International Journal of Multidisciplinary Research and Growth Evaluation

Process Safety Management and Management of Change Effectiveness in Mature Oil and Gas Production Operations

Susan Ochi Makut1, Festus-Michael Uwagboe2, Henry Chukwuemeka Olisakwe3

  1. 1
  2. 2
  3. 3
Version of record

This is an author-deposited copy. The version of record was originally published elsewhere: Originally published in International Journal of Multidisciplinary Research and Growth Evaluation, Volume 3, Issue 6, 2022. DOI 10.54660/.IJMRGE.2022.3.6.1304-1326 . Original source: https://www.allmultidisciplinaryjournal.com/archives/year-2022.vol-3.issue-6.

Abstract

Mature oil and gas operations make more brownfield changes each year while their staff shrink, straining management of change (MOC). This study develops a system dynamics model of MOC effectiveness. Five types of change flow through capture, hazard review and pre-startup safety review. Any hazard that escapes becomes a latent condition, which persists until audits, near-miss learning, process hazard analysis revalidation or maintenance remove it, or until it releases a process safety event. Inputs are representative literature values, not site data. With reviewers declining 4 percent and changes growing 3 percent a year, reviewer load doubled over ten years. Review effectiveness fell from 0.80 to 0.52, and the expected annual rate of process safety events rose from 3.2 to 5.3. Sixteen intervention portfolios were evaluated. Strengthening audits and near-miss learning was the most cost-effective single measure, averting 16.4 events for USD 1.2 million. Better change capture without added reviewer capacity was undermined by reviewer overload; pairing capture with added capacity averted a third more events than the sum of their separate effects. All four interventions together cut expected events by 70 percent, a benefit-cost ratio of 3.3. A quarterly audit of 20 MOC records detected a fall in review quality within a year with 80 percent probability. Over three years, event counts detected it with only 28 percent probability.

Keywords: management of changeprocess safety managementmature fieldssystem dynamicslatent conditionsleading indicatorsoil and gas production

Full text

Text extracted from the article PDF for reading and search. Tables, figures and equations are in the PDF, which remains the authoritative version.

1. Introduction

Process safety management (PSM) has been the principal regulatory and organizational response to major accidents in the process industries since the late 1980s. In the United States, the Occupational Safety and Health Administration standard on process safety management of highly hazardous chemicals sets out fourteen elements that covered facilities must implement [1], and the Environmental Protection Agency Risk Management Program addresses accidental releases to the public and environment [2, 3]. In Europe, the Seveso III directive establishes comparable requirements for major-accident hazards [4]. Industry frameworks such as the Center for Chemical Process Safety (CCPS) risk-based process safety guidelines [5], the Energy Institute high-level framework [6] and the International Association of Oil and Gas Producers (IOGP) process safety fundamentals [7] have extended these requirements into management systems that emphasize commitment, hazard understanding, risk management and learning. Bibliometric and scientometric analyses show that process safety research has grown rapidly and diversified across these themes [8, 9].

Management of change (MOC) is the PSM element that ensures that modifications to equipment, chemicals, technology, procedures and organization are reviewed for their hazards before they are implemented [1, 10]. Its importance was established by the Flixborough disaster of 1974, in which a temporary bypass installed without engineering review failed and released cyclohexane [11], and it has been reaffirmed by many later accidents. Investigations of the Texas City refinery explosion [12, 13], the Macondo blowout [14], the Longford gas plant explosion [15], the Williams Olefins reboiler rupture [16], the Philadelphia Energy Solutions refinery fire [17] and the Husky Superior refinery explosion [18] all identified failures to recognize or properly assess changes. Analysis of chemical industry accidents has attributed a substantial share to deficiencies in MOC [19], and practitioner reviews of incidents and audits have found recurring weaknesses in MOC practice [20, 21]. Mature oil and gas production operations present conditions that place particular stress on MOC. As fields age, brownfield modifications multiply: separators are re-rated, compression is added or removed, water handling is expanded, controls are upgraded and equipment is replaced, and ageing pressure vessels must be reassessed for fitness for service [22–25]. At the same time, declining production and margins create pressure to reduce engineering and operations staff, to outsource and to restructure, and organizational change has been shown to affect safety outcomes in the petroleum industry [26–28]. Knowledge is lost as experienced workers retire [29], and creeping changes accumulate that individually seem minor [30, 31]. These conditions resemble the drift towards the boundary of safe performance that Rasmussen described [32] and the incubation of disasters described by Turner [33]. Upstream process safety event data show that the oil and gas production sector continues to experience significant process safety events [34–36].

Although the importance of MOC is widely accepted, quantitative evidence on how MOC effectiveness responds to the conditions of mature operations, and on which interventions offer the best return, is limited. Existing studies describe what a good MOC system looks like [21, 37], how to audit it [38], how its action items should be scoped [39] and how MOC quality relates to performance [40], but they rarely model the dynamic interaction between change volume, reviewer capacity, review quality and the accumulation of latent hazards. System dynamics has been applied to safety management systems [41], construction safety culture [42, 43], behavioural safety [44] and near-miss reporting [45], but not, to the author’s knowledge, to MOC in mature production operations. This paper develops such a model and uses it to answer four questions. How does MOC effectiveness evolve when change volume grows and reviewer capacity declines? Which PSM and MOC interventions are most cost-effective, alone and in combination? Which parameters most influence process safety outcomes? And how quickly can deterioration in MOC be detected by leading indicators compared with lagging event counts? Section 2 reviews the literature, Section 3 presents the model, Section 4 the results and Section 5 the discussion, and Section 6 concludes.

2. Literature Review

This section reviews the literature on which the model is built: PSM regulation, frameworks and effectiveness; process safety indicators; MOC design and failures; organizational change, drift and normalization of deviance; organizational accident models and learning from incidents; and quantitative and system dynamics models of safety management. The review draws on the observation that major accidents in the process industries arise from combinations of technical, human and organizational causes [46–48], and on reviews of risk analysis methodologies for industrial plants and work sites, which classify the qualitative, semi-quantitative and quantitative methods available for assessing such causes [49, 50]. It also reflects the systematic review evidence that safety management practices rely on indicators whose selection and use remain contested [51].

2.1. Process Safety Management Regulation and

Effectiveness Regulatory PSM frameworks differ in scope and enforcement. The OSHA PSM standard [1] and its enforcement in petroleum refineries, which produced lessons on recurring citations [52], the EPA Risk Management Program and its accident epidemiology [2, 3], and the Seveso directives and their implementation in different countries [4, 53, 54] have been studied. The COVID-19 pandemic tested safety management in Italian Seveso establishments [55]. Calls have been made for an international standard for process safety management [56], for corporate governance guidance for senior leaders [57] and for PSM approaches suited to upstream oil and gas [58]. Lessons from Bhopal have been used to strengthen PSM elsewhere [59], and a pesticide plant explosion yielded further PSM lessons [60]. The effectiveness of PSM systems has been assessed through quality evaluations in industrial corporations [61], systematic reviews of hazard identification and risk control practices [62], analyses of interrelations between PSM elements [63], strategies for sustaining process safety performance [64] and predictions of effectiveness for managing low-probability events [65]. Internal auditing of process safety and QHSE performance [66, 67], the relationship between audit findings and operational discipline [68], the limitations of auditing as verification [69], warning flags for organizations [70], survey-based measurement systems [71] and the persistent problem that early warning signals are noticed but not acted upon [72] show that compliance does not guarantee effectiveness. Risk analysis has been proposed as the basis of safety management systems [73], risk-based process engineering frameworks have been proposed to strengthen reliability across complex natural gas infrastructure [74], including in small enterprises with major hazards [75], and cause-consequence analyses of Seveso accidents have informed system design [76]. Process safety leadership [57, 77], competence assessment [78], workforce safety training [79] and education [80] are recognized as conditions for effective PSM.

2.2. Process Safety Indicators

Indicators are used to monitor PSM effectiveness. API RP 754 defines Tier 1 and Tier 2 process safety events as lagging indicators and Tier 3 and Tier 4 as leading indicators [81], IOGP Report 456 provides an equivalent framework for oil and gas [82] and CCPS publishes leading and lagging metrics [83]. The debate on process safety indicators that followed the Texas City accident [84–87] and later work on organizational risk indicators [88], the use of indicator information [89], instantaneous measurement of plant safety [90], barrier-status indicators [91] and leading indicators for oil storage and pipelines [92] show both the promise and the difficulty of measuring process safety. Upstream event data compiled by IOGP have been analysed to identify learning opportunities [34–36, 93].

2.3. Safety Culture, Leadership and Climate

PSM operates within an organizational culture. Reviews of safety culture [94, 95], safety climate [96] and HSE culture in the petroleum industry [97, 98], maturity models [99–101], including an organizational learning-based maturity model for continuous safety performance improvement [102], and their critique show the breadth of the field. Studies in petrochemical and oil and gas settings have examined culture factors and risk perception [103], cross-cultural organizational factors in refineries [104], perceived safety culture [105], culture assessment [106], resilience safety culture [107], safety climate and mindful practices [108], safety leadership and performance [109–111], leadership practices for compliance [112], safety management practices and behaviour [113] and the role of safety climate in implementing safety management systems [114]. The Texas City investigation and subsequent analyses identified cultural causes [13, 115], and process safety culture pathologies, including normalization of deviance, have been described [116]. Conceptual models have also linked leadership-driven safety culture transformation in large workforces [117], the frequency and coverage of management safety walkthroughs [118] and the institutionalization of life-preserving safety practices across project-based organizations [119] to safety culture outcomes.

2.4. Management of Change

The CCPS guidelines define the scope of MOC, the types of change it should cover and the steps of review, authorization, implementation and closeout [10]. Practitioner studies discuss how to manage MOC [37], why it is sometimes neglected [120], what a good system looks like [21], how to ensure that MOC action items are correctly scoped [39], how to benchmark MOC practices across the process industries [121] and how to implement effective MOC in upstream oil and gas [122]. Quality implementation of MOC and its relation to performance [40], methods for auditing MOC programmes in oil and gas [38] and lessons from incidents and audits [20] have been reported. Process modelling has been used to analyse the business flow of MOC across the plant life cycle [123], to support logical PSM [124], to identify the information required for risk assessment in MOC [125] and to support MOC with HAZOP logs [126]. Case histories of process safety failures include many involving change [127, 128].

Organizational change is a particularly difficult category. Kletz argued that changes in organization, staffing and responsibilities can be as hazardous as changes in equipment [129], and studies have assessed process operation staffing arrangements [130] and the impacts of mergers, downsizing and reorganization on PSM [131]. Creeping changes, which accumulate gradually without triggering MOC, have been analysed by Goff and colleagues [30, 31, 132], and atypical accident scenarios can emerge from changes to process conditions [133]. Accidents in which change management failed include the Shell Moerdijk explosions [134], the BP Grangemouth incidents [135], the Buncefield depot explosion [136] and the Williams Geismar reboiler rupture, in which an isolated standby reboiler was overpressured [16, 137].

2.5. Organizational Change, Staffing and Psychosocial

Factors Research in the Norwegian petroleum sector and elsewhere has examined how restructuring and downsizing affect safety. Studies show ways to identify and manage psychosocial risks during restructuring [26], the moderating role of change process healthiness [27], links between psychosocial risks and hydrocarbon leaks [28, 138], action errors and violations on offshore rigs [139], safety climate on the Norwegian continental shelf [140, 141] and safety, reliability and worker satisfaction during change [142]. Broader reviews address the causes and effects of downsizing [143], restructuring and employee well-being [144], organizational change and mental health [145], downsizing and work conditions [146], responses to external shocks [147], job insecurity and safety outcomes [148], and work intensification and organizational safety performance [149]. Outsourcing in mature fields increases reliance on contractors, and governance-oriented models of contractor safety performance in multi-contract projects [150, 151] address the interfaces that restructuring creates. Fatigue [152], heat stress in extreme operating environments [153] and stress and situation awareness in drilling crews [154] complete the picture. Human factors contributions to offshore accidents have long been recognized [155].

