. It is a paradox that this low-visibilitywork has profound implications for the organization’s highest-priority per-formance indicators, including profitability, customer satisfaction, safety,environmental performance, and public image.

My career with Eastman Chemical Company began in 1969 with anassignment as a process improvement engineer in Eastman’s TexasDivision polyethylene manufacturing facility in Longview. Eastman hadoperated high-pressure polyethylene reactor lines since the mid-1950s.However, as with many chemical plants of that era, the polyethylene plantdid not always run smoothly. Full understanding and control of the manu-facturing process was still evolving at the time I joined the company.

Employees new to the polyethylene facility were often on the listeningend of stories repeated by plant operators. Many stories were of past inci-dents that had potential to be major events, but through a phenomenon

1The ImprovementChallenge

CHAPTER

1

CH01pp001-020 4/10/02 12:49 PM Page 1

known as “Eastman luck” were mitigated without significant consequences.Having heard the stories of past near misses, I immediately thought of thepolyethylene unit when my apartment shook in the early morning ofFebruary 25, 1971. It was the day “Eastman luck” ended. To researchers theevent is now simply a line item on a long list of worldwide vapor cloud ex-plosions in the past half-century:

To those directly involved, the magnitude of this 1971 incident wassobering, and its occurrence, despite the vigilance of a committed manage-ment team, made a lifelong impression. Such events raise doubts abouthuman capabilities to successfully control technology. With improved man-agement processes, however, Eastman’s polyethylene manufacturing unitshave now completed more than a quarter century without a major incident.Rather than “war stories,” new employees now hear success stories of im-provements in product quality, equipment reliability, customer satisfaction,and safety.

After completing three years as a process improvement engineer, Ibegan a supervisory assignment with responsibilities for the polyethylenewarehousing and shipping functions. The assignment served as an intro-duction to the challenges of sustaining manual handling operations in an in-jury-free manner. The experience continually reinforced the inadequacy ofsimply exhorting workers to “be more careful.” I quickly developed andhave continued to maintain a favorable bias towards minimizing hazardsthrough improving the process.

I was later transferred to Eastman’s polypropylene manufacturing facil-ity as manager of the polypropylene processing unit. During this assign-ment, another major incident occurred at the Texas Division site—furtherreinforcing the need for more effective incident prevention processes. Thistime, the incident involved an ethylene release from the ethyl alcohol man-ufacturing unit:

2 � Serious Incident Prevention

25 Feb. 1971 . . . Longview, Texas . . . Polyethylene facility . . . ethylene(450 kg) . . . 0.5 tonnes TNT . . . 10% Yield . . . $17.5M Property Damage(1991 Value) . . . 3 Dead

Leak from 12mm pipe connection to large pipe at 275 Mpa. Three explosions occurred. Second was worse.

Some confinement by barricades and building around alleyway.Explosion felt 9.6 km away.1

CH01pp001-020 4/10/02 12:49 PM Page 2

During my years as safety director, major changes occurred in the chemi-cal industry. The Bhopal, India, incident in 1984 triggered numerous initia-tives, including OSHA special emphasis programs targeted for chemicalfacilities (ultimately leading to the OSHA Process Safety Management stan-dard), the establishment of Chemical Manufacturers Association ResponsibleCare initiatives, and more active EPA involvement in process safety issues.Despite the many opportunities to learn from past incidents and additional reg-ulatory actions, serious injuries continue to occur on a much-too-frequentbasis.

Serious Incidents of the Past

News reports of failures to sustain safe operations have a special impacton individuals with responsibilities for preventing serious incidents.Reactions to the initial reports can vary from disdain to empathy, depend-ing upon the initial details provided.

� After experiencing a major incident resulting in multiple fatalitiesand property damage in excess of $200 million, a facility spokesper-son made the following statement: “It’s been a relatively safe plant.We’ve had numerous safety awards over the years. This is just dev-astating.”3

� A press release following the occurrence of an explosion at anothercompany emphasized that OSHA had conducted seven facility in-spections, all with zero violations, in the months preceding the inci-dent.4

� A report from the National Transportation Safety Board indicatedthat the crash of a commercial plane departing from a Houston air-port was caused by failure to reinstall 47 screws in the plane’s tailsection following maintenance.5 One year later, another flight by theairline required an emergency landing due to excessive vibration.

The Improvement Challenge � 3

15 Oct. 1976 . . . Longview, Texas . . . Ethyl alcohol facility . . . ethylene . . . $26.1M Property Damage (1991 Value) . . . 1 Dead

Failure of mixing nozzle led to jet of ethylene directed into courtyard between control room, process structure and pipe rack. Ignition by heaters45 m away. Control room destroyed. Pipe breakage led to ensuing firedamage.2

CH01pp001-020 4/10/02 12:49 PM Page 3

Investigators found the cause to be another failure to reinstall wingscrews.6

� In Hamlet, North Carolina, 25 people died in a chicken processingplant fire because designated emergency exit doors were locked.7

� In Houston, Texas, an inadequately trained night clerk silenced theswitchboard buzzer indicating the need to activate the hotel’s firealarm system because “the noise annoyed him.” Ten people werekilled and 30 injured in the blaze.8

� In Dallas, Texas, three construction workers died when a crane col-lapsed. At the time of collapse, the workers were positioned along thecrane boom approximately 12 stories above the ground. After re-moving an 80-foot section from the front of the boom, the workersapparently failed to remove the proper number of concrete counter-weights to keep the structure in balance prior to swinging the boom.9

� In a Florida hospital, doctors mistakenly amputated the left leg of adiabetic instead of the right leg as scheduled. With corrective sur-gery, the patient became a double amputee. Eleven days later in thesame hospital, a patient died when a respiratory technician unhookedthe wrong patient.10

� At a major university, 12 students died and dozens of others were in-jured when a massive bonfire of traditional but suspect design col-lapsed during construction.11

Since the mid-1980s, industry and many service organizations havemade great strides in improving performance in key areas including prod-uct quality, customer service, productivity and cost control. Progress hasoften been driven out of necessity to recapture market share and improveprofitability in the face of fierce competition. Performance managementprinciples including teamwork, empowerment, employee participation,measurement, feedback, and positive reinforcement of individuals andteams have been a cornerstone of the improvement process.

Is the progress in preventing serious safety-related incidents consistentwith the breakthrough levels of improvement achieved in other key per-formance areas? Evidence indicates that progress has been less than stellar.For example, a 30-year analysis of 100 large property damage losses oc-curring in the hydrocarbon-chemical industry (Figures 1-1 and 1-2) indi-cates that the frequency of incidents has remained high compared tolong-term historical levels. It is clear that breakthrough levels of improve-ment have not been achieved. Serious incidents have continued to occur andimpact key company performance areas: safety, financial performance, em-ployee relations, customer service, and company image.


CH01pp001-020 4/10/02 12:49 PM Page 4


Distribution of Incidents by 5 Year Intervals

6

9

1917

31

18

0

5

10

15

20

25

30

35

67-71 72-76 77-81 82-86 87-91 92-96

5 Year Interval

Numberof

Incidents

FIGURE 1-1. An analysis of 100 large hydrocarbon-chemical industry propertydamage losses: 1967–1996. From J&H Marsh & McLennan, Inc.12

Total Dollar Losses(1996 Dollars)

$0.39 $0.44

$1.34

$1.04

$2.83

$1.48

$0.00

$0.50

$1.00

$1.50

$2.00

$2.50

$3.00

67-71 72-76 77-81 82-86 87-91 92-96

5 Year Interval

Losses(Billions)

FIGURE 1-2. An analysis of 100 large hydrocarbon-chemical industry propertydamage losses: 1967–1996. From J&H Marsh & McLennan, Inc.13

CH01pp001-020 4/10/02 12:49 PM Page 5

The analysis, involving losses originating primarily from fires and ex-plosions, indicates an average loss of $76 million per incident for propertydamage alone—excluding the costs of business interruption, fines, penal-ties, employee injuries, liability claims and other expenses. Many of the in-cidents resulted in business interruption losses that far exceeded the totalfor property damage, with one single incident resulting in a business inter-ruption loss totaling $700 million.14

Although the analyses in Figures 1-1 and 1-2 are focused on the chem-ical, oil refining, and gas processing industries, the opportunities for im-provement in preventing serious incidents are not limited to any specificindustry or business. For example, as illustrated by Figure 1-3, the rate offatal occupational injures for all private businesses showed little improve-ment during the decade of the 1990s.15 Although OSHA delights in empha-


FIGURE 1-3. Annual number of fatal occupational injuries. Bureau of LaborStatistics16

14.4 14.315.9

14.914.2 14.2 14.4

15.6

17.518.2

02468

101214161820

1991 1992 1993 1994 1995 1996 1997 1998 1999 2000

FIGURE 1-4. Rail yard accident rate per 1 million yard-switching miles 1991–2000.From U.S. Department of Transportation, Federal Railroad Administration17

Fata

l In

juri

es

CH01pp001-020 4/10/02 12:49 PM Page 6

sizing that workplace fatalities are now about 60 percent lower than the14,000 annual fatalities occurring when the agency was enacted in 1971, thetrend of the 1990s clearly indicates that the performance of businesses inpreventing fatalities is stuck on a plateau.


46

4240 40

28

54

34

4042

0

10

20

30

40

50

60

1991 1992 1993 1994 1995 1996 1997 1998 1999

FIGURE 1-5. Large-loss fires that caused $5 million or more in property dam-age, 1991–1999 adjusted to 1990 dollars.18

1%

5%

5%

11%

14%

21%

43%

0% 5% 10% 15% 20% 25% 30% 35% 40% 45%

Sabotage/Arson

Design Error

Natural Hazard

Process Upset

Not Known

Operational Error

Mechanical Failure

PERCENT OF LOSSES

FIGURE 1-6. Causes of hydrocarbon-chemical industry property damage losses:1967–1996. From J&H Marsh & McLennan, Inc.19

CH01pp001-020 4/10/02 12:49 PM Page 7

The rail industry provides another example of where there has been noimprovement, and in fact an increasing rate of fatalities. As illustrated byFigure 1-4, the rate of rail yard accidents, including serious injury and prop-erty damage incidents, has increased from 14.4 accidents per million yard-switching train miles in 1991 to 18.2 accidents in 2000—an increase ofabout 26 percent.

The lack of significant improvements in the prevention of large-loss fires,despite great strides in fire-fighting technology, is yet another example of theneed for improved management processes. Figure 1-5 illustrates that the num-ber of fires causing $5 million or more in property damage has remained rel-atively flat even when adjusted for inflation. Certainly, there is ampleevidence, based on fatality rates, property damage, and other performance in-dicators, that an improved, more effective approach is needed to reduce seri-ous incidents.

Although the “all accidents are preventable” theme is often repeated bymanagers, the degree to which management control can prevent serious in-cidents is a valid question. Are such incidents truly uncontrollable, or dotheir paths typically include opportunities for prevention through proactiveactions?

An evaluation of hydrocarbon-chemical property damage losses20 indi-cates causes that are generally controllable account for about 80 percent ofpast serious incidents (Figures 1-6 and 1-7). These generally controllablecauses include mechanical failure (43 percent), operational error (21 per-cent), process upsets (11 percent), and design error (5 percent). The cate-gories of natural hazards and sabotage, which might be considered


CONTROLLABLE 80%

NOT KNOWN14%

LESSCONTROLLABLE

6%

FIGURE 1-7. Analysis of causes for large hydrocarbon/chemical property dam-age losses 1967–1996.

CH01pp001-020 4/10/02 12:49 PM Page 8

relatively uncontrollable, have accounted for only about 6 percent of past in-cidents. Causes of the remaining incidents included in the study—14 per-cent of the total—are not publicly known.

Certainly, safety professionals and line managers can attest to the factthat most common injuries, including serious injuries, are preventable.Accident investigations continually reinforce that injuries and other inci-dents have preventable causes, with many resulting from failures to adhereto the most basic of accident prevention principles.

Table 1-1 summarizes probable causes of past serious incidents involv-ing various types of facilities and businesses. An analysis of these past in-cidents confirms that in nearly all cases they could have been prevented ortheir consequences minimized through effective implementation of anynumber of actions considered to be fundamental for the type of operation inwhich the incident occurred. For example, preventative actions applicable topast petrochemical incidents include many safety practices fundamental tothat industry—effective maintenance permit systems, piping system isola-tion techniques, lock-out procedures, operator training, preventative main-tenance, inspections, audits, process hazard analyses, checklists, testing ofcritical instrumentation, redundant features in design of equipment, andconducting emergency drills.


CH01pp001-020 4/10/02 12:49 PM Page 9

10

�Serious Incident Prevention

RefineriesCaliforniaUSA1999 (21)

LouisianaUSA1993 (22)

Sodegaura,Japan1992 (23)

TABLE 1-1

Analysis of Serious Incident Causes and Preventative Actions

Location and Year Incident Description Known Consequences Probable Cause Potential Preventative (References) Actions

A fire occurred after naphthawas released from a pipe thatwas being replaced. At the timeof the naphtha release and fire,workers were positioned on scaf-folding with limited means of es-cape.

An intense fire occurred after a6˝ diameter elbow ruptured andreleased hydrocarbons. The sus-tained heat caused other pipes inthe unit to rupture resulting, inadditional fires.

During startup, an exchangerleaked. Explosion occurred asbolts were being tightened tostop the leak.

Fatalities: 1Injuries: 46OSHA fine: $400,000

Property damage: $65 MOperating unit down one year

Property damage:$161 M

Inadequate isolation and depres-surization of pipe containingnaphtha

Piping elbow was made of car-bon steel instead of the chromealloy steel required by the de-sign specifications.

Exchanger not adequately se-cured prior to startup

Effective pipe isolation procedures

Effective management systems formaintenance work:

� Evaluation of hazards

� Increased management over-sight

Improved safety auditing proce-dures

Effective process to ensure instal-lation of piping consistent with de-sign specifications

Effective corrosion/erosion inspec-tion process

Sprinkler systems to minimizespread of fire

Proper securement of vesselProcedure to leak test prior tostartupPrompt shutdown when leak ini-tially discovered

CH01pp001-020 4

/10/02 1

2:49 PM P

age 10

The Im

provement C

hallenge�

11

CaliforniaUSA1992 (24)


TexasUSA1991 (26)

PennsylvaniaUSA1990 (27)


Explosion occurred following 6˝carbon steel elbow rupture andrelease of hydrocarbon & hydro-gen mixture.

During fluidic catalytic cracking(FCC) unit startup, superheated oilwas introduced to vessel thoughtto be empty but which containedwater. A steam explosion occurredrupturing vessel and starting firethat engulfed FCC unit.

A fire occurred in a crude unit dueto seal failure on pump. Beforepump could be shut down and iso-lated, heat of fire resulted in addi-tional releases that spread fire.

During manual draining of waterfrom a debutanizer system in anFCC unit, LPG was suddenly released. The unit operator re-portedly panicked and left theplant without closing the valve.The release continued and a fireand explosion occurred.

During normal operation of anFCC unit, internal corrosion causedfailure of 8˝ carbon steel elbow, re-sulting in release of hydrocarbonsand vapor cloud explosion.

Property damage: $78 M

Fatalities: 6Property damage: $23 MBusiness interruption:$44 MOSHA settlement:$6 M

Property damage: $25 MBusiness interruption:$76 M

Property damage:$26.3 M

Property damage:$254 M5,200 off-site property damageclaims reported

Erosion/corrosion in elbow

Drain valve at bottom of vesselimproperly closed during shut-down, allowing water to un-knowingly accumulate.

Pump seal failureLack of prompt shutdown andisolation

Inadequate drain system design

Localized internal corrosion

Effective corrosion/erosion inspec-tion program

Effective checklist for shutdownand startup of FCC unitPolicy limiting valve operation todesignated personnelOperator & maintenance personneltraining

Double-seal pumpsHeat-activated and/or remote-oper-ated pump shutdown and valveisolation

Double block & bleed drain sys-tem design to limit flow potentialCapability for activation of valvefrom remote locationMonitoring system for detection ofwater level in vesselOperator training

More effective internal corrosiondetection program

CH01pp001-020 4

/10/02 1

2:49 PM P

age 11

12


IllinoisUSA1984 (29, 30)

Chemical FacilitiesNevadaUSA1998 (31)


An operator was in the process ofclosing a valve to isolate a leakfrom a 6˝ horizontal crack at weldon a column. The crack spread to24˝, and the column experiencedtotal failure. Propane released at200 psig propelled most of the20-ton vessel 3,500´, where ittoppled a 138KV power transmis-sion tower. An explosion andmajor fire resulted.

Two explosions in rapid successionoccurred at a facility manufactur-ing explosive boosters for the min-ing industry. The explosions wereinitiated when a mixing blade wasleft embedded overnight in basemix for the explosive boosters in alarge mixing pot. The solidifiedexplosives in the pot detonatedwhen the mixer blade was reacti-vated the next morning.

A laminated shell reactor in aurea manufacturing unit explodedafter an improperly weldedbracket resulted in a carbonateleak and corrosion of the outercontainment vessel. Reportedly,

Fatalities: 17Lost workday injuries: 14Property damage:$191 M

Fatalities: 4Injuries: 6Property damage: Plant de-stroyed


OSHA cited a failure to applyrecognized welding procedures inprevious repair of the vessel.Deficiencies included lack ofpost-weld treatment and inade-quate inspection practices.

Inadequate process hazard analysisInadequate training programsInadequate operating proceduresInsufficient separation distancesbetween operationsInadequate inspection and audit-ing program

Improper weldInadequate monitoring of weepholes for early detection of leak-age

Process to ensure proper repair ofpressure vessels including proce-dures, training, and controls. Effective process to detect corro-sion and other deterioration ofprocess vessels.

More comprehensive process haz-ards analysisWritten operating procedures spe-cific to processEffective communicationsExplosives training and safety pro-gramsManagement-of-change ProcessPeriodic assessments and auditsIncreased separation between fa-cilities

More effective welding inspec-tion/quality assurance programMore effective process for periodi-cally monitoring and reporting sta-tus of weep holes


CH01pp001-020 4

/10/02 1

2:49 PM P

age 12

The Im

provement C

hallenge�

13

TexasUSA1989 (33-35)

TexasUSA1990 (36, 37)

the leak went undetected for sometime because weep holes designedto detect leakage through the lam-inated reactor layers were not ade-quately checked on routine basis.

During a maintenance shutdown,a large flow of ethylene was re-leased from a high-density poly-ethylene reactor. An explosionoccurred that destroyed two pro-duction units and causedBLEVEs of nearby tanks. Releaseoccurred through an 8” valve thatshould have remained locked outin inoperable position for dura-tion of shutdown.

An explosion and fire originatedin a 900K gallon wastewater tankduring reinstallation of a com-pressor used to remove hydrocar-bon vapors from the tank. Anoxygen analyzer falsely indicatedlow oxygen and caused the con-trol system to reduce nitrogenflow. The lower rate of nitrogenflow was insufficient to preventformation of a flammable mixturein the tank’s vapor space. Theflammable mixture is believed tohave ignited with startup of thecompressor.

Fatalities: 23Property damage:$675 MBusiness interruption: $700 MOSHA settlement: $4 MApproximately 1,000 legalclaims reportedly filed.

Fatalities: 17Property damage:$12 MBusiness interruption:$200 M

Valve mistakenly opened, whichdumped reactor contents

The failure of an oxygen analyzerthat inaccurately indicated lowoxygen and inadequate redun-dancy in the nitrogen control system.

More effective process for valvelockout and isolation of lines &vessels.More effective compliance auditsystemAdditional training of operatingand maintenance personnel, in-cluding contractors

Provide redundancy for oxygenanalyzers and other critical instru-mentationModify nitrogen control to ensureadequate nitrogen at all timesEliminate need for compressorAdditional training for operatingand technical personnelImproved calibration and testprocess for critical instrumentation

CH01pp001-020 4

/10/02 1

2:49 PM P

age 13

14


Hydrocarbon StorageTerminalsTexasUSA1985 (38)

PennsylvaniaUSA1988 (39)

TexasUSA1992 (40, 41)

A contractor accidentally cut intoa 10˝ propane line at a storageterminal. Flammables from 5 un-derground storage caverns werereleased, and a large vapor cloudformed and exploded.

An estimated 3.9M gallons ofdiesel fuel spilled when a 40-year-old 120´ diameter tank thathad recently been reassembledsuddenly ruptured during its ini-tial filling. Approximately 750Kgallons washed over dikes intothe Monongahela River.

A release of hydrocarbons oc-curred due to an overfill of a saltdome storage cavern. A largevapor cloud and explosion re-sulted.

Property damage:$43 M

Specific loss estimate not avail-able. Fees for cleanup and legalclaims were substantial.

Fatalities: 3 (off-site)Property damage: $9 MFacility operating permit re-vokedCivil jury judgment:$143 M

Cutting into line that containedpressure

Failure of tankFailure to use the most stringentstandard hydrostatic test practicesprior to filling with diesel (testedby filling only 5´ of tank withwater instead of entire tank)

Failure of system designed to au-tomatically close valves on cav-ern wellhead in event of overfill. The telemetry system monitor atremote control center displayeddata in a format difficult toquickly interpret.

More effective permit system formaintenance activitiesProcess to positively identifylines/equipment prior to start ofworkRemote-operated emergency shut-off valves on wellheads.

More effective prestartup inspec-tion and test practices for tanksAdequate diking

Accurate process for monitoringcavern inventory levelPeriodic testing of shutdown de-vicesAn effective audit and inspectionprocessImproved telemetry formatting ofcritical data


CH01pp001-020 4

/10/02 1

2:49 PM P

age 14

The Im

provement C

hallenge�

15

Gas Processing PlantsMexico1996 (42)

Bontang, Indonesia1983 (43)

OtherNorth CarolinaUSA1991 (44)

After changing a leaking seal onan LPG pump, plant personnelwere in the process of tightening aflange after removing an isolationblind on the pump’s suction line.LPG product began leaking fromthe flange and formed a vaporcloud that resulted in a series ofexplosions. Investigation indi-cated a motor-operated isolationvalve in the suction line was openinstead of closed, allowing LPGto reach the unsecured flange.

A heat exchanger in a liquefiednatural gas plant ruptured vio-lently due to overpressure.Investigation indicated a closedvalve on a 24-inch blowdown lineprevented both the safety reliefvalves and a pressure controllerfrom performing their function.

Chicken processing facility em-ployees attempted to evacuateafter a fire began in the plant’sdeep-fat fryer operation.Evacuating employees foundmany exits either locked orblocked.


Property damage: $50 M

Fatalities: 25OSHA fine: $810,000Plant owner sentenced to 20-year prison term

Isolation valve opened prema-turely

Closed valve prevented reliefvalves and pressure controllerfrom functioning.

Locked and blocked exitsLeak from hydraulic lines

More effective process for valvelockout and isolation of lines andequipment

More effective system for manag-ing block valves in pressure relieflinesMore effective procedures andchecklists for startup of operations

Evacuation planEmployee training Emergency drillsInspections to ensure open and un-blocked exitsProcess hazard analysis of hy-draulic system

CH01pp001-020 4

/10/02 1

2:49 PM P

age 15

16


TexasUSA1991 (45)

AlaskaUSA1994 (46)

OhioUSA1990 (47)

A commuter plane went into a se-vere nosedive and crashed when ade-icer boot on the tail sectionapparently came loose duringflight. Company officials con-firmed that 43 screws were re-moved from the tail sectionduring maintenance and were notreinstalled, due to an oversight.

A 987-foot tanker ran aground ona reef spilling 11M gallons ofcrude oil from the tanker’s rup-tured hull. Implementation of ef-fective cleanup efforts was slowto develop, and approximately1,200 miles of coastline were ulti-mately affected.

At a resin manufacturing plant, opera-tors were cleaning a reactor betweenbatches of resin. Solvent was pumpedinto the bottom of the reactor as partof the cleaning process. The residualheat caused the solvent to vaporizeand over-pressure the reactor. Hot va-pors were released through the reactorrupture disc and formed a vapor

Fatalities: 14Loss of plane

Punitive damages:$5 billion (ordered September 1994)Paid to Alaska fishermen forimmediate losses: $287 MSettlement on criminal chargesfiled by state and federal gov-ernment: $1.02 billionPaid for cleanup:$2.1 Billion

Property damage: $23 MOther losses not known.

Screws missing from tail section

Multiple causes including:Tanker allowed to veer off courseLow level of emergency pre-paredness:a) response barge too small andinadequately equipped with ade-quate length of boomb) response team inadequatelytrained

Flammable solvent introducedinto hot reactor

Effective maintenance procedures,including inspection processMore effective accountability sys-tem for parts and fasteners re-movedTraining of maintenance personnel

Establish effective policy for othervessels to escort tankersImprove emergency plan, conductdrills and audit preparednessProvide adequate emergency re-sponse equipment. Ensure effectiveness of alcohol/drugtesting program

Procedure to cool reactor prior tointroduction of solventSubstitution of less flammable sol-vent (or elimination of need forsolvent)Improved vent system to eliminatepotential vapor accumulation inbuilding.


CH01pp001-020 4

/10/02 1

2:49 PM P

age 16

The Im

provement C

hallenge�

17

FloridaUSA1995 (48)

cloud in the reactor building. Thecloud contacted an ignition sourceand an explosion occurred.

During surgery to amputate oneleg of a diabetic, doctors mistak-enly removed the left leg insteadof the right. Correction left thepatient a double amputee.

Unnecessary amputation anddeathLiability claimsDamage to reputation and image

Failure of hospital quality assur-ance process

Develop and implement an effec-tive patient accountability andquality assurance process

CH01pp001-020 4

/10/02 1

2:49 PM P

age 17

The analysis of past serious incidents supports the contention of authorand petrochemical process safety expert Trevor Kletz, who states:

It might seem to an outsider that industrial accidents occur because we donot know how to prevent them. In fact, they occur because we do not usethe knowledge that is available.49

References1. J. A. Davenport and E.M. Lenoir, “A Survey of Vapor Cloud Explosions,

Second Update,” Proceedings of the 26th Annual Loss Prevention Symposium,American Institute of Chemical Engineers (1992): 13–15.

2. Ibid.3. D. Jackson, “Pampa Plant Deciding When and Whether It Will Reopen,”

Dallas Morning News, 16 November 1987, 1A, 4A.4. G. Morris, “New Details Emerge as Carbide Fights OSHA Fine,” Chemical

Week, 15 January 1992, 16. 5. “Missing Screws Caused ‘91 Commuter Plane Crash, NTSB Says,” Dallas

Morning News, 22 July 1992.6. “Missing Wing Screws Cited in Aborted Flight,” Dallas Morning News, 23

December 1992, 1A, 30A.7. “Report on Fire at NC Food Plant Sent to Prosecutor,” Dallas Morning News,

7 September 1991, 3A.8. M. Reeves, “Clerk Turned Off Alarm, Official Says,” Dallas Morning News, 7

March 1982, 1A, 7A.9. T. J. Meyer, “Crane Collapse Kills 3, Hurts 1,” Dallas Morning News, 26 April

1987, 1A, 28A.10. D. Sharp, “Errors Renew the Call for Doctor Review,” USA Today, 27 March

1995, 1.11. H. Petroski, “Vanities of the Bonfire,” Professional Safety, July 2001, 20–24.12. D. G. Mahoney, ed., Large Property Damage Losses in the Hydrocarbon-

Chemical Industries, A Thirty-Year Review, 17th ed. (Risk Control Consulting,a division of J&H Marsh & McLennan Inc., formerly M&M ProtectionConsultants: 1997), 1–46.

13. Ibid.14. Ibid.15. Bureau of Labor Statistics, Census of Fatal Occupational Injuries, Industry by

Year, 1992–1999.16. Ibid.17. U.S. Department of Transportation, Federal Railroad Administration, Rail Yard

Accident Rate per 1 Million Switching Miles, 2000.


CH01pp001-020 4/10/02 12:49 PM Page 18

18. S. G. Badger and T. Johnson, “1999 Large-Loss Fires and Explosions,” NFPAJournal, November/December 2000, 80.

19. Mahoney, ed., “Large Property Damage Losses.”20. Ibid.21. Chemical Safety and Hazard Investigation Board, Federal Investigation of

Tosco Refinery Fire Finds Flawed Management Supervision, 28 March 2001.22. Mahoney, ed., “Large Property Damage Losses.”23. Ibid.24. Ibid.25. Ibid.26. Ibid.27. Ibid.28. Ibid.29. Ibid.30. United States of America Occupational Safety and Health Review

Commission, Notice of Decision in Reference to Union Oil Company ofCalifornia, Chicago Refinery, 29 December 1987.

31. Chemical Safety and Hazard Investigation Board, Investigation Report,Explosives Manufacturing Incident, Sierra Chemical Company, 2001.

32. Mahoney, ed., “Large Property Damage Losses.”33. Ibid.34. Phillips Petroleum Company, Phillips 66 Company’s Response to OSHA

Citations, 9 May 1990, 1–10.35. “15 People are Awarded $730,500 in Phillips Explosion Settlement,” Dallas

Morning News, 24 November 1993.36. Mahoney, ed., “Large Property Damage Losses.”37. ARCO Chemical Company, A Briefing on the ARCO Chemical Channelview

Plant July 5, 1990 Accident, January 1991.38. Mahoney, ed., “Large Property Damage Losses.”39. J. Prokop, “The Ashland Tank Collapse,” Hydrocarbon Processing, May 1988,

105–108.40. National Transportation Safety Board, Pipeline Accident Report, Highly

Volatile Liquids Release from Underground Storage Cavern and Explosion.Mapco Natural Gas Liquids Inc. Brenham, Texas, April 7, 1992, Notation5779B, Washington D.C., 4 November 1993.

41. “Reopening of Salt Dome Storage Facility Blocked,” Dallas Morning News, 14June 1994.

42. Mahoney, ed., “Large Property Damage Losses.”43. Ibid.44. “Report on Fire at NC Food Plant Sent to Prosecutor,” Dallas Morning News,

7 September 1991, 3A.45. “Missing Screws Caused ‘91 Commuter Plane Crash, NTSB Says,” Dallas

Morning News, 22 July 1992.46. G. Jones, “Exxon Trial Set to Open,” Dallas Morning News, 1 May 1994, 1A,

20A.


CH01pp001-020 4/10/02 12:49 PM Page 19

47. Mahoney, ed., “Large Property Damage Losses.”48. D. Sharp, “Errors Renew the Call for Doctor Review,” USA Today, 27 March

1995, 1.49. T. A. Kletz, Lessons from Disaster: How Organizations Have No Memory and

Accidents Recur (Houston: Gulf Publishing, 1993), 1.


CH01pp001-020 4/10/02 12:49 PM Page 20

Sustaining serious incident-free operation for the long-term hasproven to be elusive for many companies. Given that most incidents couldhave been prevented through the use of fundamental safe practices, whyhave companies not been more successful in preventing serious incidents?

It is apparent that numerous barriers exist in sustaining incident freeoperations—barriers that many organizations have been unable to over-come. Maintaining the constancy of purpose needed has proven difficult.Ever-shifting forces continually shape organizational priorities and theprocess for allocating resources. These forces often favor highly visibleprojects with a payback perceived to be quick, rather than less-visible ini-tiatives designed to ensure continuing financial success through the pre-vention of high-consequence accidents that are often perceived to be lowprobability events. As a result of the focus on shorter-term interests, thepriority and resources for work required to prevent serious incidents mayover time be relegated to a level where excellence is difficult to sustain.

Organizational barriers that inhibit serious incident prevention include:

� A focus on today’s problems

� Limited employee involvement

� Inadequate measurement and feedback

2The Barriers toImprovement

CHAPTER

21

CH02pp021-028 4/10/02 12:49 PM Page 21

� Inadequate recognition

� Limited line organization ownership

� Limited personal experience

� Misguided optimism

A Focus on Today’s Problems

Managers and other personnel tend to allocate time and resources to ac-tivities that relieve current pressures. The importance of serious incidentprevention is generally recognized, but the work necessary to ensure a safeworkplace is sustained may often be treated as deferrable. Unless an inci-dent actually occurs, failure to properly execute incident prevention workmay result in no undesirable consequences for personnel responsible for thework. Unfortunately, accountability actions implemented after the occur-rence of a catastrophic incident do not reverse the damage done.

By viewing the critical work as deferrable, managers fail to embracewhat author Stephen R. Covey refers to as the “Law of the Farm”:

Procrastinating and cramming don’t work on the farm. The cows must bemilked daily. Other things must be done in season, according to natural cy-cles. Natural consequences must follow violations, in spite of good inten-tions. We’re subject to natural laws and governing principles—the laws ofthe farm and harvest. The only thing that endures over time is the law of thefarm. According to natural laws and principles, I must prepare the ground,put in the seed, cultivate, weed, and water if I expect to reap a harvest.1

A manager’s daily schedule tends to fill with meetings, report dead-lines, and responses to requests from superiors. Many managers simply donot consistently take the actions needed to adequately support the incidentprevention process. Too often, managers find themselves majoring in re-sponses to events that appear pressing but which make no significant con-tribution toward success of the organization’s mission. To sustain long-termsuccess in the prevention of incidents, managers must assure that the allo-cation of their time is properly aligned with safe workplace objectives.

Limited Employee Involvement

Identifying the critical work required to succeed in any key perform-ance area is best accomplished through input from personnel responsible


CH02pp021-028 4/10/02 12:49 PM Page 22

for achieving results. Organizations typically recognize employee involve-ment as a prerequisite for improvements in performance areas such as prod-uct quality, productivity, cost control, customer service, and injuryprevention. However, the same organizations may attempt to address theprevention of high-consequence incidents with a top-down, regulatory-driven approach. Such an approach fails to achieve ownership at the impor-tant point-of-control operating level. Restricting employee involvementmay also result in failure to include preventative actions known to be criti-cal only by point-of-control personnel.

Failure to actively involve employees is a barrier to achieving a com-mon understanding throughout the organization of “how, when, and why”work critical to sustaining safe operations must be done. Without a commonunderstanding of performance expectations or the relevance of the work,failure is a predictable outcome.

Inadequate Measurement and Feedback

Teams are more likely to achieve and sustain excellent results when per-formance is measured and feedback is provided. Experience has validatedthe accuracy of the old adage, “What gets measured gets done.” However,in many organizations, measurement and feedback systems regarding thestatus of work necessary to sustain incident-free operations are often inad-equate. As a result, operating personnel, management, and others with aneed to know are not sufficiently informed and are therefore not in positionto manage effectively.

Most organizations maintain a strong focus on minimizing the fre-quency of OSHA recordable injuries. As part of an organization’s processfor preventing recordable injuries, observations of work practices and thedocumentation of minor injuries serve as ongoing reminders of the poten-tial for experiencing injuries. These actions also provide ongoing feedbackof effectiveness for the injury prevention process. In the process to preventserious incidents, however, measurement and feedback systems are oftennot as formally established for upstream indicators of potential problems.For managers who typically “manage by exception,” such lack of informa-tion about potential problems can create an unjustified overconfidence in anorganization’s serious incident prevention efforts.

Without knowing the status of critical work, management options to in-fluence serious incident prevention become limited—typically to generalexhortations regarding the importance of safe work. You know them well—“Safety is Number 1—Let’s make all production safe production”—andsimilar slogans. Such communications, when not supported by adequate

The Barriers to Improvement � 23

CH02pp021-028 4/10/02 12:49 PM Page 23

knowledge and allocation of resources, are analogous to Covey’s descrip-tion of a gardener exhorting a flower to “Grow! Grow!” while limiting thewater and fertilizer to other plants in the garden.2

Inadequate Recognition

Individuals tend to place priority on activities that generate potential forfavorable personal recognition. Recognition perceived as certain to occurfollowing satisfactory performance is particularly powerful in driving de-sired actions and results. Clearly, effective reinforcement is not possiblewithout timely knowledge of performance. Furthermore, in the absence ofmeaningful recognition, it is unreasonable to expect individuals to sustainexcellence for the long-term.

