See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/324881404 Challenging the immediate causes: A work accident investigation in an oil refinery using organizational analysis Article  in  Work · April 2018 DOI: 10.3233/WOR-182702 CITATIONS 0 READS 278 3 authors: Some of the authors of this publication are also working on these related projects: Acidente de trabalho: da análise sócio técnica à construção social de mudanças. View project Acidentes de Trabalho: da análise sociotécnica à construção social de mudanças View project Sandra Lorena Beltran University of São Paulo 6 PUBLICATIONS   2 CITATIONS    SEE PROFILE Rodolfo Andrade de Gouveia Vilela University of São Paulo 92 PUBLICATIONS   169 CITATIONS    SEE PROFILE Ildeberto Muniz Almeida São Paulo State University 67 PUBLICATIONS   255 CITATIONS    SEE PROFILE All content following this page was uploaded by Sandra Lorena Beltran on 22 May 2018. The user has requested enhancement of the downloaded file. https://www.researchgate.net/publication/324881404_Challenging_the_immediate_causes_A_work_accident_investigation_in_an_oil_refinery_using_organizational_analysis?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_2&_esc=publicationCoverPdf https://www.researchgate.net/publication/324881404_Challenging_the_immediate_causes_A_work_accident_investigation_in_an_oil_refinery_using_organizational_analysis?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_3&_esc=publicationCoverPdf https://www.researchgate.net/project/Acidente-de-trabalho-da-analise-socio-tecnica-a-construcao-social-de-mudancas?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_9&_esc=publicationCoverPdf https://www.researchgate.net/project/Acidentes-de-Trabalho-da-analise-sociotecnica-a-construcao-social-de-mudancas?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_9&_esc=publicationCoverPdf https://www.researchgate.net/?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_1&_esc=publicationCoverPdf https://www.researchgate.net/profile/Sandra_Beltran?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_4&_esc=publicationCoverPdf https://www.researchgate.net/profile/Sandra_Beltran?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_5&_esc=publicationCoverPdf https://www.researchgate.net/institution/University_of_Sao_Paulo?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_6&_esc=publicationCoverPdf https://www.researchgate.net/profile/Sandra_Beltran?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_7&_esc=publicationCoverPdf https://www.researchgate.net/profile/Rodolfo_Vilela2?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_4&_esc=publicationCoverPdf https://www.researchgate.net/profile/Rodolfo_Vilela2?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_5&_esc=publicationCoverPdf https://www.researchgate.net/institution/University_of_Sao_Paulo?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_6&_esc=publicationCoverPdf https://www.researchgate.net/profile/Rodolfo_Vilela2?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_7&_esc=publicationCoverPdf https://www.researchgate.net/profile/Ildeberto_Muniz_Almeida?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_4&_esc=publicationCoverPdf https://www.researchgate.net/profile/Ildeberto_Muniz_Almeida?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_5&_esc=publicationCoverPdf https://www.researchgate.net/institution/Sao_Paulo_State_University?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_6&_esc=publicationCoverPdf https://www.researchgate.net/profile/Ildeberto_Muniz_Almeida?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_7&_esc=publicationCoverPdf https://www.researchgate.net/profile/Sandra_Beltran?enrichId=rgreq-6b7065ddd920af897fae8a157399805f-XXX&enrichSource=Y292ZXJQYWdlOzMyNDg4MTQwNDtBUzo2MjkwNDY1NDczNDU0MTBAMTUyNjk4Nzc5MjgyNg%3D%3D&el=1_x_10&_esc=publicationCoverPdf A U TH O R C O P Y Work 59 (2018) 617–636 DOI:10.3233/WOR-182702 IOS Press 617 Challenging the immediate causes: A work accident investigation in an oil refinery using organizational analysis Sandra Lorena Beltrana,∗, Rodolfo Andrade de Gouveia Vilelaa and Ildeberto Muniz de Almeidab aDepartment of Environmental Health, School of Public Health, University of São Paulo, São Paulo, Brazil bDepartment of Public Health, School of Medicine, São Paulo State University “Júlio de Mesquita Filho”, Botucatu, São Paulo, Brazil Received 10 December 2016 Accepted 11 June 2017 Abstract. BACKGROUND: In many companies, investigations of accidents still blame the victims without exploring deeper causes. Those investigations are reactive and have no learning potential. OBJECTIVE: This paper aims to debate the historical organizational aspects of a company whose policy was incubating an accident. METHODS: The empirical data are analyzed as part of a qualitative study of an accident