2.6. Drift, Normalization of Deviance and Organizational

Accidents Rasmussen’s model of migration towards the boundary of acceptable performance under pressures of efficiency and workload [32] has been formalized and extended [156, 157], and Dekker described drift into failure as an emergent property of complex systems [158, 159]. Vaughan’s analysis of the Challenger launch decision introduced the normalization of deviance [160], and related analyses of Challenger and Columbia [161–163], repeated failures in high-risk technologies [164], learning failures as root causes [165] and disaster dynamics [166, 167] show how organizations accept growing risk. Normalization of deviance has been studied in oil and gas, including the role of rig leadership [168] and the Ocean Ranger [169], in process safety [170–172], construction [173], healthcare [174, 175], and nuclear power [176], and a conceptual framework has described the mechanisms through which unsafe behaviours recur in high-hazard worksites [177]. Models of production versus protection [178], frameworks for balancing productivity and safety compliance in high-risk drilling [179], drift and adjustment in rule compliance [180, 181], and high-reliability organizing [182] provide complementary perspectives.

Organizational accident models provide the theoretical basis for treating MOC failures as latent conditions. Reason’s distinction between active failures and latent conditions [48, 183, 184] and his account of organizational accidents [47] underpin the stock of latent conditions in the model. Systems approaches include STAMP [185, 186], applied to well control [187], pipelines [188, 189], process industries [190, 191], maritime incidents [192] and other domains [193], and reviewed [194, 195]; the functional resonance analysis method (FRAM) [196], reviewed and extended [197–199], and applied [200–203]; and AcciMap [204, 205], applied to building collapses [206], low-income settings [207] and near misses [208]. Comparisons of systemic methods [209–213], their use in practice [214–216], the organizational ceiling of investigations [217, 218], anti-dualist models [219], hybrid Reason-based approaches [220], accident causation reviews [221–223], loss of responsibility [224], rail safety management [225], mine safety [226] and the complexity of failure [227] complete the landscape. Root cause and accident investigation methods have been compared [228, 229], root-cause and thematic analysis for major incident management has been reviewed [230], the effect of accident models on investigations examined [231, 232], and the challenges of investigation data identified [233]; the systemic analysis of the 2015 Aliso Canyon gas leak [234] illustrates their application.

2.7. Learning from Incidents and Near Misses

Learning from incidents is the mechanism by which latent conditions are revealed and removed. Studies have examined how organizations learn from incidents [235, 236], efficient learning [237], methods to assess the effectiveness of the learning cycle [238], critical steps and propensity to learn [239, 240], experience feedback [241], organizational learning in high-hazard industries [242], multilevel learning [243], practical applications [244], systemic constraints [245], maturity of investigations [246], lessons from accidents [247, 248], the dilemma between learning and liability [249], learning from normal accidents to high reliability [250] and situation awareness and organizational learning [251]. Kletz’s work on learning from accidents remains influential [128], and reflections on Piper Alpha [252] and Texas City [253] ask what has really been learned.

Near-miss management extends learning to events without consequences. Near-miss reporting as a safety tool [254, 255], near-miss management in the chemical process industry [256], its effectiveness [257], industry-wide reviews [258, 259], workers’ near-miss experiences and reports [260, 261], game-theoretic analysis [262], the utilization of near-miss and hazard observation data [263], proactive hazard recognition and reporting systems [264], weak signals [265], unsafe acts and conditions [266], near misses from Seveso inspections [267] and accident surveys in downstream oil [268] show both the potential and the limits of near-miss systems. Incident data analysis using natural language processing and Bayesian networks [269], taxonomies of oil and gas process safety events [270], analyses of incident investigation data across industries and in U.S. chemical plants [271, 272] and analyses of operational events [273] provide evidence on contributing factors. Accident analyses in China [274–279], domino accidents [280], vapour cloud explosions [281], West Fertilizer [282] and drill crew situation awareness [283] add further lessons.

2.8. Quantitative Models of Safety Management

Quantitative methods for modelling organizational factors include fuzzy Bayesian networks [284], uncertainty handling in fault trees [285], dynamic Bayesian safety assessment of gas stations [286], dynamic risk assessment of the Texas City accident [287] and of process faults [288], fuzzy HAZOP of gas wellheads [289], expert judgement [290] and realistic frequency assumptions in QRA [291]. Barrier management in offshore oil and gas [292, 293], barrier diagrams [294], state-of-the-art reviews [295], mechanical integrity and barrier alarms [296] and operational safety economics [297] link organizational factors to technical barriers. Human reliability analysis methods such as SPAR-H [298–301], HEART [302], CREAM [303], NARA [304] and their reviews [305–308], together with skills-rules-knowledge [309], human barriers [310], performance shaping factor dependence [311], refinery-specific methods [312], offshore causal models [313, 314], integration with process hazard analysis [315], maintenance optimization [316] and conceptual frameworks of human error causation in high-risk construction and industrial activities [317], address the human contribution. Conceptual models of data-driven occupational safety risk control in large energy projects [318] and risk pathway models for lifting, rigging and crane installation [319, 320] show how hazards, controls and organizational factors can be linked in a structured way for specific high-risk activities.

System dynamics, which represents feedback, accumulation and delay [321], has been applied to the Westray mine disaster [322], traffic safety policy [323], construction safety culture and attitudes [42, 43], production pressure in construction [324], behavioural safety in chemical plants [44], the Bhopal safety management system [41] and near-miss reporting in complex systems [45]. These studies show that stock-and-flow models can capture the accumulation of latent hazards and the feedback between workload and safety performance that static models miss.

2.9. Mature-Field Operations and Research Gap

Late-life operations raise specific issues: the ageing of onshore fields [22], life extension of production facilities [23], asset management guidelines [24], decommissioning safety [325, 326], risk from maintenance and modification work on major process equipment [327], incident prevention in maintenance engineering [328], integrity management of ageing fired heaters, boilers and furnaces in upstream service [329], operational discipline and conduct of operations [330, 331], shift handover [332–335] and knowledge retention with an ageing workforce [29]. The literature has therefore established that MOC failures contribute to major accidents, that organizational change and workload affect safety, that latent conditions accumulate and that learning removes them. What it lacks is a quantitative model that connects these mechanisms in the setting of mature production operations, evaluates interventions jointly and compares leading and lagging indicators of MOC deterioration [41, 45, 156]. The model presented next is designed to fill that gap.

3. Methods

This section describes the model structure, the representative operation and its parameters, the interventions evaluated, the global sensitivity analysis and the indicator detection experiment. The model is a stock-and-flow system dynamics model in the tradition of Sterman [321], in which the stock is the number of latent conditions present in the facility, following Reason’s concept of latent conditions that lie dormant until combined with triggering events [47, 48]. Its inflows are the hazards introduced by changes that escape the MOC process, and its outflows are removal of latent conditions by detection and the release of process safety events. Similar structures have been used to model safety management systems and drift [41, 44, 156]. All parameter values are representative values chosen from ranges reported in the literature cited; they are not data from a specific operation, and the results demonstrate the behaviour of the model rather than estimate outcomes for any facility.

3.1. Model Structure

Figure 1 shows the model structure. Changes arrive in five categories: technical permanent changes, temporary changes, emergency changes, organizational changes and setpoint and software changes, following the scope of change recommended in MOC guidance [10, 129]. Each change has a probability of creating a latent hazard if it is implemented without effective review. A change is first captured by the MOC process with a probability that depends on its category; uncaptured changes, including creeping and unrecognized organizational changes, pass directly to the stock of latent conditions if hazardous [30, 131]. Captured changes are reviewed for hazards with an effectiveness that falls when reviewer load exceeds capacity, reflecting the effect of work intensification on safety performance [130, 149]. Hazards missed at review may be caught at pre-startup safety review (PSSR) and closeout. Captured temporary changes that remain in place beyond their expiry create further hazards [20, 21]. Latent conditions are removed by audits, near-miss reporting and investigation, process hazard analysis (PHA) revalidation and routine rectification during maintenance, or release a process safety event [5, 66, 256, 328]. Mature-operation pressures increase change volume and reduce reviewer staffing over time.

Fig 1: Stock-and-flow structure of the management of change and process safety model.

Change arrivals of category ?????? in month ?????? grow with brownfield activity, and reviewer staffing declines with cost reduction:

The reviewer load is the effort demanded by captured changes relative to reviewer capacity, and review effectiveness declines as a power of the overload [149, 324]:

where � is the monthly probability that a latent condition releases a process safety event, � the monthly near-miss rate per latent condition, �� the reporting probability, �� the probability that investigation identifies and removes the condition, ?????? the annual fraction removed by audits and �� the monthly fraction removed by routine maintenance. �(??????) is the fraction removed at five-yearly PHA revalidation, equal to the PHA detection probability multiplied by documentation accuracy in months 60 and 120 and zero otherwise, which reflects the dependence of PHA on accurate records of past changes [10, 124]. Expected process safety events are ??????(??????)=�??????(??????), of which a fraction ?????? are Tier 1 events in the API RP 754 classification and the remainder Tier 2 [81, 82]. The MOC effectiveness index is the fraction of hazardous changes that are neutralized:

The model starts from the steady state of the baseline parameters and runs monthly for ten years.

3.2. Representative Operation and Parameters

The representative operation is a mature onshore production asset with gathering, separation, compression, water handling and storage, operated by a team that includes three full-time equivalent MOC reviewers at the start of the horizon. Table 1 gives the change-type parameters and Table 2 the system parameters. Change volumes, about 230 per year at the start, are consistent with practitioner descriptions of MOC workload in operating facilities [20, 21, 122]. Capture probabilities are lowest for organizational changes, which are often not recognized as requiring MOC [120, 129, 131], and for setpoint and temporary changes [20, 38]. Review effectiveness at capacity of 0.80 and PSSR detection of 0.40 reflect evidence that MOC reviews miss a substantial share of hazards [19, 40]. The annual decline in reviewers of 4 percent and growth in changes of 3 percent represent cost pressure and brownfield activity in mature fields [22, 26]. Near-miss rates, reporting and investigation parameters reflect studies of near-miss management in the process industries [257, 259, 263, 268], and audit and PHA parameters reflect evidence on audit and revalidation effectiveness [66–68]. Costs of process safety events, USD 2.5 million for a Tier 1 event and USD 0.3 million for a Tier 2 event, include repair, lost production and response, consistent with analyses of operational safety economics [297].

Table 1: Change-type parameters.

3.3. Interventions

Four interventions were evaluated (Table 3), each grounded in recommendations from the literature. P1, a change capture programme, extends MOC coverage through training, clearer triggers and an MOC system that flags organizational, temporary and setpoint changes [123, 126, 129]; structured training models are a recognized means of operational risk reduction [79], and cross-functional education has been associated with fewer errors in the work of engineering teams [336]. P2 restores reviewer capacity by adding one reviewer, halting the decline in staffing and introducing risk-tiered triage, in which half of the changes are classified as low risk and receive a streamlined review requiring 30 percent of the standard effort [21, 39, 125]. P3 enforces expiry of temporary changes through tracking and escalation [20, 21]. P4 strengthens the detection of latent conditions through more effective audits and improved near-miss reporting and investigation [66, 256, 257, 264]. Annual costs are representative estimates of staff time, systems and training. All sixteen combinations of the four interventions, including the baseline, were evaluated.