Without accurate feedback, managers may unknowingly undercut theserious incident prevention process by reinforcing results accomplishedthrough eliminating, short-cutting, or deferring safe work practices. A man-ager may favorably recognize personnel for their efforts to minimize thetime required to complete a maintenance shutdown when the manager doesnot know that recognized safe practices were violated to save time.Misguided reinforcement, made in the absence of an accurate feedback sys-tem, can lead to a culture where performance of the work to prevent inci-dents is considered optional rather than an organizational value that cannotbe compromised.

Management bonus plans based upon organizational performance havebeen a part of corporate culture for many years. The expansion of bonusplans to lower levels of the organization and increasing percentages of com-pensation tied to such plans is a growing trend. In some organizations, thebase compensation for both managers and nonmanagers is reduced andplaced “at risk,” with receipt contingent upon organizational performance.Typically such plans provide a range of possible outcomes—ranging fromloss of all “at risk” compensation for poor results to receipt of several timesthe “at risk” amount for outstanding results.

The impact of bonus plans on decisions and other behaviors serves as atestimony to the power of reinforcement. The designated measures that de-termine the size of the bonus become the focus of attention. When signifi-cant compensation is at stake, managers can be tempted to take actions thatmay increase this year’s bonus, even though such actions may not be pru-dent from a long-term perspective. When production volume or reductionsin maintenance cost are a significant part of the measurement used for thebonus calculation, for example, managers may tend to defer needed main-tenance and may be tempted to push production rates too far.


CH02pp021-028 4/10/02 12:49 PM Page 24

Management at all levels must continuously be aware of the potentialfor imprudent actions initiated to help ensure a high bonus plan payout.Despite pressures that may be created by bonus plans, managers must con-tinuously look at the big picture and maintain a long-term perspective.Managers should be diligent in communicating the importance of seriousincident prevention throughout the organization, and personal actions mustbe congruent with the message communicated.

Limited Line Organization Ownership

It’s well recognized that achieving and maintaining outstanding safetyperformance is dependent upon line organization ownership. Acceptance bythe line organization as full owner of the serious incident prevention processmay be complicated by several factors including: (1) lack of line organiza-tion involvement in developing the process, and (2) dependence upon staffgroups and contractors to conduct a significant portion of the critical work.Contractors or internal staff groups, for example, may be utilized for spe-cialized work, such as equipment inspections, instrument calibrations, cor-rosion monitoring, and relief valve tests.

When these conditions exist, line organizations may take a passive, par-tial ownership position rather than assuming a broader, more active role.When ownership is passive, members of the line organization team maylack the motivation to implement prompt corrective action when needed.When the staff group responsible for inspecting and testing the thickness ofpipes and vessels falls behind schedule, only active, committed owners willtake the initiative to resolve the problem. Rather than feeling a sense of ur-gency to take action, passive owners look at such situations as someoneelse’s problem to solve. When execution of critical work is dependent uponother groups, active intervention by the line organization may often be re-quired to ensure the work is satisfactorily performed.

Limited Personal Experience

An individual’s priorities are heavily shaped by past experiences.Managers often obtain experience relatively quickly in areas of responsibil-ity such as product quality, customer service, and prevention of common in-juries. Incidents affecting these areas tend to be frequent enough tointroduce even relatively new managers to the consequences that occurwhen deficiencies are allowed to exist. However, the same managers mayhave no direct experience with serious incidents due to their inherent low


CH02pp021-028 4/10/02 12:49 PM Page 25

frequency of occurrence. Without having experienced the consequences,managers may not have the foresight and self-motivation to maintain thedisciplined approach required for sustaining serious incident-free opera-tions. When addressing the potential for serious incidents, these managersmay express limited concern because such an incident “has never happenedduring my career.”

Misguided Optimism

Many managers share a belief in the power of positive thinking. Forsome, such beliefs include a fear that acknowledgment of risks or other ex-pressions of concern may result in an undesirable self-fulfilled prophecy, orat the minimum be perceived by superiors as weak leadership.

In these organizations a condition known as “groupthink” may developwhere members of the group relinquish individual opinions to avoid beingperceived as nonsupportive of the group. In such groups there is little roomfor critical questions or dialogue regarding alternate approaches. Whengroupthink is at work, there is a strong atmosphere to conform, dissensionis unwelcome, and individual censorship is prevalent. Individuals in thegroup develop a belief that they couldn’t possibly be intelligent enough toquestion the group’s plans. It’s not surprising that in such environments, thego-ahead is often given to plans that have little chance for success—newproducts with no realistic chance for survival are launched, solutions not re-lated to root causes are embraced, and the safety risks of operations are notopenly addressed.3

Vernon L. Grose, a pioneer in the application of systems methodologyfor controlling risks, once stated:

“Risk, for those committed to benefit, is like a bad dream. Aspiring tomanage risks is like a wartime Marine volunteer hoping to become a sup-ply depot sentry. It has the glamour, promotion potential, and excitementof a yawn.”4

Unfortunately, Grose’s description may be accurate within many organ-izations. In these organizations, serious incident prevention has not yet beenestablished as a true organizational priority, and little recognition exists foridentifying and executing the work critical to its success. The straight-aheadapproach with minimal thought to “what can go wrong” may serve man-agers well when discharging some responsibilities. However, managersmust recognize that, with the catastrophic consequences of a serious inci-dent, optimism must be tempered with a full understanding of the risks and


CH02pp021-028 4/10/02 12:49 PM Page 26

a systematic process for ensuring unacceptable risks are controlled. Evencaptains of “unsinkable” ships need to consider the icebergs.

Overcoming the Barriers

Maintaining the conditions necessary to sustain serious-incident-freeoperations may be either driven or restrained by various organizationalforces. One approach to achieving any objective, including safe operations,is to overwhelm it with the resources needed to drive improvement. Certainlycommand-and-control organizations are dependent upon the application ofsuch resources in sufficient quantity and depth if they are to succeed.

A second, more cost-effective strategy is to complement driving forceswith actions that lower the intensity of restraining forces within the organi-zation. Actions should be taken to identify barriers that are roadblocks tosuccess, and to initiate appropriate actions that remove or lower the barri-ers. For a major construction project, examples of driving forces to help en-sure safe work could include actions such as mandating safe work as a


RESTRAINING FORCES

SERIOUS INCIDENT PREVENTION

Conflicting PrioritiesKnowledge GapsResource LimitationsOverconfidenceLack of Accountability

CommunicationsPolicies & ProceduresEmployee InvolvementMeasurement &

FeedbackTrainingHazard IdentificationAuditsRecognition

DRIVING FORCES

FIGURE 2-1. A force field diagram for sustaining serious-incident-free operations.

SERIOUS INCIDENT PREVENTION

CH02pp021-028 4/10/02 12:49 PM Page 27

condition of employment, developing procedures, conducting inspections,and applying disciplinary actions. All of these are important actions, butsafety performance can be further enhanced through actions that reduceemployee and management resistance. Ensuring employee participation inthe job planning process, use of safety teams, and other actions to increaseinvolvement, understanding, and ownership are examples of actions that re-duce restraining forces.

A force-field diagram, Figure 2-1, illustrates the relationship betweendriving and restraining forces and their importance in maintaining perform-ance at a high level. One approach to raising the safety performance bar isto increase the intensity and number of driving forces. For example, an or-ganization may enhance the depth or frequency of audits. A second, com-plementary approach involves taking actions to reduce the impact ofrestraining forces such as knowledge gaps and lack of accountability.

In practice, many driving forces also serve to improve conditions thatrestrain performance. Employee involvement and training, for example, re-duce performance restraints arising from limited ownership and lack ofknowledge. Other forces intended to drive improvement have limited im-pact on restraining forces and may have very limited driving power as well.Examples of driving forces that typically have very limited impact includemanagement exhortations, posters, and slogans. A process that strives tomaximize driving forces while ignoring the need to reduce restrainingforces will consume a substantial level of management’s energy. Withtoday’s lean organizations, it’s doubtful that long-term success could be sus-tained with such an unbalanced, resource-intensive approach.

History confirms that breakthrough achievements usually do not occurtotally by chance. Even accomplishments that initially merit classificationas a “miracle” are usually found upon further research to have been given aplanned birth. So it is with achieving breakthrough improvements in sus-taining safe operations—commitment and proactive actions are required.The barriers may be formidable, and overcoming them will require an ef-fective process—one that not only drives improvements but that also mini-mizes restraining forces within the organization.

References1. S. R. Covey, Principle-Centered Leadership (New York: Simon & Schuster,

1992), 161, 195. Excerpt used with permission. All rights reserved.2. Ibid.3. D. Gano, Apollo Root Cause Analysis (Yakima, Wash.: Apollonian

Publications, 1999), 147.4. V. L. Grose, Managing Risk—Systematic Loss Prevention for Executives

(Englewood Cliffs, N.J.: Prentice Hall, 1987), 26.


CH02pp021-028 4/10/02 12:49 PM Page 28

In my career as a manager, nothing was more personally disappoint-ing than an injury to a team member. (My active involvement in promot-ing safety as a line manager ultimately led to my reassignment as safetydirector.) For many years, my efforts resulted in rather marginal improve-ments in safety performance despite a strong commitment to the achieve-ment of a safe workplace. The inability to achieve and sustainbreakthrough levels of improvement became a source of frustration.

Finally, in the mid-1980s a change from the traditional safety man-agement process to a performance-management-based, behavioral ap-proach was initiated with employees taking a leadership role. The changeto a behavioral approach proved to be a milestone event that led to break-through improvements. The behavioral safety process remains in effecttoday and has been the catalyst for reducing injuries in many areas of thecompany by more than 80 percent.

While eliminating workplace injuries is a part of a manager’s safetyresponsibilities, there are other requirements that are also critical to suc-cess. In addition to preventing injuries, managers must be responsible forthe safety of the process, i.e., preventing property and equipment damage,production downtime, hazardous material spills, and similar incidents.Ensuring regulatory compliance and workplace security are other key per-formance expectations.

3A Proven ProcessImprovement Model

CHAPTER

29

CH03pp029-036 4/10/02 12:49 PM Page 29

While companies often cite their favorable OSHA injury statistics asevidence that the entire safety process is being well managed, a closeranalysis indicates this approach can lead to a false sense of well-being. Inreality, there is often limited correlation between an organization’s injuryfrequency and the fitness of the safety process that is in place for managingother responsibilities such as process safety and regulatory compliance.While there is some overlap, many differences exist in the work required foran organization’s success in each of its important safety performance areas,as illustrated by Figure 3-1. Certainly, the fact that an organization is doinga good job in eliminating slips, trips, and falls does not necessarily meanthat the organization’s process for eliminating the potential for hazardousmaterial releases is effective. These are separate processes, each with itsown set of critical work that must be diligently executed for success.

In addition to achieving breakthrough reductions in workplace injuriesthrough behavioral-safety initiatives, performance management techniqueshave also proven effective in achieving major improvements in other areasof safety. For example, implementation of these techniques has led to majorreductions in accidental releases of chemicals, hazardous material trans-portation incidents, and regulatory agency violations. Through actions suchas measurement of upstream performance indicators, performance feed-back, and positive reinforcement, workplace safety in all critical areas hasbeen greatly improved.


Regulatory Compliance

Injury Prevention Process Safety

Tasks for Meeting Other Safety Objectives

FIGURE 3-1. Universe of tasks required to fully achieve safety performanceexpectations.

Regulatory Compliance

Tasks for Meeting other Safety Objectives

CH03pp029-036 4/10/02 12:49 PM Page 30

With the presence of conflicting priorities and other organizational bar-riers, a proactive, disciplined approach is required to sustain serious-inci-dent-free operations. An effective management system is needed to helpshape a new mindset—one recognizing that incident prevention is muchmore than simply maintaining a high level of awareness. Successful inci-dent prevention requires an understanding of risks specific to the organiza-tion and the execution of critical work to minimize the risks.

Performance management principles have been effectively applied inmany organizations to improve key results. The quality management focuswithin these organizations has typically been on visible opportunities forimproving the current year’s bottom line. Opportunities to improve per-formance in high visibility areas, such as product quality, cost control, andcustomer service, have been abundant. Many companies have also appliedperformance management techniques, typically in the form of behavioral-safety initiatives, to achieve breakthrough improvements in injury rates.

With the quality revolution still in its infancy—or perhaps in its adoles-cent stage—applications of performance management principles to less vis-ible opportunities, such as sustaining serious incident-free operations, arenot as firmly established. However, it’s clear that these proven managementprinciples have great potential for driving breakthrough performance im-provements in the prevention of serious incidents—an opportunity waiting tobe seized by proactive managers interested in making a true difference.

Quality management process models typically have some differences inemphasis—often traceable to the quality gurus utilized by various compa-nies. However, at their core, successful improvement models typically havemany elements in common. The safety management process reviewed in thechapters that follow is a proven approach for preventing serious incidentswith its core elements rooted in proven performance managementprocesses. These core elements critical to successful safety managementprocesses include:

1. A high level of management leadership.

2. Active employee participation in leadership roles.

3. A firm understanding of what must be managed for successfulachievement of safety and other organizational objectives.

4. An accurate identification of the critical work that, when executed,will provide the conditions and practices necessary to achieve andsustain a safe workplace.

5. A common understanding of performance expectations.

6. Effective measurement and timely feedback of performance in meet-ing objectives.

A Proven Process Improvement Model � 31

CH03pp029-036 4/10/02 12:49 PM Page 31

7. Effective reinforcement processes to help individuals and teams feelgenuinely appreciated for their actions to meet or exceed perform-ance expectations.

8. Application of a “Plan-Do-Check-Act” improvement process to en-sure plans are implemented, performance monitored, and adjust-ments made as necessary to achieve desired results. Full applicationof the “Plan-Do-Check-Act” cycle (illustrated in Figure 3-2), alsoknown as the Deming improvement cycle, helps minimize the mor-tality rate for new improvement initiatives.1

Process Model For Serious IncidentPrevention

On a global basis, progress appears relatively limited in the full applica-tion of performance management principles for ensuring the work requiredfor serious incident prevention is sustained at high performance levels. Aprocess model is needed that merges proven performance management tech-niques with sound risk-management practices. The following eight elementsare essential for inclusion in an effective process for maintaining workplaceconditions necessary to sustain serious-incident-free operations.

Element 1: Management Commitment and Leadership

Management commitment and leadership is critical to overcoming thebarriers for success and for maintaining the serious incident prevention


FIGURE 3-2. The “Plan-Do-Check-Act” continuous improvement cycle.

CH03pp029-036 4/10/02 12:49 PM Page 32

process as a top priority throughout the organization. Ideally, the develop-ment and implementation of improved safety management processes shouldbe driven by top management. Top management leadership helps assure thatsufficient resources are available for implementation and thus increases theprobability of favorable recognition for performing the required work.

Nevertheless, lack of a clear upper management mandate to implementan improved incident prevention process should not be an insurmountablebarrier for the supervisor who desires improvement. In fact, it is relativelycommon in companies of all types and sizes to find organizational unitswithin the company that are “islands of excellence.” In these units, the lead-ership and commitment of the supervisor is at such a level that achievementof outstanding results is not dependent upon the boss’s strong, visible sup-port. These managers find a way to implement an improved safety process,because it is simply “the right thing to do.” Supervisors and managers ateach level of the organization need to recognize that they are considered“top management” by their subordinates, and each level of managementmust assume a strong leadership role.

Application of the serious incident prevention process model ensuresthat management’s investment of time and resources will yield the desiredresults.

Element 2: Involve EmployeesFull employee involvement is essential to leveraging the organization’s

limited resources, capturing vital employee knowledge, and facilitating em-ployee ownership of the process. The full benefits of employee involvementare achieved only when employees have leadership roles in all aspects of de-veloping, implementing, maintaining, and improving the serious incidentprevention process.

The process model provides effective techniques for leveraging thepower of employee involvement in accomplishing the work required to pre-vent serious incidents.

Element 3: Understand the RisksSuccess in any endeavor requires knowledge of potential risks. Without

a firm understanding of the risks, pitfalls are identified only after theyoccur, a “fly-crash-fix-fly” cycle.

With the nonroutine nature of serious incidents, the focus must be onwhat can happen rather than what has happened in the past. The argumentthat a unit has been operating 10 to 20 years without problems must begranted only limited consideration in evaluating the potential for a future in-cident. Past incidents involving Flixboro, Bhopal, and the Exxon Valdez


CH03pp029-036 4/10/02 12:49 PM Page 33

illustrate this point: The specific chain of events leading to these cata-strophic incidents had not previously occurred within the company experi-encing the incident.

The identification of risks that can lead to incidents having serious con-sequences for the organization is a key element of the serious incident pre-vention process model.

Element 4: Identify Critical Work for Controlling the Risks

The key to avoiding risk management by the “fly-crash-fix-fly” cycle isto proactively identify and execute the critical work required to effectivelycontrol risks. In today’s working environment, it is rare to find an organiza-tion where people don’t work long and hard, but organizations where peo-ple focus their work on the most important issues and tasks are a rarity aswell. The serious incident prevention process model includes the identifi-cation of the critical work that the organization must focus on to success-fully control major risks.

Element 5: Establish Performance StandardsOnce the work critical to incident-free operations is identified, per-

formance standards are required to establish the parameters for satisfacto-rily executing the work. What must be done, when it will be done, and whowill do it must be clearly established.

Performance standards should be the product of thorough research andevaluation. Standards not providing guidance in sufficient detail may leavetoo much to the discretion of the performer. Such inadequate standards canresult in work performance not meeting the intended objective, while overlyexcessive requirements increase costs without a corresponding increase insafety. Issues often arise within the organization about how frequently in-spections, audits, hazard reviews, training, and other tasks should be con-ducted. Determining the optimum frequency for these tasks may createtension between the organization’s safety objective and other key objectives,such as cost control and productivity.

The serious incident prevention process model emphasizes the need forestablishing standards that are effective in both the prevention of incidentsand in resource utilization.

Element 6: Maintain Measurement and Feedback Systems

Identifying the critical work and developing performance expectationsestablishes actions critical to achieving safe operations. Unless executed ac-


CH03pp029-036 4/10/02 12:49 PM Page 34

cording to plan, however, the organization’s efforts will simply become an-other initiative with “good intentions” rather than a “milestone initiative”with major benefits. Success requires that organizations develop and main-tain measurement systems to monitor performance in executing the actionsrequired to fully implement the serious incident prevention process.Effective feedback systems must be established to communicate progresson key initiatives to personnel accountable for performance.

The serious incident prevention process model requires that effectivemeasures of performance be established—measures not only of results butfor upstream performance indicators, as well. Effective feedback systemsmust be established that keep personnel informed and allow for timely ad-justments to the safety process—proactive actions taken prior to the occur-rence of an incident rather than reactive actions taken after the damage hasbeen done.

Element 7: Reinforcement and CorrectiveActions

People tend to sustain activities where they feel positively reinforced,either through internally generated personal satisfaction or through externalreinforcement originating from family, friends, coworkers, bosses, or othersources. Neither effective reinforcement nor proactive corrective action canbe carried out without knowledge of performance. The communication ofsuch performance information requires effective measurement and feed-back systems.

The serious incident prevention process model utilizes measurementand feedback systems as the basis for establishing effective reinforcementand corrective actions. Reinforcement actions help ensure that employeesfeel genuinely appreciated when performance meets or exceeds expecta-tions—a simple but powerful concept. In addition to making reinforcementopportunities visible, measurement and feedback of upstream performanceindicators provides an early warning of potential deficiencies in the safetyprocess and the critical opportunity to initiate preventative actions beforeserious incidents occur—rather than on an after-the-fact basis.

Element 8: Improve and Update the ProcessLike life itself, the workplace is ever changing. Changes in raw materi-

als, equipment, facilities, organization structure, and other factors continu-ally impact the organization and the actions required for safe operations.

The serious incident prevention process model recognizes the impor-tance of organizational changes and provides a systematic method for as-suring that the actions required for incident-free operations remain current,up-to-date, and effective.


CH03pp029-036 4/10/02 12:49 PM Page 35

Figure 3-3 is a simplified diagram illustrating the relationship betweeneach element of the serious incident prevention process model. The chap-ters that follow provide an in-depth discussion of the actions required tosuccessfully develop and implement each process element. Together, theseeight elements form a proactive, team-based process for effectively sustain-ing serious incident-free operations.

References1. B. O. Paul, “How Eastman Won the Malcolm Baldrige Award—One

Company’s Quality Journey,” Chemical Processing, January 1994, 38–43.


Involve Employees

Understand the Risks

Identify Critical Work forControlling the Risks

Establish PerformanceStandards

Maintain Measurement andFeedback Systems

Reinforce and ImplementCorrective Action

Improve and Update theProcess

Management Commitmentand Leadership

FIGURE 3-3. Serious incident prevention process.

CH03pp029-036 4/10/02 12:49 PM Page 36

Benchmarking surveys typically identify management commitment asa necessity for achieving excellent safety performance. Management’scritical role may be better described as leadership rather than simply com-mitment. While many managers seem committed to almost an infinitenumber of objectives, most managers can provide the energy, excitement,and passion needed for true leadership only for a critical few initiatives.Whether described as commitment or leadership, the message is clear—management’s role is critical in achieving and sustaining a safe workplace.

Today’s managers generally recognize the importance of safety, in-cluding serious incident prevention. However, managers are usually feel-ing the pressure to achieve excellence in numerous key performance areas.In addition to safe operations, management’s attention is focused on pro-ductivity, product quality, customer service, and cost control. As a furthercomplication, these objectives often seem to be in tension with one an-other, with the manager unable to improve performance in one area with-out unfavorably impacting the others (Figure 4-1). Although I have yet tomeet a manager who confessed to be against safety, it’s a workplace real-ity that noble intentions are insufficient to accomplish desired results.Managers must demonstrate effective leadership in utilizing the organiza-tion’s finite resources to achieve all that is expected.

4ManagementCommitment andLeadership

CHAPTER

37

CH04pp037-047 4/10/02 12:49 PM Page 37

Initiatives dependent upon the formation of new habits require bothmanagement leadership and an effective strategy. During the decade of thenineties, the U.S. Navy experienced a number of unfortunate incidents, in-cluding Naval Academy cheating scandals, allegations of sexual harass-ment, and the suicide of its top officer. Following the suicide of AdmiralJeremy Boorda, a prominent U.S. Senator stated that the Navy’s problemswere nothing “that can’t be cured by good leadership.”1 Such laying of


Involve Employees








CH04pp037-047 4/10/02 12:49 PM Page 38

blame on “lack of leadership” is common. In this context, leadership is as-sumed to have mystical powers—with crime, unemployment, drug use,poverty, teenage pregnancy, and workplace accidents ready to be snuffedout, if only we had true leaders in positions of responsibility.

In reality, leadership is a rather vague concept requiring further defini-tion. Leadership is more than style. Rather than simply offering words thataffirm personal commitment, management must lead by identifying andtaking the actions necessary to maintain the prevention of incidents as a pri-ority objective. Leadership will be critical in transforming concepts into thespecific actions required for achieving desired performance. A safety man-agement process must be put in place that is comprehensive rather thanpiecemeal. The process must ensure that the ground is properly prepared;seeds are sown, growth is nourished, harvesting is on schedule, and im-proved methods are implemented for a more prosperous future.

Peter Drucker has observed that “charisma without a program is alwaysineffectual.”2 Management actions must be sufficient to ensure that seriousincident prevention objectives are understood and supported through alllevels of the organization. Management support that is both visible and con-structive is required. The following excerpt from Kaizen by Masaaki Imaiillustrates the need for management action beyond mere affirmations:

The president of an airline company proclaims that he believes in safetyand that his corporate goal is to make sure that safety is maintainedthroughout the company. This proclamation is prominently featured in the

Management Commitment and Leadership � 39

Serious Incident Prevention

OTHER OBJECTIVES

Cost Control Production

Customer Satisfaction

Environmental Performance

FIGURE 4-1. The tension between organizational objectives.

CH04pp037-047 4/10/02 12:49 PM Page 39

company’s quarterly report and its advertising. Let us suppose that the de-partment managers also swear a firm belief in safety. The catering man-ager says he believes in safety. The pilots say they believe in safety. Theflight crews say they believe in safety. Everyone in the company practicessafety. True? Or might everyone simply be paying lip service to the ideaof safety?

On the other hand, if the president states that safety is company pol-icy and works with division managers to develop a plan for safety that de-fines their responsibilities, everyone will have a very specific subject todiscuss. Safety will become a real concern. For the manager in charge ofcatering services, safety might mean maintaining the quality of food toavoid customer dissatisfaction or illness. In that case, how does he ensurethat the food is of top quality? What sorts of control points and checkpoints does he establish? How does he ensure there is no deterioration offood quality in-flight? Who checks the temperature of the refrigerators orthe condition of the oven while the plane is in the air?

Only when safety is translated into specific actions with specific con-trol and checkpoints established for each employee’s job may safety be saidto have been truly employed as a policy. Policy deployment calls for every-one to interpret policy in light of his own responsibilities and for everyoneto work out criteria to check his success in carrying out the policy.3

Achieving and Sustaining Effective Leadership

If leadership is critical to success, how do we achieve and sustain it?Author John C. Maxwell’s observations are directly applicable to the lead-ership requirements necessary for achieving and sustaining a safe work-place. Maxwell’s “Law of the Lid” accurately recognizes that an individual’seffectiveness within the organization is a product of both individual leader-ship ability and dedication.4 My experience indicates that, as a group, thededication level for both line and staff personnel responsible for safety per-formance is already very high. There is limited capability for significantlyincreasing the level of dedication. Thus, the key to increasing effectivenessin achieving and sustaining safety performance for most managers is to in-crease their leadership abilities.

Becoming an effective leader requires that individuals develop influ-ence within the organization. Developing influence is a step-by-step processthat requires commitment and an investment of personal time. Managersmust work to leverage their strengths and to shore up weaknesses—muchlike Demosthenes, who in the third century B.C. trained by shouting above


CH04pp037-047 4/10/02 12:49 PM Page 40

the ocean roar with pebbles in his mouth to overcome a harsh, unpleasantvoice and weak lungs. Demosthenes was so successful in overcoming hisweakness that he went on to become one of the best-known great Greek or-ators of his time. Such commitment is required to provide the level of lead-ership needed to sustain workplace operations free of serious incidents.

Leaders in safety must view everything with a leadership bias. Leaderssee the possibilities and have confidence that people can effectively handlechange when allowed to become involved in the process. Leaders under-stand the importance of goals and challenges in galvanizing individuals andteams. True leaders focus on visions and values, with the leader’s time allo-cated to actions that leverage his or her personal effectiveness.

Many managers, particularly those who have been successful in climb-ing the organizational ladder, maintain a personal bias toward positivethinking. However, when working in an organization having the potentialfor serious incidents, a manager’s tendency toward positive thinking mustbe tempered with an ongoing chronic unease. The wise manager is alwaysaware that every day is a potential bad day and that constant vigilance andcritical thinking will be required for a positive outcome.5

Effective leaders recognize the importance of timing. In particular, theoccurrence of significant events, either within the company or on a moreglobal basis, can provide a valuable window of opportunity for effective ac-tion. These opportunities are often short-lived and must be seized when theyoccur. An opportunity during my tenure as Eastman Chemical Company’sTexas Division Safety Director illustrates the importance of taking proac-tive actions to facilitate management understanding of risks:

In 1984, an incident in Mexico City resulted in the loss of more than 500lives from BLEVEs (Boiling Liquid Expanding Vapor Explosions).Several large LPG storage tanks were involved.6 Shortly after this cata-strophic event, a documentary videotape of the incident was obtained anda viewing scheduled for Eastman’s Texas Division senior management.This viewing, initiated by the safety organization, gave birth to a manage-ment vision for substantially reducing on-site LPG inventory. With thestrong support of management, storage and distribution systems were re-designed to achieve major reductions in inventory. The total propane andpropylene tanks at the site were reduced from 35 tanks to a total of 6 tanks,each with state-of-the-art safeguards. The more than 80 percent reductionin the number of LPG tanks has provided an inherently safer facility whilehaving no undesirable effects on operations.

The simple action of scheduling a video presentation for senior man-agement served to trigger an initiative resulting in breakthrough improve-


CH04pp037-047 4/10/02 12:49 PM Page 41

ments. Management’s full understanding of the potential consequences as-sociated with maintaining large on-site LPG inventories was a prerequisitefor change. Once educated, management readily became the driving forcein assuring that needed changes were made.

The breakthrough improvement in reducing LPG inventory illustratesthe importance of keeping management informed, and the power of an in-formed management team in helping make difficult changes a reality. Toooften, safety professionals share information with each other, but not withthe key members of line management who can provide the resources andsupport needed to implement changes.

Achieving a Common Focus

Effective leaders work to achieve a shared vision within the organiza-tion. Documenting and communicating key objectives helps the organiza-tion keep its eye on the right ball. The tendency to be distracted by hottrends is minimized. The effect of such distractions is illustrated by com-ments from a manager for a Midwestern equipment manufacturer:

In the past 18 months, we have heard that profit is more important than rev-enue, that quality is more important than profit, that people are more im-portant than profit, that customers are more important than our people, thatbig customers are more important than small customers, and that growth isthe key to our success. No wonder our performance is inconsistent.7

Achievement of a common focus requires strong linkage between orga-nizational units. Linkage is facilitated through ensuring that each unit’s mis-sions, vision, performance measures, and improvement projects supportthose of other organizational units that are dependent upon performance.

Sustaining a common focus throughout the organization requires anumber of management actions. Effective communications are critical toensure that overall company direction, measures, goals, and objectives areunderstood. Communications must be sufficiently in-depth to ensure thatemployees understand the fundamental business principles driving com-pany initiatives. As adjustments in direction are made, the changes must beeffectively communicated to all.

A system of accountability helps ensure the right actions are imple-mented to support key organizational initiatives. This is the critical “Check”step of the “Plan-Do-Check-Act” improvement cycle. Periodic managementreviews of the mission, vision, measures, goals, and improvement projects de-veloped by subordinate teams can be an effective part of the accountability


CH04pp037-047 4/10/02 12:49 PM Page 42

process. Reviews should focus on understanding incident preventionprocesses in place, results achieved, identifying reinforcement opportuni-ties, and ensuring team-to-team linkage.

Sustaining a common focus throughout the organization is a challeng-ing management responsibility. However, such alignment behind a commonpurpose is essential in leveraging the support of all levels of the organiza-tion needed for achieving breakthrough improvements. The benefits pro-vide a generous return for the management time invested.

Allocation of Resources

Stated objectives not backed by adequate resources ring hollow. Inmany organizations the landscape is dotted with the gravestones of failedinitiatives that were inadequately resourced. Such failures waste the organi-zation’s finite energy and undermine management credibility.Organizational resources of the appropriate type and quantity are essentialfor new initiatives to succeed. Management leadership, together with a sys-tematic process, is required to ensure management time, staffing, training,and funding are allocated to successfully support company objectives.

Knowledge of Results

Sustaining a high level of support for an initiative requires an effectivemeasurement and feedback system. It is difficult to comprehend manage-ment tolerating a key performance objective that does not have an effectivesystem for monitoring progress toward meeting the objective. Certainly,measurement and feedback systems are usually well established for someorganizational objectives, such as profitability, productivity, and cost con-trol. Serious incident prevention may be designated as a key objective, butthat fact does not ensure appropriate measurement and feedback systemsare in place to provide the performance information needed to achieve andsustain success.

Managers are usually aware of a facility’s past history of incidents, butthey may not be informed of current performance in executing the “up-stream” work necessary to prevent future incidents. At best, managers mayreceive results of area safety audits. However, audits are often focused onregulatory compliance rather than effectiveness in the broader task of iden-tifying and executing all of the work critical to preventing incidents. Atworst, management’s feedback is limited to the frequency of common in-juries, with no system in place for monitoring leading indicators for sus-taining serious incident-free operations.


CH04pp037-047 4/10/02 12:49 PM Page 43

Accurate feedback is needed to keep management informed on the de-ployment of safety initiatives throughout the organization. Deploymentshould not be assumed as a given. Unfortunately, performance of work toprevent incidents may be perceived as deferrable by line managers feelingthe squeeze of time and funding constraints. Further, many managers dependupon exception reports—customer complaints, production at less than targetrates, costs over budget, injury frequency higher than goal—to allocate timeand resources. “Red flag” indicators of upstream deficiencies in the seriousincident prevention process are often visible only to personnel at the operat-ing point of control. However, with the severe consequences of performancefailures, an effective measurement and feedback system is needed to capture,communicate, and evaluate upstream indicators of potential safety problems.Sustaining incident-free operations is dependent upon it.

Reinforcement of Performance

Effective leadership requires an understanding of effective reinforce-ment principles. Specific actions and results that support achievement of or-ganizational goals and objectives must be positively reinforced if we expectthese actions to be sustained. However, management must diligently guardagainst the potential for unwanted side effects resulting from misguided re-inforcement efforts. Unwanted side effects can occur when reinforcement re-ceived for supporting some objectives overpowers the perceived value ofreinforcement for actions required to meet other objectives.

The experience of a national pizza chain with their heavily advertisedgoal of delivering all pizzas within 30 minutes after receipt of the order pro-vides an excellent case study. Performance consistent with this high visibil-ity objective was clearly a priority for all employees—from store managersthrough the delivery drivers. The requirement to refund customers for latedelivery provided a strong incentive to rush if necessary to meet the dead-line. Reinforcement for safe driving was perhaps perceived as weak com-pared to the “punishment” for late delivery. From a behavioral perspective,it’s not surprising that company drivers became involved in a number of se-rious accidents. Following a $78 million award for one accident, involvinga delivery driver who reportedly ran a red light, the company eliminated theguarantee on delivery time.8

Decisions Consistent with ObjectivesMuch is asked of supervisors—often more than they or anyone else can

actually deliver. How do these individuals cope with unrealistic expectations?


CH04pp037-047 4/10/02 12:49 PM Page 44

Supervisors look to the actions of their bosses for clues to determine whatis really considered important. What questions is the boss asking? Whichobjectives does the boss support with his or her personal time? What sub-jects does the boss discuss during performance reviews? These are the ini-tiatives that will be given priority by subordinates. Requests that are simplycommunicated by memorandum with no other visible management supportare likely to receive minimum attention from the supervisor stretched to hisor her limits.

In an environment where supervisors are looking to superiors for cluesto guide priority setting, management leadership and decisions have a pow-erful influence in shaping what is perceived as important. Decisions thatskew the allocation of resources or rewards toward any one of the organiza-tion’s key objectives can create conflicts. The remaining objectives, includ-ing incident prevention, become more difficult to achieve. In many cases theperceived necessity for special focus on only a portion of an organization’sobjectives may be driven by powerful external pressures—for example, thespecial need for cost control during industry down cycles. However, man-agement must realize the potential pitfalls of decisions that provide supportto a select few key performance areas while in effect neglecting the others.

America’s space program provides ample material for case studies onthe effects of management decisions and leadership on safety performance.The impact of misguided decisions is illustrated by the work to expedite theinitial Apollo mission. During preparation for Apollo 1, an environment de-veloped where intelligent individuals rationalized a dependence upon luckto prevent serious incidents rather than diligent execution of the work re-quired to be successful. Astronauts Alan Shepard and Deke Slayton con-tribute many of the misguided decisions to pressure from NASA’s ultimateboss, President Lyndon Johnson.9 Widespread unrest during 1966 regardingthe Vietnam War and other issues had President Johnson anxious to focusthe country’s attention on a success story. Johnson’s communications toNASA were forceful in his desire for the initial Apollo mission to fly on orahead of the February 1967 scheduled launch date.

