Burning down the JHA - complete

Burning down the JHA

Part 1.

Question: is the JHA reliable? Perhaps let’s answer the question with a question; what is its mean time to failure? Does it satisfy its specified behavioural requirements over time and under given conditions—that is, does it not fail when used as prescribed?

Increasing reliability can lead to decreased safety, but there is no evidence that I can find that decreasing reliability increases safety. Why is the JHA tool unreliable? Because it assumes that the task steps actually employed follow those written exactly, and because it does not consider the environment in which the work is conducted. Put another way, as Moltke wrote in 1871...

“No plan of operations extends with any certainty beyond the first encounter with the main enemy forces. Only the layman believes that in the course of a campaign he sees the consistent implementation of an original thought that has been considered in advance in every detail and retained to the end.”

In another words, the JHA is likely to fail sooner rather than later – not a sign of reliability.

In qualitative terms

• the mean time to failure of the JHA is inversely proportional to the accuracy and relevance of the task steps identified and/or the consistency of the environment in which they are performed. Put another way, the more complex (whether interactive complexity, dynamic complexity, or non-linear complexity) the work, the sooner the failure.
• Mean time to failure is proportional to the level of administrative dogma surrounding the JHA including post-incident modifications that are irrelevant to the future of work but are included to keep some Numpty in our own or our client’s organization happy. Put in simple terms, the mean time to failure is proportional to the amount of sh1t we include.
• Mean time to failure is proportional to the competitive or financial pressures to increase efficiency that every organization faces.? Mean time to failure is therefore also proportional to the level of innovation in the organization.

What gets included in the document also contributes to an absence of both reliability and safety. There is no tool per se for identifying hazards – such an activity derives its results from the expertise and subjective evaluation of the assessor. Performance-based legislation supports by outlining the hazards that the regulator wants considered when a particular type of work is carried out, but prescriptive legislation is of itself unreliable. Taking a mindset that following legislation is enough will ensure that the set of hazards that need to be identified and avoided is insufficient and inadequate.

There is also a problem where being legislation-centric leads to the flawed assumption that every hazard identified as being present also has potential to cause harm. If I go to the kitchen for a cup of tea, a scan of that environment identifies a number of hazards – sharp edges on knives inside blocks, sharp points on forks inside drawers, potentially hot surfaces, equipment with rotating parts (a blender), any number of cleaning chemicals etc. None of these have the potential to harm me until such time as I interact with them.

Does it make us safer? No, not in its current form, it is paper safe at best. The premise is flawed; optimizing each task step does not necessarily add up to optimum execution of the whole.

Part 2... The way in which conditions influence future events. The Bhopal disaster, illustrates how a change in conditions (in that case a reduction in demand for MIC), led to a series of critical events (the refrigeration units being switched off, or the chemical engineer in charge quitting for example). As suggested above, mean time to failure is proportional to the competitive or financial pressures to increase efficiency that every organization faces.?In another words, to reframe Reason’s findings, the foundation for a failure lies in the day-to-day efforts of the workforce to respond to the ubiquitous change that is inherent in business. Our current approach does not sit well with that. We make a point of highlighting that the JHA must be updated when conditions change. But we must understand that change is ubiquitous. When we say “conditions change” do we really mean when the market tightens? Do we really mean when maintenance is delayed so as to not impact financial performance? Do we really mean when the supervisor quits? What we really mean is when a new process, operation or piece of equipment is introduced. Because that is a far more practical approach. Utilizing the former would be paralysing and impossible. Or would it? If we recognize that events are limited in duration and that conditions can persist until a new event occurs leading to new or changed conditions, we can assess conditions and their impact on safety. The presence of fuel and oxygen as conditions can persist for a long time before an event (the introduction of a source of ignition) leads to another event, an explosion. For some time, FAS 157 has required financial institutions to ‘mark to market’ in valuing assets. In the approach I am going to recommend I will draw on the same notion of marking risk to market conditions.