Table 3: Interventions evaluated. Code Intervention Parameter changes Annual cost (USD k) P0 Baseline mature operation None 0 P1 Change capture programme Capture probabilities 0.97, 0.92, 0.90, 0.75, 0.85 150 P2 Reviewer capacity and risk-tiered triage 4.0 FTE, no decline, triage of low-risk changes 200 P3 Temporary change expiry enforcement Overdue fraction 0.05 60 P4 Audit and near-miss learning Audit removal 0.30, reporting 0.70, investigation 0.70 120

3.4. Global Sensitivity Analysis

To identify the parameters that most influence outcomes, eighteen parameters were varied simultaneously over the ranges in Table 4 using Latin hypercube sampling with 3,000 samples, and partial rank correlation coefficients (PRCC) between each parameter and the ten-year expected count of process safety events were computed [285, 290]. PRCC measures the monotonic association between a parameter and the output after removing the linear effects of the other parameters on ranks, and is widely used for global sensitivity analysis of system dynamics and risk models [285, 321]. Latin hypercube sampling ensures that each parameter range is covered evenly with far fewer samples than simple random sampling, and the ten-year expected event count was chosen as the output because it integrates both the inflow and the removal of latent conditions.

Table 4: Parameter ranges for the global sensitivity analysis. Parameter Range Parameter Range Capture, technical 0.80 to 0.99 Overdue temporary changes 0.05 to 0.50 Capture, temporary 0.55 to 0.95 Event release probability 0.004 to 0.009 per month Capture, emergency 0.50 to 0.95 Near-miss reporting 0.2 to 0.8 Capture, organizational 0.10 to 0.80 Investigation removal 0.3 to 0.8 Capture, setpoint 0.40 to 0.90 Audit removal 0.05 to 0.35 per year Review effectiveness at capacity 0.60 to 0.95 PHA revalidation detection 0.2 to 0.6 PSSR detection 0.2 to 0.6 Documentation accuracy 0.50 to 0.95 Overload elasticity 0.4 to 1.2 Reviewers at start 2.0 to 4.5 FTE Annual decline in reviewers 0 to 8 percent Annual growth in changes 0 to 6 percent

3.5. Indicator Detection Experiment

The final analysis compares how quickly a deterioration in MOC review quality can be detected by a leading indicator and by a lagging indicator. In the experiment, review effectiveness drops from 0.80 to 0.60 at time zero, with change volume and staffing held constant. The leading indicator is a quarterly audit in which � completed MOC records are independently re-reviewed and scored as adequate or inadequate, consistent with MOC audit methods [38, 66]. A Beta(1,1) prior on review quality is updated with the cumulative results, and an alarm is raised when the posterior probability that quality is below 0.70 exceeds 0.90:

where ??????� is the number of adequate records in quarter ??????. The lagging indicator is the cumulative count of Tier 1 and Tier 2 process safety events, with an alarm when it exceeds the 90th percentile of the Poisson distribution of the cumulative count expected without deterioration, in line with the use of event counts as lagging indicators [81, 89]. Each indicator was simulated 4,000 times over twelve quarters with deterioration, and its false alarm probability was estimated by simulating the same procedure without deterioration.

4. Results

This section reports the baseline dynamics of the mature operation, the effects of single interventions and portfolios, the global sensitivity analysis and the indicator detection experiment. Results are expected values over the ten-year horizon unless stated otherwise. Because the parameters are representative, the relative effects of interventions and the qualitative dynamics are more informative than the absolute numbers of events, in keeping with the use of system dynamics models for policy analysis rather than point prediction [41, 321, 322]. Where portfolios are compared, the same initial stock of latent conditions is used so that differences reflect the interventions alone, and costs are undiscounted totals over the decade.

4.1. Baseline Dynamics of the Mature Operation

Figure 2 and Table 5 show the baseline. Reviewer load rose from 0.86 of capacity at the start to 1.72 at year ten, crossing capacity after about two years. Once reviewers were overloaded, review effectiveness fell steadily from 0.80 to

0.52. The MOC effectiveness index, the share of hazardous

changes neutralized, fell from 0.69 to 0.58, and new latent conditions rose from 19.2 per year in year one to 33.5 per year in year ten. The stock of latent conditions grew from about 44 to 54, and the expected rate of process safety events rose from 3.2 per year in year one to 5.3 per year in year ten. The PHA revalidations at years five and ten produced visible step reductions in the stock and the event rate, but the stock rebuilt within two years because the inflow continued to grow. Over ten years the baseline produced 39.3 expected events, of which 5.9 were Tier 1, with an expected loss of USD 24.8 million. A counterfactual without staffing decline or change growth produced 32.6 events, so the pressures of mature operation added 6.7 events, or 20 percent, over the decade. These dynamics reproduce in quantitative form the drift towards the boundary of safe performance described by Rasmussen [32] and the incubation of hazards described by Turner and by Dekker [33, 158].

Fig 2: Baseline dynamics of the mature operation: (a) reviewer load and review effectiveness and (b) expected process safety event rate compared with a counterfactual without staffing decline or change growth.

Table 5: Baseline mature operation in year 1 and year 10. Measure Year 1 Year 10 Reviewer load relative to capacity 0.86 1.72 Review effectiveness 0.80 0.52 MOC effectiveness index 0.69 0.58 New latent conditions per year 19.2 33.5 Stock of latent conditions 44 54 Expected process safety events per year 3.2 5.3 Figure 3b shows the sources of latent conditions. In year one, temporary changes were the largest source, contributing 7.4 of 19.2 new latent conditions per year, followed by technical permanent changes with 4.6. By year ten, technical permanent changes had more than doubled to 10.8, because the growth in their volume combined with the collapse in review effectiveness, and temporary changes had risen to

11.6. Organizational changes contributed 2.2 latent

conditions per year in year one despite their low volume, because most were not captured by MOC.

4.2. Single Interventions

Figure 3a and Table 6 compare the single interventions. Strengthening audits and near-miss learning (P4) was by far the most effective, reducing ten-year expected events from 39.3 to 22.9, a reduction of 16.4 events or 42 percent, for USD 1.2 million, a benefit-cost ratio of 8.6. It worked by draining the stock of latent conditions, which fell to 29 by year ten instead of rising to 54. The change capture programme (P1) averted 5.1 events, but its effect was limited by a mechanism that is easy to overlook: by routing more changes into MOC without adding reviewers, it raised reviewer load to 1.97 of capacity by year ten and reduced review effectiveness to 0.46, below the baseline. Reviewer capacity and triage (P2) kept load at 0.56 of capacity and review effectiveness at 0.84 throughout and averted 4.8 events, but at the highest cost. Temporary change expiry enforcement (P3) averted 4.0 events for only USD 0.6 million, a benefit-cost ratio of 4.2. The weak response to P1 mirrors the finding of studies of work intensification that adding demands without resources degrades the quality of safety-critical work [149, 337].

Fig 3: (a) Cumulative expected process safety events under single interventions and (b) sources of new latent conditions in year 1 and year 10 of the baseline.

4.3. Intervention Portfolios

Table 6 reports all sixteen portfolios and Figure 4 plots expected events averted against cost. Every portfolio had a benefit-cost ratio above 1, ranging from 1.5 for P2 alone to 8.6 for P4 alone. The cost-efficient frontier consists of P3, P4, P3 and P4, P1 and P4, P2 and P4, P1 with P3 and P4, P1 with P2 and P4, and all four. Every frontier portfolio from P4 onwards contains P4, confirming that removing latent conditions is the foundation of a cost-effective programme in a mature operation. The interaction between capture and capacity is strongly synergistic: P1 and P2 together averted 13.3 events, against 9.9 for the sum of their separate effects, because capacity allows the additional captured changes to be reviewed effectively. All four interventions together reduced ten-year expected events from 39.3 to 11.9, or 70 percent, and Tier 1 events from 5.9 to 1.8, for USD 5.3 million, averting USD 17.3 million of expected losses, a benefit-cost ratio of

3.3. The MOC effectiveness index under the full portfolio

was 0.86 throughout the horizon. These results support the view that PSM elements interact and must be strengthened together [63, 64].

Table 6: Ten-year results of intervention portfolios. Portfolio Expected events Tier 1 events Expected loss (USD M) Cost (USD M) Events averted Benefit-cost ratio P0 39.3 5.9 24.8 0.0 0.0 P1+P2+P3+P4 11.9 1.8 7.5 5.3 27.4 3.3 Fig 4: Expected process safety events averted over ten years against intervention cost for all sixteen portfolios; filled markers and the line show the cost-efficient frontier.

4.4. Global Sensitivity Analysis

Across the 3,000 Latin hypercube samples, the ten-year expected number of events had a mean of 33.2, with a 90 percent range from 17.2 to 55.2. Figure 5 shows the PRCC values. The event release probability per latent condition had the strongest positive association (0.91), as expected, since it scales the conversion of latent conditions into events. The strongest protective parameters were audit removal of latent conditions (-0.85), near-miss reporting (-0.78) and review effectiveness at capacity (-0.75), followed by investigation removal (-0.67), reviewer staffing (-0.62) and PSSR detection (-0.59). Growth in change volume (0.70) and the overdue fraction of temporary changes (0.62) were the strongest harmful parameters after the release probability. Capture probabilities had moderate associations, from -0.40 for technical changes to -0.22 for organizational changes, and PHA revalidation detection (-0.20) and documentation accuracy (-0.13) the weakest. The ranking is consistent with the portfolio results and indicates that, within the ranges studied, the detection and removal of latent conditions and the quality of hazard review matter more than incremental improvements in capture [40, 89, 257].

Fig 5: Partial rank correlation coefficients between model parameters and the ten-year expected number of process safety events.

4.5. Leading and Lagging Indicators

Table 7 and Figure 6 report the detection experiment. A quarterly audit of 20 MOC records detected the fall in review quality from 0.80 to 0.60 within four quarters with probability 0.80 and within eight quarters with probability 0.95, with a false alarm probability over twelve quarters of 0.02. With 40 records per quarter, detection within four quarters rose to 0.94; with 5 records it fell to 0.58 and false alarms rose to

0.09. The lagging indicator performed poorly: because latent

conditions accumulate gradually, the expected event rate rose from about 0.80 to only about 1.0 per quarter over three years, and the cumulative event count detected the deterioration within twelve quarters with probability 0.28, while raising false alarms with probability 0.23. This quantifies the argument that lagging process safety event counts are too sparse and too delayed to monitor the health of PSM elements, and that leading indicators based on the quality of element execution are needed [84, 90, 92].

Table 7: Probability of detecting a fall in MOC review quality from 0.80 to 0.60. Indicator Within 4 quarters Within 8 quarters False alarm within 12 quarters Cumulative process safety event count 0.16 0.22 0.23 Fig 6: Probability of detecting a fall in MOC review quality and of false alarms for audit-based leading indicators and a lagging event count.

5. Discussion

This section interprets the findings in relation to the literature, draws implications for operators and regulators of mature production operations, considers how the model could be calibrated and used in practice, and sets out its limitations. The discussion is framed by the organizational accident perspective, in which serious events result from latent conditions created by decisions and processes remote from the point of failure [47, 48, 184], and by the systems view that safety emerges from the control of interactions across organizational levels [32, 185, 186]. It also takes account of evidence that organizations frequently fail to act on early warnings [70, 72, 165].

5.1. Principal Findings

Three findings stand out. First, in a mature operation in which changes grow and reviewers decline, MOC effectiveness erodes gradually and the stock of latent conditions builds, so that the event rate rises by about two thirds over a decade even though no single decision appears to weaken the MOC system. This is the quantitative signature of drift into failure [156, 158, 159] and of the normalization of deviance, in which progressively degraded practice comes to be accepted [116, 160, 177]. Studies of restructuring and downsizing in the petroleum industry report associations between organizational change and safety outcomes [26–28], and the model provides a mechanism, reviewer overload, through which such associations can arise.