Apollo 1 was a complicated spacecraft with thousands of systems thatneeded to work perfectly for the mission to succeed. Like earlier capsules,the Apollo craft was equipped with a pressurization system to ensure an in-terior free of contaminants. The use of pure oxygen to pressurize the cap-sule was a design compromise made years earlier by the spaceadministration. An inherently safer nitrogen-oxygen mixture, similar tobreathing air, had been vetoed primarily because the extra containers addedweight and complexity to the craft.

Numerous failures had plagued the Apollo program—a primary reasonthe Apollo team was behind schedule. Though it was understood that pure


CH04pp037-047 4/10/02 12:49 PM Page 45

oxygen creates a highly flammable environment, the problem-free historyof the earlier Mercury and Gemini missions led NASA to become too com-placent about the possibility of fire. In an effort to meet the flight schedule,NASA management decided to bypass an oxygen pressure test of the cap-sule in the unmanned mode. Instead, NASA scheduled a full dress rehearsalfor January 27, 1967, with astronauts Grissom, White, and Chaffee onboard.

With the astronauts on board, pressuring of the capsule was initiated bydischarging pure oxygen into the craft until the desired pressure of 16.7psig was reached. Somewhere in the cabin, wiring sparked, and flames en-gulfed the interior of the capsule. All three of the astronauts were killedwithin seconds. It would be another 21 months before a manned Apollomission would fly.

Following the fire, NASA’s focus shifted from expediting the flight toidentifying the root causes of the catastrophic fire. The Apollo reviewboard’s investigation concluded that an electric arc from defective wiringwas the most likely source of ignition. Numerous deficiencies related to de-sign, engineering, manufacturing, and quality control were identified. Thereport criticized the NASA management team for poor management, care-lessness, negligence, and failure to fully consider personnel safety.

Once NASA resources were focused on building an inherently safercraft, tremendous advances were made. Many design deficiencies of the oldcraft were eliminated. The electrical system was redesigned, fire-resistantmaterials were extensively utilized, and a new escape hatch capable of beingopened in three seconds was developed. Finally, the pure oxygen was re-placed with a nitrogen-oxygen mixture.

Twenty-one months were required to develop, implement, and test thechanges needed to improve the craft. The successful ascent of the firstmanned Apollo on October 11, 1968, was a milestone date for NASA. Theflight of the redesigned Apollo craft was superb. The intense focus on seri-ous-incident prevention had been successful.

Commitment and Leadership—Closing Thoughts

Whenever I speak with safety managers, whether new to the field orlong experienced, I always talk with them about leaving some footprints be-hind—leaving a personal legacy of accomplishment that will be admired fordecades to come. Such legacies require boldness, leadership, and commit-ment. Peter Drucker states it well with his rules for establishing priorities:10


CH04pp037-047 4/10/02 12:49 PM Page 46

� Pick the future as against the past;

� Focus on opportunity rather than on the problem;

� Choose your own direction—rather than climb on the bandwagon;and

� Aim high, aim for something that will make a difference, rather thanfor something that is “safe” and easy to do.

In any organization there are always more opportunities deserving at-tention than capable people to address them. In determining which oppor-tunities to seize, managers must be biased toward true organizationalpriorities rather than reacting to pressures of the day. Work on daily pres-sure points is usually targeted at resolving or explaining yesterday’s prob-lems. Management leadership and commitment in support of criticalorganizational objectives, including the prevention of serious incidents, isthe key to shaping a better tomorrow.

References1. S. Komarow, “Academy Tries to Restore a Sense of Honor,” USA Today, 23

May 1996.2. P. F. Drucker, The New Realities (New York: Harper & Row, 1989), 109.3. M. Imai, Kaizen—The Key to Japan’s Competitive Success (New York:

Random House, 1986), 144–145.4. J. C. Maxwell, The 21 Irrefutable Laws of Leadership (Nashville: Thomas

Nelson, 1998), 1–10.5. J. Reason, Managing the Risks of Organizational Accidents (Aldershot,

Hampshire, England: Ashgate Publishing, 1997) 37.6. B. F. Olson and J. L. de la Fuente, L.P-Gas Disaster November 1984—Mexico

City (Presented at GPA Convention, San Antonio, Texas, 10–12 March 1986).7. J. A. Byrne, “Business Fads: What’s In—And Out,” Business Week, 20 January

1986, 53.8. “Domino’s Dropping Delivery Guarantee,” Dallas Morning News, 22

December 1993, 1A, 17A.9. A. Shepard and D. Slayton, Moonshot—The Inside Story of America’s Race to

the Moon (Atlanta: Turner Publishing, 1994), 192–221.10. P. F. Drucker, The Effective Executive (New York: Harper & Row, 1985), 111.


CH04pp037-047 4/10/02 12:49 PM Page 47

Most managers learn early in their careers that achieving results isoften dependent upon collaboration with hourly-roll employees and otherpersonnel having point-of-control knowledge. Experience continually re-confirms that the true experts are the individuals performing the work.Employee involvement is clearly a critical prerequisite for identifying andimplementing the actions necessary to achieve and sustain a safe work-place, as well as for achieving other organizational objectives.

Consider the comments of Charles Ross, operator of the Tilt-a-Whirlamusement ride for Bill Dillard Shows Inc.:

I’m a master at what I’m doing. I don’t mean to brag, but facts are facts.I can take any tub and make it spin like I want. I know every pin andgrease circuit in it. I’ve fallen in love with this machine. Why? I canmake people happy. Making it spin for them with all that hollering goingon—that makes me feel good. That’s why I stick with it. If I quit, I’dprobably die.1

A line manager or safety engineer would obviously be a fool not to in-volve Charles Ross in any initiative designed to improve Tilt-a-Whirl

48

5EmployeeInvolvement

CHAPTER

CH05pp048-059 4/10/02 12:49 PM Page 48

safety. All companies have their Rosses, or at least those with the potential,at point-of-control positions. The detailed knowledge many individuals pos-sess on their life’s work is incredible, and most will gladly share it. To lever-age this knowledge, we must make a habit of treating employees as valuableresources rather than simply overhead costs.

Employee Involvement � 49

Involve Employees








CH05pp048-059 4/10/02 12:49 PM Page 49

There is a strong linkage between active employee ownership and theultimate success of any initiative. The reason we diligently maintain ouryards and gardens through the hot summer is rooted in pride of ownership.These same concepts hold true in the workplace. Pride of ownership is fos-tered by providing opportunities for meaningful employee involvement, to-gether with management’s willingness to entrust employees withresponsibility and authority.

The importance of involvement, responsibility, and buy-in is widelyrecognized:

“Mark it down, asterisk it, circle it, underline it. No involvement, no com-mitment.”2

—Steven Covey, Author and Co-Chairman, Franklin Covey Co.

“Get everyone in the game! With boundrylessness, speed, and stretch”3

—Jack Welch, CEO, General Electric Co.

“We’ve found over and over again that the true experts in our business arethe people who see it up close every day.”4

—Robert C. Crandell, Former CEO, American Airlines Inc.(in announcing the company’s purchase of a Boeing 757

with savings generated from employee ideas)

Synergy

Synergy is the phenomenon that occurs when the whole is greater thanthe sum of the parts. The existence of synergistic outcomes, like the creationof fluffy popcorn from hard kernels and heat, is one of life’s pleasant sur-prises. The phenomenon makes a treasure of diversity—differences in back-grounds, personalities, talents, and points of view provide the potential forachieving greatness as a team. Maximizing the synergistic capability of anorganization requires skills—management, facilitation, and people skills.The level of synergy achieved through harnessing these skills separates ef-fective teams from those destined to underperform.

The reality of synergy has been confirmed frequently in workshop set-tings. A typical exercise demonstrating synergy involves each individualparticipant performing a task capable of being objectively graded. Then,the same task (for example, a written quiz on a specific topic or variety of


CH05pp048-059 4/10/02 12:49 PM Page 50

topics) is performed as a team exercise. Both individual and team perform-ances are then reviewed. In the absence of a total breakdown in teamwork,the quantified team score is higher than the average score of all individu-als—a predictable outcome. However, with synergistic teamwork, the teamscore not only exceeds the individual average, but also exceeds the highestindividual score—an outcome with tremendous implications for accuratelyidentifying the actions needed for a safe workplace.

Synergy, at first glance, appears to have connections with the world ofmagic. A more comprehensive evaluation reveals that synergy is a pre-dictable outcome of people working together. I’ve come to appreciate thatthere are different forms of intelligence, and I have never met an individualwho did not excel in at least one or two of them. On the other hand, it’s arare individual who excels in the majority. In The Age of Paradox, authorCharles Handy identifies and describes nine separate forms of intelligence:

� Factual intelligence: The intelligence demonstrated by the human en-cyclopedia. We are envious but often bored.

� Analytical intelligence: The intelligence that thrives on intellectualproblems and fun challenges such as crossword puzzles. People whoscore high on this intelligence delight in reducing complex data tomore simple formulations.

� Linguistic intelligence: Seen in the person who speaks seven lan-guages and can pick up another within a month.

� Spatial intelligence: The intelligence that sees patterns in things.Artists have it, as do mathematicians and system designers.

� Musical intelligence: The sort that gave Mozart his genius, but thatalso drives pop stars and their bands, many of whom would neverhave had a chance of going to college, because their scores on thefirst two intelligences would have been too low.

� Practical intelligence: The intelligence that allows young kids to takea motor bike apart and put it together again, although they might notbe able to explain why in words.

� Physical intelligence: The intelligence or talent that we can see insports stars, which enables some people to hit balls much better thanothers, to ski better, dance better, etc.

� Intuitive intelligence: The gift that some have of seeing things thatothers can’t, even if they cannot explain why or wherefore.

� Interpersonal intelligence: The ability to get things done with andthrough other people. Without this form of intelligence, great mindscan be wasted.5


CH05pp048-059 4/10/02 12:49 PM Page 51

Prison Break Exercise

Let’s test the theory that our decisions can often benefit from the inputof others. Most of us think of ourselves as having excellent analytical abil-ities. However, in workshop settings I have found that only about 1 in 20people can correctly solve the exercise below when given 15 to 20 minutesto complete it. Take a few minutes to work through the exercise to evaluateyour analytical ability and to determine if you could benefit from collabo-ration with others.

Exercise

Four prisoners are planning a midnight prison break. Their objective willbe to cross over a nearby gorge as quickly as possible to distance them-selves from the bloodhounds that will be in pursuit. A rope bridge spans thegorge, and a flashlight will be required to cross the bridge. Furthermore,the maximum capacity of the rope bridge is two people at a time. The pris-oners have been able to obtain only one flashlight for the escape.

The physical conditioning of the prisoners varies significantly andthey estimate that the most athletic of the four can cross the bridge in 1minute. (This prisoner is known as prisoner #1.) A second, less athleticprisoner (prisoner #2) will require 2 minutes to cross, a third prisoner(prisoner #5) will require 5 minutes, and the least mobile prisoner (pris-oner #10) will require 10 minutes to cross the bridge.

Given that the group only has one flashlight that must be carried for vi-sion when crossing the bridge and that the bridge will hold a maximum oftwo people, determine the order in which prisoners should cross the bridgeto minimize the time requirements for all four prisoners to cross the gorge.

Use the worksheet below as a guideline for developing the optimumsolution.

Notes: (1) When two prisoners cross together the time for the two tocross will be equal to the time required for the slowest of the two prison-ers. For example, if prisoners 1 and 10 cross together, the time for both tocross is 10 minutes. (2) The flashlight must be hand-carried back and forthacross the gorge—no tossing of the light or other trick solutions.

Prison Break Worksheet

Action Taken Minutes Cumulative Required Minutes

Elapsed

______ & ________ cross bridge_______ returns with flashlight_______ & _______ cross bridge_______ returns with flashlight______ & _______ cross bridge


CH05pp048-059 4/10/02 12:49 PM Page 52

My experience indicates that a large percentage of the working popula-tion can devise a plan for getting all prisoners safely across the bridge in 19minutes. However, there is a better solution with no tricks involved, for re-ducing the time required for all prisoners to cross. Can you identify a bet-ter plan? If not, you are among the vast majority who could benefit fromcollaboration with others on the project. For those of you who identify theoptimum solution of 17 minutes for all prisoners to cross—Congratulations! However, be aware that for other types of problems andprojects, you may be the one benefiting from the synergy that can beachieved through teamwork with others. (A solution for the 17-minutebridge crossing is presented at the end of this chapter.)

Teamwork

Effective teamwork leverages the diversity of team members to producea synergistic output. Employee involvement and teamwork facilitate the se-rious-incident prevention process in a number of ways:

1. Identification of risks: Employees at the point of control and otherswith specialty knowledge can provide valuable input on past inci-dents, near misses, and improvement opportunities.

2. Identification of critical work: Point-of-control employees can pro-vide information based upon direct observations and experiences toidentify the proactive actions needed to effectively control risks.Input from employees with technical or other specialty knowledge isalso critical.

3. Synergy: The involvement of individuals with diverse backgroundsand knowledge enhances the development of effective serious-inci-dent prevention processes. Team-based, synergistic processes aremuch more likely to succeed than those developed exclusively by themanager.

4. Understanding the process: Employee involvement increases under-standing of the serious incident prevention process. Involvement isthe difference between experiencing Europe through personal travelcompared to viewing someone else’s photographs. The first-handexperience provides a greater feel, sense of perspective, and under-standing. Involved individuals understand the fundamental principlesdriving the incident prevention process and are more likely to main-tain the commitment necessary to sustain performance.

5. Pride of ownership: People show polite interest in other people’s ba-bies but reserve real commitment and personal sacrifice for raising


CH05pp048-059 4/10/02 12:49 PM Page 53

their own. It’s the same with workplace initiatives. Passion is limitedto initiatives where individuals are involved and feel ownership.Such commitment is critical for sustaining the long-term, task-ori-ented process of serious incident prevention.

An OSHA Perspective on Employee Participation

The critical role of employee involvement in workplace safety is recog-nized by OSHA through requirements for the agency’s prestigious STARprogram administered through its Voluntary Protection Program (VPP).Employee involvement is a cornerstone of the program, which is basedupon the best safety and health practices found in American industry.OSHA considers employee participation to be particularly important in thefollowing functions and activities:

� Safety observations

� Safety and health problem-solving groups

� Safety and health training of other employees

� Analysis of job hazards

� Committees that plan and conduct safety and health awareness programs

� Reporting of safety concerns to management.6

In addition to VPP program guidelines, OSHA has also published adocument entitled Voluntary Safety and Health Program ManagementGuidelines. These guidelines, which are a distillation of successful safetyand health management practices in the United States, identify managementcommitment and employee involvement as key elements for successfulsafety programs.

Specifically, the OSHA document recognizes the value of:

� A worksite safety policy on safe and healthful work and workingconditions stated so that all personnel understand the priority ofsafety and health protection in relation to other organizational objec-tives

� Clear safety goals, with plans for meeting the goals that are under-stood by all personnel responsible for goal achievement.

� Top management involvement in implementing the program.


CH05pp048-059 4/10/02 12:49 PM Page 54

� Employee involvement in the operation of the program and in deci-sions that affect safety and health.

� Assignment of responsibilities for all aspects of the program, so thatmanagers, supervisors, and employees in all parts of the organizationknow what performance is expected of them.

� Provision of adequate authority and resources to responsible parties,so that assigned responsibilities can be met.

� Holding managers, supervisors, and employees accountable formeeting their responsibilities, so that essential tasks will be per-formed.

� Annual reviews to evaluate success in meeting goals and objectives,so that deficiencies can be identified and the program and/or the ob-jectives can be revised as needed.7

Leveraging the Power of Employee Involvement

The typical organization is blessed with talented individuals waiting forthe perceptive manager to provide an opportunity congruent with their per-sonal strengths and interests. It is an eye-opening exercise to inventory theleadership roles assumed outside the workplace by an organization’s clerks,plant operators, maintenance mechanics, and technicians. Church officers,school board members, United Way leaders, small business owners, effec-tive managers of substantial monetary investments—the workplace is filledwith individuals having the initiative, skills, and intelligence to make mean-ingful contributions in the workplace.

Figures 5-1 through 5-3 summarize results of survey responses on thesubject of employee involvement from America’s largest employers.8

Results of the comprehensive survey, conducted by the U.S. GeneralAccounting Office, confirm the power of employee involvement in helpingto achieve and sustain results. Of the 934 companies surveyed, 76 percentreport that employee involvement has improved organizational processesand procedures. Thus, if we manage the prevention of high-consequence in-cidents as a business process, we can expect favorable results from activelyinvolving employees.

In 1994, the world followed 50th anniversary proceedings for the June6, 1944, D-Day landings with great interest. Frank Elliot, a U.S. Army cor-poral with the 741st Tank Battalion, was one of the many heroic casualtiesof the initial landings. As part of the events leading up to the D-Day


CH05pp048-059 4/10/02 12:49 PM Page 55

anniversary, the contents of Corporal Elliot’s letters, written during themonths preceding his landing on Omaha Beach, were released. In one let-ter, Frank communicates his personal thoughts on improving the steel millthat provided his peacetime employment. Corporal Elliot’s active interest inimproving his employer’s work process, despite the stresses of preparing forthe imminent invasion, is a testimony to the dedication and resourcefulnessof workers in a free enterprise system.12

Management must ensure that the Charles Rosses and Frank Elliots oftheir organization are involved, nurtured, and given responsibility. A safeand prosperous workplace is a vision that can be sustained as realitythrough the involvement of each and every employee.


January 11, 1944

Dearest Wife,

Last night in one of my pre-dream reveries I was dreaming of an ideathat was designed to revolutionize the strip steel industry. However, withthe dawn of an English day the idea began to look like a drunkard’sdream (and me a teetotaler) and I have at last cast it away to the windshaving first memorized the faults of the idea. I hesitate to mention theidea for fear of being scoffed at but since Firestone and Edison were bothsuccessful inventors and attributed their successes to the counsel of theirwives I am going to briefly outline the idea to you. It had to do with therolling and thinning of steel as it is done on a four high Steckle Mill ofthe type used at our plant. I wondered if it weren’t possible to weld a sec-tion of the sheet of steel to itself so that the strip instead of having to berun through several times could be run to the desired degree of thinnessby one continual passing.

I love youFrank

CH05pp048-059 4/10/02 12:49 PM Page 56

Prison Break Exercise 17-Minute Solution:

Action Taken Minutes Required Cumulative Minutes Elapsed

1 & 2 cross bridge 2 21 returns with flashlight 1 35 & 10 cross bridge 10 132 returns with flashlight 2 151 & 2 cross bridge 2 17


Question: To what extent, if at all, is each of the following conditions currently a facilitator of employee involvement in your corporation?

Percent Respondents Saying Condition Is a Great or

Condition Very Great Facilitator

Support by top management 55%

Support by middle management 39%

Training relevant to employee involvement 37%activities

Communications about employee 36%involvement to all employees

Support by first-line supervision 33%

Communication of job and business 33%relevant information

Availability of resources for employee 28%involvement activities

Decentralization of decision-making 22%authority

Employment security 17%

Third party consultation 13%

Union involvement 9%

Monetary awards for employee involvement 7%activity

FIGURE 5-1. Conditions facilitating employee involvement. From AmericanProductivity & Quality Center.9

CH05pp048-059 4/10/02 12:49 PM Page 57


Question: To what extent, if at all, is each of the following conditionscurrently a barrier to employee involvement efforts?

Percent Respondents Saying Condition Is a Great or

Condition Very Great Obstacle

Short-term performance pressures 43%Lack of a "champion" for employee 26%involvementLack of a long-term strategy 25%Lack of training on employee involvement 23%skillsUnclear employee involvement objectives 21%Lack of tangible improvements 20%Lack of a feedback system 18%Centralization of decision-making authority 17%Management culture opposed to employee 15%involvementWorsened business conditions 14%Lack of coordination of employee 12%involvement programs with other programsTurnover in top management 6%

FIGURE 5-2. Barriers to employee involvement. From American Productivity &Quality Center.10

Percent or Respondents Saying Improved at

Internal Business Condition Least Some

Increased employee trust in management 79%Improved organizational processes and procedures 76%Improved management decision making 74%Improved implementation of technology 66%Improved employee safety/health 55%Improved union-management relations 43%Eliminated layers of management or supervision 38%

FIGURE 5-3. Percent indicating at least some improvement in internal businessconditions as a result of employee involvement. From American Productivity &Quality Center.11

CH05pp048-059 4/10/02 12:49 PM Page 58

References1. A. Farris, “Fair Worker Loves Job,” Arkansas Gazette; 9 October 1988, 1B, 2B.2. S. R. Covey, The 7 Habits of Highly Effective People (New York: Simon &

Schuster, 1990), 143. Excerpt used with permission. All rights reserved.3. “GE: Just Your Average Everyday $60 Billion Family Grocery Store,” Industry

Week, 2 May 1994, 13–18. Reprinted with permission. Copyright 1994 PentonMedia Inc., Cleveland, Ohio.

4. R. T. Hurley, “The Truth About American Workers,” Industry Week, 3 May1993, 37. Reprinted with permission. Copyright 1993 Penton Media Inc.,Cleveland, Ohio.

5. C. Handy, The Age of Paradox (Boston: Harvard Business School Press, 1994),203–206.

6. “Voluntary Protection Programs to Supplement Enforcement and to ProvideSafe and Healthful Working Conditions Changes,” Federal Register; vol. 53,no. 133, 12 July 1988, 26344–26345.

7. “Voluntary Safety and Health Program Management Guidelines,” Fact SheetOSHA 91-37, U.S. Department of Labor, 1 January 1991.

8. E. E. Lawler III, G. E. Ledford, Jr., and S. S. Mohrman, Employee Involvementin America: A Study of Contemporary Practice (Houston: AmericanProductivity and Quality Center, 1989), 41–46.

9. Ibid.10. Ibid.11. Ibid.12. D. Elliot, “D-Day: What it Cost,” American Heritage 45, no. 3 (May/June

1994), 64. Reprinted by permission of American Heritage magazine, a divisionof Forbes Inc.


CH05pp048-059 4/10/02 12:49 PM Page 59

The active involvement of employees at all levels of the organizationis required to achieve and sustain an effective safety management process.Organizations often recognize this need by including strong references toactive employee involvement and effective teamwork in the organizationalvision statement. However, in reality, the effectiveness of involvement andteamwork in the workplace often falls far short of the vision.

Why do efforts to involve employees in safety fall short of the organi-zation’s stated vision? In many situations performance gaps exist becausethe organization does little more than state their desire for employee in-volvement and teamwork. A closer look often indicates the organizationhas given little or no thought to developing an effective strategy forachieving their objectives. Without an effective plan, employee involve-ment efforts will be little more than window dressing on the company vi-sion statement—the real opportunities to leverage employee involvementand teamwork for improved safety results will be missed.

Employee Involvement on Teams

One of the most practical and effective ways to channel employee in-volvement toward the achievement of a safer work environment is through

60

6EmployeeInvolvement—Developing Teamwork

CHAPTER

CH06pp060-67 4/10/02 12:50 PM Page 60

the involvement of employees on formal teams. Teams can be effective incarrying out numerous types of safety initiatives, including identifying andimplementing safety improvements, providing feedback to management onkey safety initiatives, and helping to identify and remove barriers to im-provement.

Using safety teams comprised of personnel at all levels of the organi-zation provides many benefits. A primary benefit is that participation onteams creates the employee ownership and commitment needed to carry outand sustain successful safety initiatives. As reviewed in Chapter 5, theachievement of synergy is also dependent upon effective teamwork.Without teamwork, the quality of decisions and programs suffers. A thirdbenefit in using teams is that it expands the organization’s available re-sources for problem solving. Hourly-roll and other personnel not normallyin the development loop for safety initiatives can make valuable contribu-tions to the organization through their involvement on teams.

Effective Teamwork Techniques

When forming a new team, care must be taken to ensure that roles ofteam members are understood. Clarifying roles and responsibilities helpsensure that critical items get done, overlap and duplication are minimized,and disruptive power grabbing is avoided. Roles should be clarified formembers, leader(s), facilitator(s), and for other participants. Although a fa-cilitator is not always a necessity, a trained facilitator, who is aware of whatis going on in the group and possesses the expertise to make appropriate in-terventions, can often greatly enhance teamwork.

Unfortunately, it’s not unusual for teams to reach decisions and thenhave individual team members criticize team decisions to coworkers. Oncea team has “shot itself in the foot” in this manner, it has little chance of ob-taining the full organizational support needed to meet team objectives. Suchundesirable situations can be avoided by working toward a true consensusin team meetings, rather than reaching decisions by other methods, such as“the boss decides” or “majority rules.”

Consensus is often confused with reaching a unanimous decision orwith “majority rules.” However, making decisions by majority vote does notusually provide a situation in which team members walk away from meet-ings in full support of the decisions made. For example, if a decision passeson a 60-to-40 vote, 40 percent of team members are likely to leave the meet-ing not supporting the team’s decision. A true consensus is reached wheneach individual team member can affirm the following:

� I believe you understand my point of view;

Employee Involvement—Developing Teamwork � 61

CH06pp060-67 4/10/02 12:50 PM Page 61

� I believe I understand your point of view; and

� Whether or not I prefer this decision, I will support it, because it wasarrived at in an open and fair manner.

Some teams avoid trying to reach a consensus because they perceive itwill take too much time. This effort to shorten the time required to reach de-cisions often backfires with the lack of consensus adding substantial timeto the implementation phase for new initiatives. Reaching consensus can beexpedited by team participation techniques, such as brainstorming andmethods for screening and prioritizing ideas generated by brainstorming.

Brainstorming Techniques Teams often fail because input in team meetings is limited to a select

few—perhaps the leader or other influential or verbose members. Effectivebrainstorming techniques help ensure input from all team members in gen-erating potential solutions or other ideas for improvement. Brainstormingalso helps the creative process flow and helps ensure a high level of synergyis achieved.

Effective brainstorming requires adherence to the following principles:

� Present the situation to be brainstormed, and then allow “think time”before proceeding.

� Make sure everyone understands there will be no criticism of ideasas they are generated.

� Proceed one person at a time around the room, or in an alternatemanner that ensures everyone genuinely feels an equal chance forparticipation. To help ensure broad participation, individuals shouldprovide only one item during each turn before proceeding to the nextperson.

� Record all ideas. Avoid the tendency to debate ideas as they are gen-erated.

� Continue rotating the opportunity to provide input until several teammembers start to “pass” on their turn. Then open the process to free-wheeling—additional ideas generated by any member in the room.

� Keep the brainstorming process active until a large number of ideasare generated. Giving up too early is a common mistake. Quite oftenthe best ideas come toward the end when team members must bemore creative in identifying additional ideas not yet on the list.

Teams sometimes make the mistake of trying to eliminate brainstormedideas as they are generated, based on the misguided thinking that keeping


CH06pp060-67 4/10/02 12:50 PM Page 62

an “out-of-bounds” idea off the board will save time. Such an approach isinappropriate for three reasons: (1) The discussion is perceived as criticism,and team members become less likely to provide additional ideas. (2) Notrecording items can harm the level of team synergy. Even ideas that are notfeasible have the potential to serve as a catalyst for generating other inno-vative solutions that may be feasible. (3) Discussing the merits of items asthey are generated increases the time required to reach a consensus ratherthan serving to decrease time. Effective approaches for screening and pri-oritizing brainstormed ideas are available that will result in any impracticalideas being quickly discarded.

Screening and PrioritizingA technique known as Pareto voting is an effective and timely method

for reducing a long list of brainstormed items down to a critical few thatmerit further evaluation by the team. My experience has been that Paretovoting is perceived as fair and equitable by team members, thus meeting oneof the critical requirements for reaching a consensus.

This prioritization technique is based upon the Pareto principle, namedafter the Italian economist of the early 1900s who identified certain mathe-matical relationships related to the distribution of wealth.1 Perhaps it’s moredescriptive to refer to the Pareto principle as the “principle of the criticalfew.” (The principle is also referred to as the 80-20 rule.) In our efforts toimprove safety, we unfortunately often spend the majority of our time on the“trivial many”—the 80 percent—rather than the “critical few” items—the20 percent that can provide the most benefits for safety programs. Effectivemanagers leverage their finite time and resources by identifying the criticalfew actions having the most impact on results and then keeping the organi-zation’s spotlight focused on these critical items.

Pareto voting is a quick and effective way to separate the importantfrom the unimportant, and it is consistent with the principle that about 80percent of the potential benefits for an organization can be achieved by act-ing upon about 20 percent of the potential opportunities. For example, if wedevelop a list of everything that could be done to improve safety in the or-ganization, implementing the most effective 20 percent of the actions willusually provide about 80 percent of the potential benefits. Pareto votinghelps in identifying the critical few items that will provide the most benefitin a timely, accurate, and equitable manner.

To illustrate the steps in Pareto voting, let’s assume that a team com-prised of five employees, Susan (the team leader), Frank, Linda, Bill, andJoe, has been asked to develop a recommendation for management on howbest to recognize employees in a facility for achieving all of the facility’ssafety goals. The team has been asked to ensure that the dollar value of the


CH06pp060-67 4/10/02 12:50 PM Page 63

recognition does not exceed $30 per employee, or a total of $15,000 for the500-employee facility.

The team leader, Susan, is well versed in use of brainstorming, prioriti-zation methods, and other effective teamwork techniques. She understandsthe importance of reaching a team consensus for the recommendation thatwill be made to management. Susan is committed to ensuring that effectiveteamwork is fully achieved. The team will utilize brainstorming and Paretovoting to help ensure that the team is productive, that high-quality ideas aredeveloped, and that all members are supportive of the team’s final recom-mendation to management.

Frank has volunteered to record all brainstormed items on a flip chartlocated in front of the meeting room, and he will also take his turn in pro-


1) $30 cash for each employee2) Drawing for single $15,000 prize3) Drawing for 15 $1000 prizes4) Company picnic with families invited 5) Issue single share of company stock to each employee6) Jacket with appropriate patch7) $30 item selected by each employee from catalogue8) $30 of movie passes to local theater9) Renovate break rooms throughout facility

10) Purchase fitness equipment for a workout room11) Provide $30 gift certificate to local restaurant12) Add $30 to each employee’s retirement account13) Give each employee 2 hours off with pay14) Air condition the manufacturing area15) Provide ice cream and cake for celebrations throughout facility16) Send a notice of appreciation from management to home of each em-

ployee17) Give everyone raises18) Bring in entertainment for a local concert for employees and their

families19) Provide an ice chest with company logo for each employee20) Provide a plaque to be displayed in lobby with each employee’s name21) Provide a $30 gift certificate to a local department store22) Provide a $30 phone calling card23) Donate $15,000 to United Way in name of employees24) Cater an in-plant lunch for all employees with guest speakers25) Provide free tickets to NHL hockey game

FIGURE 6-1. Results of brainstorming process—list of employee reinforcementitems.

CH06pp060-67 4/10/02 12:50 PM Page 64

viding specific items for the list. Susan starts the meeting by explaining theteam’s charge, the process for brainstorming, and the importance of reach-ing a team consensus. Susan provides “think time” for each person to iden-tify ideas for employee recognition and then proceeds with asking eachperson for one idea to be posted on the chart. She repeats this process untilall ideas are exhausted. A listing of 25 potential reinforcement actions iden-tified by the team is illustrated by Figure 6-1.

Having the team discuss each of the 25 items and continuing the dis-cussion until a team consensus is reached is one approach for developing a


Item Votes

1) $30 cash for each employee2) Drawing for single $15,000 prize 13) Drawing for 15 $1000 prizes4) Company picnic with families invited 55) Issue single share of company stock to each employee6) Jacket with appropriate patch7) $30 item selected by each employee from catalogue 48) $30 of movie passes to local theater9) Renovate break rooms throughout facility

10) Purchase fitness equipment for a workout room11) Provide $30 gift certificate to local restaurant 512) Add $30 to each employee’s retirement account13) Give each employee 2 hours off with pay 214) Air condition the manufacturing area15) Provide ice cream and cake for celebrations throughout

facility16) Send a notice of appreciation from management to home 3

of each employee17) Give everyone raises18) Bring in entertainment for a local concert for employees 1

and their families19) Provide an ice chest with company logo for each employee 120) Provide a plaque to be displayed in lobby with each

employee’s name21) Provide a $30 gift certificate to a local department store 122) Provide a $30 phone calling card 123) Donate $15,000 to United Way in name of employees24) Cater an in-plant lunch for all employees with guest

speakers25) Provide free tickets to NHL hockey game

FIGURE 6-2. Brainstorming process—results of Pareto voting.

CH06pp060-67 4/10/02 12:50 PM Page 65

recommendation for management. Such an approach is at best a time-con-suming process with many pitfalls. A more productive approach is for theteam to narrow the list of 25 to the critical few items that have the most po-tential benefit before proceeding to more detailed discussions. The Paretovoting process is an ideal method to accomplish this objective. Since thereare 25 items listed, Pareto voting rules allow each participant to have 5 votes(20 percent of 25). Figure 6-2 presents the tabulation of votes after each par-ticipant has stated his or her top five selections.

My experience has been that this systematic process quickly narrowsthe list of potential actions down to a manageable number of items thatclearly have the most support from team members. These critical few itemscan then be discussed and researched in more detail by the team.

Since the process is an open one and viewed as fair and equitable byteam members, it greatly facilitates the achievement of both quality solu-tions and the consensus support of team members. In this case, the votingprocess has identified three potential reinforcement actions for facility em-ployees with broad support from team members: (1) a company picnic withfamilies invited; (2) a $30 gift certificate for each employee to a localrestaurant; and (3) the choice of a $30 item to be selected by each employeefrom a catalog. After detailed discussion of the three potential actions, theteam’s ultimate recommendation is for the facility manager to mail a per-sonal letter of congratulations to the home of each employee with a $30 giftcertificate to a local restaurant enclosed.

One variation of the Pareto voting technique is to provide each partici-pant with 100 points to spend, rather than individual votes. In using the“100-points method,” it is best to provide some up-front rules of play to en-sure fairness. For example, rules may be established requiring participantsto spend no less than 20 points on any single item with a maximum limit ofno more than 50 points on any one item. An advantage of the 100-pointsmethod is that it provides a more accurate quantification of the differencesin team member support for potential choices.

The Right Team AtmosphereThe right team atmosphere as described by Figure 6-3, sets the stage for

teams to achieve greatness. Such an atmosphere results in an environmentthat team members find to be challenging and a source of positive rein-forcement. It is an environment where members feel free to speak theirminds, and diversity in backgrounds and areas of expertise is valued.Leaders of effective teams recognize the importance of team synergy andownership.


CH06pp060-67 4/10/02 12:50 PM Page 66

References1. Juran Enterprises, Juran on Quality Improvement Workbook, 1st ed., 1983,

p. 2-2.2. “Good Team Atmosphere,” Eastman Chemical Company Quality Management

Awareness Training Manual, 1989.


1. The level of trust is strong enough so that team members can act nat-urally with one another.

2. People strive to understand what other members of the group say andfeel.

3. There is a mutual respect among team members, and diversity ofopinions is valued.

4. Individuals feel free to participate fully, including expressing agree-ment or disagreement with the ideas of other members.

5. The entire group, rather than just the leader, feels accountable for re-sults.

6. Members understand that constructive conflict and tension are often anecessary part of the effective teamwork process, but members arediligent in quickly extinguishing destructive criticism and actions.