that occurred in an oil refinery in Brazil in 2014. To investigate and analyse this case we used one-to-one and group interviews, participant observation, Collec- tive Analyses of Work and a documentary review. The analysis was conducted on the basis of concepts of the Organizational Analysis of the event and the Model for Analysis and Prevention of Work Accidents. RESULTS: The accident had its origin in the interaction of social and organizational factors, among them being: excessively standardized culture, management tools and outcome indicators that give a false sense of safety, the decision to speed up the project, the change of operator to facilitate this outcome and performance management that encourages getting around the usual barriers. CONCLUSIONS: The superficial accident analysis conducted by the company that ignored human and organizational factors reinforces the traditional safety culture and favors the occurrence of new accidents. Keywords: Accident prevention, oil refinery, oil and gas industry 1. Introduction Work accidents are serious social phenomena. The lack of reaction to them leads to a significant human cost, in addition to having economic repercussions. Companies and workers know that this affects pro- ductivity negatively. According to the International Labour Organization (ILO), it is impossible to accept ∗Address for correspondence: Sandra Lorena Beltran, Depart- ment of Environmental Health, School of Public Health, University of São Paulo, Av. Dr. Arnaldo 715, Cerqueira César, São Paulo, SP, 01246-904, Brazil. E-mail: sandrabeltran@usp.br. a job that undermines economic efficiency and does not take into account the safety and health of workers as the basis of a sustainable development strategy [1]. Accidents now come under public scrutiny more than ever before and there had been an increasing social demand for public and independent investi- gations [2]. Many organizations are now collecting data in order to better understand the causality of the events. The International Association of Oil & Gas Producers, IOGP, has been collecting safety inci- dent data from its member companies globally since 1985. The IOGP incident reporting system covers 1051-9815/18/$35.00 © 2018 – IOS Press and the authors. All rights reserved mailto:sandrabeltran@usp.br A U TH O R C O P Y 618 S.L. Beltran et al. / Challenging the immediate causes at work accident investigation Fig. 1. Total Recordable Injury Rate (TRIR)1 five-year rolling average by region (2011–2016). Source: IOGP – Safety Performance Indicators – 2016 data. worldwide Exploration and Productions operations, both onshore and offshore, and includes incidents involving both companies and contractors’ employ- ees. For the last five years, Total Recordable Injury Rate (TRIR) and Lost Time Injury Frequency (LTIF) have been high in South and Central America as com- pared with those of other regions and these rates are even worse for contractors in exploration activities [3]. The worrying situation in our region may be reflected in the average Total Recordable Injury Rate (TRIR) which in South and Central America attained its worst result in 2013 while the other regions’ rates decreased (see Fig. 1). Further, we believe that the situation in South and Central America could in fact be still worse, since some of the major state-owned companies in the region do not report their statistics to the IOGP. The most recent Brazilian data available show that in the period 2011–2013, work-related accidents in the oil & gas industry exceeded twice the total national incidence rate; and the typical accident inci- dence rate2 of this sector was 2.5 times greater than the overall national incidence rate [4]. In 2012 the refining and biofuels sector stood out as occupy- ing the first place in the processing industry and fifth place among all economic sectors in the inci- dence rate of typical accidents (30.1 cases per 1,000 workers) [5]. 1Total recordable injury rate (TRIR) The number of recordable injuries (fatalities + lost work day cases + restricted work day cases + medical treatment cases) per million hours worked 2In Brazil typical accidents are those resulting from the char- acteristic of the specific professional activity. This term excludes traffic accidents occurring between the home and the workplace and occupational diseases. Trade unions in the oil industry in Brazil have expressed alarm about the precarious safety condi- tions existing in the workplace and about the limits imposed on investigations of work-related accidents [6, 7]. Companies have ignored these alarms on the basis of the argument that they are working on the corrective actions generated by their internal inves- tigations. However, such actions are not proving effective in preventing fatal accidents. Brazil is the country that