Second, the most cost-effective intervention in the model is not at the front of the MOC process but at its back: strengthening audits, near-miss reporting and investigation so that latent conditions are found and removed. This reflects the stock-and-flow structure: in a mature operation, a large stock of latent conditions has already accumulated from past changes, and front-end improvements only reduce the rate at which it grows. It is consistent with the emphasis that the learning-from-incidents literature places on the learning cycle [237–239] and with evidence on the effectiveness of near-miss management systems [256, 257, 259]. It also implies that audits should be designed to find latent conditions in the field, not only to verify paperwork, a distinction emphasized in critiques of auditing [66, 68, 69].

Third, front-end improvements interact. Capturing more changes without adding review capacity worsens review quality and partly defeats its purpose, whereas capture and capacity together are synergistic. This result illustrates why PSM elements must be considered as a system [5, 63] and why risk-tiered triage, which concentrates scarce review effort on the changes that matter most, is valuable [21, 39]. It also cautions against responding to an MOC audit finding of poor coverage simply by widening the scope of MOC without considering the effect on reviewers.

5.2. Implications for Operators and Regulators

For operators of mature production assets, the results suggest a sequence of actions. The first is to treat reviewer capacity as a process safety resource, monitoring MOC backlog, review time and reviewer load as leading indicators, and to examine the effect of any staffing reduction on MOC through the organizational MOC process itself [129–131]. The second is to strengthen the detection of latent conditions through field-verified audits, management safety walkthroughs with adequate frequency and coverage [118], improved near-miss reporting and investigations that look beyond immediate causes, using systemic methods and root-cause and thematic analysis where appropriate [209, 211, 228, 230]. The third is to enforce the expiry of temporary changes, which is cheap and has a high benefit-cost ratio, and which addresses one of the most common MOC weaknesses found in audits [20, 21]. The fourth is to extend MOC capture to organizational and setpoint changes, but only together with triage or additional capacity. Operational discipline and conduct of operations provide the cultural foundation for these measures [330, 331], and attention to shift handover and knowledge retention addresses the specific vulnerabilities of an ageing workforce [29, 332, 335]. For regulators and industry bodies, the detection experiment supports a shift in emphasis from lagging event counts to leading indicators of element execution. API RP 754 and IOGP Report 456 already define Tier 3 and Tier 4 indicators [81, 82], and the results show that a modest audit sample of 20 MOC records per quarter can detect a material fall in review quality within a year with high probability, whereas event counts would take years and give frequent false alarms. Regulatory inspection that samples MOC records for quality, rather than checking only that procedures exist, would exploit this sensitivity [52, 53, 267]. Industry event data sharing remains valuable for identifying common causes [34, 93, 271], but it cannot substitute for site-level monitoring of PSM element health.

5.3. Calibration and Use in Practice

The model is intended as a decision-support tool that can be calibrated to a specific operation. Change volumes and categories can be obtained from MOC system records, capture probabilities from audits that compare field changes with MOC records, review effectiveness from independent re-review of samples [38, 40], near-miss rates and reporting from incident databases [261, 263] and release probabilities from incident investigations that trace events to latent conditions [269, 271, 272]. Bayesian networks and fuzzy methods can be used to combine sparse data with expert judgement [284, 290], and dynamic risk assessment can update estimates as new data arrive [286–288]. Barrier management frameworks provide a structure for linking latent conditions to specific barriers [292, 293, 295], and human reliability methods can refine the treatment of review and PSSR performance [298, 302, 303]. Operational safety economics provides the basis for valuing interventions [297].

The model can be extended in several directions. Safety culture and leadership could be represented as slowly varying stocks that influence capture, reporting and review quality, as in system dynamics models of construction safety culture [42, 43]. Production pressure could be linked to deferral of audits and investigations, as in models of production versus protection and of the balance between productivity and safety compliance [178, 179, 324]. Accident models such as STAMP, FRAM and AcciMap could inform the structure of the model for specific facilities [194, 197, 205]. Human reliability analysis could be used to estimate the effect of fatigue and workload on reviewers [152, 154, 300].

5.4. Limitations

The study has several limitations. All parameters are representative values chosen from the literature rather than data from a specific operation, so the absolute numbers of events and the benefit-cost ratios should not be transferred without calibration [291, 321]. The model treats latent conditions as homogeneous, whereas in practice they differ greatly in severity, and a single release probability and Tier 1 share were applied to all. The intervention costs are representative estimates. The model omits feedback from events to organizational behaviour, such as the temporary improvement in vigilance that often follows a serious incident [247, 249], and from culture to all parameters [94, 95]. The detection experiment considered a single, step deterioration in review quality, whereas real deterioration is often gradual and multidimensional. Finally, the model is deterministic in its expected values; event counts were treated as Poisson only in the detection experiment, and parameter uncertainty was addressed through the global sensitivity analysis rather than full probabilistic simulation [285, 290].

6. Conclusion

This study developed a system dynamics model of management of change and process safety management effectiveness in mature oil and gas production operations. Changes flow through capture, hazard review and pre-startup safety review; hazards that escape accumulate as latent conditions until they are removed by audits, near-miss learning, process hazard analysis revalidation and maintenance, or release process safety events. In a representative mature operation with declining reviewer staffing and growing change volume, reviewer load doubled over ten years, review effectiveness fell from 0.80 to 0.52 and the expected rate of process safety events rose from about three to more than five per year, with the pressures of mature operation adding a fifth to the events expected over the decade. Strengthening audits and near-miss learning was the most cost-effective single intervention. Extending change capture without adding review capacity was undermined by reviewer overload, while capture and capacity together were strongly synergistic. A portfolio of all four interventions reduced expected events by 70 percent with a benefit-cost ratio of 3.3. A quarterly audit of MOC record quality detected a fall in review quality far sooner and more reliably than process safety event counts.

For mature operations, the results support treating reviewer capacity as a process safety resource, prioritizing the detection and removal of latent conditions, enforcing the expiry of temporary changes and monitoring MOC through audits of execution quality. Further work should calibrate the model with MOC, audit and incident data from operating facilities, represent the heterogeneity of latent conditions and add feedback from culture, leadership and events.