7. People understand and accept that the group will have some highsand lows.

8. The team recognizes the importance of providing adequate "thinktime" for critical decisions.

9. The team effectively critiques itself and is committed to continuallyimproving the teamwork process.

10. Team members effectively reinforce one another when performanceexpectations are met or exceeded.

FIGURE 6-3. The right team atmosphere.2

CH06pp060-67 4/10/02 12:50 PM Page 67

Risk is a word dependent upon the context of its use for full definition.For example, the universe of risks that must be controlled to minimizetotal injury frequency is quite different from the specific risks that must becontrolled to prevent serious, high-consequence incidents. Further, “seri-ous incident” is a relative term with meaning dependent upon factors suchas size and type of organization. For a small employer, loss of a deliveryvehicle, destruction of a warehouse, or a disabling injury to a key em-ployee may be sufficient to endanger continued profitable operations.Occurrences having severe consequences for large facilities may be lim-ited to incidents resulting in fatalities, multiple injuries, major propertydamage, major business interruption, or significant impact on the public.

Understanding the risks is a prerequisite for identifying the criticalwork necessary to control the risks. Understanding risks requires answer-ing the questions: What can go wrong? How likely is each undesirableevent? What are the potential impacts? (See Figure 7-1). Understandingrisks requires in-depth knowledge of specific conditions and causal factorsthat could lead to serious incidents.

68

7Understanding the Risks

CHAPTER

CH07pp068-82 4/10/02 12:50 PM Page 68

Do Managers Understand the Risks?

Members of an expedition climbing to the summit of Mount Everestcan reasonably expect their expedition leader to have extensive past climb-ing experience either on Everest or one of the other major Himalayan peaks.

Understanding the Risks � 69

Involve Employees









CH07pp068-82 4/10/02 12:50 PM Page 69

Certainly, experience as a climber helps ensure that expedition leaders rec-ognize and understand the unique risks of high-altitude climbing.

In more traditional workplace settings, managers may reach their posi-tions by a variety of career paths—some of which do not ensure a full un-derstanding of the organization’s risks. Even when managers rise throughthe ranks within the operation where their careers began, managers are oftenmore versed in productive rather than preventive skills. It should not be as-sumed that obtaining an adequate understanding of risks occurs as a natu-ral part of the management development process. Managers with newresponsibilities must be educated regarding existing risks, and all managersmust be informed when significant changes occur that impact the organiza-tion from a risk perspective. In reality, staying educated on potential risksmust be a neverending task for both new and experienced managers.

Management may find a variety of tools useful in maintaining an un-derstanding of the organization’s risks. Conducting periodic managementbriefings is one effective technique. The purpose of these presentationsshould be to review: (a) the basics of each operation, (b) significant risksinvolved, and (c) the processes in place to control the risks. In addition toeducating upper management, the process provides a valuable learning ex-perience for the presenters. Major advances in personal knowledge can re-sult from preparations to present and prepare for questions that may arisefrom such briefings.

Management’s process for staying informed may also include partici-pation on selected committees and teams. For example, it may be appropri-ate for a senior site manager to chair the committee responsible for processsafety within a petrochemical facility. Leadership by a senior manager pro-vides the needed visibility for chemical process safety initiatives while ed-ucating the participating manager on site risks. A manager who leads asafety committee or who takes the lead on a new safety initiative often be-


UNIVERSE OF POTENTIAL

OUTCOMES

PROBABILITY

CONSEQUENCES

CRITICALRISKS

FIGURE 7-1. Understanding the risks.

CH07pp068-82 4/10/02 12:50 PM Page 70

comes a center of influence on safety issues—exerting influence both withsubordinates and members of the senior management team.

Visits to operating areas within a facility can be an effective part of themanagement risk-education process. These visits also provide area personnelan opportunity for interactive communication with managers. Advance sched-uling is the key to making management visits a reality. Without advance sched-uling, well-intentioned managers will find themselves yielding to the dailypressures and rationalizing that trips to the field are deferrable to another day.

Small Boat Operation: An Illustration of Risks

Consider the operation of a small fishing boat. Potential consequencesfrom boating incidents include drowning of passengers and loss of the boat.This knowledge is of interest, but a more detailed consideration of potentialaccident scenarios is needed for identifying the critical work necessary toprevent incidents. In operating a boat, for example, potential scenarios lead-ing to serious incidents include: (1) passengers falling out of the boat; (2) theboat capsizing; (3) the boat sinking due to leakage; (4) the boat sinking dueto overloading; or (5) the boat being destroyed by striking another object.

Expanding the consideration of risks to include specific potentialcauses and scenarios facilitates identification of critical work for effectivelycontrolling hazards. For example, identification of potential boating acci-dent scenarios leads to a conclusion that boating risks may be controlledthrough critical actions such as:

� Training passengers in boating fundamentals, the proper wearing oflife jackets, and in swimming skills;

� Properly equipping the boat with life jackets, a sign designatingmaximum loading, and lights for any operation during poor visibil-ity conditions; and

� Maintaining an inspection process to ensure the boat remains in fullysatisfactory condition.

A boating novice would likely, on his or her initial outing, be cautiousand concerned about the possibility of an accident. However, as the novicegains incident-free experience, a tendency toward complacency and blind-ness to hazards may develop. We find ourselves becoming desensitized tothe hazards. Consider the following news report from the AtlantaConstitution:


CH07pp068-82 4/10/02 12:50 PM Page 71

Sylvania—In the past, dozens of H. D. Mead’s employees on the 13,000-acre Wade Plantation had gone fishing on the old dead part of theSavannah River in that brown, flat-bottom aluminum boat.

Nothing out of the ordinary ever happened.On Monday, plantation hand Melvin Bates recalls, Norman Scurry

had taken his cousin, Bates wife, fishing in the boat. . . . Norman—de-scribed by his boss, A.M. Hill, the plantation manager, as a “great fisher-man”—had caught a mess of bream in the old river. His wife was cookingthe catch on the shore in a clearing beneath moss-laden trees. . . . Some ofthe kids wanted to go for a ride in the old boat, which was powered by asmall 3 1/2 horsepower outboard motor.

On Wednesday, Bates waited with others amidst swarming gnats inthe mournful humidity outside the Sylvania Funeral Home as Scurryviewed for the first time the bodies of his four children and niece, all ofwhom drowned Tuesday when that old boat sank in one of the worst boat-ing disasters in Georgia history.

“We’ve all been out in that boat with our kids,” said Bates, “and noth-ing ever happened. It goes to show you, you can be looking at death anddon’t see it.”

“I don’t to this minute know what happened,” said Norman Scurry. . . .“The front of the boat . . . just went straight down. Straight down. . . .”

The 12-foot boat is fine for the old river—which was once part of thethrobbing main channel of the Savannah. . . . But with six persons aboard,all so comfortable in their surroundings on the frolicsome family outingthat they did not follow simple safety rules, it was a floating disaster.

“He (Norman Scurry) told me he knew better than to put that manypeople in a boat at one time,” said Screven County Sheriff George F.Bazemore, “but he said since it was kids he thought it would be all right.”Neither Norman Scurry nor the children in the boat were swimmers.1

Understanding More Complex Risks

Like the after-the-fact awakening to the risks involved in boating, thechemical industry experienced a period of risk discovery following a 1984catastrophic incident in Bhopal, India. More than 2,000 people died after arelease of methyl isocyanate from a chemical facility. In Congressionalhearings, the statements by management responsible for the facility echoedthose of individuals affected by the fatal Georgia boating accident.Although the plant had been operating for seven years, top management in-dicated they were not adequately informed regarding the potential risks in-volved with their operation.2


CH07pp068-82 4/10/02 12:50 PM Page 72

With news of the Bhopal tragedy, I was among the safety directors andplant managers throughout the chemical industry contacted by the newsmedia for interviews. The pressing question was, “Can it happen at any ofyour facilities?” In retrospect, our response indicating that our facilitiescould not impact the public to the same magnitude as the Bhopal incidentwas totally correct. It’s fair, however, to say our assessment was based ongeneral knowledge of on-site operations rather than the results of scientificevaluations. In the months after the Bhopal catastrophe, in-depth evalua-tions of the potential for our operations to impact areas outside plant bound-aries provided an enhanced understanding of facility risks. This improvedunderstanding led to identification of numerous improvement initiatives—actions resulting in inherently safer facilities. The period of discovery andaction following Bhopal was truly an industry-wide phenomenon, and thework done to better understand the risks was a key to the implementation ofactions to more effectively control the risks.

The commitment and resources required for understanding major risksinvolved in operating complex operations, such as a large chemical facility,are obviously much greater than for understanding the risks of operating asmall boat. Complex operations, such as aviation, health care, large-scaleconstruction, manufacturing, utility operations, refineries, pipelines, trans-portation operations, and chemical facilities, require a systematic approachto identify and understand risks.

A petrochemical facility, for example, is typically comprised of thou-sands of components, all of which must function reliably, both separatelyand as a system. Failure scenarios with potentially serious consequencesmay be relatively numerous, and each must be understood in some detail.Consider, for example, a single component in a typical facility—a pump. Itis not sufficient to simply understand that a pump failure can result in a re-lease of material. Identification of the work necessary to control pump-re-lated risks requires a full understanding of the specific failures that canoccur. For example, the following conditions that can lead to pump failuremust be understood and controlled:

� Gradual changes leading to failure due to corrosion, erosion, or otherwear and tear.

� Changes in operating conditions that may contribute to increasedcorrosion or erosion.

� Improper installation or repair leading to failure of pump compo-nents.

� Misoperation, such as opening valves in the wrong sequence duringstartup.


CH07pp068-82 4/10/02 12:50 PM Page 73

� Quality control deficiencies leading to installation of a pump incom-patible with process requirements.

A Systematic Process of Risk Identification

Identifying and understanding significant risks for a major operation orfacility requires a comprehensive, systematic approach. An effectiveprocess for a petrochemical facility, for example, will generally require atleast the following:

� Input from operating, staff, and management personnel with opera-tional expertise

� Process hazard analyses

� A system for employees to report suspected deficiencies related toany aspect of the incident prevention process

� Management-of-change reviews

� Near-miss and accident investigations

� Field inspections

� Management briefings regarding specific serious-incident-relatedrisks

� Networking through trade associations and safety groups

� Review of investigative reports for incidents experienced by othercompanies

� Evaluation and compliance with regulatory standards such as theOSHA Process Safety Management standard

� Evaluation of applicable statistical summaries and technical infor-mation regarding the causes of accidents

� Computer modeling or other evaluation of the range of consequencesfor potential incident scenarios

Maintaining an adequate understanding of risks inherent in complexoperations is truly a neverending journey. The process requires perception,attention to detail, dedication, and a keen thirst for knowledge. The disci-pline and courage to challenge assumptions is critical. Experience confirmsthat rather than “what you don’t know,” the real danger is often linked to“what you think you know that isn’t so.” In traveling, the occasions wherewe become lost tend to be those where we are certain of the proper route—so certain that we fail to confirm the address or obtain directions. In oper-


CH07pp068-82 4/10/02 12:50 PM Page 74


FIGURE 7-2. Estimates of human performance error rates. (From System Safety2000 by J. Stephenson. Copyright 1991 by Van Nostrand Reinhold. Reprinted bypermission of John Wiley & Sons Inc.)3

(Highest) (Lowest)

100 10-1 10-2 10-3 10-4 10-5 10-6

1 in 1 1 in 1,000,000

•Missetting largevalves (no statusindicator exceptopen or closed)

• Selection of switchdissimilar in shapeor location to desiredswitch

•Crew reactionduring disaster

Technician seeingan out of calibrationinstrument as intolerance

••

Missetting largemanual valves(controlled byprocedure, keys,chaining, etc.)

Two-person team(one does, onechecks, then rolesare reversed)

•

•Simulated militaryemergency

•General error of omissionfor items embedded inprocedure

•Passive inspections(general walk-around)

• Selection of key-operated switchrather than non-key switch (doesnot•

General error ofomission (no controlroom display)

•Monitor/Inspector failsto recognize initial errorby operator

• General errors of commission, eg.,misread label and selected wrongswitch

•Simple arithmetic errors (withoutre-doing calculation on separatepaper)

CH07pp068-82 4/10/02 12:50 PM Page 75

ations with potential for serious incidents, assumptions made withoutchecking it out can lead to catastrophic consequences.

Understanding the Role of Human Error

Managers must have a firm understanding of the role human errors canplay in serious incidents. As illustrated by Figure 7-2, estimates of humanperformance error rates for various tasks range from a high probability(e.g., 1 in 10) to a very low probability (e.g., 1 in 100,000). When humanerrors can lead to severe consequences, managers must understand the widerange of potential responses and ensure tasks are designed to facilitate cor-rect responses.

Some environments have the unfortunate characteristics of being botherror inducing and unforgiving in the event an error is made. In the pres-ence of these conditions, preventative actions must be sustained to effec-tively block the pathway leading to incidents with severe consequences. Inpetrochemical, utility, and other similar operations, conditions such as un-planned shutdowns resulting from operational upsets can create stressful,error-inducing environments. The human error accident causation model, asillustrated by Figure 7-3, confirms that preplanned, proactive actions arevital in helping ensure plants are shut down safely. Examples of proactiveactions helpful in maintaining safe conditions during shutdowns include:(1) development of procedures, checklists, and other specific job aides; (2)operator training; and (3) testing and calibration of critical instrumentation.Regardless of the type of operation, the focus should be on identifying andimplementing specific actions necessary for reducing the potential for inci-dents due to human error.

Although accidents typically have multiple causes, investigations oftenindicate some form of human failure in the sequence of events leading tothe incident. Some human errors have immediate impact on safe work andresult in adverse effects leading directly to an incident. These types of er-rors are often committed by front-line personnel at the point-of-control andare commonly referred to as unsafe acts or “at risk” behaviors.

Other types of critical human failures lead to conditions categorized aslatent conditions. These types of conditions may be present for many yearsbefore they combine with at-risk behaviors and other random circumstancesto lead to an incident with catastrophic consequences. Such latent condi-tions include poor design, gaps in supervision, training deficiencies, inac-curate procedures, faulty planning, and less-than-adequate equipment.While unsafe acts having direct adverse impact are usually committed byhands-on personnel, latent conditions are often attributable to failures in the


CH07pp068-82 4/10/02 12:50 PM Page 76


FIGURE 7-3. Human error accident causation model.4

CH07pp068-82 4/10/02 12:50 PM Page 77

upper layers of the organization. Understanding an organization’s safetyrisks requires an understanding of both “at-risk” actions that can directlylead to incidents and the role of latent conditions that are like hidden landmines waiting for the right circumstances to cause destruction.

Classifying and Prioritizing Risks

Organizations have finite resources and must continually make deci-sions regarding the level of resources that will be applied to control risks. Itis important that the organization classify and prioritize its risks to providethe right guidance in making these strategic decisions. Risk classificationmethods include those that quantify risks by means such as probability ofoccurrence, costs, number of expected fatalities, or other potential out-comes. Other classification methods are commonly used that provide onlya qualitative description of potential consequences (e.g., catastrophic, crit-ical, negligible) and the probability of occurrence (e.g., frequent, occa-sional, improbable).

The Department of Defense’s Standard Practice for System Safety isprovided in MIL-STD-882D, and is an example of a classification methodthat incorporates both qualitative and quantitative factors in the risk priori-tization process. The standard utilizes four separate tables to describe andclassify risks as described below.

Mishap SeverityMishap severity categories provide a qualitative measure of the most

reasonable credible mishap resulting from personnel error, environmentalconditions, design inadequacies, procedural deficiencies, or system, sub-system, or component failure or malfunction. Suggested mishap severitycategories are shown in Table 7-1.

Note: These mishap severity categories provide guidance for a wide va-riety of programs. However, adaptation to a particular program is generallyrequired to provide a mutual understanding between the program managerand the developer as to the meaning of the terms used in the category defi-nitions. Other risk assessment techniques may be used provided that theuser approves them.6

Mishap ProbabilityMishap probability is the probability that a mishap will occur during the

planned life expectancy of the system. It can be described in terms of po-tential occurrences per unit of time, events, population, items, or activity.


CH07pp068-82 4/10/02 12:50 PM Page 78

Assigning a quantitative mishap probability to a potential design or proce-dural hazard is generally not possible early in the design process. At thatstage, a qualitative mishap probability may be derived from research, analy-sis, and evaluation of historical safety data from similar systems.Supporting rationale for assigning a mishap probability is documented inhazard analysis reports. Suggested qualitative mishap probability levels areshown in Table 7-2.

TABLE 7-2

Suggested Mishap Probability Levels (Based on MIL-STD-882D)7

Description* Level Specific Individual Item Fleet or Inventory**

Frequent A Likely to occur often in the life Continuously experiencedof an item, with a probability of occurrence greater than 10-1 in that life

Probable B Will occur several times in the Will occur frequentlylife of an item, with a probability of occurrence less than 10-1 in that life


TABLE 7-1

Suggested Mishap Severity Categories Based on MIL-STD-882D5

Description Criteria Category Environmental, Safety, and Health Result

Catastrophic 1 Could result in death, permanent total disability, lossexceeding $1M, or irreversible severe environmentaldamage that violates law or regulation.

Critical II Could result in permanent partial disability, injuries oroccupational illness that may result in hospitalization ofat least three personnel, loss exceeding $200K but lessthan $1M, or reversible environmental damage causinga violation of law or regulation.

Marginal III Could result in injury or occupational illness resultingin one or more lost work day(s), loss exceeding $10Kbut less than $200K, or mitigatible environmental dam-age without violation of law or regulation whererestoration activities can be accomplished.

Negligible IV Could result in injury or illness not resulting in a lostwork day, loss exceeding $2K but less than $10K, orminimal environmental damage not violating law orregulation.

CH07pp068-82 4/10/02 12:50 PM Page 79

TABLE 7-2 continued

Suggested Mishap Probability Levels (Based on MIL-STD-882D)7

Description* Level Specific Individual Item Fleet or Inventory**

Occasional C Likely to occur some time in Will occur several timesthe life of an item, with a probability of occurrence less than 10-2 but greater than 10-23

in that life

Remote D Unlikely but possible to occur in Unlikely, but can reasonablythe life of an item, with a be expected to occurprobability of occurrence lessthan 10-3 but greater than 10-6 in that life

Improbable E So unlikely it can be assumed Unlikely to occur, butoccurrence may not be experi- possibleenced, with a probability of occurrence less than 10-6 in that life

* Definitions of descriptive words may have to be modified based on quantity of items involved.

** The expected size of the fleet or inventory should be defined prior to accomplishing an assessment

of the system.

Mishap Risk AssessmentMishap classification by severity and probability can be performed by

using a mishap risk assessment matrix. This assessment allows one to as-sign a mishap risk assessment value to a hazard based on its mishap sever-ity and its mishap probability. This value is then often used to rank differenthazards as to their associated mishap risks. An example of a mishap risk as-sessment matrix is shown in Table 7-3.

TABLE 7-3

Example Mishap Risk Assessment Values (Based on MIL-STD-882D)8

Severity Probability: Catastrophic Critical Marginal Negligible

Frequent 1 3 7 13

Probable 2 5 9 16

Occasional 4 6 11 18

Remote 8 10 14 19

Improbable 12 15 17 20


CH07pp068-82 4/10/02 12:50 PM Page 80

Mishap Risk CategoriesMishap risk assessment values are often used in grouping individual

hazards into mishap risk categories. Mishap risk categories may then beused to generate specific actions, such as mandatory reporting of certainhazards to management for action or formal acceptance of the associatedmishap risk. Table 7-4 includes an example listing of mishap risk categoriesand the associated assessment values. In the example, the system manage-ment has determined that mishap risk assessment values 1 through 5 con-stitute “high” risk while values 6 through 9 constitute “serious” risk.

TABLE 7-4

Example Mishap Risk Categories (Based on MIL-STD-882D)9

Mishap Risk Assessment Value Mishap Risk Category

1–5 High

6–9 Serious

10–17 Medium

18–20 Low

The above process, based on MIL-STD-882D,10 provides a systematicmethod for categorizing and prioritizing risks. For complex operations,such a system can be of great benefit in providing a full understanding ofthe organization’s risks.

Understanding the Risks—A Prerequisite for Success

I once participated in a Fortune 100 company’s annual safety workshopwhere the corporate safety director declared that increasing compliance inthe wearing of seat belts for off-the-job driving should clearly be the pri-mary safety emphasis for the corporation. Plans were already in place toaudit employee compliance as they entered company parking lots eachmorning and to increase awareness through actions such as a seat-belt slo-gan contest.

Knowing that the company handled large quantities of hazardous mate-rials and that other risks existed that could potentially lead to serious inci-dents, several managers in attendance voiced support for wearing seat belts,


CH07pp068-82 4/10/02 12:50 PM Page 81

but at the same time vigorously questioned whether seat-belt complianceshould be established as the number-one focus for the company’s safety ini-tiatives. However, it was a case in which the corporate safety director hadestablished a position and would not consider any reevaluation.

Some months later, I read reports that the EPA had assessed this com-pany a multimillion dollar penalty as a result of hazardous materials leak-ing from storage tanks. The lack of control over hazardous materials alsoresulted in the community’s loss of confidence in the corporation—a loss oftrust that would prove difficult to recapture. While company support ofseat-belt regulations is clearly important, the company’s obligation to han-dle hazardous materials safely and without environmental harm was clearlyan issue having more potential impact on the continued long-term successof the organization.

Unfortunately, such misjudgments in evaluating and acting upon risksare not rare. History is full of instances in which serious incidents have oc-curred because those responsible for risk management had their eyes on thewrong ball.11 Focusing on the right opportunities requires a full under-standing of the risks.

References1. D. Morrison, “The Boat’s Front ‘Just Went Straight Down,’” Atlanta

Constitution, 26 July 26 1979, 1C, 3C.2. “Tragedy Shock Waves: Carbide Chief Urges Look at Chemical Industry

Safety,” Dallas Times Herald, 15 December 1984, 2A.3. J. Stephenson, System Safety 2000: A Practical Guide for Planning, Managing

and Conducting System Safety Programs (New York: Van Nostrand Reinhold,1991), 134.

4. Center for Chemical Process Safety. Guidelines for Preventing Human Errorin Process Safety (New York: AICHE, 1994), 258. Copyright 1994, AmericanInstitute of Chemical Engineers. Reproduced with permission.

5. “Standard Practice for System Safety (MIL-STD-882D),” U.S. Department ofDefense, 10 February 2000, 18–20.

6. Ibid.7. Ibid.8. Ibid.9. Ibid.

10. Ibid.11. J. Reason, Managing the Risks of Organizational Accidents (Aldershot,

Hampshire, England: Ashgate Publishing, 1997), 228.


CH07pp068-82 4/10/02 12:50 PM Page 82

The ability to transform concepts and slogans into specific tasks is oneof the key characteristics differentiating successful organizations fromthose destined to underachieve. In the context of serious incident preven-tion, concepts and slogans must be transformed into the critical work nec-essary to sustain safe operations. An organization’s long-term success inpreventing serious incidents will be determined by its effectiveness inidentifying and executing the right preventative actions.

Managing Similar Risks with Varying Levels of Success

Although many organizations have similar risks to manage, a signifi-cant variation in outcomes is common. As an illustration, governmentsaround the world achieve varying levels of success in controlling risks re-lated to the operation of motor vehicles. Automobiles were introduced inseveral countries during the same approximate time period: the late 1800sand early 1900s. In 1895, horseless carriages in the United States werelimited to about 300, mostly imported. By the turn of the century, however,automobiles numbered almost 4,000 among the 76 million Americans, and

8Identifying theCritical Work

CHAPTER

83

CH08pp083-095 4/10/02 12:50 PM Page 83

during the early 1900s, automobile ownership in the United States began toskyrocket.

Sadly, the increase in vehicles was accompanied by a tremendous esca-lation in vehicle-related deaths. By the 1920s, motor vehicle fatalities hadclimbed to 20,000 per year. With increasing public pressure to improve traf-fic safety, Herbert Hoover, then Secretary of Commerce, called the first


Involve Employees








CH08pp083-095 4/10/02 12:50 PM Page 84

National Conference on Street and Highway Safety. The 1924 national con-ference was one of America’s initial efforts to identify and reach consensuson the critical work required to minimize traffic-related fatalities. TheUniform Vehicle Code was developed at the conference, and these guide-lines became a model for traffic laws in every state.1

As time has passed, additional actions to reduce fatalities have beenidentified and implemented. Actions have included additional rules and reg-ulations, driver education, improved highway design and maintenance, im-proved signal devices, vehicle inspection programs, driver testing andlicensing, and enhancements such as seat belts. Certainly, the promulgationof rules, regulations, and design standards, together with enforcement ac-tivities, has varied significantly among countries throughout the world.

As illustrated by Figure 8-1, the results in preventing fatalities have alsovaried widely. Bottom-line results range from 7.0 fatalities per 100,000

Identifying the Critical Work � 85

FIGURE 8-1. Highway fatalities for selected countries (from USA Today).2

Fatalities Per 100K Vehicle Miles

CH08pp083-095 4/10/02 12:50 PM Page 85

vehicle miles in Egypt to the nearly 50-fold improvement of 0.15 fatalitiesper 100,000 vehicle miles in Britain. With the fundamentals of vehicle op-eration similar in each locale, these differences in outcomes are directly re-lated to each country’s effectiveness in identifying and implementing thework necessary to minimize fatalities.

This same variation in results holds for other forms of transportation,including commercial aviation. Statistics for a recent year, indicate that theprobability of commercial aviation passengers being involved in an accidentresulting in at least one fatality varied by a factor of 42 among air carriersthroughout the world. Flying with the carriers having the best records pro-vided an approximate 1 in 11,000,000 probability of death or injury, whileflying with the poorest performers resulted in a 1 in 260,000 probability.3

Interestingly, these wide variations in serious incidents exist despite eachcarrier being involved in a similar operation, the process of transportingpassengers through commercial aviation.

Beyond Regulatory Compliance

Even though vehicle-related fatalities in both Britain and the UnitedStates are substantially lower than in many other countries, one is hardpressed to accept the results as satisfactory. Efforts to prevent traffic-relatedfatalities are for the most part limited to developing and enforcing laws andregulations. As with other regulated activities, vehicle laws and regulationstypically represent minimum acceptable standards. For example, it has beenlegally acceptable to operate a vehicle in many parts of the United Statesfollowing consumption of alcohol, provided the blood alcohol level is main-tained below 0.10 percent. However, sound science supports the premisethat operation of high-speed equipment is prudent only at much lower bloodalcohol levels.

Less-than-outstanding results are predictable when preventative actionsare focused primarily on regulatory compliance. A manufacturing or pro-cessing facility, for example, should not expect satisfactory long-term re-sults if actions are limited to complying with rules promulgated by OSHA,EPA, and other agencies. A comprehensive, customized approach extendingbeyond compliance is essential to successfully manage risks.

In evaluating probable causes of major incidents, as tabulated inChapter 1, the need for proactive identification and execution of preventa-tive actions is evident. Many past incidents could have been preventedthrough executing work considered fundamental for the type of operationexperiencing the incident—fundamental actions with tremendous favorablebenefits. For example, typical actions applicable to preventing serious inci-


CH08pp083-095 4/10/02 12:50 PM Page 86

dents include facility inspections, testing of equipment and instrumentation,development of procedures, training, near-miss and accident investigation,emergency response drills, and effective management-of-change procedures.

Few of these actions are difficult to achieve singularly, but in total com-prise a comprehensive system of critical work requiring significant re-sources and a constancy-of-purpose to effectively manage. An effectiveincident-prevention process is needed to facilitate identification and dili-gent long-term execution of the critical work.

Identifying Critical Work

The potential for achieving major improvements through the identifica-tion and execution of critical work is illustrated by the success in reducingtornado deaths within the United States. Implementation of improved fore-casting and tracking technology, better warning systems, and increased pub-lic understanding of tornado risks have resulted in dramatic improvements,as illustrated by Figure 8-2. With the implementation of these improve-ments, the average number of annual deaths from tornadoes in the 1990swas reduced to about one-fifth the average annual rate experienced in the1930s.

Unlike the regulatory-driven approach to preventing vehicle-related fa-talities, the effort to minimize tornado deaths has been driven by sound sci-ence with emphasis on solutions that add value. This successful effortdemonstrates the loss prevention benefits that can be achieved through ac-curately identifying the critical work and then properly resourcing and exe-cuting it.


0

50

100

150

200

250

1930-39 1940-49 1950-59 1960-69 1970-79 1980-89 1990-96

AV

G A

NN

UA

L

DE

AT

HS

FIGURE 8-2. Average annual U.S. tornado deaths, 1930–1996 (from USAToday).4

CH08pp083-095 4/10/02 12:50 PM Page 87

The types of tasks that must be executed to sustain incident-free opera-tions are dependent upon the particular risks that must be managed. In ahealth care facility, for example, we would anticipate the list of actionsneeded to control risks to include critical work for addressing areas such astoxic material control, infection control, radiation safety, asbestos manage-ment, medical waste management, blood-borne pathogen control, fire pre-vention, emergency preparedness, facility evacuation, elevator safety, lossof critical utilities, and prevention of violent acts. For any type of operation,an effective management process is needed that facilitates diligent execu-tion of critical work required for success.

Regardless of differences in risks, the general types of causal factorsthat lead to serious incidents are common to different types of facilities andoperations. Critical work must be identified for controlling each of thesecausal factors to prevent deficiencies that could lead to a serious incident.These factors, as described below, include twelve related to human per-formance, six to equipment performance, and one to external causes.5

Causal Factors for Serious Incidents

Human Performance:

1. Verbal communication: the spoken presentation or exchange of in-formation

2. Written procedures and documents: the written presentation or ex-change of information

3. Man-machine interface: the design of equipment used to communi-cate information from the plant to a person (displays, labels, etc.)

4. Environmental conditions: physical conditions of the work area

5. Work schedule: factors that contribute to the ability of the worker toperform his assigned task in an effective manner

6. Work practices: methods workers use to ensure safe and timely com-pletion of task

7. Work organization/planning: the work-related tasks including plan-ning, scoping, assignment, and schedule of the task to be performed

8. Supervisory methods: techniques used to directly control work-re-lated tasks, in particular, a method used to direct workers in the ac-complishment of tasks


CH08pp083-095 4/10/02 12:50 PM Page 88

9. Training/qualification: how the training program was developed andthe process of presenting information on how a task is to be per-formed prior to accomplishing the task

10. Change management: the process whereby the hardware or software as-sociated with a particular operation, technique, or system is modified

11. Resource management: the process whereby manpower and materialare allocated for a particular task/objective

12. Managerial methods: an administrative technique used to control or di-rect work-related plant activities, which includes the process wherebymanpower and material are allocated for a particular objective

Equipment:

13. Design configuration and analysis: the design layout of the system orsubsystem needed to support plant operations and maintenance

14. Equipment condition: the failure mechanism of the equipment is thephysical cause of failure

15. Environmental conditions: the physical conditions of the equipmentarea

16. Equipment specification, manufacture, and construction: the processthat includes the manufacture and installation of equipment in the plant

17. Maintenance/testing: the process of maintaining components/sys-tems in optimum conditions

18. Plant/system operation: the actual performance of the equipment orcomponent when performing its intended function

External:

19. Human or nonhuman influence outside the usual control of thecompany

Critical Work for a Tank Car Loading Operation

The need for customized processes to address risks inherent to specificoperations is apparent when comparing a health care facility to a petro-chemical facility. Consider, for example, an organizational unit within a


CH08pp083-095 4/10/02 12:50 PM Page 89

chemical facility responsible for loading and properly securing chemicaltank cars for shipment. The loading and securement process must be care-fully performed to minimize the probability of product releases duringtransport. Let’s assume the operators responsible for loading and securingtank cars comprise a chemical loading and shipping team. The team’s goalsinclude zero releases resulting from improper securement or condition ofchemical tank car shipments.

In working toward leak-free rail shipments, the chemical loading andshipping team takes the same approach as utilized to improve results inother key performance areas. The team’s focus is on development of an im-proved process—a more effective process for tank car inspection and se-curement. To fully understand significant risks that must be controlled, theteam evaluates potential scenarios and causes that can lead to chemical re-leases from tank cars. The team’s objective is to drive transportation inci-dents, controllable by the team, to zero by identifying and executing thework critical to ensuring leak-free tank car shipments.

Worn manway gaskets have been the most common cause of past leaksfrom cars loaded by the team. However, the team recognizes that their inci-dent prevention efforts must be broad enough to address what can occurrather than limited to what has occurred. For additional information on po-tential causes of incidents, the team consults with the Association of


0 50 100 150 200 250

Shell or Head

Liquid Line

Safety Relief Valve

Bottom Fittings

Other Top Fittings

Rupture Disc

Other Causes/Unknown

Manway

Number of Incidents - 1997

FIGURE 8-3. Sources of tank car nonaccident releases, United States, 1997(from Transportation Technology Center Inc.).6

CH08pp083-095 4/10/02 12:50 PM Page 90

American Railroads. The Association’s database includes Non-AccidentRelease incidents involving tank cars for all U.S. carriers. The information,as summarized in Figure 8-3, confirms that manways, rupture discs, othertop fittings, bottom outlets, safety relief valves, and liquid fill lines, are themost frequent sources of leaks. Success in preventing future incidents willrequire the team to ensure that all potential causes of releases are effectivelyaddressed.

After investigation and input from all members, the improvement teamidentifies the specific work needed to minimize transportation incidentscontrollable by the team. Critical tasks identified include:

1. Documentation of the tank car inspection and securement process ina reference manual including:� Preloading inspection procedures and checklists

� Procedures for inspecting and replacing gaskets

� Proper use of tools for securement

� Procedures for tightening and securing dome lids, plugs, caps,valves, and other connections

� Postloading inspection procedures and checklists

2. Formal operator training including:

� Importance of zero tank car leaks

� Specific actions required to correctly perform each step of thedocumented tank car inspection and securement process

� Tool selection and proper usage

� Skills checks to ensure proficiency

3. An audit process involving scheduled hands-on inspections of tankcar securement by members of the loading and shipping team.

Sustaining Performance

The chemical loading and shipping team is confident that execution ofthe work identified as critical will drive the frequency of controllable trans-portation incidents toward zero. To help sustain long-term execution of thecritical work, the team’s process includes:

� Measurement systems for monitoring both the frequency of trans-portation incidents and results of tank car securement audits


CH08pp083-095 4/10/02 12:50 PM Page 91

� Timely performance feedback to all team members and management

� Reinforcement for sustaining the tank car securement process at ahigh performance level

� Identification of root causes and implementation of appropriate cor-rective action when performance fails to meet expectations


0

1

2

3

4

1 2 3 4 5 6 7 8 9 10

MONTH

NUMBER

FIGURE 8-4. Chemical loading and shipping team number of transportationincidents.

0

5

10

15

20

25

30

1 2 3 4 5 6 7 8 9 10

MONTH

NUMBERTOTAL CARS AUDITED

TOTAL SATISFACTORY

FIGURE 8-5. Chemical loading and shipping team tank car closure audit results.

CH08pp083-095 4/10/02 12:50 PM Page 92

The team of tank car loading and shipping operators is committed to re-maining alert for any changes affecting tank car loading and securementand continually strives to improve the incident prevention process. Throughmeasurement, timely feedback, and reinforcement contingent upon per-formance, the team knows where it stands in meeting performance expec-tations. The improving results for leak-free shipments and for tank carsecurement audits, as illustrated by Figures 8-4 and 8-5, are a major sourceof pride for the team.