reports the largest num- ber of companies to IOGP in the South and Central American region. It is also a country that has reported higher LTIF and TRIR than the regional and global averages over the last three years [3] (see Table 1). Systemic approaches have been used in major acci- dent investigations in the oil industry, but analyses which adopt this approach are rare when it comes to typical workplace accidents or occupational acci- dents. In the oil and gas industry some examples of more in-depth investigations are those concerning the Piper Alpha disaster, BP Texas Refinery explosion, the Deep Water Horizon disaster and the Brazilian P-36 platform case [8–11]. There are several possible theoretical approaches to safety and accident investigation that have emerged since the third decade of the twentieth century. Dien et al. [12] have classified these periods in recent decades, based on the earlier description of Reason (1993) and Wilpert & Fahlbruch (1998) [12]: a) the technical period (the 70 s): the source of problems is seen to be technological; b) the “Human error” period (the 80 s): the source of problems is held to be the operator; c) the socio-technical period (the 90 s): the source of problems is found in the interaction between the social and technical subsystems; and d) the inter- organizational relationship period (the 2000 s): the A U TH O R C O P Y S.L. Beltran et al. / Challenging the immediate causes at work accident investigation 619 Table 1 Total Recordable Injury Rate (TRIR)3 and Lost Time Injury Frequency (LTIF)4 in Brazil and region (2014–2016) Country/Region TRIR LTIF 2014 2015 2016 2014 2015 2016 Brazil 3.13 2.64 1.99 0.84 0.97 0.68 South & Central American 2.82 2.08 1.83 0.77 0.66 0.59 Average Global average 1.54 1.21 1.03 0.36 0.29 0.27 Source: IOGP – Safety Performance Indicators – 2016 data. source of problems is regarded as the dysfunctional relationship between organizations. Dien et al. argue that the results of this evolu- tion are complementary and not mutually exclusive. No aspect should be ignored in favor of others [12]. According to Stoop and Dekker, modern safety investigations are characterized by: evidence-based information, knowledge-based information, a sys- temic approach, communication and dissemination [13]. Theoretically, there is enough knowledge about accident investigation to prevent new events. But for safety investigators the major challenge has become how to incorporate human and organizational fac- tors, policy making and governance investigation capabilities to their arsenal of technical skills and competences [14]. According to the IOGP, there are five common causal factors related to the fatal incidents and events with great accident potential that occurred between 2010 and 2014 [3]: a) Process (Conditions): Organi- zational: Inadequate training/competence; b) People (Acts): Inattention/lack of awareness: Improper decision making or lack of judgement; c) Pro- cess (Conditions): Organizational: Inadequate work standards/ procedures; d) Process (Conditions): Organizational: Inadequate supervision; e) Pro- cess (Conditions): Organizational: Inadequate hazard identification or risk assessment. Although these results show that the events were more closely related to organizational aspects, recent accident investigations continue to point to fac- tors related to individuals. Especially investigations conducted internally by the companies where the accidents resulted predominantly from human error. Despite their past performance, investigations are criticized for their reactive nature and the lack of learning potential they provide [13]. 3Total recordable injury rate (TRIR): The number of recordable injuries (fatalities + lost work day cases + restricted work day cases + medical treatment cases) per 1,000,000 hours worked 4Lost time injury frequency (LTIF) The number of lost time injuries (fatalities + lost work day cases) per million hours worked The review of accident investigation from the Norwegian petroleum industry reports that most of internal company investigations are based on com- mon sense rather than the use of systematic methods. But currently the use of the term “root causes” in a considerable number of the investigations of indus- trial accidents leads to conclusions suggestive of the need for changes in technology and organization [15]. Inter-organizational relationships appear to be more frequently addressed by external and indepen- dent research in major disasters. So it is necessary to adopt a different approach that goes beyond human error and also takes organizational and cultural fac- tors into consideration. Unions, government and all professional players need new tools to explain and prevent accidents. In addition, the analysis of just one accident brings the potential of knowing the individual, organizational and societal factors; other industrial sectors can generalize and introduce their lessons. This kind of deep analysis provides an approachable human and organizational factors per- spective, which will probably affect safety system underlying dynamics [2]. This paper aims to debate the historical aspects of an organization whose pol- icy created the conditions which in fact led to the occurrence of an accident. 