The RMS Titanic wanted to set a time record across the Atlantic although there were warnings of icebergs in the area to be crossed. The crew ignored the warnings and RMS Titanic hit an iceberg in full speed.
The crew ignored the warnings and RMS Titanic hit an iceberg in full speed. The Challenger space shuttle was launched a few hours after a group of engineers proposed to delay the launch due to the sealing function of O-rings on the rocket booster. The space shuttle disintegrated 73 seconds after launch due to a failure of the sealing.
History has demonstrated that conflicting goals of safety and production performance have contributed to several major accidents. “Do it more efficient, but don’t have an accident”.
DNV recognize the oil and gas industry’s need to be more cost efficient in order to survive with today’s oil price combined with the high cost level. So how can cost cutting be made safe? Several safety scientists have developed theories on how production pressure and cost cutting influence the risk level, theories that might be useful to understand and have in mind in these cost cutting times.
Rasmussens "Migration model” is one way of discussing how production pressure and cost cutting affect the risk. The model illustrates our work space which is between the boundaries of financial performance, acceptable workload and acceptable risk. If these boundaries are crossed you will (respectively) go bankrupt, be overworked or have an accident.
The fundamental challenge is that the pressure towards efficiency and the pressure towards least effort may lead to a migration towards the safety boundary.
The theories of resilience might help us explain the phenomenon of moving towards the boundary of acceptable risk further. One of the key terms within resilience theory is adaptability. Adaptability can be defined as the the ability to absorb or adapt to disturbance, disruption and change (Woods, 2006). The opposite of adaptability is brittleness. A few weeks ago, I participated on a seminar given by the safety scientist David Woods. He argued that an organization, exemplified by the NASA Faster, Better, Cheaper (FBC) initiative, gets more brittle (i.e. does not absorb or adapt well to disturbance, disruption and change) when exposed to increased performance goals combined with reduced resources. He further argued that FBC pressure leads to a mis-calibration based on the past incredible, which means that you assume what was effective yesterday still is effective, without examining the differences or changes in the conditions or assumptions. Thus, when exposed to FBC pressure, the boundary of safe performance and acceptable risk gets harder to see, or the perceived boundary moves further out.
One example is the very experienced drilling team on the Deepwater Horizon which rationalized away the clear signals of a blowout in development. Another example is the NASA Challenger organization, which had experienced repeated signals of potential dangers related to the sealing function on the O-rings of the Challenger space shuttle. These signals had been risk assessed and found acceptable over and over again. The repetition of defining the potential danger as acceptable risk led to a change in the assumption of what was normal and what was acceptable. A “normalization of deviance” (Vaughan, 1996) led to that the Challenger Space Shuttle actually was launched, despite the clear signals of failure.
The MS Herald of Free Enterprise was a Ro-Ro vessel that capsized in Zeebrugge, just after leaving the port. An open bow-door caused flooding of the decks and 193 persons died. Before the capsize, shore management had turned down installing alarm on the bridge to notify if the bow door was open when leaving port, even though a sister ship had experienced the same. Rasmussen (1994) argues that managers (in the blunt end) often are more prone to take risk than operational personnel are (sharp end), due to their distance from daily operation and that their incentive systems direct their attention to profits at the expense of events that they perceive as unlikely to happen (SINTEF, 2010).
Cross-scale interactions between levels in an organization is critical for how resilient a system is, as the resilience defined in one level on the organization depends on influences from the other (Woods, 2006). The resilience in the sharp end of the organization is affected by how the levels above handle pressure and prioritizing between production and safety goals. Thus, if you as a manager show that you are willing to cut cost at the expense of the safety level, your way of prioritizing will cascade downwards.
One of the challenges that we in DNV face, is that it is difficult to reflect the full effects of cost cutting in the risk models that we have for evaluating the major accident risk, i.e. in the Quantitative Risk Analysis (QRA) and in barrier management systems. The influence of the cost cutting on technical systems can to a certain degree be reflected, but the general influence on the behavior, and in turn the behavior’s effect on the risk level, is difficult to reflect in our quantitative studies. To fully understand the dependencies in the entire system and how they interact and create mechanisms which bear an impact on the safety level on a shorter or longer term, a different perspective may be called for. In the sharp end we only detect the ripple effects of the changes, whereas other tools and approaches may be needed to detect and interpret the early warning signs.
Thus, a complete understanding of how cost and production pressure affect safety is important to be able to prevent the undesired effect that may arise. Cost cutting is necessary, but it should be done with caution.
Hopefully, this brief summary of available theory and perspectives will inspire for further efforts towards a safer cost reduction process in the industry. Understanding and awareness is the first step.
Sources:
Rasmussen, J. High reliability organisations, Normal accidents and other dimensions of a risk management problem (1994)
SINTEF Technology and Society “Organisational Accidents and Resilient organisations: Six perspectives: Revision 2 (2010)
Vaughan, D. The Challenger Launch Decision (1996)
Woods, David D. “Essential characteristics of resilience.” Resilience engineering: Concepts and precepts (2006)