A Systematic, Knowledge-BasedApproach

Through research and input from team members, the chemical loadingand shipping team effectively identifies the work critical to preventing re-leases from tank cars. The team’s systematic, data-based approach avoidsthe pitfalls of identifying the wrong things to work on. Such success in ac-curately identifying the right critical work is less likely when a managerproceeds on “gut-feelings” without sufficient research and input from oth-ers. Consider author Philip B. Crosby’s account7 of the misguided actionstaken by the coach of a mythical high school football team:

Coach Smedley conducted his evaluation after losing a game by a score of14 to 13. He reasoned that the problem was that the opposition hadblocked one extra-point try while his team had blocked none. Had his teamblocked two, the game would have been won 13 to 12.

The team set out on an intensive practice schedule devoted exclu-sively to the art of blocking extra points. They practiced all week, set goalsfor themselves, conducted motivational meetings to keep themselvespumped up. Two games later they blocked 13 extra points. They celebratedthe achievement of their target and then went on to deny their opponentsdozens of extra points during the remainder of the season. They had quiteforgotten that there is more to the game.

Correctly identifying the critical work is a prerequisite for success insustaining serious-incident-free operations. A systematic, data-driven ap-proach with input and involvement from knowledgeable individuals is re-quired. The work identified must be sufficiently comprehensive and mustbe diligently executed to ensure success. Measurement, timely feedback, re-inforcement, and proactive corrective action will be needed to sustain long-term performance at the level required to sustain serious-incident-freeoperations.


CH08pp083-095 4/10/02 12:50 PM Page 93

Process Safety Management Standard

The objective of OSHA’s Process Safety Management (PSM) standardis to prevent accidental releases of hazardous materials. The standard strivesto meet these objectives by requiring employers to execute the critical workas outlined by the standard. The objective of the work required by the stan-dard is to provide for the proactive mitigation or prevention of potential re-leases due to failures in processes, procedures, or equipment.

The PSM standard has much to offer. The types of critical actions re-quired by the standard provide a solid foundation for an effective safetyprocess even for employers not handling hazardous materials. When com-pared to the eight-element serious incident prevention process, however, wefind that the elements of the Process Safety Management Standard are pri-marily a listing of critical work to be done with little to offer in ensuring thatthe work is diligently executed consistent with established standards.Organizations will also find that many actions beyond PSM compliancewill be required for sustained success. Thus, the elements of PSM should beconsidered as a subset of the universe of critical work required to achieveand sustain serious incident free operations.

The actions required by the PSM standard, however, can be a very im-portant part of the total work required to maintain safe operations. The re-quired elements of the standard include:

� Employee participation

� Process safety information

� Process hazards analysis

� Operating procedures

� Training

� Contractors

� Prestartup safety review

� Mechanical integrity

� Hot work permit

� Management of change

� Incident investigation

� Emergency planning and response

� Compliance audits

The full text of OSHA PSM standards is located in the Code of FederalRegulations 29 CFR 1910.119. One of the elements of the PSM standard is


CH08pp083-095 4/10/02 12:50 PM Page 94

management of change. Effective management of change has proven par-ticularly important for the prevention of serious incidents and is discussedin more detail in the next chapter.

References1. G. S. McClellan, ed., “Safety on the Road,” The Reference Shelf, 38, no. 1

(New York: H. W. Wilson, 1966), 16–17.2. G. Visgaitis, “Highway Fatalities Abroad,” USA Today; 7 June 1996, 3E.

Reprinted with permission.3. J. Reason, Managing the Risks of Organizational Accidents (Aldershot,

Hampshire, England: Ashgate Publishing, 1997), 191.4. E. A. McLean, “Tornado Deaths in a Downward Spiral,” USA Today; 22 July

1997, 12A. Reprinted with permission.5. M. Ammerman, The Root Cause Analysis Handbook (Productivity Inc., 1998),

66–67.6. Transportation Technology Center Inc., Sources of Tank Car Non-Accident

Releases, U.S., 1991–1997, 1998.7. P. B. Crosby, Quality Without Tears—The Art of Hassle-Free Management

(New York: McGraw-Hill, 1984), 112. Reproduced with permission ofMcGraw-Hill.


CH08pp083-095 4/10/02 12:50 PM Page 95

Serious-incident-free operation is the norm. Even poorly managed or-ganizations do not typically experience such occurrences on a daily,weekly, or monthly basis. However, with the catastrophic impact of seri-ous incidents, organizations must be committed to sustaining incident-freeoperation for the long term—decades rather than months or years.Managers must adopt a mindset of completing careers without serious in-cidents within their areas of responsibility.

With serious-incident-free operation the norm, a simplistic approachtoward sustaining such operations is to prevent or control the occurrenceof changes. Obviously, in practice, we want some conditions to remainconstant while other changes are desirable and intentionally implemented.While maintaining the status quo is not feasible, it is clear that the capa-bility to prevent serious incidents is directly linked to effectiveness inmanaging both unplanned and planned changes.

Two forms of change must be addressed:

� Unplanned changes

� Planned changes

96

9Identifying theCritical Work—Management ofChange

CHAPTER

CH09pp096-102 4/10/02 12:50 PM Page 96

Unplanned Changes

Entropy recognizes that, in the absence of compensating forces, all mat-ter and systems tend toward disorder. With “change” being a potentialenemy of safe operations, the presence of naturally occurring degradation isa significant concern.

Changes driven by entropy are of particular concern because they occurslowly—often too slowly to be recognized by individuals who observe op-erations on a daily basis. Even if these changes are recognized, individualsmay not have the expertise to determine when corrective action is required.In operations such as aviation, petrochemicals, construction, and healthcare, prompt identification and accurate evaluation of subtle workplacechanges are critical to sustaining operations free of serious incidents.

Changes related to naturally occurring degradation may at first glance beprimarily associated with mechanical failures from forces such as friction orcorrosion. A closer look confirms entropy is also at work in eroding the ef-fectiveness of administrative processes. Major gaps in an organization’s pub-lished safety processes compared to actual implementation can develop. Forexample, with the passage of time, compliance with a facility’s safety permitsystem may degrade to where individuals routinely authorize maintenancework without conducting an adequate review of field preparations.

A process dependent upon general employee awareness to detect andevaluate the significance of subtle, naturally occurring changes is inade-quate. Recognizing and understanding the potential consequences of grad-ual changes requires a comprehensive, systematic approach. Managementtools such as audits, inspections, equipment testing, instrument calibrations,procedure reviews and training are needed. Many of us have experiencedthe advantages of including “outsiders” in safety inspections. Rather thancomparing an operation to “how it looked yesterday,” knowledgeable out-siders are more likely to compare the operation to “how it should be.”

Training courses on management of change typically focus on changesthat are planned and intentionally implemented. For planned changes, man-agers and other personnel commonly have advance knowledge prior to im-plementation. Management review is generally involved since approval ofexpenditures or other authorization is usually required. Reviews for sometypes of planned changes are also mandated by OSHA’s Process SafetyManagement Standard. Obviously, planned changes must be properly man-aged to prevent serious incidents. However, unplanned changes are equallyas critical while often receiving less scrutiny.

Examples of potential unplanned changes applicable to a chemical fa-cility include drum filling equipment that has become unreliable in dis-

Identifying the Critical Work—Management of Change � 97

CH09pp096-102 4/10/02 12:50 PM Page 97

pensing the proper quantity of material; unexpected changes in operatingpressures; a noise that has developed in a pump; instrumentation that hasceased normal operation; an odor where no odor is typical; changes in op-erating temperature; and unexpected changes in inventory level. The burdenfor recognizing the occurrence of unplanned changes often falls upon indi-viduals at the point-of-control operating level. Point-of-control personnelmust be timely in communicating evidence of significant changes and inimplementing corrective action. If drum-filling equipment malfunctions,members of the drumming crew may be the only individuals in position tosuspend operations and initiate corrective action. However, the entire or-ganization is dependent upon the individuals at the point of control to rec-ognize the problem and initiate the proper response.

Minimizing the consequences from unplanned changes requires indi-viduals at the point of control to have expert knowledge of the operationsfor which they are responsible. Point-of-control personnel must also have aclear understanding of organizational objectives. Employees who under-stand organizational priorities and objectives are much more likely to takethe correct action when responding to the unexpected. Expert knowledge,together with commitment to safe workplace objectives, is needed to helpensure workplace “red flags” that often accompany unplanned changes areobserved and properly evaluated.

While traveling to lunch with Eugene Thomas, a first-level supervisorand fishing enthusiast, I asked for advice on how to fish one of the arealakes. My past attempts to fish this lake had always ended in frustration dueto the heavy underwater hydrilla fouling my lure on almost every cast. Hisresponse was an enthusiastic dissertation on the best techniques for suc-cessfully fishing the lake. Eugene detailed the procedure for rigging a “BassAssassin” to make the lure weedless while retaining the capability to hooka high percentage of fish that strike. I was particularly impressed that his re-search on the rigging technique included observing a professional bass fish-erman who fished with the “Assassin.” Eugene encouraged me to be moreaware of the details—in particular, the locations of any openings in the un-derwater hydrilla. The “Assassin” should be allowed to free-fall throughopen pockets in the hydrilla to the lake bottom—where big bass lie in wait.

Even though Eugene has developed expert-level fishing knowledge, hehas remained eager to improve his knowledge and skills. He quickly detectsand accurately evaluates the significance of any changes in the fishing en-vironment—a change in wind direction, water conditions, ambient temper-ature, or the condition of his fishing gear. In fact, he recently shared withme that he no longer uses the “Assassin” as his main lure. “Flukes” nowseem to be more successful for him.


CH09pp096-102 4/10/02 12:50 PM Page 98

An equally high level of understanding and commitment is clearly feasi-ble in the workplace environment where individuals earn their living.Training, communications, performance measures, feedback, reinforcementsystems, and understanding of objectives are particularly critical in achievingthe desired level of understanding, commitment, and effectiveness throughoutthe organization. I have become a true believer in the power of committed in-dividuals and teams to make a real difference in workplace safety.

Planned Changes

A Texas city recently announced that it was refunding a Wal-Mart storefor an overcharge of $283,000 on its water bill. The city had replaced thestore’s water meter several years earlier with a new meter that measures thevolume of water usage in hundreds of gallons instead of in thousands of gal-lons like the old meter. The new meter functioned as designed, but after itsinstallation the city failed to change a factor in the computer system used tocalculate water bills. The system continued to assume that the number en-tered from the meter was in thousands of gallons rather than hundreds, re-sulting in the store being charged for a thousand gallons of water for everyhundred gallons used.1 How fortunate that this failure to manage change didnot involve life-threatening or other similar consequence.

In a large organization, the frequency of planned changes can be high,with changes initiated at many different organizational levels. Even thoughimprovement is the ultimate objective of most planned changes, some havethe potential for unintended consequences not readily apparent. Introducinga new raw material into a chemical manufacturing process to reduce costsmay also result in an unintended increase in process piping corrosion.Similarly, air bags installed in vehicles to protect passengers have beenfound to be potentially hazardous for the elderly and small children.

Specific methods for evaluating planned changes prior to implementa-tion may vary with the size and type of organization. However, each of thesemethods has a common objective—to ensure that planned changes involv-ing equipment, facilities, procedures, and processes do not adversely affectemployees, the public, or the environment. Systems to effectively managechange generally require documentation of the planned change, a review byappropriate technical experts and managers, pre-startup inspections ofchanges involving facilities or equipment, development or modification ofprocedures to address the changes, and employee training on the revisedprocedures.

Several excellent publications are available that focus on effective man-agement of planned changes. The American Chemical Society’s publication


CH09pp096-102 4/10/02 12:50 PM Page 99

A Manager’s Guide to Implementing and Improving Management ofChange Systems provides an in-depth review of systems applicable for bothsmall and large facilities.2 Facilities are encouraged to customize manage-ment-of-change systems based upon needs and resources. However, experi-ence indicates that effective systems have several common elements,including:

� Identifying the need for change

� Specifying review and approval steps

� Conducting appropriate hazard reviews

� Taking action to control associated hazards

� Obtaining approval and authorization

� Implementation of approved changes.

Identification of all planned modifications or replacements not consid-ered “replacement-in-kind” is a key management-of-change objective. Thisrequires identifying all planned changes involving items (e.g., equipment,raw materials, procedures) that deviate from the design specification of theoriginal item being modified or replaced. Changes that affect design speci-fications often lead to deviations from the normal output of a process, andthe significance of these potential changes must be closely evaluated priorto authorizing implementation of a process change.

The identification and review of planned changes provides an opportu-nity to decide if a proposed change should actually be implemented. The re-view process also provides the opportunity to identify any actions requiredto control unwanted side effects that could occur from the change. The re-view process must be flexible, and personnel must be trained in determin-ing the level of evaluation required for a specific proposed change. Forexample, a brief review may be fully sufficient to identify the potential con-sequences for some planned changes, while an in-depth HAZOP (hazardand operability), or other detailed analysis, may be required for others. Thelevel and intensity of review is typically a decision made by a designatedline manager, safety professional, or other authorized individual.

In reviewing planned changes, accurately identifying the potential forundesirable consequences can be very challenging. Effectiveness in con-ducting reviews varies among individuals due to differences in knowledgelevels, analytical capabilities, and other personal factors. My experience, infact, indicates that individuals with truly outstanding analytical skills forevaluating changes comprise only a small percentage of the workplace. Thevariation in individual capability increases the importance of utilizing theteam concept in reviewing planned changes.


CH09pp096-102 4/10/02 12:50 PM Page 100

The need for thoroughness in reviewing planned changes is illustratedby an incident involving a major health care facility. The hospital initiated aplanned change to utilize a new respiratory oxygen supplier. In the course ofimplementing the change, the supplier installed a new oxygen tank and sup-port equipment at the facility. The new installation included a section of hosein the oxygen distribution system that apparently contained residue from achemical compound utilized to clean the hose. Several patients requiring res-piratory care died in the days following their initial exposure to the new oxy-gen system.3 Although the investigation did not conclusively correlate thedeaths with the change in oxygen supply, the public images of both the hos-pital and oxygen supplier were unfavorably impacted. The point to be madeis that an in-depth review is required to successfully minimize the potentialfor subtle, unintended problems resulting from process changes.

In many facilities, processing and manufacturing operations are period-ically shut down to perform equipment maintenance or modifications. Theactions of shutting down the operation, managing the maintenance/modifi-cation work, and restarting the operation following completion of the workrepresent significant changes from the normal operating mode. Predictably,an abnormally high percentage of serious incidents have occurred duringsuch periods. One study indicates about 24 percent of the total serious inci-dents in petrochemical facilities occur when the operating mode is otherthan normal.4 Certainly, we would expect most petrochemical operationstypically to be in the “other-than-normal” mode less than 10 percent of thetime. Thus, the probability of an incident occurring during a day when a fa-cility is down for maintenance is likely to be several times higher than for aday when operations are in the normal mode.

Such shutdowns for maintenance and modifications belong in a specialcategory of planned change. Management tools such as procedures, training,contractor safety programs, and effective permit systems are particularly crit-ical in sustaining incident-free operations during these nonroutine periods.

Management of Change in the SeriousIncident Prevention Process

Table 9-1 provides a listing of management tools that can be effectivelyutilized to manage change. The serious-incident prevention process providesan effective method for ensuring that critical work necessary to sustain seri-ous-incident-free operations is identified and effectively executed. It is clearthat this work must include actions to effectively manage change. Successfulincident-prevention processes must ensure that all types of changes are ef-fectively managed, including both unplanned and planned changes.


CH09pp096-102 4/10/02 12:50 PM Page 101

TABLE 9-1

Tools for Effectively Managing Change

Unplanned Changes

AuditsInspectionsEquipment testingInstrument calibrationsProcedure reviewsTraining Near-miss and hazardous-condition reporting systemDocumentation of acceptable operating conditions and parametersEstablishment and communication of incident prevention objectivesManagement control systems including:� performance measures for serious incident prevention work� performance feedback� recognition and accountability� timely correction of identified problems

Planned Changes

Establishment of process for advance review and authorization of changesProcess hazard analysisPrestartup inspectionsProcedures updated for changesTrainingSafety permit systemsEffective communications

NOTE: The above listing is intended only to provide examples, and it is recognized that manyother potentially effective tools are available.

References1. M. Roark, “City Owes Wal-Mart $283,000 Refund,” Longview, Texas, Daily

News, 21 July 2001, 1A.2. J. S. Arendt, M. L. Casada, A. C. Remson, and D. A. Walker, A Manager’s

Guide to Implementing and Improving Management of Change Systems(Chemical Manufacturers Association Inc., 1993).

3. “Medical Gas Supplier Restricted Further: Judge Issues Order After Deaths of10 Veterans Exposed to Tainted Oxygen,” Dallas Morning News, 16 Nov.1997; 28A.

4. D. G. Mahoney, ed., Large Property Damage Losses in the Hydrocarbon-Chemical Industries, A Thirty-Year Review, 14th ed. (Risk Control Consulting,a division of J&H Marsh & McLennan Inc., formerly M&M ProtectionConsultants: 1992), 8.


CH09pp096-102 4/10/02 12:50 PM Page 102

Individuals have varying ideas on what it takes to satisfactorily exe-cute a job. Such variations can be observed in the way individuals performtasks—maintaining a yard, studying for an exam, or performinglockout/tagout procedures. When proper execution of tasks is critical topreventing incidents having the potential for catastrophic consequences,an organization would be negligent to entrust its destiny to the whims ofindividual opinions regarding satisfactory performance. A consensus onacceptable standards of performance is needed within the organization.Standards must support the execution of critical work in a manner that pro-vides a full margin of safety while utilizing resources effectively.Performance standards are a prerequisite to maintaining the operating dis-cipline necessary for incident-free operations.

What are performance standards, and what role do they play in theprevention of serious incidents? Performance standards are a means ofdocumenting and communicating how tasks should be performed andwhat results need to be accomplished—they serve to define excellence.Performance standards may be either explicit or implicit, with explicitstandards typically documented in written form—missions, goals, actionplans, policies, and procedures. Inferred or implicit standards are equallyas important in defining acceptable performance. These standards are

10EstablishingPerformanceStandards

CHAPTER

103

CH10pp103-110 4/10/02 12:50 PM Page 103

often reflected in each employee’s level of awareness, discipline, and carein performing work. Actions of employees often mirror the expectations andvalues of their leaders.


Involve Employees









CH10pp103-110 4/10/02 12:50 PM Page 104

Corporate/Company Standards

A hierarchy of performance standards exists. At upper management lev-els, performance standards are typically expressed in terms of missions, vi-sions, goals, objectives, policies, guidelines, and action plans. Input toupper management from organizational units accountable for implementa-tion is critical. Plans and standards developed in a vacuum tend to have ahigh mortality rate when introduced into the workplace environment. Eventechnically perfect standards are doomed to resistance from individuals nothaving the opportunity for input in the development stage.

Corporate level standards for a company might include:

1. A mission and vision statement incorporating safety objectives

2. A corporate safety policy

3. Goals and objectives to:� Reduce the frequency of hazardous material spills and releases

by “x” percent

� Experience zero incidents resulting in fatalities, major propertydamage, or impact on the public

� Conduct process safety management audits of each facility,with at least “x” percent of facilities achieving an A-level auditscore

� Obtain OSHA VPP STAR program status for all major facili-ties

4. Corporate guidelines for:� Hazard communication

� Hot work procedures

� Emergency response

� Isolation of energy sources

� Employee training

� Auditing of serious incident prevention processes



� Accident reporting and investigation

Establishing Performance Standards � 105

CH10pp103-110 4/10/02 12:50 PM Page 105

� Contractor safety

� Mechanical integrity

� Facility and fixed-equipment inspections

The company safety policy documents and communicates the organi-zation’s core values regarding safety performance. The policy should ad-dress prevention of serious incidents and protection of the public in additionto prevention of common injuries among employees and contractors. An in-creasing proliferation of policy statements has become a workplace real-ity—statements addressing safety, environmental, quality, diversity,harassment, and other issues. A growing competition has developed, notonly for conference room wall space, but for comprehension in the mindsof employees. A safety policy is most effective when it is developed withemployee input, and is concise, easy to understand, and sufficiently com-prehensive in scope.

Facility/Operating Level Standards

Goals and objectives generated at each level of the organization need tobe clearly documented together with action plans for achievement. Specificguidelines for execution of critical work should be established to providecriteria for excellence and promote consistency of actions. A company withmultiple locations may develop guidelines applicable to all facilities or maylook to each site for development of facility specific guidelines. In practice,some combination of corporate and site-specific guidelines is the norm. Theimportance of employee involvement in the development of standards is aconstant for all levels of the organization—top management through firstlevel. Managers and teams having the opportunity for input are more likelyto proceed with support rather than resistance.

A facility’s safe-practices manual can serve as an effective method fordocumenting many operating and maintenance-related safety standards. Asafe-practices manual provides guidance for work routinely performed—guidance impacting the performance of critical work by numerous employ-ees and contractors. Facility-wide standards must be based on soundrisk-management practices. A sufficient margin of safety must be includedin the standards to ensure jobs can be performed hundreds and thousands oftimes without creating conditions leading to a serious incident.

At the facility and departmental level, managers and their teams are ex-pected to implement actions to ensure that company goals, objectives, poli-cies, and guidelines are fully realized. For example, compliance with acorporate guideline for process equipment inspections may require manu-


CH10pp103-110 4/10/02 12:50 PM Page 106

facturing managers to develop and implement action plans and proceduresspecific to each operating unit. To ensure that process equipment inspec-tions accomplish their intended purpose, inspections must be executed inconformance with appropriate performance standards. In conducting a pre-startup inspection, for example, guidelines should be developed to assignresponsibility and document how the inspections will be conducted.

Expectations should be established for both target levels of perform-ance and for specific methods of performance. As one moves down the or-ganization chart, standards need to become more specific and detailed. Atthe point-of-control level, operating and maintenance procedures, togetherwith work authorization permits, are examples of the documentation neededto provide detailed guidance for the execution of critical work. Such docu-mentation helps ensure that the numerous actions and special techniquesnecessary to sustain long-term success are properly performed.

Reducing the frequency of accidental spills and releases is a commonsafety and environmental-related objective for chemical facilities and re-fineries. Performance standards in the form of action plans and proceduresare essential in documenting critical actions needed to achieve the desiredreductions. An effective action plan for reducing spills and releases shouldinclude steps to evaluate causes of past incidents, prioritize opportunitiesfor improvement, and initiate improvement actions. Examples of operatingand maintenance practices with potential for reducing hazardous materialspills include: double checking the alignment and position of valves prior tostarting flow, corrosion inspections, and the testing of high-level alarms ontanks. Such practices are a part of the critical work for spill reduction, anddocumented standards are needed to ensure expectations in performingthese tasks are clearly understood.

People will eventually make mistakes, and equipment will eventuallymalfunction. When errors or malfunctions have the potential for cata-strophic consequences, standards must include redundant safeguards block-ing the pathway to a serious incident. The consequences of inadequateperformance standards can be devastating.

In its investigative report1 of an overfilled underground hydrocarbonstorage cavern, the National Transportation Safety Board concluded that in-adequate performance standards were a contributing cause of the incidentthat resulted in three deaths. In recommending that the facility’s operatingpermit be revoked, a Texas State Board of Examiners concluded the caverninventory process was inaccurate, measurement procedures unreliable,safety devices not fully operable, and employees insufficiently trained.Facilities with inadequate standards of performance are in effect dependentupon good luck for sustaining safe operations. When the consequences offailure include the release of flammable or toxic materials, performancestandards dependent upon luck are clearly not sufficient.


CH10pp103-110 4/10/02 12:50 PM Page 107

Explicit and Implicit Standards

Performance expectations for the execution of critical work must bedocumented in enough detail to prevent conditions leading to serious inci-dents. However, good judgment must be exercised to avoid creation of a bu-reaucratic management system through excessively rigid requirements. Aproper balance between explicit and implicit standards must be maintained.A standard of “checking tank high-level alarms on a monthly basis” doesnot sufficiently describe the criteria for excellent performance.Documentation of the optimum methods for testing and calibrating thealarms is required—methods that ensure reliability of the alarm systemswhile utilizing resources efficiently. In establishing the required frequencyfor alarm tests, the consequences of failure to detect a hazardous conditionmust be considered together with the probabilities for both instrument mal-function and the presence of a hazardous condition.

In addition to developing task specific standards, management actionsmust be consistent with shaping an organizational culture that toleratesnothing less than excellence in performing the work necessary for seriousincident prevention. Management has the potential either to bring out thebest in people or to create a culture where mediocrity is the norm.Commitment to a constancy of purpose in support of the serious incidentprevention process is critical—any perception that the critical work is de-ferrable or optional must be avoided. Management must work toward insti-tutionalizing the incident-prevention process so that attention to the criticaldetails becomes a way of life. Management’s responsibilities include keep-ing the serious incident prevention flame burning.

Documentation of detailed performance standards for all behaviors andpractices required to sustain incident-free operations is impractical. A work-force must be developed that is not overly dependent upon rigorous man-agement controls to carry out proper actions. When documentedperformance standards do not exist, actions of employees will be guided bytheir previous training, commitment, and understanding of organizationalobjectives. Steven R. Covey emphasizes the need for effective work prac-tices formed through the coming together of knowledge (what to, why to),skills (how to); and desire (want to).2 To successfully sustain serious-inci-dent-free operations, team members must be consistently willing to go theextra mile, particularly in exercising their full mental capabilities.

Fear of criticism can cause individuals to rationalize a wait-and-see ap-proach when prompt action may be required to prevent conditions from de-teriorating toward a serious incident. Employee confidence in thedisciplinary review process is critical—is there a management bias to blameproblems on employee errors? Without confidence in the system, a ten-


CH10pp103-110 4/10/02 12:50 PM Page 108

dency toward deafness and blindness to early warning signals of potentialproblems may develop.

The World War II attack on Pearl Harbor would likely have resulted inless tragic consequences for the United States if radar operators hadpromptly issued an alert after observing an unusually large blip on the radarscreen. Operators apparently did not have the competence and confidenceneeded to properly interpret and report this “red-flag” condition. Ratherthan risking the possibility of sounding a false alarm on a Sunday morning,operators looked for alternate explanations and ultimately rationalized theactivity as a squadron of U.S. bombers. The first wave of Japanese aircraftarrived without warning at Pearl Harbor 38 minutes later. Following the at-tack, deficiencies in battle readiness standards were addressed by relievingtop military commanders from their assignments, but the damage at PearlHarbor had been done.3

Employees need more than a road map for performing critical work; acompass is needed to provide direction in uncharted territory. Employees onnight shift, for example, need to understand they have authority and are ex-pected to shut down equipment as needed to maintain safe conditions.Employees are continually recalibrating their compasses based upon howthey perceive management reactions to events. When employees are facedwith difficult decisions regarding actions to take, factors—such as how theboss reacted the last time equipment was shut down, and the level of mutualconfidence between the boss and employee—become critical. North on thecompass is continually being redirected by management’s actions—includ-ing some actions subject to misinterpretation. It has been observed, for ex-ample, that if equipment is down for repairs, managers often ask theirsubordinates when startup will be, but the message typically heard by sub-ordinates is, “Hurry, we’re losing money!” In these situations, employeesmay rationalize the taking of shortcuts, including the violation of safe workpractices, in order to achieve the results they perceive to be the most im-portant to the boss. Managers need to remember that their communicationsand personal reactions continually shape and reshape employee perceptionsof expected performance.

Standards—A Prerequisite forMeasurement, Feedback, andAccountability

Standards provide benchmarks for measurement and a basis for per-formance feedback.


CH10pp103-110 4/10/02 12:50 PM Page 109

Standards, together with measurement and feedback systems, make ac-countability for the critical work feasible and are essential in helping main-tain operating discipline. Without performance standards, the process modelis incomplete and insufficient to sustain serious-incident-free operations.

References1. Railroad Commission of Texas, Application of Seminole Pipeline Company to

Expand the Underground Hydrocarbon Storage Facility at Brenham SaltDome, Washington and Austin Counties, Texas; Oil and Gas Docket No. 03-0200582, 25 March 1994.

2. S. R. Covey, The 7 Habits of Highly Effective People (New York: Simon &Schuster 1989), 47–49. Excerpt used with permission. All rights reserved.

3. M. Carter, “Pearl Harbor—This Is No Drill,” Dallas Morning News, 1December 1991, 36A.


CH10pp103-110 4/10/02 12:50 PM Page 110

Measurement of performance compared to established standards is anessential element of the serious incident prevention process.Measurement, together with feedback of results to individuals and teamsresponsible for performance, provides the foundation for an effective ac-countability system. Measurement and feedback also facilitate the growthof employee pride, enthusiasm, and job satisfaction.

Effective measurement is essential in monitoring progress in key per-formance areas such as product quality, financial performance, customersatisfaction, safety, and regulatory compliance. Rather than a burden im-posed by management, measurement and feedback are consistent withpersonal needs. The sport of bowling, for instance, would have little ap-peal if performers had no knowledge of the pins knocked down—andknowing the score is equally important in the workplace. Measurementand feedback systems provide a source of focus and pride for point-of-control personnel, serving to raise competitive instincts and promote un-derstanding of the actions required to achieve and sustain improvements.

James Dyson, founder and chairman of the United Kingdom’s DysonAppliances Ltd., has a keen understanding of both the need for improvedprocesses and the fundamental human need for performance feedback.While vacuuming the floor at home, Dyson noticed that his conventional

11Measurement andFeedback

CHAPTER

111

CH11pp111-125 4/10/02 12:51 PM Page 111

vacuum cleaner seemed to be pushing dust around rather than collecting it.He was surprised to discover that the vacuum had lost a substantial amountof cleaning power despite its collection bag being less than half-full.

Dyson understood the basics of “cyclones,” which are conical-shapedvessels used in industrial applications to separate dust, such as sawdust,from air used to transport the dust. His recognition of the need to change the


Involve Employees









CH11pp111-125 4/10/02 12:51 PM Page 112

process for vacuum cleaners led to development of the double-cyclone, bag-less cleaner. Dyson’s revolutionary vacuum cleaner outsells its nearest com-petitor in the U.K. by a wide margin, and virtually all major vacuum cleanermanufacturers throughout the world now offer their versions of a baglessmachine.

Dyson’s genius also included an understanding of the human desire fordirect feedback of results when performing tasks. Other vacuum manufac-turers had historically assumed that individuals operating the machine didnot want to see the accumulation of dirt and grime as it was being vacu-umed. Dyson, however, realized that users do want to see the results of theirwork—whether it be bowling, preparing a vessel for confined space entry,or vacuuming a floor. His clear plastic, removable collection bin that showsthe dirt, debris, and dog hairs being collected provides direct performancefeedback to the vacuum cleaner operator and has added to the vacuum’scommercial success.1

Performance Accountability

Completion of each step in a “Plan-Do-Check-Act” continual improve-ment cycle helps ensure that desired initiatives are successfully deployed.An effective measurement and feedback system allows managers and oth-ers accountable for performance to stay up-to-date on implementation ef-forts. Progress beyond the “Plan” step is dependent upon a system formeasuring results and providing timely feedback to individuals and teamsaccountable for performance. When the consequences of failure are cata-strophic, an effective process must be in place for ensuring proper imple-mentation. Management confidence based upon anecdotal reporting,superficial inspections, or the passing of consecutive days without an inci-dent is a false confidence.

Performance Measurement for Critical Work

To illustrate an effective measurement and feedback system, consider awarehouse operation involving storage of combustible and flammable ma-terials. Critical work to prevent serious incidents for an operation of thistype would likely include:

� Development of storage, fire prevention, and emergency responseprocedures

Measurement and Feedback � 113

CH11pp111-125 4/10/02 12:51 PM Page 113

� Training personnel on procedures

� Scheduled inspections

� Hot work permit systems

� Evacuation/emergency response drills

� Management-of-change process

� Incident investigation and corrective action

� A hazard-reporting process

� Maintenance and testing of safety-related equipment including firedoors, sprinkler systems, smoke alarms, fire extinguishers, and se-curity systems

� An audit process

� A contractor safety process

Each task critical to preventing serious incidents must be executed con-sistent with an appropriate performance standard. The standard should typ-ically include a specified frequency and method for execution of the criticalwork. A weekly warehouse inspection, for example, may be an appropriatefrequency to ensure the means-of-egress system is adequately maintained.The inspection method must be sufficient to confirm that aisles and exitdoors are unblocked, emergency lights are in working order, and all otherconditions conform with documented means-of-egress standards. Suchstandards should incorporate appropriate regulatory requirements (i.e.,OSHA Subpart E—Means of Egress), and any value-adding performancerequirements beyond regulatory compliance.

The process utilized by the warehouse operating team for schedulingcritical work, measuring performance, and providing performance feedbackis documented by Tables 11-1, 11-2, 11-3, and Figure 11-1.


CH11pp111-125 4/10/02 12:51 PM Page 114

TABLE 11-1

Warehouse Operations Serious Incident Prevention Critical Work

Critical Work Frequency


Inspections conducted to ensure:

a) no leakage from stored containersb) proper storage practices for flammable

and combustiblesc) sprinkler system block valves fully

opend) forklifts in good conditione) facility security measures operationalf) sprinkler system heads unblockedg) fire extinguishers in place, unblocked,

and chargedh) fire doors unblocked and in working

orderi) no-smoking signs posted and in good

conditionj) evacuation routes posted and aisles,

exits, doors, signs, and lights in orderk) trash contained in self-closing metal

containersl) prestartup inspection for new or modi-

fied equipment

Deficiencies identified on inspectionsare on schedule for correction

Audit to ensure plans and proceduresare up-to-date and effectively imple-mented:

a) emergency response and evacuationplan

b) storage proceduresc) control of ignition sourcesd) safety-permit procedurese) management-of-change procedures

Initial and refresher training:

a) fire extinguisher useb) sprinkler system trip location and acti-

vationc) reporting of fires, spills, and other

emergenciesd) security practices and procedurese) facility evacuation planf) permit system to control hot work and

other ignition sources

DailyDaily

Daily

DailyDailyWeeklyWeekly

Weekly

Weekly

Weekly

Weekly

Prior to startup of new or modified equip-ment

Review list minimum of once per week(some items require more frequent follow-up)

All items audited annually

Frequencies for all critical work items:� Initial training for all new operators

within two months of employment� Refresher training every two years and

prior to significant changes

CH11pp111-125 4/10/02 12:51 PM Page 115

NOTE: Several technical references are available to assist in identifying the critical work necessary to pre-vent serious incidents in warehouse operations. Examples include: NFPA 1420, Recommended Practicefor Pre-Incident Planning for Warehouse Occupancies; NFPA 30, Flammable and Combustible LiquidsCode; and various insurance company publications.


g) lock-out procedures for controllinghazardous energy

h) lift-truck trainingi) proper storage practices

Facility orientation and site visit forlocal emergency response agencies

Emergency drill

Alarm and equipment tests:

a) smoke detectorsb) fire alarm systemc) evacuation alarmd) emergency lightse) security system

Process hazards analysis by cross-func-tional team

Investigation of incidents and near-missincidents with serious potential

Comprehensive review and update of se-rious-incident prevention process

Annual

Annual

Monthly for all items

Every 3 years

Within 24 hours of occurrence

Annual

TABLE 11-1 continued

Warehouse Operations Serious Incident Prevention Critical Work


CH11pp111-125 4/10/02 12:51 PM Page 116

TABLE 11-2

Warehouse Operations Serious Incident Prevention (Percent Critical Work Completed on Schedule)

Month/Year: 8 / XX


Critical Work

Area inspections:a) Daily checklist itemsb) Weekly checklist itemsc) New or modified equipment in-

spection prior to startup

Deficiencies noted on previous inspections on-schedule for completion

Audit of key processes:a) Emergency response and

evacuation planb) Storage proceduresc) Control of ignitions sourcesd) Maintenance permit systeme) Management of change

Procedures/plans up-to-date:a) Emergency response/evacuationb) Reporting of hazardsc) Management of changed) Maintenance permit systemse) Proper storage practices

Initial and refresher training:a) Fire extinguisher useb) Sprinkler system activationc) Reporting of emergenciesd) Security procedurese) Facility evacuationf) Control of ignition sourcesg) Reporting & correction of

hazardsh) Energy isolation proceduresi) Proper storage practicesj) Lift truck operation

Items Scheduled

DuringMonth?

yesyes--

yes

--

yes----

yes

yesyesyesyesyes

yesyesyes--------

--yes--

Comments

One weekly inspec-tion missed due toheavy vacations

All items are on-schedule for com-pletion

Achieved A-levelscore on bothprocesses audited

All procedures areup-to-date; one revi-sion completed dur-ing month

100% attendance atall training sessions

ScheduledItems

Completed?

yesno--

yes

--

yes----

yes

yesyesyesyesyes

yesyesyes--------

--yes--

CH11pp111-125 4/10/02 12:51 PM Page 117


Items Scheduled

DuringMonth?