References

  1. Occupational Safety, Health Administration. 29 CFR 1910.119, Process safety management of highly hazardous chemicals. U.S. Department of Labor; 2013.
  2. Kleindorfer PR, Belke JC, Elliott MR, Lee K, Lowe RA, Feldman HI. Accident epidemiology and the U.S. chemical industry: Accident history and worst-case data from RMPInfo. Risk Analysis*. 2003;23(5):865-881. doi:10.1111/1539-6924.00365 https://doi.org/10.1111/1539-6924.00365
  3. Elliott MR, Kleindorfer PR, Lowe RA. The role of hazardousness and regulatory practice in the accidental release of chemicals at U.S. industrial facilities. Risk Analysis. 2003;23(5):883-896.
  4. European Parliament, Council of the European Union. Directive 2012/18/EU of 4 July 2012 on the control of major-accident hazards involving dangerous substances, amending and subsequently repealing Council Directive 96/82/EC. Official Journal of the European Union. 2012.
  5. Center for Chemical Process Safety. Guidelines for risk based process safety. Wiley/AIChE; 2007.
  6. Energy Institute. High level framework for process safety management (2nd ed.). Energy Institute; 2022.
  7. International Association of Oil, Gas Producers. Process safety fundamentals (IOGP Report No. 638). IOGP; 2020.
  8. Li, J., Goerlandt, F., & Reniers, G. (2020). Mapping process safety: A retrospective scientometric analysis of three process safety related journals (1999-2018). Journal of Loss Prevention in the Process Industries, 65, 104141. https://doi.org/10.1016/j.jlp.2020.104141 https://doi.org/10.1016/j.jlp.2020.104141
  9. Center for Chemical Process Safety. Guidelines for the management of change for process safety. Wiley/AIChE; 2008.
  10. Department of Employment. The Flixborough disaster: Report of the Court of Inquiry. HMSO; 1975.
  11. Chemical Safety US, Hazard Investigation Board. Investigation report: Refinery explosion and fire, BP Texas City, Report No. 2005-04-I-TX. CSB. 2007.
  12. Hopkins A. Failure to learn: The BP Texas City refinery disaster. CCH Australia; 2008.
  13. Hopkins A. Disastrous decisions: The human and organisational causes of the Gulf of Mexico blowout. CCH Australia; 2012.
  14. Hopkins A. Lessons from Longford: The Esso gas plant explosion. CCH Australia; 2000.
  15. Chemical Safety US, Hazard Investigation Board. Williams Geismar Olefins Plant reboiler rupture and fire, Geismar, Louisiana (Report No. 2013-03-I-LA). U.S. Chemical Safety and Hazard Investigation Board; 2016.
  16. Chemical Safety US, Hazard Investigation Board. Fire and explosions at Philadelphia Energy Solutions Refinery hydrofluoric acid alkylation unit (Report No. 2019-04-I-PA). U.S. Chemical Safety and Hazard Investigation Board; 2022.
  17. Chemical Safety US, Hazard Investigation Board. FCC unit explosion and asphalt fire at Husky Superior Refinery (Report No. 2018-02-I-WI). U.S. Chemical Safety and Hazard Investigation Board; 2022.
  18. Laughland, G. (2018). Practical experience with Management of Change reflecting upon incidents, audits and gap analyses. IChemE Hazards 28, Symposium Series No. 163.
  19. Patterson K, Wigham G. Management of change: What does a ‘good’ system look like?. Loss Prevention Bulletin, 267, 7-9. 2019.
  20. Belmazouzi Y, Djebabra M, Hadef H. Contribution to the ageing control of onshore oil and gas fields. Petroleum; 2020. doi:10.1016/j.petlm.2019.11.006 https://doi.org/10.1016/j.petlm.2019.11.006
  21. Palkar, S., & Markeset, T. (2012). Extending the service life span of ageing oil and gas offshore production facilities. Advances in Production Management Systems (APMS 2011), IFIP AICT 384 (Springer), 213-221.
  22. Amaechi CV, Reda A, Kgosiemang IM, Ja’e IA, Oyetunji AK, Olukolajo MA, et al. Guidelines on asset management of offshore facilities for monitoring, sustainable maintenance, and safety practices. Sensors. 2022;22(19):7270. doi:10.3390/s22197270 https://doi.org/10.3390/s22197270
  23. Mathisen GE, Brønnick K, Arntzen KJ, Bergh LIV. Identifying and managing psychosocial risks during organizational restructuring: It’s what you do and how you do it. Safety Science. 2017;100:20-29.
  24. Tvedt SD, Saksvik, P. Ø., Nytrø K. Does change process healthiness reduce the negative effects of organizational change on the psychosocial work environment?. Work & Stress, 23(1), 80-98. 2009.
  25. Bergh LIV, Ringstad AJL, Leka S, Zwetsloot G. Psychosocial risks and hydrocarbon leaks: An exploration of their relationship in the Norwegian oil and gas industry. Journal of Cleaner Production. 2014;84:824-830. doi:10.1016/j.jclepro.2013.09.040 https://doi.org/10.1016/j.jclepro.2013.09.040
  26. Sumbal MS, Tsui E, See-to E, Barendrecht A. Knowledge retention and aging workforce in the oil and gas industry: A multi perspective study. Journal of Knowledge Management. 2017;21(4):907-924. doi:10.1108/JKM-07-2016-0281 https://doi.org/10.1108/JKM-07-2016-0281
  27. Goff, R. J., Wilday, J., & Holroyd, J. (2015). Creeping changes. IChemE Symposium Series No. 160 (Hazards 25).
  28. Gyenes, Z. (2020). Learning from creeping changes. IChemE Symposium Series No. 167 (Hazards 30).
  29. Rasmussen J. Risk management in a dynamic society: A modelling problem. Safety Science. 1997;27(2-3):183-
  30. Turner BA, Pidgeon NF. Man-made disasters (2nd ed.). Butterworth-Heinemann; 1997.
  31. Walker, K., Fargie, D., Poore, W., & Skar, O. (2022). Learning from global upstream process safety event data. IChemE Hazards 32, Symposium Series No. 169.
  32. Walker K, Toutain P, Poore W. Upstream oil and gas industry process safety event data: A first step. Society of Petroleum Engineers conference paper; 2014.
  33. Walker K, Fargie D, Kannan S, Skar O, Carvalho M. Process safety: Learning from upstream event data. Society of Petroleum Engineers conference paper; 2020.
  34. Chosnek J. Managing management of change. Process Safety Progress. 2010;29(4):384-386.
  35. Laskar, S. (2018). A novel methodology for auditing management of change (MOC) program to make it sustainable. 2018 AIChE Spring Meeting and 14th Global Congress on Process Safety.
  36. Almowalad, Y. (2012). Management of change: Quality implementation and performance. 2012 AIChE Spring Meeting and 8th Global Congress on Process Safety.
  37. Di Nardo M, Madonna M, Murino T, Castagna F. Modelling a safety management system using system dynamics at the Bhopal incident. Applied Sciences. 2020;10:903. doi:10.3390/app10030903 https://doi.org/10.3390/app10030903
  38. Mohamed, S., & Chinda, T. (2011). System dynamics modelling of construction safety culture. Engineering, Construction and Architectural Management, 18(3), 266-281.
  39. Shin M, Lee HS, Park M, Moon M, Han S. A system dynamics approach for modeling construction workers’ safety attitudes and behaviors. Accident Analysis and Prevention. 2014;68:95-105.
  40. Bugalia N, Maemura Y, Ozawa K. A system dynamics model for near-miss reporting in complex systems. Safety Science. 2021;142:105368.
  41. Reason J. Managing the risks of organizational accidents. Ashgate; 1997.
  42. Reason, J. (1990). The contribution of latent human failures to the breakdown of complex systems. Philosophical Transactions of the Royal Society of London. Series B, Biological Sciences, 327(1241), 475-
  43. https://doi.org/10.1098/rstb.1990.0090 https://doi.org/10.1098/rstb.1990.0090
  44. Marhavilas PK, Koulouriotis D, Gemeni V. Risk analysis and assessment methodologies in the work sites: On a review, classification and comparative study of the scientific literature of the period 2000-2009. Journal of 523.
  45. Ali MXM, Arifin K, Abas A, Ahmad MA, Khairil M, Cyio MB, et al. Systematic literature review on indicators use in safety management practices among utility industries. International Journal of Environmental Research and Public Health. 2022;19(10):6198.
  46. Occupational Safety and Health Administration. (2017). Process safety management for petroleum refineries: Lessons learned from the petroleum refinery process safety management national emphasis program. OSHA 3918-08.
  47. Laurent A, Pey A, Gurtel P, Fabiano B. A critical perspective on the implementation of the EU Council Seveso Directives in France, Germany, Italy and Spain. Process Safety and Environmental Protection. 2021;148:47-74. doi:10.1016/j.psep.2020.09.064 https://doi.org/10.1016/j.psep.2020.09.064
  48. Bragatto P, Vairo T, Milazzo MF, Fabiano B. The impact of the COVID-19 pandemic on the safety management in Italian Seveso industries. Journal of Loss Prevention in the Process Industries. 2021;70:104393. doi:10.1016/j.jlp.2021.104393 https://doi.org/10.1016/j.jlp.2021.104393
  49. Longley, A., & Rantell, M. (2022). Mind the gap: The case for a formally agreed ISO standard for process safety. IChemE Hazards 32.
  50. Organisation for Economic Co-operation, Development. Corporate governance for process safety: OECD guidance for senior leaders in high hazard industries. OECD; 2012.
  51. Center for Chemical Process Safety. Process safety in upstream oil and gas. Wiley/AIChE; 2021.
  52. Liaw HJ. Lessons in process safety management learned from a pesticide plant explosion in Taiwan. Process Safety Progress. 2018;37(1):104-109. doi:10.1002/prs.11913 https://doi.org/10.1002/prs.11913
  53. Markowski AS, Krasławski A, Vairo T, Fabiano B. Process safety management quality in industrial corporation for sustainable development. Sustainability. 2021;13(16):9001. doi:10.3390/su13169001 https://doi.org/10.3390/su13169001
  54. Aziz H, Shariff A, Rusli R. Interrelations between process safety management elements. Process Safety Progress. 2017;36(1).
  55. Arendt, S., & Manton, M. (2015). How to ensure sustainable process safety performance: Strategies for managing, maintaining, and improving PSM systems. IChemE Hazards 25, Symposium Series No. 160.
  56. Rosenthal I, Kleindorfer PR, Elliott MR. Predicting and confirming the effectiveness of systems for managing low-probability chemical process risks. Process Safety Progress. 2006;25(2).
  57. Allford L. Internal auditing of process safety. Chemical Engineering Transactions. 2016;53:313-318. doi:10.3303/CET1653053 https://doi.org/10.3303/CET1653053
  58. Blewett V, O’Keeffe V. Weighing the pig never made it heavier: Auditing OHS, social auditing as verification of process in Australia. Safety Science. 2011;49(7).
  59. Sutton I. Should your organization fly warning flags?. Chemical Engineering Progress, 105(12). 2009.
  60. Carder B, Ragan P. A survey-based system for safety measurement and improvement. Journal of Safety Research. 2003;34:157-165.
  61. Pasman HJ. Early warning signals noticed, but management doesn’t act adequately or not at all: A brief analysis and direction of possible improvement. Journal 2021;70:104272. doi:10.1016/j.jlp.2020.104272 https://doi.org/10.1016/j.jlp.2020.104272
  62. Culbert, P. (2021). Identifying & embedding good practice in process safety including the role of executive leadership; how to achieve engagement and common practice; learning lessons from past incidents. IChemE Hazards 31, Symposium Series No. 168.
  63. Wigham, G., Tham, C. K., Patterson, K., & Bruffell, P. (2022). It’s the people, dammit! Assessing process safety competence: One company’s approach. IChemE Hazards 32, Symposium Series No. 169.
  64. Obriki, O. D., Obogo, S. F., & Arumosoye, O. M. (2022). Advances in workforce safety training models for operational risk reduction. Gyanshauryam, International Scientific Refereed Research Journal, 5(6), 349-382. https://doi.org/10.32628/GISRRJ225638 https://doi.org/10.32628/GISRRJ225638
  65. American Petroleum Institute. ANSI/API Recommended Practice 754: Process safety performance indicators for the refining and petrochemical industries (2nd ed.). American Petroleum Institute; 2016.
  66. International Association of Oil, Gas Producers. Process safety: Recommended practice on key performance indicators (IOGP Report No. 456, 2nd ed.). IOGP; 2018.
  67. Center for Chemical Process Safety. Process safety leading and lagging metrics. AIChE CCPS; 2011.
  68. Allford L. Process safety indicators: Response to Andrew Hopkins. Safety Science. 2009;47:466.
  69. Collins RL. Heinrich and beyond. Process Safety Progress. 2011;30:2-5.
  70. Pasman H, Rogers W. How can we use the information provided by process safety performance indicators? Possibilities and limitations. Journal of Loss Prevention in the Process Industries; 2013.