Part 3:

The role of the environment in which work takes place and its influence. Environment can mean the sociotechnical factors at work in the background. As outlined, change is ubiquitous and the foundation for a failure lies in the day-to-day efforts of the workforce to respond to it. This environment is much more impactful that the physical environment where changes are easily identified and responded to. People respond to a hot or cold day by dressing differently, drinking more water etc. But purpose, goals and decision criteria are not so overt in their influence. Put another way, the ‘caused by’ test is harder to evidence with social or organizational factors than with physical environmental factors such as noise, heat etc. Conditions can persist until a new event occurs leading to new or changed conditions. An organizational shift in purpose, goals, priorities, and resources may persist beneath the surface as a condition for some time until the increased risk leads to an event. In this case if the event leads to an incident the response is likely to be focussed on what the person did wrong. Fortunately, modern thinking is moving towards understanding why it made sense for them. This though is not a discussion of investigation paradigms, nor is it about resisting or demonizing the adaptations made in the workplace ?but a way of recognizing and embracing ubiquitous change as an opportunity. If we recognize this evolution and fluidity of the environment in which work takes place we can exploit it for better safety performance and competitive advantage.

Part 4: The focus on evidence that work is safe versus evidence that it is not and the potential for controls to fail to act as intended. It is not unusual for a hazard/risk assessment to be poorly completed. Indeed, two Chemical Safety Board (CSB) investigations drew attention to the poor quality of the process hazard assessment, in one case since the cause of the event was the focus of a group of specialists yet was absent from the process hazard assessment. It is sadly too often completed from memory and repetition than from an effective solution. I would propose that over time there has been heuristic pairing of controls – work at height= tie off, pinch point=wear gloves etc and in doing so we have become less discerning in our approach. Also, the controls often proposed are intended to mitigate the severity rather than the source of the harm. If we think about hazards in a general sense as something with the ability to create harm, we can also define the cause of harm as the failure of controls or constraints to prevent unsafe conditions. Where the current approach fails is that it both assumes the selected control is effective, but more importantly, it sees the parts as discrete and fails to identify interactions between system variables. By extension, it does not address the inherent shift towards greater risk that production and efficiency pressure creates. Put another way, an absence of safety is an absence of control. Our hazard assessment process must embrace the ubiquitous change we have already acknowledged. Also, the perfect-world assumptions around which hazard assessment takes place will need to be revisited. The determination of the extent of control required cannot come from an arbitrary box on a (likely flawed) risk matrix but instead on the likely/foreseeable impacts of ubiquitous change on the structure of the controls. The notion of residual risk is different to emergent risk. One is static, the other acknowledges the fact that workers will adapt to production and efficiency pressures. We must move on from seeing these as violations and see them as normal. The hazard assessment legitimacy lies in its utilization – does it support work, or does it just provide a convenient place for dust to accumulate? Perhaps a first step is to redefine hazardous as a state the system should not move into. That means we perform a two-part assessment – where we firstly identify the ‘generic’ sources of harm such as cuts from a sharp edge, entanglement around a rotating part, equipment contacting people. Then we ask a better series of questions around what might cause the established ‘generic control’ to become compromised. Is it that it is cumbersome in the face of production and efficiency pressures?

Part 5:

A better approach. If we start from the understanding that our hazard assessment, the outcome of which is currently captured in JHA or Risk assessment document, should in a functioning system, inform safe work methods, purchasing decisions around equipment, PPE choices and training and education requirements, then the process needs to improve. We have delved into the competitive or financial pressures to increase efficiency that every organization faces.?Since we are aware of them, and since we recognize that change is ubiquitous, both are foreseeable. In the first part the notion of reliability was introduced as meaning the ability to satisfy specified behavioural requirements over time and under given conditions. In order for the process to be reliable it needs some tweaks. My suggestion is as follows.

1. Do the usual task breakdown, identify hazards and controls as before. This will make the next parts easier.
2. Consider the controls identified and for each ask, what potentially unsafe behaviour or condition is this attempting to constrain? How much safety margin does the control have? How much degradation can it withstand? What other factors is it dependent upon for its success?
3. The third proposed step is to look at the task and its likely competitive or financial pressures. Where is the likely shortcut? Does that alternative however better reflect work as done versus work as imagined and does this require a change in the steps? Does the ‘shortcut’ so called reflect a natural flow such as the way water moves or the desire paths that reflect the natural movements of people and animals?
4. Does the control still function in the event of a shortcut? How many shortcuts? By only related people or by unrelated parties? What failure of another constraint could have a cascading effect on the one being examined? All of these questions are important because they form the basis for inspection audit and other assurance activity.