--

--

yesyesyesyesyes

--

yes

--

20

Comments

All systems OK

Percent CompletedAs Scheduled:95%

ScheduledItems

Completed?

--

--

yesyesyesyesyes

--

yes

--

19

Critical Work

Facility orientation and site visit forlocal emergency response agencies

Emergency drill

Critical alarm and instrumentationtests:a) Smoke detectorsb) Fire alarmc) Evacuation alarmd) Emergency lightse) Security system

Process hazards analysis by cross-functional team

Investigation of incidents and “nearmisses”

Review and update of serious-inci-dent prevention process

Monthly Totals:


Warehouse Operations Serious Incident Prevention (Percent Critical Work Completed on Schedule)

12-Month Moving Average: 93%Goal for 12-Month Moving Average: 97% to 100%

CH11pp111-125 4/10/02 12:51 PM Page 118

Measurem

ent and Feedback�

119

TABLE 11-3

Critical Work Not Completed on Schedule—Status of Follow-Up Action

Item Behind Schedule Cause Projected Completion Date Completed Comments

Emergency light inspections Confusion over responsibility 2-1-xx 2-1-xx Responsibility clarified andlights inspected

Corrective action for Instructions unclear to 2-7 2-5repairing fire door found maintenance personnel onon last month’s inspection location of fire door that

needs to be repaired

Evacuation training 2 operators missed due 3-24 3-24to vacations

Investigative report not Conflicting priorities 4-7 Will expedite completionyet issued on chemical spill that occurred in December

CH11pp111-125 4

/10/02 1

2:51 PM P

age 119

FIGURE 11-1. Warehouse operations team—percent critical work complete.

Feedback and Its Linkage toReinforcement

Personnel responsible for the warehouse operation routinely receivefeedback and reinforcement on the quality of services provided to ware-house customers. This ongoing feedback and reinforcement tends to ensurethat warehouse activities impacting customer service receive priority—or-ders are promptly delivered, and inventories are replenished as needed. Thefeedback and reinforcement received shapes team priorities and drives ef-forts toward improving customer service.

Feedback and reinforcement from customers for executing work neces-sary to sustain serious incident-free warehouse operations is typically non-existent, however. Customers served by the warehouse are satisfied as longas services are adequate and costs are reasonable. Rather than being drivenby external sources, leadership for executing serious incident preventionwork must be generated internally—driven by the warehouse team togetherwith line management. Without an effective performance measurement andfeedback system, the team does not know where it stands—a situation thatis somewhat like driving a car with no speedometer, fuel gauge, or mainte-nance records. Without knowing the past and current levels of performance,


40

50

60

70

80

90

100

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

MONTH

Monthly %

12 Month Moving Avg

Goal

Congratulations! 100% Moving average atgoal level!

Lift truck trainer unavailable.Will provide “back-up.”

CH11pp111-125 4/10/02 12:51 PM Page 120

the team’s first indication of “loose bricks” in the safety process will likelybe the occurrence of an incident.

Without measurement and feedback, the warehouse team’s safety per-formance tends to be recognized only when a significant problem occurs—a pendulum that swings between either negative recognition or norecognition. Measurement and feedback help ensure employees are rein-forced for their diligent work in executing critical serious incident preven-tion tasks—adding “thanks for a job well done” to work that may otherwisebe perceived as thankless.

Knowing the score and understanding that others appreciate their con-tribution provides meaning to the work for each member of the team.Employees see the impact of their efforts, and the resulting pride serves tosustain performance at high levels. Measurement and feedback systemsprovide the information needed for managers to effectively reinforce teammembers for sustaining satisfactory performance—or for ensuring correc-tive action is initiated when needed.

Knowledge of results facilitates the identification of barriers that mayimpede performance. Knowing that improvements will be measured andthat feedback will be provided to superiors provides incentive for managersto take on the difficult challenge of removing performance barriers. Whenthe capability does not exist for monitoring and communicating improvedresults, few managers are willing to allocate the time, resources, and per-sonal energy required for barrier bashing.

Elevating the Visibility of Critical Work

The critical work to sustain incident-free operations tends to be low vis-ibility, with neither the actual performance of the work nor the status of thework typically visible to management. It is a paradox that this low-visibil-ity work has profound implications for the company’s highest visibility per-formance indicators—profits, customer service, company image, employeesatisfaction, and safety. Consider the catastrophic incident at a petrochemi-cal facility that resulted in 23 fatalities, together with loss of more than $1.5billion in property damage and business interruption. This catastrophic in-cident was directly linked to apparent deficiencies in one of the low-visi-bility tasks critical to preventing serious incidents—that of effectivelyisolating piping systems to eliminate the potential for flammable releasesduring maintenance work.2,3

Similarly, a $21-million loss due to fire in an Iowa warehouse resultedfrom deficiencies in the basic tasks of controlling smoking and providingproperly designed trash receptacles.4 Success in preventing serious inci-


CH11pp111-125 4/10/02 12:51 PM Page 121

dents requires attention to the old adage, “Big doors swing on little hinges.”Individuals accountable for performance must pay attention to the details—the condition of each hinge is critical.

Characteristics of Effective Measurementand Feedback Systems

Processes for sustaining serious-incident-free operations must be for-ward looking rather than driven by after-the-fact reactions to incidents.After-the-fact knowledge cannot replace losses. Knowing that a ship has notsunk or experienced major damage during past operations has limited valuein preventing or predicting future events. The seaworthiness of a ship mustbe judged on detailed knowledge of the crew and craft. Proactive knowl-edge is required to help ensure that conditions necessary to sustain incident-free operations are consistently maintained.

The focus of measurement should be on actions and conditions that di-rectly impact serious-incident-free operations. For a ship, key areas ofmeasurement might include the condition of the ship’s hull, the skill levelof the crew, and the reliability of the navigational system. For a pipeline op-eration, measures should address critical factors that reflect the capabilityof the system to sustain incident-free operations, i.e., the condition of thepipe, cathodic protection systems, and right-of-way. While a low injury fre-quency is a favorable indicator of the potential for outstanding performanceby both the ship and pipeline crews, an injury frequency measure does notsufficiently reflect the status of workplace conditions necessary to sustainserious-incident-free operations. While some overlap exists, prevention ofcommon injuries and prevention of serious incidents are two separateprocesses and should be recognized as such.

Measurement Systems

The objective of measurement is to monitor actual performance com-pared to expectations. Characteristics of an effective measurement systeminclude:

� Influenceable—Performers directly influence the measured results.

� Meaningful—The items measured are important to the performerand organization.


CH11pp111-125 4/10/02 12:51 PM Page 122

� Timely—Prompt measurement provides information on the currentquality of work and allows performers to make timely adjustments asneeded to improve results.

� Accurate and Reliable—Measurement provides data that truly reflectactual performance. The measure is objective and not easily manip-ulated.

� Sensitive to change—The measure promptly reflects significantchanges in performance.

� Void of unwanted side effects—The measure does not promote un-wanted behaviors to achieve the desired level of performance.

Feedback Systems

The objective of feedback is to communicate results in a manner thatfacilitates sustaining satisfactory performance and improving inadequateperformance. Characteristics of an effective feedback system include:

� Specific—The feedback provides specific knowledge regarding per-formance.

� Simple—Feedback is easily understandable.

� Visible—Feedback is effectively communicated through charts andother visual aids.

� Positive—Feedback is constructive rather than used as a vehicle forplacing blame.

� Timely—Feedback is provided soon after results are generated. Thelinkage between results and execution of the work is maximized.Timely feedback facilitates prompt adjustment of the process asneeded.

� Individualized—Feedback is tailored to optimize meaning for indi-viduals and teams.

� Self-monitoring—Teams take the initiative to monitor their own per-formance and provide performance feedback to all team members.

� Goal-related—Feedback is specific to performance impacting orga-nizational goals and objectives.

� Linkage with reinforcement and corrective action—Feedback effec-tively triggers reinforcement for good performance and correctiveactions when improvements are needed.


CH11pp111-125 4/10/02 12:51 PM Page 123

Types of Measurement and Feedback Systems

Any list of critical work necessary to sustain a safe workplace typicallyincludes tasks that must be executed at varying frequencies. Target fre-quencies may range from a time span of hourly (i.e., instrument readings)to a span of several years between task performance (i.e., pressure testingor “smart-pigging” a pipeline system). The high number of tasks involvedand the varying frequencies for execution can result in a system requiringeffective organization for successful administration. A system of documen-tation, as illustrated by the tables and figures in this chapter, is useful in en-suring required tasks are effectively scheduled and executed. The systemlends itself to providing effective measurement and feedback in the form ofgraphs and charts to individuals and teams accountable for performance.

Performance monitoring for some types of work can be best accom-plished through an audit process. Audits are an appropriate tool, particularlywhen knowledge-based judgment is required to quantify the level of per-formance. Audits are an excellent tool for measuring the level of policy de-ployment throughout an organization—for example, monitoring the level ofcompliance to energy isolation, hot work, or management of change stan-dards. The focus of audits should be on ferreting out improvement oppor-tunities and identifying other opportunities for positively reinforcingindividuals and teams. When deficiencies are identified, emphasis must beon determining root causes and implementing timely corrective actions.

Status reporting to management can also be an effective measurementand feedback tool. Progress reports on safety related initiatives promoteself-measurement with a direct feedback loop to the performer.Management reviews of progress on key initiatives provide an appropriate“Check” step to help ensure plans are moving toward implementation.

Safety Performance Indexing

A combination of different types of measurement and feedback sys-tems, e.g., charts, audits, and status reports, will typically be needed to pro-vide the performance monitoring and the feedback systems required todrive improvements. However, many organizations have found value in de-veloping a single measure, or at least a limited number of measures, to re-flect how the organization is progressing in achieving its safety objectives.A safety performance index utilizing a matrix that weights key performanceindicators is a simple but very powerful technique that meets these needs.Safety performance indexing is discussed in detail in Chapter 12.


CH11pp111-125 4/10/02 12:51 PM Page 124

Essential to the Process

Measurement and feedback make good sense from many perspectives.These systems serve to continually inform key personnel of performanceand to give meaning to the work for individuals responsible for executingthe tasks critical to sustaining safe operations. Measurement and feedbacksystems document and communicate where we have been, where we are,and the direction in which we are heading. Measurement and feedback sys-tems are congruent with human needs and are essential components of theserious incident prevention process.

References1. M. Gottlieb, “Conventional Wisdom Be Damned,” Industry Week, 21 June

1999, 36–44.2. D. G. Mahoney, ed., Large Property Damage Losses in the Hydrocarbon-

Chemical Industries, A Thirty-Year Review, 15th ed. (Risk Control Consulting,a division of J&H Marsh & McLennan, Inc., former M&M ProtectionConsultants: 1993), 3–42.

3. Phillips Petroleum Company, Phillips 66 Company’s Response to OSHACitations, 9 May 1990, 1–10.

4. S. G. Badger, “1995 Large-Loss Fire and Explosions,” NFPA Journal,November/December 1996, 66.


CH11pp111-125 4/10/02 12:51 PM Page 125

Measurement and feedback systems for monitoring the status of criti-cal actions and results are required to drive improvements needed to meetan organization’s goals and objectives. Specific measurement systems maybe implemented to monitor key indicators of the safety process, such as:

Percentage of critical work completed on schedule:

� Inspections

� Audits

� Equipment testing

� Employee training

� Emergency drills

� Hazards analyses

� Operating procedure reviews

� Resolution of recommendations from hazard analyses, incident in-vestigations, audits, near-miss reports, etc.

� Other critical work based on organization-specific risks

Results of employee safety culture surveys

126

12Measurement andFeedback—SafetyPerformanceIndexing

CHAPTER

CH12pp126-140 4/10/02 12:51 PM Page 126

Frequency and severity of incidents:

� Injuries

� Property damage and business interruption

� Hazardous material releases

� Regulatory agency violations

� Other

With such a large number of parameters to consider in evaluating thesuccess or failure of the safety mission, how can managers know if the or-ganization’s progress is in the right direction? Utilization of the safety per-formance indexing technique will often be the best solution for providingthis information. Safety performance indexing provides an effective methodfor measuring, tracking, and graphically displaying safety performance.

Safety performance indexing can help the organization to:

� Focus on proactive, preventive measures rather than on measurementof after-the-fact indicators

� Monitor several key measures on an ongoing basis

� Establish appropriate improvement goals and reinforcement mile-stones

� Quantify progress in improving safety

� Focus the organization’s resources on the highest priority safety ini-tiatives

� Provide an equitable comparison of safety performance among dif-ferent organizations.1

Establishing a Safety Performance Indexfor Prevention of Serious Incidents

The process for implementing the safety performance index is illus-trated by Figure 12-1. Steps in the process include identifying key per-formance areas, identifying critical work and results needed to improveperformance in each key performance area, identifying progress measures,establishing goals and reinforcement milestones, and tracking performance.

There are several variations of the safety performance index, but eachmethod typically utilizes a matrix that provides the capability for weightingthe relative importance of each key performance area and for quantifying

Measurement and Feedback—Safety Performance Indexing � 127

CH12pp126-140 4/10/02 12:51 PM Page 127

overall performance. My extensive experience with the type of matrixshown in Figure 12-2 has been very favorable, and the performance indexhas proven to be a very powerful tool. As illustrated, key progress measuresare listed in the first column of the matrix, the next ten columns are re-served for documenting current and desired levels of performance for eachkey measure, and the remaining four columns are used for recording actualperformance (Value), the performance level achieved (Level), the relativeweighting for each measure (Weight), and calculating a score based uponthe actual performance and weighting for each measure (Score).

Safety Performance Indexing—An ExampleA simplified example will provide a better understanding of how the

matrix is developed. Let’s assume your organization has identified five keyperformance areas, as listed below with a weighting factor that the imple-mentation team has decided to assign to each area.

1. Leadership training for first-level supervisors: assigned a weightingof 20

2. Audit scores for regulatory compliance: assigned a weighting of 15

3. Timeliness in addressing corrective actions to incident investigationsand hazards analyses: assigned a weighting of 20

4. Annual volume of hazardous materials spills: assigned a weightingof 25

5. Recordable injury rate: assigned a weighting of 20

(Note that the sum of the weighting factors must equal 100; in this case20 + 15 + 20 + 25 + 20 = 100.)

A first step in developing the matrix is to record the key performanceareas to be measured and the weightings for each area in the matrix asshown by Figure 12-3. A next step is to identify the current level of per-formance and both realistic improvement goals and more visionary “stretchgoals” for each progress measure. Improvement goals are those that the or-


IdentifyActions and

ResultsNeeded

IdentifyProgressMeasures

Identify KeyPerformance

Areas

Establish Goalsand

ReinforcementMilestones

TrackPerformance

FIGURE 12-1. Steps for implementing the safety performance index.

CH12pp126-140 4/10/02 12:51 PM Page 128

Measurem

ent and Feedback—Safety Perform

ance Indexing�

129

Performance Level CalculationsProgressMeasures 0 1 2 3 4 5 6 7 8 9 10 Value Level x Weight =

Score

TOTAL SCORE =

FIGURE 12-2. Matrix for safety performance indexing.

CH12pp126-140 4

/10/02 1

2:51 PM P

age 129

130


Performance Level CalculationsProgressMeasures 0 1 2 3 4 5 6 7 8 9 10 Value Level x Weight = ScoreLeadership

Training (%)20

Audit Scores(%)

15

TimelinessCorrective

Action(days)

20

Volume ofSpills (lbs)

25

RecordableInjury Rate(Injuries /200K hrs)

20

TOTAL SCORE =

FIGURE 12-3. Matrix for safety performance indexing with progress measures and weights.

CH12pp126-140 4

/10/02 1

2:51 PM P

age 130

ganization believes are attainable, typically within a one- or two-year periodof time, while stretch goals may take longer and require additional re-sources to achieve. The implementation team has identified the key per-formance areas, current performance levels, goals, and stretch goals, asdocumented in Figure 12-4.

Quantified information on current performance, goals, and stretchgoals (an attainable vision) are then recorded in the matrix. As illustrated byFigure 12-5, the current performance level (baseline) is recorded in column3, the goal level in column 7, and the stretch goal or vision in column 10.The design of the matrix is such that improvements, such as increasing thepercentage of required training completed or decreasing the average daysrequired for correcting action items always increase the performance levelsachieved in the matrix resulting in correspondingly higher scores.

A next step is to establish intermediate or sub-goals for levels 4, 5, and6 and enter this information into the matrix in the columns between thebaseline level (3) and the goal level (7). Appropriate entries for these levelsmay be determined by either evaluating the expected improvement fromplanned initiatives or by simply establishing the numbers between level 3and 7 on a prorated basis. A simple way to accomplish the proration is totake the difference between level 3 and level 7 and increase or decrease thelevel by about 25 percent for each increment. For example, the differencebetween level 3 and 7 for “Timeliness of Corrective Action” is 30 days (60- 30 = 30). Applying the 25-percent rule for “Timeliness of CorrectiveAction” and for the other key performance areas results in the entries shownin Figure 12-6.

Although our intent must be to continually improve scores to abovebaseline levels, the matrix should also have the capability for reflecting any


Key Performance Area CurrentPerformance

Level

Goal StretchGoal

(1) Leadership Training (% complete)

40% 85% 100%

(2) Audit Scores (%)75% 90% 100%

(3) Timeliness for Corrective Actions (average days required)

60 days 30 days 15 days

(4) Volume of Hazardous Material Spills (average lbs per month)

340 lbs. 100 lbs. 10 lbs.

(5) Recordable Injury Rate (injuries per 200K hrs)

6.5 3.0 1.5

FIGURE 12-4. Documentation of key performance areas, current performance,and goals.

CH12pp126-140 4/10/02 12:51 PM Page 131

132


Performance Level CalculationsKeyMeasures 0 1 2 3 4 5 6 7 8 9 10 Value Level x Weight = ScoreLeadership

Training (%) 40 85 10020

Audit Scores(%) 75 90 100

15

Timelinessof CorrectiveAction (avg.

days)

60 30 1520

Volume ofSpills (avg.

lbs permonth)

340 100 1025


6.5 3.0 1.520

TOTAL SCORE =

Baseline Goal Stretch Goal

FIGURE 12-5. Matrix for safety performance indexing: addition of current performance, goals, and stretch goals.

CH12pp126-140 4

/10/02 1

2:51 PM P

age 132

Measurem


ance Indexing�

133

s

Performance Level CalculationsKeyMeasures 0 1 2 3 4 5 6 7 8 9 10 Value Level x Weight =

ScoreLeadership

Training (%) 40 52 63 74 85 10020

Audit Scores(%) 75 78 82 86 90 100

15


Action (avg.days)

60 52 44 37 30 1520


lbs permonth)

340 280 220 160 100 1025


6.5 5.6 4.7 3.8 3.0 1.520

TOTAL SCORE =


FIGURE 12-6. Matrix for safety performance indexing: addition of sub-goal levels 4, 5, and 6.

CH12pp126-140 4

/10/02 1

2:51 PM P

age 133

performance that deteriorates to levels below the baseline. This is accom-plished by assigning appropriate values to performance levels 0, 1, and 2,as illustrated by Figure 12-7.

The design of the matrix provides the capability for scores continuingto increase even after the goals documented in column 7 are reached. Thiscapability is provided by recording stretch goals in column 10 and then en-tering values for performance levels 8 and 9 in the appropriate columns. Theteam designing the matrix has flexibility in assigning these numbers, butone approach for determining values between the goal (column 7) andstretch goal (column 10) is to establish increments based on 33 percent ofthe difference between the values of columns 7 and 10. For example, thedifference between levels 7 and 10 for “Timeliness of Corrective Action” is15 days, and applying the 33-percent guideline results in increments of 5—in this case, a value of 25 for column 8 and 20 for column 9. The matrixwith all values entered is illustrated in Figure 12-8.

The matrix is now fully developed and ready for use. For illustrationpurposes, we will assume that a hypothetical company, Smith Industries,Inc. has developed a safety performance index matrix and is utilizing it tomonitor performance on a monthly basis. Let’s assume Smith Industries hascompleted six months of using the system, and performance levels for themost recent month were as follows:

� Leadership Training: 78 percent complete

� Audit Scores: 92 percent

� Timeliness of Corrective Action: 52 days

� Volume of Spills: 75 lbs.

� Recordable injury rate: 5.2 per 200,000 hours worked

To determine the monthly score, the first step is to record the monthlyachievement for each key performance area in the “Value” column. For ex-ample, training is 78 percent complete, and a 78 is recorded in the value col-umn for Leadership Training. The next step is to determine thecorresponding performance level for each key measure by identifying thehighest performance level fully achieved. In determining this level, no fa-vorable rounding of numbers should be performed. For example, since thevolume of spills has been reduced to 75 lbs., performance level 7 (100 lbs.)has been surpassed, but level 8 (70 lbs.) has not yet been achieved.Therefore, for “volume of spills” the actual achievement of 75 is recordedin the value column, the 100 in column 7 is circled, and the correspondingperformance level of 7 is recorded in the Level column for use in calculat-ing the score. Figure 12-9 illustrates entries of monthly performance data in


CH12pp126-140 4/10/02 12:51 PM Page 134

Measurem


ance Indexing�

135


ScoreLeadership

Training (%) 25 30 35 40 52 63 74 85 10020

Audit Scores(%) 65 69 72 75 78 82 86 90 100

15


Action (avg.days)

75 70 65 60 52 44 37 30 1520


lbs permonth)

425 400 375 340 280 220 160 100 1025


8.0 7.5 7.0 6.5 5.6 4.7 3.8 3.0 1.520

TOTAL SCORE =


FIGURE 12-7. Matrix for safety performance indexing: addition of levels 0, 1, and 2.

CH12pp126-140 4

/10/02 1

2:51 PM P

age 135

136



ScoreLeadership

Training (%) 25 30 35 40 52 63 74 85 90 95 10020

Audit Scores(%) 65 69 72 75 78 82 86 90 94 97 100

15


Action (avg.days)

75 70 65 60 52 44 37 30 25 20 1520


lbs permonth)

425 400 375 340 280 220 160 100 70 40 1025


8.0 7.5 7.0 6.5 5.6 4.7 3.8 3.0 2.5 2.0 1.520

TOTAL SCORE =


FIGURE 12-8. Matrix for safety performance indexing: addition of levels 8 and 9.

CH12pp126-140 4

/10/02 1

2:51 PM P

age 136

the Value column and the corresponding entries made in the Level columnbased on the highest performance level achieved. (Note the “Level” columnis the third column from the right in the matrix and will be multiplied by theweighting factor to determine the score for each key performance area.)

The final step in using the matrix is to calculate the scores by multi-plying the Level achieved times the Weighting factor for each key perform-ance measure and then summing the scores for each measure to calculate atotal monthly safety performance score. Figure 12-10 illustrates these stepsand indicates a total score of 560 for the month. An evaluation of the ma-trix indicates that goal levels have been achieved for audit scores and in re-ducing the volume of spills. Further reducing injury rate and improving thetimelines of corrective actions provide the most opportunity for the team toimprove their safety performance index score.

Graphing the monthly scores provides visual feedback on the organiza-tion’s performance in improving safety. The monthly graph facilitates thetracking of performance trends, helps identify performance milestones thatmerit positive reinforcement, and provides an early warning when perform-ance has begun to deteriorate. Feedback can be even more effective whenthe organization’s goal and comments on monthly performance are added tothe graph of the performance index results.

Figure 12-11 illustrates Smith Industries’ first six months of perform-ance following implementation of performance indexing. The organizationhas increased its performance from the baseline level of about 300 to a cur-rent score of 560. The performance graph has facilitated positive reinforce-ment—for example, when performance surpassed 500, Smith Industries’management visited each department to express appreciation for the out-standing work done in driving improvement from the baseline level. Safetyperformance indexing has proven to be a powerful measurement and feed-back tool for the company, and the organization is well on its way to achiev-ing the goals it has established.

Safety performance indexing has many applications. As illustrated bythe Smith Industries’ example in this chapter, the technique can be utilizedto integrate an organization’s numerous key measures into a single per-formance measurement system. As illustrated in the case study described inChapter 15, the safety performance index can also be utilized to calculatean overall performance level for an organization based on performancescores achieved within various units of the organization.

One powerful feature of performance indexing is that it provides quan-tified performance data, and the availability of quantified data greatly en-hances the organization’s capabilities for reinforcing performance.Reinforcement of performance is a critical component of the serious-inci-dent prevention process, and the next chapter describes how reinforcement


CH12pp126-140 4/10/02 12:51 PM Page 137

138



ScoreLeadership

Training (%) 25 30 35 40 52 63 74 85 90 95 100 78 6 20

Audit Scores(%) 65 69 72 75 78 82 86 90 94 97 100 92 7 15


Action (avg.days)

75 70 65 60 52 44 37 30 25 20 15 52 4 20


lbs permonth)

425 400 375 340 280 220 160 100 70 40 10 75 7 25


8.0 7.5 7.0 6.5 5.6 4.7 3.8 3.0 2.5 2.0 1.5 5.2 4 20

TOTAL SCORE =


FIGURE 12-9. Matrix for safety performance indexing: addition of values and levels for performing calculations.

CH12pp126-140 4

/10/02 1

2:51 PM P

age 138

Measurem


ance Indexing�

139

Month / Year _______________

Performance Level CalculationsKeyMeasures 0 1 2 3 4 5 6 7 8 9 10 Value Level x Weight = ScoreLeadership

Training (%) 25 30 35 40 52 63 74 85 90 95 100 78 6 20 120

Audit Scores(%) 65 69 72 75 78 82 86 90 94 97 100 92 7 15 105


Action (avg.days)

75 70 65 60 52 44 37 30 25 20 15 52 4 20 80


lbs permonth)

425 400 375 340 280 220 160 100 70 40 10 75 7 25 175


8.0 7.5 7.0 6.5 5.6 4.7 3.8 3.0 2.5 2.0 1.5 5.2 4 20 80

TOTAL SCORE = 560


FIGURE 12-10. Matrix for safety performance indexing: calculation of monthly score.

CH12pp126-140 4

/10/02 1

2:51 PM P

age 139

can be effectively utilized to help ensure desired performance is achievedand sustained.

References1. Eastman Kodak Company, Safety Performance Indexing—Metrics for safety

performance improvement projects, 1994.


200

300

400

500

600

700

800

900

1000

1 2 3 4 5 6Month

Monthly Score

Goal

Stretch Goal

Monthly Performance Graph

FIGURE 12-11. Smith Industries Safety Performance Index.

CH12pp126-140 4/10/02 12:51 PM Page 140

Reinforcement

Richard Jackman, a prominent lecturer and management consultant,told a humorous story once that illustrates the power of reward systems ininfluencing personal actions:

I was watching my dad farm, and I was helping him farm, in the late ‘30sor early ‘40s, and we were not farming very well. In fact, we were aboutready to fold up farming until the government came along with a verytimely program which they announced, to pay us for not farming.

Now, right away, that captured our attention. And, the first phase ofthat program was to pay us for not raising hogs. Now, we looked at thatand we said, we can handle that. And, so, we assessed our capabilities,and we made a determination that in that first year that we could not raise200 hogs. And, so we did this, and we did it well, so well, that at the endof the first year the government sent us a check of $4,000.

Now, in the second year, based on this accelerated learning curve,we decided to expand. It was time to grow. And, we made a commitmentnot to raise 400 hogs. But, you know, that never did work out too well.

13Reinforcement andCorrective Action

CHAPTER

141

CH13pp141-152 4/10/02 12:51 PM Page 141

We had a lot of paperwork to fill out . . . it was a case of trying to growtoo big too soon.1

Although Jackman’s story relates to a tangible, financially based rewardsystem, other forms of reinforcement also serve to influence actions and at-titudes. How encouraging it is when a spouse, friend, boss, or other co-worker takes the time to recognize our personal actions—even a simple


Involve Employees









CH13pp141-152 4/10/02 12:51 PM Page 142

“thank you” can have a major impact. If the boss brags on our work, itmakes our day. Positive reinforcement is wind for our sails, providing thesupport needed to sustain the constancy of purpose required for our long-term commitments.

During my early years with Eastman Chemical Company, the ability topositively reinforce was not a prominent management trait. A few managerswho were ahead of their time practiced it, but these pioneers were usuallymore popular with their subordinates than their bosses. From this baseline, Iwas fortunate to have participated in a cultural change leading to a workplaceenvironment where reinforcement is graciously given and received. Suchchanges do not come easily, but once institutionalized, the process of rein-forcement is a force multiplier in harnessing involvement and commitment.Effective reinforcement is critical in developing the organizational mindsetneeded to sustain high-level performance and continual improvement.

The primary objective of reinforcement is to help performers feel ap-preciated for work well done. Reinforcement facilitates the constancy ofpurpose needed to sustain and continually improve performance. The focusshould be on reinforcement that is sincere, specific, immediate, and per-sonal—consistent with what is known as the SSIP rule (Table 13-1). A sec-ond important acronym to remember is PIC—behavioral research hasrepeatedly confirmed that reinforcement perceived by the performer to bepositive, immediate, and certain (PIC) is the most effective form of rein-forcement in shaping new behaviors.2

TABLE 13-1

SSIP Rule for Effective Reinforcement

S: SincereS: SpecificI: ImmediateP: Personal

The reinforcement process should include both planned reinforcementfor progress on key organizational objectives and other more spontaneousreinforcement that is integrated into the daily routine. Experience confirmsthat long-term effectiveness of the reinforcement process is enhancedthrough: (1) training in proper reinforcement techniques, (2) compliancewith the SSIP rule, (3) an emphasis on social, nontangible reinforcementperceived to be positive, immediate, and certain, and (4) reinforcement con-tingent upon performance.

Some managers are concerned that their actions to reinforce individu-als and teams will be perceived as insincere or manipulative. These are valid

Reinforcement and Corrective Action � 143

CH13pp141-152 4/10/02 12:51 PM Page 143

concerns, but compliance with the SSIP rule and other guidelines will allowthe benefits of reinforcement to be realized while minimizing unwantedside effects. Delivery of reinforcement should be contingent upon perform-ance completed rather than as a “bribe” intended to force a future outcome.Reinforcement should be specific to the achievement and, whenever feasi-ble, based upon performance data. To avoid being perceived as insincere, in-dividuals must conduct sufficient research to understand the achievementthey intend to reinforce. Managers must also avoid harboring a hiddenagenda in their reinforcement efforts. Resentment is certain if employeesperceive self-promotion as the manager’s real purpose in publicizing indi-vidual or team contributions.

Management should avoid over-reliance on tangible reinforcers, such ascash, gift certificates, clothing, or other items. Individuals receiving tangi-ble awards often perceive the level of appreciation as proportional to thevalue of the recognition item received—“We saved the company a hundredgrand; how can that be worth only a T-shirt?” Furthermore, when rein-forcement is based on tangible recognition, employees are often disap-pointed unless the value of items received escalates over time. Individualsrationalize that if a ball cap was given for working a year without a lost-timeaccident, certainly two years should merit a lined jacket, and perhaps a $100bonus for the third year.

Compliance with the SSIP rule can become treacherous when rein-forcement is focused on tangible items. Tangible reinforcers are often diffi-cult to administer in a specific, immediate, and personal manner. Ratherthan a satisfactory experience, reinforcement initiatives can become stress-ful for the manager if employees begin to consider tangible reinforcementas a standard part of the compensation package with an expectation forawards to continually escalate. The “it takes big bait to catch big fish” phi-losophy can create havoc. In order to maximize the “payout,” individualsmay rationalize massaging the data used to measure performance. Such fil-tering of data is a major disservice to the organization when the potentialconsequences of performance deficiencies include serious incidents.

Tangible reinforcers, however, do have an appropriate place in rein-forcement processes. In some circumstances, the prudent use of tangible re-inforcers can help facilitate effective communication of the reinforcementmessage. For example, the serving of snacks or lunch can provide an en-hanced setting for effectively communicating a message of thanks for a jobwell done. Reinforcers with symbolic value, such as plaques, team photo-graphs, or ball caps can also be effective in helping communicate appreci-ation for performance.

What is perceived as desirable reinforcement may vary among individ-uals and from team to team. Astute managers and team leaders should main-


CH13pp141-152 4/10/02 12:51 PM Page 144

tain an ongoing awareness of what individuals and teams consider reinforc-ing. The most effective opportunities are often those that combine tangibleand social reinforcement—for example, a gathering to celebrate significantachievements. A hamburger cookout to reinforce achievements of signifi-cant milestones can be a fun and effective setting for a celebration. With keymanagers planning the event and serving as wait staff and cooks, such out-ings help build teamwork while providing a forum for effectively reinforc-ing specific achievements. Other examples of social and tangiblereinforcers are listed in Table 13-2.

TABLE 13-2

Potential Reinforcers

Social/Intangible:Expression of appreciation, recognition or praiseNotations on performance measure chartCongratulatory letter, memo, or E-mailVisits by manager, team leader, or other stakeholderRecognition at meetingsNewspaper articlesOpportunity to represent organization

Tangible:*Food: lunch, snacks, take-home itemsClothing: ball caps, T-shirts, jacketsMementosTeam or project photographTrophiesPlaquesGift certificatesSpecial parking or drive-in privileges

*Always to be accompanied by specific verbal or written communications related to the achievementbeing reinforced.

Although delivery of reinforcement should always follow performance,specific plans for reinforcement should be proactively developed in ad-vance of desired achievements. A documented reinforcement plan should beincluded in any action plan developed to meet a key organizational goal orobjective. The reinforcement plan helps ensure that, as performance mile-stones are reached, reinforcement is not only remembered but is timely andeffective as well. Table 13-3 provides guidelines for maintaining effectivereinforcement plans. Table 13-4 illustrates a serious incident prevention re-inforcement plan developed and administered by a team responsible for awarehouse operation storing hazardous materials. The team’s plan provides


CH13pp141-152 4/10/02 12:51 PM Page 145

the who, what, when, and why for reinforcing achievement of performancemilestones.

TABLE 13-3

Guidelines for Effective Reinforcement

� Reinforcement is earned—contingent upon performance

� Reinforcement is administered not only for results but also for actions

� Reinforcement is administered for both individual and team performance

� Reinforcement is primarily social/intangible

� Tangible reinforcement is utilized selectively and is generally symbolic

� Reinforcement is not negotiated and does not escalate

� Actions and results reinforced are limited to those achieved without violating or-ganizational principles in other key performance areas

� Reinforcement is based upon measures that reflect true performance and are notsubject to manipulation

� Reinforcement is consistent with the SSIP rule

TABLE 13-4

Reinforcement Plan Warehouse Operations Serious Incident Prevention

Result or Action Who Receivesto Reinforce Reinforcement? Who Delivers?