  71. Schmitz P. Predicting major accidents in the process industry based on the barrier status at scenario level: A practical approach. Journal of Loss Prevention in the Process Industries. 2021;71:104519.
  72. Santos L, Haddad A, dos Santos IL. Process safety leading indicators in oil storage and pipelines: Building a panel of indicators. Chemical Engineering Transactions. 2019;77:73-78.
  73. Walker K, Hawkes C, Poore W, Carvalho M. Industry safety data, what is it telling us?. Society of Petroleum Engineers conference paper. 2018. doi:10.2118/190545-MS https://doi.org/10.2118/190545-MS
  74. Choudhry RM, Fang D, Mohamed S. The nature of safety culture: A survey of the state-of-the-art. Safety Science. 2007;45(10):993-1012.
  75. Griffin MA, Curcuruto M. Safety climate in organizations. Annual Review of Organizational Psychology and Organizational Behavior. 2016;3:191-212.
  76. Bye RJ, Aalberg AL, Røyrvik JOD. What we talk about when we talk about HSE and culture: A mapping and analysis of the academic discourses. Safety Science. 2020;129:104846. doi:10.1016/j.ssci.2020.104846 https://doi.org/10.1016/j.ssci.2020.104846
  77. Kongsvik T, Gjøsund G, Vikland KM. HSE culture in the petroleum industry: Lost in translation?. Safety Science, 81, 81-89. 2016.
  78. Health, Safety Executive. Safety culture maturity model (Offshore Technology Report 2000/049). HSE Books; 2000.
  79. Filho APG, Andrade JCS, Marinho MMO. A safety culture maturity model for petrochemical companies in Brazil. Safety Science. 2010;48(5):615-624.
  80. Hsu, S. H., Lee, C.-C., Wu, M.-C., & Takano, K. (2008). A cross-cultural study of organizational factors on safety: Japanese vs. Taiwanese oil refinery plants. Accident Analysis & Prevention, 40(1), 24-34. https://doi.org/10.1016/j.aap.2007.03.020 https://doi.org/10.1016/j.aap.2007.03.020
  81. Çakıt E, Olak AJ, Murata A, Karwowski W, Alrehaili O, Marek T. Assessment of the perceived safety culture in the petrochemical industry in Japan: A cross-sectional study. PLOS ONE; 2019. doi:10.1371/journal.pone.0226416 https://doi.org/10.1371/journal.pone.0226416
  82. Boughaba A, Hassane C, Roukia O. Safety culture assessment in petrochemical industry: A comparative study of two Algerian plants. Safety and Health at Work. 2014;5:60-65. doi:10.1016/j.shaw.2014.03.005 https://doi.org/10.1016/j.shaw.2014.03.005
  83. Dahl, Ø., Kongsvik T. Safety climate and mindful safety practices in the oil and gas industry. Journal of Safety Research. 2018;64:29-36. doi:10.1016/j.jsr.2017.12.009 https://doi.org/10.1016/j.jsr.2017.12.009
  84. Wu, T. C., Chang, S. H., Shu, C. M., Chen, C. T., & Wang, C. P. (2011). Safety leadership and safety performance in petrochemical industries: The mediating role of safety climate. Journal of Loss Prevention in the Process Industries, 24(6), 716-721.
  85. doi:10.1016/j.jlp.2017.11.001 https://doi.org/10.1016/j.jlp.2017.11.001
  86. Ta, M. T. D., Kim, T.-E., & Gausdal, A. H. (2022). Leadership styles and safety performance in high-risk industries: A systematic review. Safety and Reliability, 41, 10-44. https://doi.org/10.1080/09617353.2022.2035627 https://doi.org/10.1080/09617353.2022.2035627
  87. Pilbeam C, Doherty N, Davidson R, Denyer D. Safety leadership practices for organizational safety compliance: Developing a research agenda from a review of the literature. Safety Science. 2016;86:110-
  88. doi:10.1016/j.ssci.2016.02.015 https://doi.org/10.1016/j.ssci.2016.02.015
  89. Vinodkumar M, Bhasi M. Safety management practices and safety behaviour: Assessing the mediating role of safety knowledge and motivation. Accident Analysis & Prevention. 2010;42:2082-2093.
  90. Kaszniak, M. (2007). Examining organizational and safety culture causes of the BP Texas City refinery explosion. 2007 AIChE Spring Meeting and 3rd Global Congress on Process Safety.
  91. Arendt, S., & Manton, M. (2015). Understanding process safety culture disease pathologies: How to prevent, mitigate and recover from safety culture accidents. IChemE Hazards 25 Symposium.
  92. Keren N, West HH, Mannan MS. Benchmarking MOC practices in the process industries. Process Safety Progress. 2002;21(2):103-112.
  93. Laskar S. Implementing an effective management of change (MOC) system for upstream oil and gas industry. SPE Health, Safety, Security, Environment, & Social Responsibility Conference - North America; 2017.
  94. Shimada Y. Development of environment for logical process safety management based on the business process model. Journal of Chemical Engineering of Japan. 2012;45(4):245-257.
  95. Sanders RE. Chemical process safety: Learning from case histories. Butterworth-Heinemann; 1999.
  96. Kletz T. Learning from accidents (3rd ed.). Gulf Professional Publishing / Butterworth-Heinemann; 2001.
  97. Kletz, T. A. (2003). The management of organisational change. IChemE Symposium Series No. 149 (Hazards XVII).
  98. Conlin, H. (2002). Assessing the safety of process operation staffing arrangements. IChemE Symposium Series No. 148 (Hazards XVI), 421-437.
  99. Philley J. Potential impacts to process safety management from mergers, downsizing, and re-engineering. Process Safety Progress. 2002;21(2):151-160.
  100. Goff, R. J. (2017). What to do about creeping change. The Chemical Engineer(917).
  101. Paltrinieri N, Wilday J, Wardman M, Cozzani V. Surface installations intended for carbon capture and sequestration: Atypical accident scenarios and their identification. Process Safety and Environmental Protection. 2014;92(1):93-107.
  102. Dutch Safety Board. Explosions MSPO2 Shell Moerdijk. Dutch Safety Board, The Hague; 2015.
  103. Health, Safety Executive. Major incident investigation report: BP Grangemouth, Scotland, 29th May to 10th June 2000. HSE Books; 2003.
  104. Myers, T., Kytomaa, H., Ponchaut, N., & Ibarreta, A. (2009). Lessons learned from the Buncefield fuel depot explosion. 2009 AIChE Spring Meeting and 5th Global Congress on Process Safety.
  105. Bergh LIV, Leka S, Zwetsloot GIJM. Tailoring psychosocial risk assessment in the oil and gas industry by exploring specific and common psychosocial risks. Safety and Health at Work. 2018;9(1):63-70. doi:10.1016/j.shaw.2017.05.001 https://doi.org/10.1016/j.shaw.2017.05.001
  106. Tharaldsen JE, Olsen E, Rundmo T. A longitudinal study of safety climate on the Norwegian continental shelf. Safety Science. 2008;46(3):427-439.
  107. Hoivik D, Tharaldsen JE, Baste V, Moen BE. What is most important for safety climate: The company belonging or the local working environment? A study from the Norwegian offshore industry. Safety Science. 2009;47(10):1324-1331. doi:10.1016/j.ssci.2009.04.001 https://doi.org/10.1016/j.ssci.2009.04.001
  108. Datta DK, Guthrie JP, Basuil D, Pandey A. Causes and effects of employee downsizing: A review and synthesis. Journal of Management. 2010;36(1):281-348.
  109. de Jong T, Wiezer N, de Weerd M, Nielsen K, Mattila-Holappa P, Mockałło Z. The impact of restructuring on employee well-being: A systematic review of longitudinal studies. Work & Stress. 2016;30(1):91-114.
  110. Flovik, L., Knardahl, S., & Christensen, J. O. (2019). Organizational change and employee mental health: A prospective multilevel study of the associations between organizational changes and clinically relevant mental distress. Scandinavian Journal of Work, Environment & Health, 45(2), 134-145. https://doi.org/10.5271/sjweh.3777 https://doi.org/10.5271/sjweh.3777
  111. Frone MR, Blais AR. Organizational downsizing, work conditions, and employee outcomes: Identifying targets for workplace intervention among survivors. International Journal of Environmental Research and Public Health. 2020;17(3):719.
  112. Fijalkowska AP, Hjartaker KS, Nesheim T. Lay off employees or terminate consultant contracts? Responses to an external shock in three firms in the Norwegian petroleum industry. Employee Relations. 2017;39(7):1083-1099. doi:10.1108/ER-11-2016-0219 https://doi.org/10.1108/ER-11-2016-0219
  113. Probst TM, Brubaker TL. The effects of job insecurity on employee safety outcomes: Cross-sectional and longitudinal explorations. Journal of Occupational Health Psychology. 2001;6(2):139-159. doi:10.1037/1076-8998.6.2.139 https://doi.org/10.1037/1076-8998.6.2.139
  114. Bunner J, Prem R, Korunka C. How work intensification relates to organization-level safety performance: The mediating roles of safety climate, safety motivation, and safety knowledge. Frontiers in Psychology. 2018;9:2575. doi:10.3389/fpsyg.2018.02575 https://doi.org/10.3389/fpsyg.2018.02575
  115. Chan M. Fatigue: The most critical accident risk in oil and gas construction. Construction Management and Economics. 2011;29(4):341-353.
  116. Adegbuji OM, Obriki OD. Development of an integrated heat stress risk conceptual model for industrial operations in extreme environments. Iconic Research and Engineering Journals. 2018;1(12):141-160.
  117. Sneddon A, Mearns K, Flin R. Stress, fatigue, situation awareness and safety in offshore drilling crews. Safety Science. 2013;56:80-88. doi:10.1016/j.ssci.2012.05.027 https://doi.org/10.1016/j.ssci.2012.05.027
  118. Gordon RPE. The contribution of human factors to accidents in the offshore oil industry. Reliability Engineering & System Safety. 1998;61:95-108.
  119. Morrison, J. B., & Wears, R. L. (2022). Modeling Rasmussen’s dynamic modeling problem: Drift towards a boundary of safety. Cognition, Technology & Work, 24(1), 127-145. https://doi.org/10.1007/s10111-021-00668-x https://doi.org/10.1007/s10111-021-00668-x
  120. Wears RL. Rasmussen number greater than one. Applied Ergonomics. 2017;59(B):592-597.
  121. Dekker S. Drift into failure: From hunting broken components to understanding complex systems. Ashgate; 2011.
  122. Dekker S, Pruchnicki S. Drifting into failure: Theorising the dynamics of disaster incubation. Theoretical Issues in Ergonomics Science. 2014;15(6):534-544. doi:10.1080/1463922X.2013.856495 https://doi.org/10.1080/1463922X.2013.856495
  123. Vaughan D. The Challenger launch decision: Risky technology, culture, and deviance at NASA. University of Chicago Press. 1996. doi:10.7208/chicago/9780226346960.001.0001 https://doi.org/10.7208/chicago/9780226346960.001.0001
  124. Starbuck WH, Milliken FJ. Challenger: Fine-tuning the odds until something breaks. Journal of Management Studies. 1988;25(4):319-340. doi:10.1111/j.1467-6486.1988.tb00040.x https://doi.org/10.1111/j.1467-6486.1988.tb00040.x
  125. Columbia Accident Investigation Board. Columbia Accident Investigation Board report, Volume 1. National Aeronautics and Space Administration and Government Printing Office; 2003.
  126. Starbuck WH, Farjoun M. Organization at the limit: Lessons from the Columbia disaster. Blackwell; 2005.
  127. Heimann L. Repeated failures in the management of high risk technologies. European Management Journal. 2005;23(1):105-117. doi:10.1016/j.emj.2004.12.015 https://doi.org/10.1016/j.emj.2004.12.015
  128. Dechy, N., Dien, Y., Marsden, E., & Rousseau, J.-M. (2018). Learning failures as the ultimate root causes of accidents. How Could This Happen? (J. U. Hagen, Ed.), Palgrave Macmillan, 105-128.
  129. Cook R, Rasmussen J. “Going solid”: A model of system dynamics and consequences for patient safety. Quality and Safety in Health Care. 2005;14(2):130-134.
  130. Hase S, Phin S. The normalization of deviance in the oil and gas industry: The role of rig leadership in success and failure. Abu Dhabi International Petroleum Exhibition and Conference (SPE); 2015.
  131. Furey M, Rixon D. When abnormal becomes normal: How altered perceptions contributed to the Ocean Ranger oil rig disaster. Journal of Management Policy and Practice. 2018;19(3):106-116. doi:10.33423/jmpp.v19i3.51 https://doi.org/10.33423/jmpp.v19i3.51
  132. Bloch KP, Williams SA. Normalize deviance at your peril. Chemical Engineering. 2004;111(5):52-57.
  133. Bogard K, Ludwig TD, Staats C, Kretschmer D. An industry’s call to understand the contingencies involved in process safety: Normalization of deviance. Journal of Organizational Behavior Management. 2015;35(1-2):70-80. doi:10.1080/01608061.2015.1031429 https://doi.org/10.1080/01608061.2015.1031429