Critical work identified, Entire warehouse team First-level supervisorperformance standardsdeveloped, and SIP measurefully implemented for one month

SIP measure sustained for Warehouse team steward First-level supervisor2nd and 3rd months for measure

100% completion of critical Each warehouse team member First-level supervisorwork achieved for month

12-month moving average Entire warehouse team Arranged and attended byabove goal for at least 3 second-level supervisorconsecutive months and team in consensus to establish higher goal

SIP process improved or Individual initiating First-level supervisorupdated update or improvement


CH13pp141-152 4/10/02 12:51 PM Page 146

In addition to following through in implementing documented rein-forcement plans, managers should proactively search for evidence of out-standing performance as a part of the daily routine. Ongoing reinforcementshould become a daily habit for leaders through words of thanks, a high-five, or whatever else is readily available and appropriate. Surveys oftenconfirm that managers believe they initiate reinforcement frequently whilesubordinates feel reinforcement is received infrequently. This paradox is re-lated to the pyramid shape of most organizational charts together with thetrend toward wider spans of management control. A manager with twentyor more employees in his or her unit may truly reinforce subordinates on adaily or weekly basis. However, each individual may be on the receiving endon limited occasions. Thus, managers and team leaders should consider theimpact of reinforcement from the perspective of individual employees.

Unwanted side effects from well-intended but misguided reinforcementcan create barriers to achieving the results needed for an organization to befully successful. As an illustration, a Fortune 500 retailer enacted a com-mission system for its auto center workers that reduced base salaries by asmuch as 50 percent. Thus, for many workers the commission received forselling parts and services became more valuable than any reinforcement an-ticipated for satisfying customers. Later, a California probe found an aver-age of $223 in unnecessary parts on each car serviced by the company’sauto centers. In 1992, the company publicly encouraged customers to returncars for free correction of problems. It also ran full-page advertisements inmajor newspapers throughout the country reconfirming its commitment tocustomer satisfaction.3

Like the commission-based wage system that led to dissatisfied cus-tomers, misguided reinforcement practices can undermine the integrity of afacility’s serious incident prevention process. Reinforcement practices thatemphasize high production and cost reduction jeopardize the process if re-inforcement is neglected for executing the work necessary to sustain inci-dent-free operations. Clearly, production and cost-control-relatedreinforcement is appropriate, provided milestones are accomplished with-out sacrificing principles of safe operation. Reinforcement must not beskewed toward a small number of specific performance areas to the detri-ment of other critical areas. Maintaining the constancy of purpose neces-sary for serious incident-free operations requires that reinforcement beeffectively administered for the work critical to safe operations.

Reinforcement actions provide direct insight into a manager’s value sys-tem, priorities, and beliefs. Effective reinforcement processes help maintainthe constancy of purpose required to ensure that low-visibility, but essential,serious incident prevention tasks are diligently performed. Reinforcement isan essential part of the process of watering what we want to grow.


CH13pp141-152 4/10/02 12:51 PM Page 147

Corrective Action

Corrective action is universally recognized as a necessary managementresponsibility, but the subject seems largely ignored in “how-to-manage”publications. Perhaps the subject is considered too mundane to merit com-prehensive discussion. Experience indicates, however, that corrective actionis a vital part of the serious incident prevention process. An organization’sapproach to corrective action significantly impacts its long-term capabilityfor sustaining incident-free operations.

Successful corrective action must be implemented proactively, prior tothe occurrence of failures with major consequences. Such proactive correc-tive action is made feasible only through the existence of effective meas-urement and feedback systems for upstream indicators of performance.

Addressing Causal Factors

When the organization has the right measurement systems in place, de-teriorating performance in the safety process will begin to be reflected inthe measurement of upstream performance indicators during the formativestages of problems. Deteriorating performance for key measures often re-flects problems in one of the nineteen general categories of causal factorsleading to incidents.4 These causal factors, described in more detail inChapter 8, can be a starting point for identifying root causes of problems.Causal factors include:

Human Factors:

1. Verbal communication

2. Written procedures and documents

3. Man-machine interface

4. Environmental conditions

5. Work schedule

6. Work practices

7. Work organization/planning

8. Supervisory methods

9. Training/qualification

10. Change management

11. Resource management


CH13pp141-152 4/10/02 12:51 PM Page 148

12. Managerial methods

Equipment Factors:

13. Design configuration and analysis

14. Equipment condition

15. Environmental conditions

16. Equipment specification, manufacture, and construction

17. Maintenance/testing

18. Plant/system operation

External Factors:

19. Human or nonhuman influence outside the usual control of the com-pany

Responding to Red Flags

Near misses and red-flag observations should also serve as triggers forcorrective actions. The 1996 crash of a 763-foot freighter into a NewOrleans riverfront shopping center made national headlines as an apparent“freak” accident. However, investigation revealed that of the 500,000 vesselmovements per year through the Port of New Orleans, about 200 vessels peryear lose steering capability, with about 30 vessels making contact eachyear with bridges, docks, or other vessels.5 Rather than a “freak” incident,this was a serious incident waiting to happen.

A performance measure that indicates unsatisfactory results is anothertype of red flag that must be addressed. Teams must review measures fre-quently to ensure early detection of unsatisfactory performance, to deter-mine actions for correcting performance, and to ensure timelyimplementation of corrective actions. For example, if audit scores for per-formance of lock-out/tag-out procedures indicate deficiencies, the organi-zation must act firmly and with a sense of urgency to understand andcorrect the problem. To do otherwise places the organization and its em-ployees in extreme jeopardy.

Minor accidents, near misses, performance deficiencies, and other redflags serve as precursors to serious incidents. An effective system must bein place to capture and evaluate these precursor events. When an early warn-ing signal indicating the potential for a serious incident is identified, proac-tive and timely implementation of corrective action is clearly a challengethat must not be ignored.


CH13pp141-152 4/10/02 12:51 PM Page 149

Managers frequently talk-the-talk regarding the need to find and correctroot causes. However, discussions often reveal a lack of consensus on what“finding the root cause” really means. (Root cause is often defined by textsas “the most basic reason[s] for a problem, which, if corrected, will preventrecurrence of that problem.”)6 Some managers seem interested only in trac-ing causes back to the point where, in the mind of the manager, a personcould have taken action to prevent the incident. The incident is then classi-fied as caused by human error, and corrective action is targeted to influencebehavior. Such an approach considers only the shallowest of roots. The or-ganization becomes dependent upon superhumans who are expected alwaysto take the right compensating actions to circumvent conditions leading toserious incidents.

When the potential consequences of a performance failure are serious,the objective must be to implement corrective actions that will remain effec-tive for decades. Solutions must be effective even when the organization’sbottom-quartile performers are at the controls. Corrective actions must be in-stitutionalized to withstand changes in supervision and other factors that im-pact an organization over the long haul. Corrective actions with stayingpower are usually those developed and implemented with employee inputand those with a performance measurement system in place for monitoringprogress. Table 13-5 summarizes guidelines for effective corrective actions.

TABLE 13-5

Guidelines for Effective Corrective Actions in Sustaining Serious-Incident-Free Operations

� Be Proactive

� Promote individual/team involvement and ownership of the serious incident pre-vention process

� Investigate deficiencies reflected by critical work performance measures

� Investigate near misses and other “red flags”

� Strive for solutions not dependent upon the attention of best personnel or perfectoperating/administrative controls

� Institutionalize corrective actions by integrating into documented proceduresand processes

� Promote organizational mindset of continual improvement

� Follow through when corrective action needs are identified

� Be slow to fix blame, but be prepared to remove individuals from safety-criticaljobs as warranted


CH13pp141-152 4/10/02 12:51 PM Page 150

Organizations should always strive to implement fail-safe practices.When conducting incident investigations it must be recognized that theidentification of human error is a beginning point for the investigation, notthe ending point. Evidence from incident investigations supports a conclu-sion that serious incidents are more often the result of error-prone situationsor conditions rather than error-prone people. When errors do occur they arequite often related to human conditions that are extremely difficult to con-trol—i.e., short-lived mental states, such as preoccupation or distraction,and errors of omission that the employee did not intend to make.7

From a practical perspective, avoidance of many problems will remaindependent upon the prudent and disciplined actions of individuals at the op-erational point of control. Prior to loading hazardous materials, for exam-ple, tank car loaders must ensure each tank car bottom outlet valve is fullyclosed. Such basic requirements are part of the fundamental performanceexpectations for tank car loaders. In this situation, like many others in theworkplace, precise action is needed on a repetitive basis to avoid high-con-sequence events.

Failures to close bottom valves prior to starting flow should be ad-dressed through the organization’s coaching process. The focus must beon making tasks and conditions less error-prone and on employees help-ing one another to develop safer work habits through behavioral-safetytechniques. However, managers must also recognize that some individualsare less suited than others for performing repetitive work without errors.Thus, individuals who have been coached but retain a tendency to startflow without closing bottom valves should be isolated from safety-sensi-tive jobs.

Corrective action, like reinforcement, is important in maintaining theconstancy of purpose required to sustain serious-incident-free operations.The first objective of corrective actions should be to achieve inherentlysafer operations through changes that are not dependent upon perfect ad-ministrative or operating systems for success. Employees with active own-ership of the incident-prevention process and managers who maintain a biastoward constructive improvements, rather than fixing blame, are factors thatpromote implementation of effective corrective action. When the potentialconsequences of performance failures are severe, the focus must be on im-plementing solutions capable of withstanding the passage of time. Effectivemanagement of the serious incident prevention process requires the appro-priate integration of both positive reinforcement and proactive correctiveaction into the workplace environment.


CH13pp141-152 4/10/02 12:51 PM Page 151

References1. R. Jackman, “Never Treat Humans Like Relations,” Proceedings: 56th Annual

Southern Industrial Relations Conference (now Blue Ridge Conference onLeadership Inc.), 1975, 14–18.

2. A. C. Daniels and T. A. Rosen, Performance Management: Improving Qualityand Productivity Through Positive Reinforcement (Tucker, Georgia:Performance Management Publications, 1984), 46–73.

3. “NJ Probe Targets Sears Auto Centers,” Dallas Morning News, 16 June 1992. 4. M. Ammerman, The Root Cause Analysis Handbook (Productivity Inc.: 1998),

66–67.5. “Busy Port, Dangerous Mixture,” Dallas Morning News, 22 December 1996,

45A, 52A.6. M. Ammerman, The Root Cause Analysis Handbook (Productivity Inc., 1998),

89.7. J. Reason, Managing the Risks of Organizational Accidents (Aldershot,

Hampshire, England: Ashgate Publishing Limited, 1997), 126–129.


CH13pp141-152 4/10/02 12:51 PM Page 152

The Los Angeles Lakers’ victory over Philadelphia in the 2001 NBAfinals marked the passage of 15 years since the Boston Celtics were NBAchampions. More than a decade of mediocrity followed a 30-year periodduring which the Celtics made 17 appearances in the NBA finals, winning15 championships.1 The Celtics’ ultimate demise illustrates the difficultyin sustaining excellence. It is easier to get to the top than to stay there in-definitely.

It is also difficult to sustain long-term excellence in our personal en-deavors and in work-related objectives. A new car owner’s pride of own-ership, for instance, helps sustain short-term performance in maintaininga clean car, but with the passage of time, car owners often become lessdiligent about washing and cleaning. A similar tendency toward compla-cency also exists in the workplace. However, when workplace deficienciescan lead to serious safety-related consequences, complacency must be ef-fectively countered. A sustained focus on excellence is required.

A facility’s work environment is dynamic. The critical work requiredto sustain serious incident-free operations is not the same today as fiveyears previous, nor will it remain constant in the future. New equipment isbrought on-line, processes are modified, the organization changes, newtools and technology become available, knowledge increases—all impact

14Improving andUpdating the Process

CHAPTER

153

CH14pp153-158 4/10/02 12:51 PM Page 153

an organization’s capability to sustain safe operations. Sustaining excellencerequires that management processes be continually reviewed and updated.

Organizational priorities must continually support improvement andupdating of the serious incident prevention process. Specific actions shouldbe targeted to sustain: (1) a shared vision for serious incident-free opera-tions, (2) a focus on organizational learning, and (3) employee involvementand teamwork.


Involve Employees









CH14pp153-158 4/10/02 12:51 PM Page 154

Shared Vision

A shared vision serves as a beacon highlighting the direction in whichto head when various organizational priorities appear to be in tension withone another. Great accomplishments, dependent upon the combined effortsof individuals, have always involved commitment to a common objective. Asuccessful moon landing, winning a war, a sports triumph, achievement ofan improved safety culture—all require a shared vision.

Many managers confuse mere compliance with thier organization’s vi-sion to the real need for commitment to the vision. Individuals who are

Improving and Updating the Process � 155

1. Employees at all levels of the organization are actively involved in the safetyprocess.

2. Each person has specific responsibilities for improving safety, and each personunderstands their role.

3. Constructive dialogue regarding safety concerns and how to improve safety iscommon throughout the organization.

4. Everyone understands the safety risks involved in performing the organiza-tion’s work and the work practices required for safe performance of the work.

5. The reporting of near-misses, minor accidents, and safety concerns is valuedand actively encouraged within the organization.

6. Peer pressure within the organization positively supports safe work, and em-ployees are actively involved in developing safer work habits and improvedmethods.

7. Incident investigations focus on identifying and correcting root causes of acci-dents rather than assigning blame.

8. Valid measures of performance utilized to identify and prioritize safety im-provement opportunities.

9. Employees receive feedback on the quality of work they perform in support ofsafety objectives.

10. Employees receive positive reinforcement for work that meets or exceedssafety performance expectations.

11. Corrective actions are initiated proactively before incidents occur rather thanonly after an accident or injury has occurred.

12. Supervisors visibly support safety and are active in identifying and helpingemployees remove barriers to safe work.

13. Employees are provided the tools, equipment, training, and other resourcescritical to performing tasks safely.

14. Focus is maintained at all levels of the organization on continually improving safety.

15. Safety is viewed as a fundamental value of the organization and is guided by aset of principles not to be compromised.

FIGURE 14-1. Characteristics of an outstanding safety culture.3

CH14pp153-158 4/10/02 12:51 PM Page 155

merely compliant support the vision to the minimum level required to main-tain a politically correct position. When managers are truly committed to ashared vision for a safe workplace, however, they will do whatever is intheir power to make it happen, including the removal of barriers interferingwith its achievement. Persons who are truly committed bring the energy,passion, and excitement needed for success to the table.2

Elevating safety to the status of a core organizational value requiresstrong management leadership and communications skills. Achieving thevision for sustaining a safe workplace requires long-term commitment andconstancy of purpose. To achieve and sustain real improvement, effectivecommunications will be required to “paint pictures” of what the organiza-tion’s culture will look like in an incident-free environment. Such pictureswill include the elements of an outstanding safety culture, as described inFigure 14-1.

Organizational Learning

The application of new knowledge, tools, and behaviors is a prioritythrough all levels of the learning organization. New knowledge related toserious incident prevention is highly valued and effectively utilized to en-hance the process. Organizational learning places a premium on full under-standing of operating details, potential incident scenarios, causal factors,and effective preventative actions. As each year passes, the learning organ-ization applies new knowledge to enhance its safety management process.

Learning organizations realize that without individual learning, no or-ganizational learning is possible.4 Managers of learning organizations un-derstand the importance of a supportive environment in promoting personalgrowth and individual and team learning. These organizations understandthat learning requires a climate where challenging the status quo is not onlyaccepted but encouraged. Employees in a learning organization approachtheir safety responsibilities in the same manner as a potter, painter, or otherartisan—with a lifelong commitment to continual improvement.

Employee Involvement

Employee involvement helps sustain enthusiasm, pride, and commit-ment. Involved employees are willing to take the extra steps needed to im-plement improvements. Involvement is a prerequisite for generating teamsynergy and for transforming improvement ideas into reality. Surveys ofAmerican workers have identified “working as a team” as an essential con-


CH14pp153-158 4/10/02 12:51 PM Page 156

dition for sustaining the level of workplace enthusiasm required for an or-ganization to excel.5 Communication upwards, downwards, and sideways isthe norm in organizations that effectively involve employees.

Managers in learning organizations understand the importance not onlyof employee involvement, but of employee leadership as well. Employees atall levels of the organization are given the opportunity for leadership rolesin the serious incident prevention process. Management further supportsemployee involvement by providing the training, nurturing, and resources tohelp ensure success.

Transforming Concepts to Actions

Maintaining a shared vision, organizational learning, and employee in-volvement are keys to sustaining an organization’s commitment to contin-ual improvement. However, such concepts must be transformed into thespecific actions required for success. A strategy for effectively improvingand updating the process should include an ongoing action plan to:

� Review and update the serious incident prevention process as part ofthe organization’s annual planning process

� Review the need for updating as a specific step in the facility’s man-agement-of-change process

� Review the need for updating as part of each hazards analysis

� Review the need for updating as part of each accident, near miss, orother “red flag” investigation

� Promote user groups to share information among teams responsiblefor implementing and maintaining incident-prevention processes

� Nurture and support individuals willing to step forward as processchampions

� Reinforce individual and team actions to update and improve theprocess

� Learn from others and apply the learning

� Train and actively involve new employees in all aspects of the seri-ous-incident prevention process to perpetuate ownership at the point-of-control level

� Maintain effective “Plan-Do-Check-Act” management control systems

Updating and improving the serious incident prevention process overthe long-term requires leadership and commitment. An organization having

Improving and Updating the Process � 157

CH14pp153-158 4/10/02 12:51 PM Page 157

the potential for serious incidents must balance the desire for projecting aconfident image with a mindset of never being fully satisfied in the searchfor safer methods. All in the organization must recognize the true nature ofthe safety war—in reality, incident prevention is a long, hard-fought guer-rilla struggle with no final conclusive victory.6

References1. J. Hassan,. 1997 Information Please Sports Almanac (Boston: Houghton-

Mifflin, 1997), 365.2. P. M. Senge, The Fifth Discipline: The Art & Practice of the Learning

Organization (New York: Doubleday, 1990), 218–225.3. T. Burns, Characteristics of an Outstanding Safety Culture (SIP Management

Systems Inc., 2001). Reprinted with permission. All rights reserved.4. P. M. Senge, The Fifth Discipline: The Art & Practice of the Learning

Organization (New York: Doubleday, 1990), 139.5. J. S. McClenahen, “It’s No Fun Working Here Anymore,” Industry Week; 4

March 1991, 20–22.6. J. Reason, Managing the Risks of Organizational Accidents (Aldershot,

Hampshire, England: Ashgate Publishing Limited, 1997), 114, 214.


CH14pp153-158 4/10/02 12:51 PM Page 158

Quality Manufacturing Inc. (QMI) is a hypothetical company that uti-lizes large volumes of flammable chemicals in its manufacturingprocesses. QMI’s manufacturing operations are supported by a chemicalhandling department that includes a pipeline system, tank storage opera-tions, and warehouse facilities. QMI’s organization also includes a health,safety, and environmental (HSE) staff that provides services for the man-ufacturing and chemical handling areas. (See organization chart—Figure15-1).

QMI has applied the serious-incident prevention process model, as de-scribed in the previous chapters, to proactively drive the actions needed tosustain serious-incident-free operations.

Management Commitment and Leadership

Exercising the management commitment and leadership necessary tomaintain serious incident prevention as an organizational priority is theinitial element of the process. QMI’s management effectively maintains in-cident prevention as a priority through actions that include:

15Applying the Process Model—A Case Study

CHAPTER

159

CH15pp159-189 4/10/02 12:51 PM Page 159

� Establishment of a safety policy that includes serious incident pre-vention as a core element.

� Establishment of goals and objectives that clearly support the pre-vention of serious incidents.

� Effective dialogue throughout the organization regarding safetygoals, objectives, and improvement opportunities.


Involve Employees








CH15pp159-189 4/10/02 12:51 PM Page 160

� Allocation of resources consistent with the established goals and ob-jectives.

� Maintaining a consistent bias toward identifying needed improve-ments to the process rather than fixing blame when incidents andnear misses occur.

� Ensuring that the necessary company-wide procedures, guidelines,and programs that support serious incident prevention are estab-lished, including:

� Hazard communication


� HSE audits


� Training

� Emergency response planning

� Mechanical integrity processes

� Facility safe-work standards

� Alcohol and drug abuse programs

� Employee selection and hiring standards

� Contractor safety standards

Implementing Other Process Elements

The effective leadership of QMI’s management helps maintain seriousincident prevention as an organizational priority. Management’s leadership

Applying the Process Model—A Case Study � 161

SITE MANAGER

HSE ADMINISTRATION CHEMICALHANDLING

MANUFACTURING

UNIT A UNIT B UNIT C PIPELINE TANKSTORAGE

WAREHOUSE

FIGURE 15-1. Facility organization chart: Quality Manufacturing Inc.

UNIT “A” UNIT “B” UNIT “C”

CH15pp159-189 4/10/02 12:51 PM Page 161

is also critical in successful implementation of the remaining incident-pre-vention process elements. Each functional unit within QMI operates as ateam, and management direction is exercised through a system of team link-age (Figure 15-2). Each team develops and maintains objectives, key per-formance measures, goals, and improvement projects—specific to teamresponsibilities but also supportive of other functional units. Teams withinthe manufacturing, chemical handling, and HSE departments utilize the in-cident-prevention process model to develop and maintain safety manage-ment processes customized for their areas of responsibility.

Chemical Handling Department Team

QMI’s chemical handling department team is comprised of the superin-tendent of chemical handling, together with first-level supervisors respon-sible for each of the department’s three distinct areas of operation (Figure15-3). Each of the three areas—pipeline, tank storage, and warehouse—have developed effective, customized processes for sustaining serious inci-dent-free operations.


SiteTeam

DeptTeam

FirstLevelTeam

FIGURE 15-2. Natural unit team linkage.

Chemical HandlingDepartment

PipelineOperations

Tank StorageOperations

WarehouseOperations

FIGURE 15-3. Chemical handling department organization.

CH15pp159-189 4/10/02 12:51 PM Page 162

Applying the Process Model—

A Case Study

�163

Month/Year _____________

Performance Level CalculationsProgressMeasures 0 1 2 3 4 5 6 7 8 9 10 Value Level x Weight = Score

PipelinePerformanceIndex Score

300 350 400 450 500 600 700 800 900 950 1000 33.3

Tank Storage % Critical WorkCompleted

55 60 65 70 75 80 85 90 95 98 100 33.3

Warehouse % Critical WorkCompleted

55 60 65 70 75 80 85 90 95 98 10033.3

Monthly Total:12-Month Moving Average:Current Goal:

FIGURE 15-4. Chemical handling department serious incident prevention performance index.

960

88

96

9

6

8 266

200

300

766640

>700

March, xx

CH15pp159-189 4

/10/02 1

2:51 PM P

age 163

First-level supervisors, responsible for each of these operations, are alsomembers of the departmental team led by the superintendent of chemicalhandling. Linkage with other departments is provided through the superin-tendent’s participation on QMI’s site management team led by the plantmanager.

The chemical handling team incorporates the customized incident-pre-vention processes for the pipeline, tank storage, and warehouse operationsinto a department-wide management system. Departmental performance isquantified utilizing safety performance indexing. The scoring matrix(Figure 15-4) provides the capability to weight each area’s performancebased upon relative importance. Departmental results are charted to moni-tor both a monthly and 12-month moving average (Figure 15-5).

A reinforcement plan (Table 15-1) is administered to reinforce individ-ual supervisors and the entire team for sustaining high-level performance.The team focuses on reinforcement consistent with the SSIP rule—sincere,specific, immediate, and personal reinforcement. A workplace environmenthas evolved where individuals feel comfortable in both giving and receiv-ing words of appreciation, as well as other forms of reinforcement.Effective reinforcement has helped maintain serious incident prevention asa priority throughout the chemical handling department.


300

400

500

600

700

800

900

1000

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

Month

Score

Monthly Score

12 Month Moving Avg

Goal

Stretch Goal

FIGURE 15-5. Chemical handling department team serious incident preventionperformance index.

Congratulations! Goallevel achieved for month

CH15pp159-189 4/10/02 12:51 PM Page 164

TABLE 15-1

Reinforcement Plan Chemical Handling Department Serious Incident Prevention

Result or Action to Reinforce Who Receives? Who Delivers?

The department team understands its essential leadership role and thevalue of effective communications. The team drives actions needed toachieve a shared vision of excellence and focuses on removing barriers thatconstrain performance. A commitment to continual improvement is main-tained.

Employees are encouraged to search for and investigate “red flags”—clues indicating possible deficiencies that could lead to a serious incident.“Red flag” conditions identified by the team are documented (Table 15-2),and a written note of appreciation (Figure 15-6) is initiated by the team toreinforce proactive detection and correction of each potentially significantproblem.


Serious incident preventionprocess implemented in allareas

Performance measure sus-tained for 3 months

100% completion of criticalwork achieved in any area

Departmental goal levelachieved for month

12-month moving averagesustained above goal level &new goal established

Identification/correction ofred flag condition

First-level supervisionpipeline, tank storage andwarehouse operations

First-level supervision

First-level supervision responsible for area

All department team mem-bers

All department team mem-bers

Individual or team takingthe action

Department head & team,steward for measure

Department head

Department head

Department head

Department head and teamsteward for measure

Department team (in formof “red flag” note of appre-ciation)

TABLE 15-2

Chemical Handling Department "Red Flag" Reports

Date

01/18/xx

Description

Corrosion found under in-sulation on piping

Follow-Up Action

Corroded section of piping replaced.Other locations inspected and no othersignificant corrosion found. Follow-upinspections scheduled.

CH15pp159-189 4/10/02 12:51 PM Page 165



Chemical Handling Department “Red Flag” Reports

Date Description Follow-Up Action02/23/xx

02/27/xx

3/18/xx

Unexpectedly high level ofmaterial detected on dailyinventory of Tank #3

Evidence of smoking in anunauthorized area of ware-house reported by ware-house operator

Pipeline inspector on rou-tine inspection noted thirdparty stakes driven onpipeline right-of-way indi-cating plans for a futureexcavation.

Investigation indicated a valve leakingby into tank. Problem resolved beforeoverfill of tank.

Investigation indicated contract employ-ees were violating no-smoking rules.Reviewed with contractor managementwho indicated the involved contract em-ployees would be disciplined and allothers reminded of smoking restrictions.

Investigation indicated a contractor wasplanning to install a utility pole but hadnot reported plans through the one-callsystem. Plans for the excavation thatcould have damaged the undergroundpipeline were revised to install the poleat a new location safely removed fromthe pipeline route.

Chemical HandlingDepartment

SERIOUSINCIDENTPREVENTION

To: John Rigby _____

Date: 3/22/xx ________

John –Thanks for observing andinvestigating the constructionstakes near our pipeline ValveStation No. 2. Your actionsprevented the installation of autility pole in a location that couldhave damaged our pipeline.The Chemical HandlingDepartment Team appreciatesyour proactive actions andcommitment to safe work!

Linda Smith Frank Brown

Robin Burns James Johnson

A Typical Note of Appreciation from Members ofthe Chemical Handling Department Team

FIGURE 15-6. Reinforcement for proactive actions in identifying red-flag con-ditions.

CH15pp159-189 4/10/02 12:51 PM Page 166


The chemical handling department team plans to provide increased em-phasis on the identification and evaluation of “red flag” conditions. In ad-dition, the department has recently adopted a new goal for reducingaccidental releases of hazardous materials from a current average of about100 pounds per month to a maximum of 10 pounds per month. The teamunderstands that “what gets measured gets done,” and it is planning to fa-cilitate achievement of its goals for increasing the identification and report-ing of “red flag” conditions and for reducing hazardous material releases byadding these two additional elements to the safety performance matrix.

Figure 15-7 illustrates the team’s redesigned performance matrix thatincludes the addition of “red-flag” reports and hazardous material releases.The team has assigned a weighting of 10 percent to “red flag reports,” witha minimum of three reports per month required to achieve a 100 percentscore. A weighting of 15 percent is assigned to the volume of hazardous ma-terial releases. The team understands that the addition of these elements tothe performance matrix will enhance the team’s capability for identifyingand resolving potential problems before they lead to serious incidents andwill help drive significant reductions in hazardous material releases.

The team has also considered the addition of other performance indica-tors to the matrix—audit scores, employee survey results, and recordable in-jury rate are potential additions that have been discussed. The teamunderstands that the safety performance index is a flexible tool that can beshaped as needed to help achieve and sustain a safe workplace.

The chemical handling department team understands the importance ofserious-incident prevention and its linkage to other company objectives,e.g., customer satisfaction, financial performance, and company image. Theteam’s management system helps ensure that risks are understood, criticalwork is executed consistent with standards, reinforcement or corrective ac-tion initiated contingent upon performance, and that the incident-preventionprocess is continually improved and updated.

Chemical Handling Department Pipeline Operations

The potential frequency for incidents involving pipeline operations isinherently low. Thus, QMI’s record of operating its pipeline for many yearswithout a serious incident is not unexpected. Rather than depending solelyupon its favorable operating experience to identify significant risks, QMIunderstands the need to consider the collective experience of other compa-nies’ operating pipelines.

CH15pp159-189 4/10/02 12:51 PM Page 167

168


Month/Year _____________


PipelinePerformanceIndex Score

300 350 400 450 500 600 700 800 900 950 1000 25

Tank Storage % Critical WorkCompleted

55 60 65 70 75 80 85 90 95 98 100 25

Warehouse % Critical WorkCompleted

55 60 65 70 75 80 85 90 95 98 10025

Number Red FlagReports

0 1 2 3 10

Volume Materials Spills(pounds)

150 140 120 100 75 50 25 10 5 3 1 15

Monthly Score:12-Month Moving Average:Goal:

FIGURE 15-7. Chemical handling department serious incident prevention performance index—alternative matrix.

75

100

150

750605

>700

xxMarch

200

225

5

10

6

8

9

45

3

88

96

960

CH15pp159-189 4

/10/02 1

2:51 PM P

age 168

The QMI pipeline team is comprised of the first-level supervisor re-sponsible for pipeline operations, together with all other personnel respon-sible for operating and maintaining the pipeline system. The team’s riskassessment includes analyzing causes of past U.S. pipeline accidents(Figure 15-8). The analysis indicates that third-party damage is the mostfrequent cause of pipeline incidents, followed by defective equipment or re-pair, external corrosion, internal corrosion, and operator error. Based uponits evaluation of risks, the team has identified the critical work necessary tosustain incident-free operations (Table 15-3).

The pipeline team ensures satisfactory performance standards are inplace for critical work performed by the team, staff groups, and outside con-tractors. Frequencies for performing tasks are established, and a system todocument scheduled completion dates is maintained.

A designated member of the pipeline team serves as steward for the se-rious-incident prevention process. The process steward coordinates theteam’s completion of critical work consistent with established standards.Any work behind schedule is documented, rescheduled, and expedited tocompletion.

The percent critical work completed as scheduled is charted (Figure 15-9). The chart includes monthly performance and a 12-month moving aver-age helpful in trend analysis. The team’s improvement goal is displayed onthe chart, and handwritten notes are sometimes added to facilitate feedback,reinforcement, or corrective actions.

Although the team has operated for more than 10 years without a sig-nificant pipeline release, numerous reports of possible releases are receivedeach year. These reports from members of the public are typically triggeredby unusual odors in the area of the pipeline right-of-way. Fortunately, none


INTERNALCORROSION

8%

FIGURE 15-8. Causes of U.S. hazardous liquid pipeline accidents based on year2000 reports to U.S. Department of Transportation.1

INCORRECTOPERATION

6%

EXTERNALCORROSION

14%

DEFECTIVEEQUIPMENTOF REPAIR

15%

3RD PARTYDAMAGE

25%

OTHER32%

CH15pp159-189 4/10/02 12:51 PM Page 169


TABLE 15-3

QMI Pipeline Operations Serious Incident Prevention Critical Work


Third-Party Damage Prevention:

a) Investigate each planned excavationnear right-of-way

b) On-site monitoring of all excavationwork on right-of-way

c) Fixed-wing aircraft aerial right-of-waypatrol

d) Inspection to ensure right-of-waymarker signs in place

e) Mowing of right-of-way

f) Ground level inspection of entire right-of-way

g) Navigable waterway inspections bydiver

Defective Equipment and RepairPrevention:

Audit:

� Management-of-change process

� Welding certifications for authorizedrepair personnel

� Contractor safety and training pro-grams

External Corrosion Prevention:

a) Cathodic protection rectifier inspec-tions

b) Interference bond inspections

c) Corrosion grid inspection

d) Cathodic protection test station survey

e) Close interval cathodic protection survey

Internal Corrosion Prevention:

a) Monitor rate of corrosion inhibitor in-jection

b) Corrosion coupon inspections

c) Piping grid inspection

Prevention of Operator Errors:

a) Review and update operating manual

Prior to excavation

Each excavation

Weekly

Monthly

Each June & August

Annual

Every 5 years

Semi-annual audit

Monthly

Monthly

Semi-annual

Annual

20% of pipeline each year

Daily

Quarterly

Semi-annual

Annual

CH15pp159-189 4/10/02 12:51 PM Page 170



QMI Pipeline Operations Serious Incident Prevention Critical Work


Prevention of Operator Errors: cont.

b) Formal pipeline operator training

c) Procedure updates for process changes

d) Review and update training require-ments

e) Ergonomic/human-factors review ofcontrol systems

f) High-pressure shutdown checks & in-strument calibrations

g) Audit of anti-drug and alcohol misuseprogram

Emergency Preparedness:

a) Test remote valve operation

b) Test low-pressure valve shutdowns

c) Exercise and inspect manual valves

d) Visit public emergency response agen-cies

e) Conduct emergency drill

f) Test combustible gas analyzers at pumpstations

g) Inspect fire extinguishers

h) Inspect and test uninterruptible powersupply units

i) Inspect and test relief valves

Other:

a) Investigate all near misses

b) Audit safety permit system compliance

c) Conduct safety review meeting withcontractors

d) Process Hazards Analysis

e) Confirm pipeline integrity with pres-sure test or smart pig

f) Review and update risk assessmentprocess

Initial training within one month of em-ployment; refresher every 3 years and priorto significant changesPrior to implementing each change

Annual

Annual

Semi-annual

Annual

Monthly

Monthly

Semi-annual

Annual

Annual

Quarterly

Quarterly

Quarterly

Per documented schedule

Each near-miss incident

Semi-annual

Semi-annual

Every 3 years

Every 10 years

Annual

CH15pp159-189 4/10/02 12:51 PM Page 171


40

50

60

70

80

90

100

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

MONTH

Monthly %12 Month AvgGoal

FIGURE 15-9. Pipeline operations—percent critical work completed.

Moving average at GoalLevel! We’ve come a longway together . . . Let’scelebrate with lunch!

of the reports has proven to involve a release from QMI’s pipeline system,but the pipeline team understands the importance of promptly investigatingeach report and treating each as a potential serious incident until provenotherwise. With that objective, QMI has an established goal of having acompany representative on-site at the location of each reported incidentwithin one hour after the incident is reported. The pipeline team has estab-lished a measurement system for tracking its timeliness of responses(Figure 15-10), and the system has helped drive the percentage of one-hourresponses from a baseline of less than 50 percent to a current average of 90percent.

QMI’s pipeline operations receive an annual audit by the responsibleregulatory agency to determine compliance with Department ofTransportation requirements. Prior to implementation of the serious-inci-dent prevention process, the team regularly received notices of violations asa result of these compliance audits. However, execution of the critical workidentified by the team has helped eliminate regulatory agency violations.The team has completed five consecutive years without a violation, and theoutstanding progress is reflected by the team’s measurement system formonitoring the number of violations (Figure 15-11).