  134. Mize JF. The roundabout way to disaster: Recognizing and responding to normalization of deviance. Process Safety Progress. 2019;38(2):e12014.
  135. Banja J. The normalization of deviance in healthcare delivery. Business Horizons. 2010;53(2):139-148. doi:10.1016/j.bushor.2009.10.006 https://doi.org/10.1016/j.bushor.2009.10.006
  136. Price MR, Williams TC. When doing wrong feels so right: Normalization of deviance. Journal of Patient Safety. 2018;14(1):1-2. doi:10.1097/PTS.0000000000000157 https://doi.org/10.1097/PTS.0000000000000157
  137. Sanne JM. Learning from adverse events in the nuclear power industry: Organizational learning, policy making and normalization. Technology in Society. 2012;34(3):239-250. doi:10.1016/j.techsoc.2012.07.002 https://doi.org/10.1016/j.techsoc.2012.07.002
  138. Obriki, O. D., & Arumosoye, O. M. (2022). Conceptual framework explaining recurrence mechanisms of unsafe behaviors in high-hazard worksites. Shodhshauryam, International Scientific Refereed Research Journal, 5(3), 380-402. https://doi.org/10.32628/SHISRRJ225489 https://doi.org/10.32628/SHISRRJ225489
  139. Goh YM, Love PED, Brown H, Spickett J. Organizational accidents: A systemic model of production versus protection. Journal of Management Studies. 2012;49(1):52-76. doi:10.1111/j.1467-6486.2010.00959.x https://doi.org/10.1111/j.1467-6486.2010.00959.x
  140. Martinez-Moyano IJ, McCaffrey DP, Oliva R. Drift and adjustment in organizational rule compliance: Explaining the “regulatory pendulum” in financial markets. Organization Science. 2014;25(2):321-338.
  141. Martinez-Moyano IJ, McCaffrey DP, Oliva R. Drift and adjustment in organizational rule compliance. Organization Science. 2014;25(2):321-338.
  142. Weick KE, Sutcliffe KM. Managing the unexpected: Resilient performance in an age of uncertainty (2nd ed.). Jossey-Bass; 2007.
  143. Reason J. Human error. Cambridge University Press; 1990. doi:10.1017/CBO9781139062367 https://doi.org/10.1017/CBO9781139062367
  144. Leveson N. A new accident model for engineering safer systems. Safety Science. 2004;42:237-270.
  145. Leveson NG. Applying systems thinking to analyze and learn from events. Safety Science. 2011;49(1):55-64.
  146. Gong, Y., & Li, Y. (2018). STAMP-based causal analysis of China-Donghuang oil transportation pipeline leakage and explosion accident. Journal of Loss Prevention in the Process Industries, 56, 402-413.
  147. Li, F., Wang, W., Xu, J., Dubljevic, S., Khan, F., & Yi, J. (2020). A CAST-based causal analysis of the catastrophic underground pipeline gas explosion in Taiwan. Engineering Failure Analysis, 108, 104343.
  148. Yousefi A, Hernandez M. Using a system theory based method (STAMP) for hazard analysis in process industry. Journal of Loss Prevention in the Process Industries. 2019;61:305-324.
  149. Allison CK, Revell KM, Sears R, Stanton NA. Systems Theoretic Accident Model and Process (STAMP) safety modelling applied to an aircraft rapid decompression event. Safety Science. 2017;98:159-166.
  150. Zhang Y, Dong C, Guo W, Dai J, Zhao Z. Systems theoretic accident model and process (STAMP): A literature review. Safety Science. 2022;152:105596.
  151. Altabbakh H, AlKazimi MA, Murray S, Grantham K. STAMP: Holistic system safety approach or just another risk model?. Journal of Loss Prevention in the Process Industries, 32, 109-119. 2014.
  152. Hollnagel E. FRAM: The functional resonance analysis method. Ashgate; 2012.
  153. Patriarca R, Di Gravio G, Woltjer R, Costantino F, Praetorius G, Ferreira P, et al. Framing the FRAM: A literature review on the functional resonance analysis method. Safety Science. 2020;129:104827.
  154. Abreu Saurin T, Patriarca R. A taxonomy of interactions in socio-technical systems: A functional perspective. Applied Ergonomics. 2020;82:102980. doi:10.1016/j.apergo.2019.102980 https://doi.org/10.1016/j.apergo.2019.102980
  155. Patriarca R, Bergström J, Di Gravio G. Defining the functional resonance analysis space: Combining Abstraction Hierarchy and FRAM. Reliability Engineering & System Safety, 165, 34-46. 2017.
  156. Anvarifar F, Voorendt MZ, Zevenbergen C, Thissen W. An application of the Functional Resonance Analysis Method (FRAM) to risk analysis of multifunctional flood defences in the Netherlands. Reliability Engineering & System Safety. 2017;158:130-141.
  157. Bahoo Toroody A, Abaei MM, Gholamnia R. Conceptual compression discussion on a multi-linear (FTA) and systematic (FRAM) method in an offshore operation’s accident modeling. International Journal of Occupational Safety and Ergonomics. 2016;22:532-540.
  158. Svedung I, Rasmussen J. Graphic representation of accident scenarios: Mapping system structure and the causation of accidents. Safety Science. 2002;40(5):397-
  159. Waterson P, Jenkins DP, Salmon PM, Underwood P. ‘Remixing Rasmussen’: The evolution of Accimaps within systemic accident analysis. Applied Ergonomics. 2017;59:483-503. doi:10.1016/j.apergo.2016.09.004 https://doi.org/10.1016/j.apergo.2016.09.004
  160. Mohammadfam I, Gholamizadeh K. Investigation of causes of Plasco building accident in Iran using timed MTO and ACCIMAP methods. Journal of Failure Analysis and Prevention. 2020;20(6):2087-2096. doi:10.1007/s11668-020-01025-2 https://doi.org/10.1007/s11668-020-01025-2
  161. Hamim OF, Hoque MS, McIlroy RC, Plant KL, Stanton NA. A sociotechnical approach to accident analysis in a low-income setting: Using AcciMaps to guide road safety recommendations in Bangladesh. Safety Science. 2020;124:104589. doi:10.1016/j.ssci.2019.104589 https://doi.org/10.1016/j.ssci.2019.104589
  162. Thoroman B, Salmon P. An integrated approach to near miss analysis combining AcciMap and network analysis. Safety Science. 2020;130:104859.
  163. Salmon PM, Cornelissen M, Trotter MJ. Systems-based accident analysis methods: A comparison of Accimap, HFACS, and STAMP. Safety Science, 50(4), 1158-1170. 2012. doi:10.1016/j.ssci.2011.11.009 https://doi.org/10.1016/j.ssci.2011.11.009
  164. Underwood, P., & Waterson, P. (2012). A critical review of the STAMP, FRAM and Accimap systemic accident analysis models. Advances in Human Aspects of Road and Rail Transportation (CRC Press), 385-394.
  165. Underwood P, Waterson P. Systems thinking, the Swiss Cheese Model and accident analysis: A comparative systemic analysis of the Grayrigg train derailment using the ATSB, AcciMap and STAMP models. Accident Analysis and Prevention. 2014;68:75-94.
  166. Underwood P, Waterson P. Systemic accident analysis: Examining the gap between research and practice. Accident Analysis and Prevention. 2013;55:154-164.
  167. Goncalves Filho AP, Jun GT, Waterson P. Four studies, two methods, one accident: An examination of the reliability and validity of Accimap and STAMP for accident analysis. Safety Science. 2019;113:310-317.
  168. Hulme A, Stanton NA, Walker GH, Waterson P, Salmon PM. What do applications of systems thinking accident analysis methods tell us about accident causation? A systematic review of applications between 1990 and 2018. Safety Science. 2019;117:164-183.
  169. Woolley M, Goode N, Read G. Moving beyond the organisational ceiling: Do construction accident investigations align with systems thinking?. Human Factors and Ergonomics in Manufacturing & Service Industries, 28, 297-308. 2018.
  170. Woolley, M., Goode, N., Read, G., & Salmon, P. (2019). Have we reached the organisational ceiling? A review of applied accident causation models, methods and contributing factors in construction. Theoretical Issues in Ergonomics Science, 20(5), 533-555.
  171. Le Coze JC. New models for new times. An anti-dualist move. Safety Science. 2013;59:200-218.
  172. Debrincat J, Bil C, Clark G. Assessing organisational factors in aircraft accidents using a hybrid Reason and AcciMap model. Engineering Failure Analysis. 2013;27:52-60. doi:10.1016/j.engfailanal.2012.06.003 https://doi.org/10.1016/j.engfailanal.2012.06.003
  173. Pillay M. Accident causation, prevention and safety management: A review of the state-of-the-art. Procedia Manufacturing. 2015;3:1838-1848.
  174. Grant E, Salmon PM, Stevens NJ, Goode N, Read GJ. Back to the future: What do accident causation models tell us about accident prediction?. Safety Science, 104, 99-109. 2018. doi:10.1016/j.ssci.2017.12.018 https://doi.org/10.1016/j.ssci.2017.12.018
  175. Komljenovic D, Loiselle G, Kumral M. Organization: A new focus on mine safety improvement in a complex operational and business environment. International Journal of Mining Science and Technology. 2017;27:617-625. doi:10.1016/j.ijmst.2017.05.006 https://doi.org/10.1016/j.ijmst.2017.05.006
  176. Dekker S, Cilliers P, Hofmeyr JH. The complexity of failure: Implications of complexity theory for safety investigations. Safety Science. 2011;49:939-945.
  177. Kontogiannis T, Leopoulos V, Marmaras N. A comparison of accident analysis techniques for safety-critical man-machine systems. International Journal of Industrial Ergonomics. 2000;25(4):327-347.
  178. Okwesa IJ, Unamma UML, Iwuanyanwu U. Root-cause and thematic analysis for major incident management: A review. International Journal of Social Sciences and Management Research. 2021;7(4):100-131. doi:10.56201/ijssmr.v7.no4.2021.pg100.131 https://doi.org/10.56201/ijssmr.v7.no4.2021.pg100.131
  179. Lundberg J, Rollenhagen C, Hollnagel E. What you find is not always what you fix: How other aspects than causes of accidents decide recommendations for remedial actions. Accident Analysis and Prevention. 2010;42:2132-2139. doi:10.1016/j.aap.2010.07.003 https://doi.org/10.1016/j.aap.2010.07.003
  180. Benner, L., Jr. (2019). Accident investigation data: Users’ unrecognized challenges. Safety Science, 118, 309-315.
  181. Tabibzadeh, M., Stavros, S., Ashtekar, M. S., & Meshkati, N. (2017). A systematic framework for root-cause analysis of the Aliso Canyon gas leak using the AcciMap methodology. International Conference on Applied Human Factors and Ergonomics (AHFE 2017).
  182. Lukic D, Margaryan A, Littlejohn A. How organisations learn from safety incidents: A multifaceted problem. Journal of Workplace Learning. 2010;22(7):428-450.
  183. Akselsson, R., Jacobsson, A., Börjesson, M., Ek, Å., & Enander, A. (2012). Efficient and effective learning for safety from incidents. Work, 41, 3216-3222.
  184. Jacobsson, A., Ek, Å., & Akselsson, R. (2012). Learning from incidents: A method for assessing the effectiveness of the learning cycle. Journal of Loss Prevention in the Process Industries, 25, 561-570. https://doi.org/10.1016/j.jlp.2011.12.013 https://doi.org/10.1016/j.jlp.2011.12.013
  185. Drupsteen L, Groeneweg J, Zwetsloot GIJM. Critical steps in learning from incidents: Using learning potential in the process from reporting an incident to accident prevention. International Journal of Occupational Safety and Ergonomics. 2013;19(1):63-77.
  186. Drupsteen L, Wybo JL. Assessing propensity to learn from safety-related events. Safety Science. 2015;71:28-38.
  187. Kjellén U. Prevention of accidents through experience feedback. Taylor & Francis; 2000.
  188. Carroll JS. Organizational learning activities in high-hazard industries: The logics underlying self-analysis. Journal of Management Studies. 1998;35(6):797-822.
  189. Kerin T. Learning from incidents: A practical application. Process Safety Progress. 2009;28(1):96-
  190. Stemn E, Hassall ME, Bofinger C. Systemic constraints to effective learning from incidents in the Ghanaian mining industry: A correspondence analysis and AcciMap approach. Safety Science. 2020;123:104565.
  191. Stemn E, Bofinger C, Cliff D, Hassall ME. Investigating the maturity of incident investigations of the Ghanaian mining industry and its effect on safety performance. Safety. 2019;5(1):3. doi:10.3390/safety5010003 https://doi.org/10.3390/safety5010003
  192. Lindberg AK, Hansson SO, Rollenhagen C. Learning from accidents: What more do we need to know?. Safety Science, 48(6), 714-721. 2010.
  193. Le Coze JC. Organisations and disasters: From lessons learnt to theorising. Safety Science. 2008;46(1):132-149.
  194. Hopkins A. A corporate dilemma: To be a learning organisation or to minimise liability. Journal of Occupational Health and Safety: Australia and New Zealand. 2006;22(3):251-259.
  195. Cooke DL, Rohleder TR. Learning from incidents: From normal accidents to high reliability. System Dynamics Review. 2006;22(3):213-239.
  196. Marquardt N. Situation awareness, human error, and organizational learning in sociotechnical systems. Human Factors and Ergonomics in Manufacturing & Service Industries. 2019;29:327-339.
  197. Broadribb MP. What have we really learned? Twenty five years after Piper Alpha. Process Safety Progress. 2015;34(1):16-23. doi:10.1002/prs.11691 https://doi.org/10.1002/prs.11691
  198. Broadribb, M. P., & Flynn, S. A. (2009). 4 years on from Texas City. IChemE Symposium Series No. 155 (Hazards XXI).
  199. van der Schaaf TW, Lucas DA, Hale AR. Near miss reporting as a safety tool. Butterworth-Heinemann; 2013.
  200. Jones S, Kirchsteiger C, Bjerke W. The importance of near miss reporting to further improve safety performance. Journal of Loss Prevention in the Process Industries. 1999;12:59-67.
  201. Phimister JR, Oktem U, Kleindorfer PR, Kunreuther H. Near-miss incident management in the chemical process industry. Risk Analysis. 2003;23:445-459.
  202. Thoroman B, Goode N, Salmon P. System thinking applied to near misses: A review of industry-wide near miss reporting systems. Theoretical Issues in Ergonomics Science. 2018;19:712-737.
  203. Haas, E. J., Demich, B., & McGuire, J. (2020). Learning from workers’ near-miss reports to improve organizational management. Mining, Metallurgy & Exploration, 37, 873-885.
  204. Westreich S, Perlman Y, Winkler M. Analysis and implications of the management of near-miss events: A game theoretic approach. Reliability Engineering & System Safety. 2021;212:107645.
  205. Arumosoye OM, Obriki OD. Systematic review of near-miss and hazard observation data utilization in industrial safety management. Iconic Research and Engineering Journals. 2019;3(2):981-999. doi:10.64388/IREV3I2-1714417 https://doi.org/10.64388/IREV3I2-1714417
  206. Obogo SF, Arumosoye OM, Obriki OD. Advances in proactive hazard recognition and near miss reporting systems. International Journal of Multidisciplinary Research and Growth Evaluation. 2021;2(6):835-846. doi:10.54660/IJMRGE.2021.2.6.835-846 https://doi.org/10.54660/IJMRGE.2021.2.6.835-846
  207. Brizon A, Wybo JL. The life cycle of weak signals related to safety. International Journal of Emergency Management. 2009;6:117-135.
  208. Valcamonico, D., Baraldi, P., & Zio, E. (2021). Natural language processing and Bayesian networks for the analysis of process safety events. 5th International Conference on System Reliability and Safety (ICSRS), 216-221. https://doi.org/10.1109/ICSRS53853.2021.9660733 https://doi.org/10.1109/ICSRS53853.2021.9660733
  209. Valcamonico, D., Baraldi, P., Zio, E., Crivellari, A., Decarli, L., & La Rosa, L. (2022). A taxonomy for modelling reports of process safety events in the oil and gas industry. Proceedings of the 32nd European Safety and Reliability Conference (ESREL 2022), 3071-3078. https://doi.org/10.3850/978-981-18-5183-4_S29-05-616-cd https://doi.org/10.3850/978-981-18-5183-4_S29-05-616-cd
  210. Bhusari, A., Goh, A., Ai, H., Sathanapally, S., Jalal, M., & Mentzer, R. A. (2021). Process safety incidents across 14 industries. Process Safety Progress, 40(1), e12158.
  211. Wang Y, Henriksen T, Deo M, Mentzer RA. Factors contributing to US chemical plant process safety incidents from 2010 to 2020. Journal of Loss Prevention in the Process Industries. 2021;71:104512. doi:10.1016/j.jlp.2021.104512 https://doi.org/10.1016/j.jlp.2021.104512
  212. Podofillini L, Reer B, Dang VN. Analysis of recent operational events involving inappropriate actions: Influencing factors and root causes. Reliability Engineering & System Safety. 2021;216:108013. doi:10.1016/j.ress.2021.108013 https://doi.org/10.1016/j.ress.2021.108013
  213. Wang, J., Fu, G., & Yan, M. (2020). Investigation and analysis of a hazardous chemical accident in the process industry: Triggers, roots, and lessons learned. Processes, 8(4), 477. https://doi.org/10.3390/pr8040477 https://doi.org/10.3390/pr8040477
  214. Wang, J., Fu, G., & Yan, M. (2020). Comparative analysis of two catastrophic hazardous chemical accidents in China. Process Safety Progress, 39, 1-7.
  215. Zhu Y, Qian X, Liu Z, Huang P, Yuan M. Analysis and assessment of the Qingdao crude oil vapor explosion accident: Lessons learnt. Journal of Loss Prevention in the Process Industries. 2015;33:289-303.
  216. Fu, G., Wang, J., & Yan, M. (2016). Anatomy of Tianjin Port fire and explosion: Process and causes. Process Safety Progress, 35(3), 216-220.
  217. Fu, G., Zhou, L., Wang, J., & Shi, M. (2018). Analysis of an explosion accident at Dangyang Power Plant in Hubei, China: Causes and lessons learned. Safety Science, 102, 134-143. https://doi.org/10.1016/j.ssci.2017.10.010 https://doi.org/10.1016/j.ssci.2017.10.010
  218. Abdolhamidzadeh B, Hassan CRC, Hamid MD, Farrokhmehr S, Badri N, Rashtchian D. Anatomy of a domino accident: Roots, triggers and lessons learnt. Process Safety and Environmental Protection. 2012;90(5):424-429. doi:10.1016/j.psep.2012.04.003 https://doi.org/10.1016/j.psep.2012.04.003
  219. Willey RJ. West Fertilizer Company fire and explosion: A summary of the U.S. Chemical Safety and Hazard Investigation Board report. Journal of Loss Prevention in the Process Industries. 2017;49:132-138.
  220. Zarei E. Dynamic safety assessment of natural gas stations using Bayesian network. Journal of Hazardous Materials. 2017;321:830-840.
  221. Kalantarnia M, Khan F, Hawboldt K. Modelling of BP Texas City refinery accident using dynamic risk assessment approach. Process Safety and Environmental Protection. 2010;88(3):191-199.
  222. Zadakbar O, Imtiaz S, Khan F. Dynamic risk assessment and fault detection using a multivariate technique. Process Safety Progress. 2013;32(4):365-375.
  223. Hokstad P, Øien K, Reinertsen R. Recommendations on the use of expert judgement in safety and reliability engineering studies. Two offshore case studies. Reliability Engineering & System Safety. 1998;61:65-
  224. Creedy GD. Quantitative risk assessment: How realistic are those frequency assumptions?. Journal of Loss Prevention in the Process Industries, 24(3), 203-207. 2011. doi:10.1016/j.jlp.2010.08.013 https://doi.org/10.1016/j.jlp.2010.08.013
  225. Johansen IL, Rausand M. Barrier management in the offshore oil and gas industry. Journal of Loss Prevention in the Process Industries. 2015;34:49-55.
  226. Decarli L, Scataglini L, Cherubin P, La Rosa L. Barrier integrity management: An innovative approach for managing process safety risks in oil and gas assets. SPE International Conference and Exhibition on Health, Safety, Environment, and Sustainability; 2020.
  227. Duijm NJ. Safety-barrier diagrams as a safety management tool. Reliability Engineering & System Safety. 2009;94(2):332-341.
  228. Yuan S. Safety barriers in the chemical process industries: A state-of-the-art review on their classification, assessment, and management. Safety Science. 2022;148:105647.
  229. Schmitz P. Mechanical integrity of process installations: Barrier alarm management based on bowties. Process Safety and Environmental Protection. 2020;138:139-147.
  230. Gertman D, Blackman H, Marble J, Byers J, Smith C. The SPAR-H human reliability analysis method (NUREG/CR-6883). U.S. Nuclear Regulatory Commission; 2005.
  231. van de Merwe K, Øie S, Gould K. The application of the SPAR-H method in managed-pressure drilling operations. Proceedings of the Human Factors and Ergonomics Society Annual Meeting. 2012;56:2021-2025.
  232. Liu J, Zou Y, Wang W, Zhang L, Qing T, Zheng T, et al. A study on assigning performance shaping factors of the SPAR-H method for adequacy human reliability analysis of nuclear power plants. International Journal of Industrial Ergonomics. 2020;81:103051. doi:10.1016/j.ergon.2020.103051 https://doi.org/10.1016/j.ergon.2020.103051
  233. Mirzaei Aliabadi M, Esmaeili R, Mohammadfam I, Ashrafi M. Human reliability analysis (HRA) using standardized plant analysis risk-human (SPAR-H) and Bayesian network (BN) for pipeline inspection gauges (PIG) operation: A case study in a gas transmission plant. Health Scope. 2019;8. doi:10.5812/jhealthscope.87148 https://doi.org/10.5812/jhealthscope.87148
  234. Williams, J. C. (1988). A data-based method for assessing and reducing human error to improve operational performance. Proceedings of the 1988 IEEE Fourth Conference on Human Factors and Power Plants, 436-450.
  235. Hollnagel E. Cognitive reliability and error analysis method. Elsevier; 1998.
  236. Kirwan B, Gibson H, Kennedy R, Edmunds J, Cooksley G, Umbers I. Nuclear action reliability assessment (NARA): A data-based HRA tool. Safety and Reliability. 2005;25:38-45. doi:10.1080/09617353.2005.11690803 https://doi.org/10.1080/09617353.2005.11690803
  237. Hou LX, Liu R, Liu HC, Jiang S. Two decades on human reliability analysis: A bibliometric analysis and literature review. Annals of Nuclear Energy. 2021;151:107969. doi:10.1016/j.anucene.2020.107969 https://doi.org/10.1016/j.anucene.2020.107969
  238. Alvarenga MAB, Frutuoso e Melo PF, Fonseca RA. A critical review of methods and models for evaluating organizational factors in human reliability analysis. Progress in Nuclear Energy. 2014;75:25-41. doi:10.1016/j.pnucene.2014.04.004 https://doi.org/10.1016/j.pnucene.2014.04.004
  239. Gholamizadeh, K., Zarei, E., Omidvar, M., & Yazdi, M. (2022). Fuzzy sets theory and human reliability: Review, applications, and contributions. Linguistic methods under fuzzy information in system safety and reliability analysis (Springer), 91-137.
  240. Rasmussen, J. (1983). Skills, rules, and knowledge; signals, signs, and symbols, and other distinctions in human performance models. IEEE Transactions on Systems, Man, and Cybernetics, 13(3), 257-266.
  241. Guglielmi D, Paolucci A, Cozzani V, Mariani MG, Pietrantoni L, Fraboni F. Integrating human barriers in human reliability analysis: A new model for the energy sector. International Journal of Environmental Research and Public Health. 2022;19(5):2797.
  242. Wang L, Wang Y, Chen Y, Pan X, Zhang W. Performance shaping factors dependence assessment through moderating and mediating effect analysis. Reliability Engineering & System Safety. 2020;202:107034. doi:10.1016/j.ress.2020.107034 https://doi.org/10.1016/j.ress.2020.107034
  243. Abílio Ramos M, López Droguett E, Mosleh A, Das Chagas Moura M. A human reliability analysis methodology for oil refineries and petrochemical plants operation: Phoenix-PRO qualitative framework. Reliability Engineering & System Safety. 2020;193:106672. doi:10.1016/j.ress.2019.106672 https://doi.org/10.1016/j.ress.2019.106672
  244. Ren, J., Jenkinson, I., Wang, J., Xu, D. L., & Yang, J. B. (2008). A methodology to model causal relationships on offshore safety assessment focusing on human and organizational factors. Journal of Safety Research, 39, 87-100. https://doi.org/10.1016/j.jsr.2007.09.009 https://doi.org/10.1016/j.jsr.2007.09.009
  245. Zhen X, Vinnem JE, Yang X, Huang Y. Quantitative risk modelling in the offshore petroleum industry: Integration of human and organizational factors. Ships and Offshore Structures. 2020;15:1-18.
  246. Asadzadeh SM, Azadeh A. An integrated systemic model for optimization of condition-based maintenance with human error. Reliability Engineering & System Safety. 2014;124:117-131.
  247. Arumosoye, O. M., & Obriki, O. D. (2022). Conceptual risk pathway model for lifting and rigging operations in heavy industrial construction. Gyanshauryam, International Scientific Refereed Research Journal, 5(5), 346-369. https://doi.org/10.32628/GISRRJ2256237 https://doi.org/10.32628/GISRRJ2256237
  248. Obogo, S. F., Arumosoye, O. M., & Obriki, O. D. (2020). Conceptual risk management model for heavy lifting and crane installation engineering operations. Shodhshauryam, International Scientific Refereed Research Journal, 3(4), 122-144. https://doi.org/10.32628/SHISRRJ214441 https://doi.org/10.32628/SHISRRJ214441
  249. Sterman JD. Business dynamics: Systems thinking and modeling for a complex world. Irwin/McGraw-Hill; 2000.
  250. Goh YM, Love PED. Methodological application of system dynamics for evaluating traffic safety policy. Safety Science. 2012;50(7):1594-1605.

How to cite

BibTeXDownload .bib
RISDownload .ris
EndNoteDownload .enw

Licensed under CC BY 4.0.