The pipeline team has developed a safety performance index basedupon three areas deemed essential to success: (1) percentage of criticalwork completed on-schedule, (2) timeliness of on-site responses to leak re-ports, and (3) number of regulatory agency violations. The team has as-signed a weighting factor of 40 percent to the on-schedule completion of

CH15pp159-189 4/10/02 12:51 PM Page 172


Percent On-Site Responses Within One Hour

0102030405060708090

100

1 2 3 4 5 6 7 8 9

Quarter

QuarterlyAverage

Goal

FIGURE 15-10. Responses to pipeline “leak” reports.

0

1

2

3

4

1 2 3 4 5 6 7 8 9 10

Year

FIGURE 15-11. Pipeline regulatory agency violations.

critical work, 40 percent to timeliness of responses to leak reports, and 20percent to prevention of regulatory agency violations. The team’s safetyperformance score for the most recent month, as calculated by the per-formance index matrix, is 760 (Figure 15-12). During the past ninemonths, the team has improved its safety performance score from 490 tothe current level of over 700, as illustrated by Figure 15-13. This quantifi-cation of performance has provided frequent opportunities for positivelyreinforcing the pipeline team’s efforts, and the favorable results reflect an

CH15pp159-189 4/10/02 12:51 PM Page 173

174


Month /Year:_____/______


% Critical WorkCompleted

60 65 70 75 80 85 90 96 98 99 100 40

1-Hr Responses to LeakReports

45 50 55 60 70 80 90 95 96 98 100 40

Regulatory AgencyViolations

4 3 2 1 020

Monthly Total:12-Month Moving Average:Current Goal:

96

91

0

7

6

10 200

240

280

720650

>700

xx

FIGURE 15-12. Pipeline safety performance index.

3

CH15pp159-189 4

/10/02 1

2:51 PM P

age 174


0

100

200

300

400

500

600

700

800

Score

1 2 3 4 5 6 7 8 9

Month

FIGURE 15-13. Pipeline safety performance index results.

TABLE 15-4

Reinforcement Plan Pipeline Operations Serious Incident Prevention


Serious incident prevention Pipeline team First-level supervisor andprocess fully developed department head

Performance measure fully Process steward and other First-level supervisorimplemented for one month team members

100% completion of critical Pipeline team First-level supervisorwork achieved for month

Goal for one-hour responses Pipeline team Chemical handling to “leak” reports achieved department team

Completion of 12 months Pipeline team Chemical handlingwithout a regulatory agency department teamviolation

Action taken to identify and Individual or team Chemical handlingarrange for correction of taking the action department team (in“red flag” condition form of “red flag”

note of appreciation)

Moving average above goal Pipeline team Chemical handling for 3 consecutive months department teamand new goal established

CH15pp159-189 4/10/02 12:51 PM Page 175


operation that has substantially reduced its potential for experiencing ahigh-consequence incident.

The pipeline team reviews its performance measures on a monthlybasis, and a reinforcement plan is triggered when performance milestonesare achieved. When work fails to meet established standards, root causes areidentified and corrected. The team focuses on removing barriers that are un-favorably impacting performance.

The pipeline team’s reinforcement plan (Table 15-4) includes reinforce-ment both for achieving results and for actions supporting the incident pre-vention process. Reinforcers are primarily intangible, often consisting ofnotes of appreciation or verbal recognition. Celebrations have also provento be effective reinforcement for achievement of major milestones and havehelped build the team’s esprit de corps.

TABLE 15-5

QMI Tank Storage Operations Serious Incident Prevention Critical Work

Critical Work FrequencyInspections conducted to monitor:a) Presence of any leakage from tanks or

pipingb) Tank inventoriesc) Nitrogen inerting systemd) Sprinkler system operabilitye) Condition and accuracy of labels on

tanks and linesf) Integrity of tank dikingg) Condition of bonding and groundingh) Condition of no-smoking signsi) Condition of access for emergency re-

sponsej) Fire extinguishers in-place, unblocked,

and chargedk) Accumulation of weeds and combustiblesl) Flame arrestors:

in placeunplugged

m) External corrosionn) Adequacy of drainageo) Integrity of floating roofsp) Internal corrosion

q) prestartup inspection for new or modi-fied equipment

Daily

Daily Daily Weekly Monthly

Monthly Monthly MonthlyMonthly

Monthly

Monthly

Monthly Annual Annual AnnualAnnual Every 3–5 years, depending upon productand past history of corrosion

Prior to each startup as applicable

CH15pp159-189 4/10/02 12:51 PM Page 176



QMI Tank Storage Operations Serious Incident Prevention Critical Work


Deficiencies identified on inspections areon-schedule for correction

Audit to ensure plans and procedures areup-to-date and effectively implemented:a) Emergency response planb) Operating proceduresc) Maintenance proceduresd) Safety permit system procedurese) Management-of-change procedures

Initial and refresher training:a) Fire extinguisher useb) Sprinkler system location and activationc) Reporting of spills and other emergenciesd) Evacuation procedurese) Permit system to control hot work and

other ignition sourcesf) Permit system to control excavationsg) Lock-out procedures for controlling

hazardous energyh) Location and operation of key manual and

remote operated emergency shutoff valvesi) Hazard communications

Facility orientation and site visit for localemergency response agencies

Emergency drill

Equipment/instrumentation tests andcalibrations:a) Prestartup leak testb) Sprinkler system flow testc) Nitrogen system instrument calibrationd) Exercise emergency shut-off valves:

� remote actuated� manual

e) Tank level indicator calibration andalarm test

f) Relief valve inspections

Comprehensive process hazards analysisby cross functional team

Investigation of all material releases andnear-miss incidents

Review and update of serious incidentprevention process

Minimum weekly review of items (someitems require more frequent follow-up)

Annual audit for all items

For all training:� Initial training for all new operators


prior to changes

Annual

Annual

Prior to startup of equipmentEvery 3 monthsEvery 3 months

Every 3 monthsAnnualEvery 6 months

As established for each relief valve

Every 3 years

Within 24 hours of each incident

Annual

CH15pp159-189 4/10/02 12:51 PM Page 177


40

50

60

70

80

90

100

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

MONTH

%Monthly %

12 Month Moving Avg

Goal

FIGURE 15-14. Tank storage operations percent critical work completed.

In their daily work, team members are alert for early warning signals ofpotential pipeline problems. Red flag conditions, such as low cathodic pro-tection readings and evidence of pending third-party construction work af-fecting the pipeline right-of-way, are proactively identified and investigated.Action is taken in the early stages to prevent development of more signifi-cant problems.

The team proactively seeks new information impacting pipeline inci-dent prevention. New knowledge is continually applied to improve theprocess. The team understands the severe consequences of pipeline inci-dents and is highly committed to sustaining incident-free operations.

Chemical Handling Department: Tank Storage Operations

With responsibility for a large inventory of flammable materials, thetank storage team is well aware of the potential for serious incidents. Theteam has enhanced its understanding of tank storage risks through re-searching various publications including NFPA 30, Flammable andCombustible Liquid Code.2 Primary concerns include prevention of firesand accidental releases of material.

CH15pp159-189 4/10/02 12:51 PM Page 178


The team’s critical work (Table 15-5) includes effective preventative ac-tions extending well beyond regulatory requirements. Performance in exe-cuting critical work is reviewed on a monthly basis. A reinforcement plan isadministered to provide appropriate recognition. The team’s commitment tosafe operations is reflected by its improving performance (Figure 15-14).

The team proactively reviews planned changes to ensure that theyachieve their purpose without detrimental consequences. Small releases ofmaterial and other precursors to serious incidents are investigated promptly.Minor incidents are viewed as a learning opportunity, and effective actionsare implemented to prevent recurrence. The team stays informed of regula-tory changes and maintains operations in compliance. Annual reviews areconducted to identify improvement opportunities and help ensure the inci-dent-prevention process remains updated.

Chemical Handling Department:Warehouse Operations Team

The warehouse operations team is comprised of the first-level supervi-sor together with all other warehouse operating personnel. The team oper-ates and maintains facilities for the storage of certain raw materials,manufacturing supplies, and finished products. Significant quantities offlammable and combustible materials are stored and handled. The team’s in-cident-prevention process focuses on ensuring actions needed to preventand minimize the consequences of warehouse fires are identified and dili-gently executed.

The team’s evaluation of risks specific to warehouse operations has in-cluded a review of guidelines such as NFPA’s Pre-Incident Planning forWarehouse Occupancies.3 Based upon its evaluation of risks, the team hasidentified the critical work necessary to sustain incident-free operations(Table 15-6). The team’s performance measurement (Figure 15-15) moni-tors execution of the work. Results are reviewed in team meetings, and re-inforcement or corrective action initiated contingent upon performance.Team members are sensitive to the impact of changes, such as new materi-als, increases in inventory, and modifications to the fire protection system.Management-of-change systems are in place, and priority is maintained onkeeping the incident prevention process up to date and continually im-proved.

CH15pp159-189 4/10/02 12:51 PM Page 179


TABLE 15-6

QMI Warehouse Operations Serious Incident Prevention Critical Work


Inspections conducted to ensure:a) No leakage from stored containersb) Proper storage practices for flammables

and combustiblesc) Sprinkler system block valves fully

opend) Sprinkler system heads unblockede) Fire extinguishers in place, unblocked,

and chargedf) Fire doors unblocked and in working

orderg) No-smoking signs posted and in good

conditionh) Evacuation routes posted and aisles,

exits, doors, signs, and lights in orderi) Trash properly containedj) Forklifts in good conditionk) Facility security measures operationall) Prestartup inspection for new or modi-

fied equipment

Deficiencies identified on inspections areon-schedule for correction

Audit to ensure plans and procedures areup-to-date and effectively implemented:a) Emergency response and evacuation planb) Storage proceduresc) Control of ignition sourcesd) Safety permit procedurese) Management-of-change proceduresf) Hazard communication procedures

Initial and refresher training:a) Fire extinguisher useb) Sprinkler system trip location and acti-

vationc) Reporting of fires, spills, and other

emergenciesd) Security practices and procedurese) Facility evacuation planf) Permit system to control hot work and

other ignition sources

DailyDaily

Daily

WeeklyWeekly

Weekly

Weekly

Weekly

DailyDailyDailyPrior to startup of equipment

Minimum weekly review of items (someitems require more frequent follow-up)

All items audited annually

For All Training:� Initial training for all new operators


prior to significant changes

CH15pp159-189 4/10/02 12:51 PM Page 180


g) Lock-out procedures for controllinghazardous energy

h) Lift-truck trainingi) Hazard communication

Facility orientation and site visit for localemergency response agencies

Emergency Drill

Alarm tests:a) Smoke detectorsb) Fire alarm systemc) Security system

Process hazards analysis by cross-func-tional team

Investigation of incidents and near-missincidents with serious potential

Comprehensive review and update of se-rious incident prevention process

Annual

Annual

Monthly for all items

Every 3 years

Within 24 hours of occurrence

Annual


QMI Warehouse Operations Serious Incident Prevention Critical Work


40

50

60

70

80

90

100

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

MONTH

Monthly %

12 Month Moving Avg

Goal

FIGURE 15-15. Warehouse operations team—percent critical work completed.

Congratulations! 100%Moving average at

goal level!

Lift truck unavailable.Will provide “back-up.”

CH15pp159-189 4/10/02 12:51 PM Page 181


Manufacturing Department—Serious Incident Prevention Processes

Each of the organizational units within QMI’s manufacturing depart-ment (Figure 15-16) has developed customized serious-incident preventionprocesses. Each unit within the department operates as a team led by itsfirst-level supervisor. Each first-level supervisor also serves as a member ofthe department team led by the superintendent of manufacturing. The man-ufacturing superintendent’s participation on the QMI Site Managementteam provides the linkage needed to sustain a common focus on key per-formance objectives, including maintaining incident-free operations.

Each team within the manufacturing department understands the spe-cific risks related to its operations and has identified the critical work nec-essary to sustain incident-free operations. Goals are established that reflecthigh performance expectations. Performance is monitored and reinforce-ment or corrective action initiated contingent upon performance. Priority ismaintained on updating and continually improving serious incident preven-tion processes throughout the department.

Each unit in the manufacturing department has identified work criticalto sustaining safe operations, established performance standards, measure-ment and feedback systems, and has developed reinforcement plans. (Dueto similarity with information developed by units within the chemical han-dling department, the critical work, measurement and feedback systems,and reinforcement plans developed by the manufacturing team are not in-cluded in this case study.)

ManufacturingDepartment

Unit A Unit B Unit C

FIGURE 15-16. Manufacturing department organization.

Unit “A” Unit “B” Unit “C”

CH15pp159-189 4/10/02 12:51 PM Page 182


HSE—Serious Incident Prevention Processes

The actions of QMI’s Health, Safety, and Environmental department sig-nificantly impact the company’s capability to sustain serious incident-freeoperations. The HSE department utilizes all elements of the serious incidentprevention process to ensure services supporting incident-free operations areeffectively provided. The team’s critical work is targeted towards minimizingboth the probability and potential consequences of an incident.

Table 15-7 documents the critical work identified by the HSE team. Theteam maintains performance measures for on-schedule completion of criti-cal work, as illustrated by Figure 15-17, and for other key performance in-dicators such as rescue and fire brigade training attendance (Figure 15-18)and the results of annual surveys indicating line organization management’ssatisfaction with the quality of HSE services provided (Figure 15-19).Performance measures and the status of improvement projects are reviewedeach month by the team. Reinforcement and corrective actions are imple-mented based upon reviews of the performance measures. The HSE team’sreinforcement plan (Table 15-8) includes specific reinforcement for indi-viduals who successfully complete special tasks, such as coordinating theannual site visit for local emergency response agencies.

75

80

85

90

95

100

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

MONTH

MONTH12 MONTH AVGGOAL

FIGURE 15-17. HSE percent critical work completed on schedule.

Excellent Results!

Congratulations!Moving average at

Goal Level.One PHA behindschedule

Per

cen

t

CH15pp159-189 4/10/02 12:51 PM Page 183


TABLE 15-7

QMI HSE Department Serious Incident Prevention Critical Work

Critical Work FrequencyAssess serious incident preventionprocess compared to current and futureneeds:a) Conduct internal customer interviews

with leaders of site management, chemi-cal handling, and manufacturing teamsto identify needs and obtain input onadequacy of HSE services provided.

b) Audit quality of critical HSE servicesc) Assess adequacy of plans and proce-

dures under the stewardship of HSE de-partment:� Facility emergency response plan� EPA Risk Management Plan� Facility safe practices guidelines� Plans for emergency responder training

Develop action plans and implement im-provements based upon assessments

Provide special training for HSE personnel:a) Process hazards analysis facilitationb) Emergency response skills for fire, spill,

and medical emergenciesc) Knowledge-based training for safety-

sensitive jobs—e.g., confined spaceentry, hot work, and hazard communica-tions

Provide serious incident prevention tech-nical support for line organizations:a) Conduct training course on process haz-

ards recognition and incident preventionavailable to line personnel

b) Review adequacy of technical libraryand publicize available resources

c) Develop and implement plan for net-working with other companies and out-side sources

d) Provide technical support for processhazard reviews, accident and near-missinvestigations, area inspections, capitalprojects, and improvement initiatives

Annual interview with each team leader

AnnualAnnual and as facility, organizational, orother significant changes occur

Action plans developed annually withmonthly status review

Initial training for all new facilitators & re-fresher training every three years

Quarterly

Training for safety sensitive jobs:� Initial training for new HSE employees� Refresher training every two years and

prior to implementation of significantprocess changes

Annual

Annual

Annual with quarterly status review

Assess annually as part of interviews withleaders of the site management, chemicalhandling, and manufacturing teams

CH15pp159-189 4/10/02 12:51 PM Page 184


Schedule and coordinate site visit forlocal emergency response agencies

Assist site management team in planningand coordinating facility emergency drill

Maintain emergency response equipmentand supplies:a) Firefightingb) Spill containmentc) Rescued) Medicale) Emergency communications equipment

Investigate and/or critique:a) Each emergency responseb) Accidents or near-miss incidents on

jobs involving support from HSE per-sonnel

Annual

Annual

Inspect and maintain each type of equip-ment and supply item consistent with docu-mented procedures

Within 24 hours following incident


QMI HSE Department Serious Incident Prevention Critical Work


70

75

80

85

90

95

100

1 2 3 4 5 6 7

Quarter

Percent

FIGURE 15-18. Rescue/fire brigade training (percent of members attending).

CH15pp159-189 4/10/02 12:51 PM Page 185

TABLE 15-8

Reinforcement Plan HSE Serious Incident Prevention


Serious incident prevention HSE team HSE managerprocess fully developed

Performance measure fully Process steward and HSE managerimplemented one month other team members

100% completion of critical HSE team HSE managerwork for month

Twelve month moving HSE team HSE manageraverage above goal for 3consecutive months andnew goal established

Favorable comments from Individual or team HSE managerinternal customer interviews as appropriate

Completion of annual site Individuals responsible HSE managervisit and facility emergencydrill

Action taken to identify and Individual or team HSE team (in form ofarrange for correction of taking the action “red flag” note of “red flag” condition appreciation)


1

2

3

4

5

1 2 3 4 5 6

Year

Su

rvey

Res

ult

s

FIGURE 15-19. Quality of HSE services based on annual survey of line man-agers.

CH15pp159-189 4/10/02 12:51 PM Page 186

HSE personnel maintain active dialogue with the manufacturing andchemical handling areas. This interaction helps team members clearly un-derstand the risks that must be controlled and the specific HSE support re-quired. The team’s expertise is recognized, and members are often invited toparticipate in improvement efforts initiated by the manufacturing and chem-ical handling departments. The HSE team is highly respected throughoutthe company, and the team is proud of its contributions and partnership rolewith line organizations.

QMI Site Management Team: Serious Incident Prevention

The site management team is led by QMI’s plant manager, with mem-bership that includes manufacturing, chemical handling, and HSE depart-ment heads. The site management team focuses on ensuring incidentprevention processes are effectively deployed throughout the organization.The team has identified and documented its critical work for proactivelyimpacting serious incident prevention (Table 15-9).

TABLE 15-9

QMI Site Management Team Serious Incident Prevention Critical Work


Integrate serious incident prevention objectives into Annual review and updatesafety policy & communicate through organization

Establish goals & performance expectations that support Annual review and updateserious incident prevention objectives; communicatethrough organization

Schedule line organization briefings regarding potential Annual briefing by eachrisks and status of the incident prevention process department

Walk-through visit/inspection of chemical handling and Annualmanufacturing department facilities

Ensure audits of departmental serious incident prevention Annualprocesses are conducted and results are reviewed

Review investigation reports for accidents and near-miss First team meeting followingevents having serious incident potential occurrence

Assess the site team’s serious incident prevention process; Annual review with monthlyinitiate updates & improvements review of improvement

actions


CH15pp159-189 4/10/02 12:51 PM Page 187

Performance measures maintained by the team help identify potentialproblem areas within the organization, as well as opportunities for positivereinforcement. The team’s serious incident prevention reinforcement plan(Table 15-10) focuses on recognizing department heads for sustaining highlevels of performance. Support of the serious incident prevention process isa key factor in annual merit reviews, and coaching is effectively utilized bythe plant manager in shaping values and priorities. The team diligently sup-ports the constancy of purpose required to sustain incident-free operations.

QMI’s management team is careful to limit positive reinforcement to re-sults achieved consistent with safe work practices. A planned seven-daymaintenance shutdown was completed in six days, but an audit identifiedshort-cutting of hot work procedures during the shutdown. Rather than ini-tiating positive reinforcement for minimizing downtime, management fo-cused on ensuring that the root causes of the deficient work practices wereidentified and corrected.

Measurement and feedback systems keep the site management team in-formed of the facility’s fitness for sustaining serious incident-free opera-tions. The system provides the capability for managers to driveimprovements through meaningful actions.


Serious incident preventionprocess implemented in alldepartments

Sustaining serious incidentprevention process at highperformance level

Department heads

Department heads

Plant manager

Plant manager in form ofmerit pay increase as appro-priate

Plant manager in form ofverbal recognition at timeof:� Department head’s an-

nual review with siteteam

� Site team’s annual in-spection of departmentalfacilities

� Plant manager’s coach-ing sessions with depart-ment heads

TABLE 15-10

Reinforcement Plan Site Management Team Serious Incident Prevention

Result or Actionto Reinforce Who Receives? Who Delivers?

CH15pp159-189 4/10/02 12:51 PM Page 188

The site management team recognizes that the occurrence of a seriousincident represents a common point of failure on the pathway to achievingmany of the organization’s key objectives, e.g., customer satisfaction, fi-nancial performance, company image, and maintaining a safe workplace.Tolerating conditions that could lead to a serious incident is clearly incom-patible with QMI’s core values.

Benefits Achieved from the SeriousIncident Prevention Process

The improvements achieved by QMI through deployment of effectiveincident-prevention processes have created benefits extending well beyondsafe operations. Sustaining safe operations has resulted in improved pro-duction volume, product quality, shipping date reliability, cost control, andcompany image, in addition to a safer workplace. The serious incident pre-vention process has been successfully institutionalized, helping ensure theorganization will continue to keep its eye on the right ball even whenchanges occur in the organization. All stakeholders, including employeesand their families, shareowners, customers, suppliers, and the public, arebenefiting and will continue to benefit from QMI’s deployment of effectiveserious incident prevention processes.

References1. Department of Transportation, Office of Pipeline Safety, Liquid Pipeline

Accident Summary by Cause, 1/1/2000–12/31/2000.2. National Fire Protection Association, Flammable and Combustible Liquids

Code, 1993.3. National Fire Protection Association, Pre-Incident Planning for Warehouse

Occupancies, 1993.


CH15pp159-189 4/10/02 12:51 PM Page 189

190

Into Thin Air: A Personal Account of the Mount Everest Disaster,1 byJon Krakauer, describes the challenges for climbers and their expeditionleaders in attempting to conquer Mount Everest. After months of trainingand payments of up to $65,000, a climber typically has only one try at as-saulting the summit. Limitations on physical strength and supplies, suchas bottled oxygen, make a restart unfeasible once the march to the summitbegins from the expedition’s highest elevation camp.

Prior to starting the climb to the summit, most Mount Everest expedi-tion leaders establish a firm turnaround time for all members of the expe-dition. If the summit has not been reached by the specified time (typically2 p.m.), climbers and guides have instructions to turn around and descendthe mountain. Compliance with this guideline helps ensure a climber’sbottled oxygen and other supplies are sufficient, and that the climber isable to safely return to the protection of camp by nightfall.

Predictably, “summit fever” often strikes both climbers and their ex-pedition leaders. Enforcement of the turnaround time becomes difficult,particularly when the summit is in sight. Turning around represents majordisappointment for climbers who have sacrificed physically and finan-cially to position themselves in sight of the mountaintop, and who may belooking at their last chance to achieve their personal goal. For expedition

16Responding to theChallenge

CHAPTER

CH16pp190-196 4/10/02 12:52 PM Page 190

Responding to the Challenge � 191

leaders, the percentage of clients who reach the summit is a key perform-ance measure—a measure impacting reputation and the size of client fees.Under such pressures, the turnaround time has often been ignored when thesummit is in sight—and deaths have occurred.

In more standard workplaces, few decisions are as dramatic as the de-cisions involving enforcement of the turnaround time on Mount Everest.Nevertheless, key decisions are made every day that affect an organization’scapability to sustain incident-free operations. Individuals making these de-cisions are faced with the challenges of fully satisfying both the short- andlong-term needs of bosses, subordinates, shareholders, and the public, aswell as personal needs. The desire for achievement and recognition can cre-ate “workplace fevers” that rival “summit fever” in intensity.

Ever-present forces tend to focus management’s attention on reacting toongoing, daily problems in the workplace. The proactive actions needed toaddress longer-term issues may be sacrificed in such an environment. Withthe severe potential consequences of serious incidents, it’s vital that an ef-fective management process be in place to maintain the constancy of pur-pose needed for sustained incident-free operations. The need for excellenceis clear.

Companies throughout the world have demonstrated the effectivenessof performance management techniques in achieving breakthrough levels ofperformance. Efforts have typically focused on improving performance inareas that are highly visible to management, such as cost control, produc-tivity, product quality, customer service, and prevention of common in-juries. Similar performance breakthroughs are feasible in executing thework necessary to prevent serious incidents resulting in fatalities, propertydamage, business interruption, hazardous material releases, regulatory vio-lations, damage to company image, and other losses. The merging ofproven-quality management techniques with sound risk-management prac-tices provides the basis for a proactive process to achieve these break-throughs.

Overcoming the barriers to sustaining safe operations requires a com-prehensive management process. Inclusion of the following elements in theprocess will help ensure effectiveness:

� Management leadership in maintaining serious incident preventionas a top organizational priority

� Emphasis on employee involvement, teamwork, and empowerment

� Understanding of the organization’s significant risks

� Accurate identification of the critical work necessary to control therisks

CH16pp190-196 4/10/02 12:52 PM Page 191

� Standards for performing the critical work

� Measurement and feedback systems for monitoring and communi-cating performance in executing critical work

� Reinforcement and corrective action contingent upon performance

� A systematic method for continually updating and improving the se-rious-incident prevention process

Keys for Successful Implementation

Successful implementation of the serious incident prevention processwill require more than good intentions—a sound plan and the commitmentto transform concepts into actions is a necessity. Each of the eight-elementsmust be firmly in place to ensure that the process is successfully imple-mented and that the desired results are achieved.

In planning for implementation of the serious incident preventionprocess, organizations may decide to proceed with a full facility-wide im-plementation or a more focused pilot effort in one or more units within a fa-cility. A facility-wide implementation has the obvious advantage ofensuring that the entire facility benefits from the improved process in theshortest practical time frame. A facility-wide approach is particularly ap-propriate if implementation of the improved incident prevention process isactively endorsed and supported by the organization’s top management.

Even when top managerial support exists, it may be advantageous toimplement the improved safety management process on a pilot basis in se-lected units of a facility or company. The resources required for such a piloteffort will be less intensive compared to implementation on a broader scale.The focusing of resources will help assure that the initial effort is well or-ganized and that the desired results are achieved. Getting the implementa-tion effort off to a good start is essential for generating the enthusiasm andencouragement needed to ensure that other organizational units will be re-ceptive to adopting this more effective management process.

In selecting specific organizational units for participation in a pilot pro-gram, managers should remember that the serious incident preventionprocess is applicable not only to operating units but also to HSE depart-ments and top-level management teams. To help ensure that initial imple-mentations achieve levels of improvement that will shine as a beacon toothers, management should strongly consider initial implementations inunits where there is the most concern for the occurrence of a serious inci-dent. Such concern may be based upon the following factors:


CH16pp190-196 4/10/02 12:52 PM Page 192

� History of incidents

� Frequency of near misses

� Low safety audit scores

� High level of risk inherent to the unit’s operations

� Other key indicators

Priority for implementation may also be given to units led by individu-als who have earned the reputation as “safety champions” for their leader-ship in implementing safety improvement initiatives. Inclusion of thesehigh-performance units in a pilot program will assure that the initial imple-mentation is supported with the proper leadership and that the initiative isreceived as credible in the eyes of others.

Regardless of implementation on a facility-wide or a pilot-programbasis, leaders must ensure the actions necessary for success are taken.Experience confirms that implementation plans should include the follow-ing actions:

� Identify, encourage, and recruit employees for leadership roles

� Form implementation teams comprised of employees responsible forthe critical work and other individuals with special expertise valuableto the team

� Provide training for implementation teams

� Consider the need for team facilitators

� Consider the need for a steering team

� Ensure that “Plan-Do-Check-Act” steps are in place

� Conduct communications meetings led by the implementation teamto introduce the serious incident prevention process to all affectedemployees

� Include management’s visible participation and endorsement in thecommunications meetings

� Follow the plan, maintain constancy of purpose, continue to involveemployees, and continually strive for improvement

An approach that includes the above actions will maximize the proba-bility of a successful implementation. This approach recognizes that indi-viduals responsible for the critical work must be involved in leadership rolesin developing and implementing the serious incident prevention process.Providing training on the elements of the serious incident preventionprocess and teamwork skills will be helpful in keeping the team on track


CH16pp190-196 4/10/02 12:52 PM Page 193

and achieving effective teamwork. Resourcing the team with a trained fa-cilitator and the formation of a steering team will provide guidance and helpassure that teams function efficiently and remain on the proper course.

After the serious incident prevention process is developed, the imple-mentation team should take the lead in communicating the new process tocoworkers. Effective communications can be accomplished by schedulingspecial meetings where hourly-roll and other implementation team mem-bers take leadership roles in communicating the improved safety manage-ment process to their coworkers. The objective of these kick-off meetings isto educate all employees regarding the need for an improved process, howthe new process works, why it will be successful, the responsibilities ofeach team member, and the benefits to be gained from implementation.

The list of critical work items, performance standards, and measure-ment and feedback systems should be discussed in sufficient detail toachieve a common understanding of the new safety-management process.Participation of one or more top-level managers in the communicationsmeetings to endorse the implementation team’s work will help facilitatesuccessful implementation.

Following roll-out of the newly developed serious incident preventionprocess, the ongoing involvement of all affected employees will remain crit-ical to achieving and sustaining high levels of performance. Periodic re-views to evaluate each of the eight process elements will help keep theprocess fine-tuned and up-to-date. In striving for continual improvement,managers must be diligent in maintaining the constancy of purpose and vis-ible support needed for long-term success.

Taking the Step Forward

Implementation of a more effective safety management process can beone of the most value-adding and personally satisfying initiatives possibleduring a management career. Providing the leadership for implementationof the eight-element serious incident prevention process will provide majorbenefits to the organization for decades to come. It is the type of positive,long-lasting change that legacies are made of.

It is time for more leaders to take the step forward. Breakthrough per-formance is needed to further drive serious incidents toward extinction.Managers must look beyond the daily pressures inherent in their jobs to im-plement more effective processes for the prevention of incidents. Serious-incident-free operation provides major benefits for all—employees andtheir families, shareowners, customers, suppliers, and the public.


CH16pp190-196 4/10/02 12:52 PM Page 194

References1. J. Krakauer, Into Thin Air: A Personal Account of the Mount Everest Disaster

(New York: Doubleday, 1997), 259–280.


CH16pp190-196 4/10/02 12:52 PM Page 195

CH16pp190-196 4/10/02 12:52 PM Page 196

197

AApollo I, 45–46Association of American Railroads, 90–91Automobile safety (see motor vehicle

safety)Aviation safety, 86

BBarriers to improvement, 27–28Behavioral-safety, 29–31, 44, 143Bhopal, India, 3, 33, 72–73Bill Dillard Shows, Inc., 48BLEVE, 41Bonfire incident, 4Boorda, Jeremy, 38Boston Celtics, 153Brainstorming, 62–66

CCase study, 159–189Causal factors, 88–89, 148–152Chaffe, Roger, 46

Chemical incidents (see hydrocarbon-chemical

Computer modeling, 74Consensus, 61–62Corrective action, 35, 148–152, 192Covey, Stephen R., 22, 50, 108Crandell, Robert C., 50Critical work, 34, 83–102, 113–121,

159–181, 191Crosby, Philip B., 93

DD-Day, 55Deming improvement cycle, 32–33, 42–43Demosthenes, 40–41Department of Defense, 78Drucker, Peter, 39, 46–47Dyson, James, 111–113

EEastman Chemical Company, 1–3, 41, 143Elliot, Frank, 55–56

Index

Indexpp196-198 4/17/02 10:54 AM Page 197

Employee involvement, 22–23, 33, 48–59,54–55, 60–67, 94, 154–156, 191

Survey results, 55, 57–58EPA, 3, 86

FFatality rates, 6–7Feedback (see Measurement and feedback) Fire incident rates, 7–8Flixboro, 33Fly-crash-fix-fly cycle, 33–34Force-field diagram, 27

GGrissom, Virgil, 46Grose, Vernon L., 26

HHandy, Charles, 51HAZOP, 100Hoover, Herbert, 84HSE incident prevention process, 183–187Human error, 75–78, 88, 148, 150–151

Causation model, 77Estimates of rates, 75

Hydrocarbon–chemical industry incidents,4–15, 101

IImai, Masaaki, 39Intelligence, types of, 50–51Islands of excellence, 33

JJackman, Richard, 141–142Johnson, Lyndon, 45

KKaizen, 39Kletz, Trevor, 18Krakauer, Jon, 190

LLaw of the Farm, 22Law of the Lid, 40Line ownership, 25Los Angeles Lakers, 153

MManagement by exception, 23Management commitment and leadership,

32–33, 37–47, 159–161, 165, 191–194Management of change, 96–102, 161

Planned changes, 96, 99–102Unplanned changes, 96–99, 101–102

Maxwell, John, 40Measurement and feedback, 23–24, 34–35,

109–140, 159–181, 192Safety performance indexing, 124,

126–140, 163–168, 173–174Mexico City incident, 41MIL-STD-882D, 78–81

Mishap probability, 78–80Mishap risk assessment, 80–81Mishap risk categories, 81Mishap severity, 78–79

Misguided optimism, 26–27Motor vehicle safety, 83–86

Highway fatalities, 85

NNASA, 45–46National Transportation Safety Board, 3,

107NBA (National Basketball Association), 153Near misses, 74, 102, 116, 118, 149, 171NFPA codes, 178, 179

OOrganizational focus, 42–43, 154Organizational learning, 154–156OSHA, 3, 6, 30, 54–55, 74, 86, 94–95, 114

Process Safety Management, 74, 94–97Voluntary Protection Program (VPP), 54Voluntary Safety and Health Program

Management Guidelines, 54–55

PPareto principle (voting), 63–66,Pearl Harbor, 109Performance management, 29–32Performance standards, 34, 103–110, 192

Corporate/company standards, 105–106Explicit standards, 108–109Facility/operating standards, 106–107Implicit standards, 108–109


Indexpp196-198 4/17/02 10:54 AM Page 198

PIC, 143Pipeline operations, 162–178Plan-Do-Check-Act, 32–33, 42–43, 113,

124, 157, 193Port of New Orleans, 149Prison break exercise, 52–53, 57

QQuality management, 31

RRail yard incidents, 6–8,Recognition (see also reinforcement and

feedback), 24–25Red flags, 44, 53, 98, 149–151, 157,

165–167, 175, 178Refinery incidents (see hydrocarbon-

chemical)Reinforcement, 32, 35, 44, 137, 141–147,

165–166, 175–176, 183–186, 188Reinforcement Plans, 143–146, 165,

175–176, 186, 188Social Reinforcement, 143–146Tangible Reinforcement, 143–146

Resource allocation, 43Responsible Care, 3Risks

Definition, 68Identification and understanding, 33–34,

68–82, 83–87, 167–187, 191Root causes, 148, 150, 176

SSafety culture, 155–156Safety performance indexing (see measure-

ment and feedback)

Shared vision, 154–156Shepard, Alan, 45Site-management incident prevention

process, 187–189Slayton, Deke, 45SSIP Rule, 143–144, 146, 164Storage terminal incidents (see hydrocar-

bon-chemical)Summit Fever, 190–191Synergy, 50–54Systems Safety, 78–81

TTank car loading, 89–93, 151Tank storage operations, 162–167, 176–179Team atmosphere, 66–67Teamwork, 53–54, 60–67, 154–156, 162,

191The Age of Paradox, 51Thomas, Eugene, 98Tornado safety, 87

UU.S. Navy, 38Universe of safety tasks, 30

VValdez, 33Vapor cloud explosion, 2

WWal-mart, 99Warehouse operations, 114–121, 162–167,

179–182Welch, Jack, 50White, Edward, 46

Index � 199

Indexpp196-198 4/17/02 10:54 AM Page 199

Indexpp196-198 4/17/02 10:54 AM Page 200

Serious Incident Prevention 2E

Documents

Transcript of Serious Incident Prevention 2E