2. Methods 2.1. The case selected Because of the existing cooperation between the School of Public Health – University of São Paulo and the Public Ministry of Labour (Ministério Público do Trabalho, henceforth MPT) on previous accident analyses, the MPT asked the School of Public Health to investigate a work-related accident which had occurred in a particular oil refinery. The accident was selected in the light of the criteria that it had occurred: in the last five years, in one of the petroleum refineries located in the Brazilian southeastern region and for its involving at least one victim with more than 30 days away from work or one death. The refinery, where the accident occurred, processes approximately 15% of the national production of petroleum products with an approximate headcount of 1000 direct workers and 4000 outsourced workers (at the time of the accident). The accident happened on the morning of 11 September 2014. There was a fire on a Liquefied Petroleum Gas (LPG) manifold. The manifold was being isolated to connect with a new line and the A U TH O R C O P Y 620 S.L. Beltran et al. / Challenging the immediate causes at work accident investigation Fig. 2. Photo of 14” flange where the leak occurred. workers were unloading a 14-inch flange for the sub- sequent installation of a valve (see Fig. 2). A gas leak occurred followed by an explosion. The fire left six victims. One of them was in the Intensive Care Unit (ICU) for over 70 days as a result of multiple burns, at the end of which time he died. The immediate causes indicated by the company were the absence of planning, a failure in the work permit process and non-compliance with necessary proce- dures and intervention steps. The enterprise, where the accident occurred, was the LPG-C5+ project, which sought to expand and modernize existing units at the refinery for process- ing oil to be received from the pre-salt layer. It was a large-scale project. An Engineering, Procure- ment and Construction (EPC) contract between the contracting company (henceforth company B) and the contractor (henceforth company M) was being executed. It was worth approximately US$ 150 mil- lion and covered a total period of two and a half years, beginning in February 2013 with its deadline in August 2015. The construction phase at the refinery began in July 2013. 2.2. Techniques used to collect data and analyse the accident The empirical data are based on a qualitative study. To investigate and produce data for this case we used four techniques: a documentary review, a Collective Work Analysis, participant observation, and one-to- one and group interviews. Our work began five days after the event with a visit to the site of the accident. We reviewed more than 50 documents including accident notifications, company proceedings, work permits, risk analysis, equipment manuals, minutes of meetings, auditors’ reports; the contract, charts, schedules and budgets of the project; documents and videos used for the dissemination of information on other accidents and the internal investigation report of this accident. Collective Work Analysis (Análise Coletiva de Trabalho, henceforth CWA) is a technique based on the ergonomics of activity theory. It aims to under- stand “work actually done” and the distance between it and the work prescribed5. The workers themselves analyse their work in a group setting on the basis of a leading question: “What do you do in your job?” The work is not analyzed in the actual work place, but outside it, and the analysis is constructed by the workers themselves under the guidance of researchers [16]. We held one CWA meeting with 16 work- ers from company B’s operations and maintenance departments. The interviews were individual, semi-structured and conducted by one and the same researcher. We interviewed a total of 36 people, from both companies, among them being: victims of the 5So called by Hollnagell “work as done” in opposition to “work as imagined”. (Hollnagel E. Safety-I and Safety-II. The past and future of safety management. Farnham: Ashgate; 2014. 187 p). A U TH O R C O P Y S.L. Beltran et al. / Challenging the immediate causes at work accident investigation 621 accident, members of the company’s investigation board, operators, safety technicians, supervisors, managers, union representatives and employees from other supporting areas: planning, maintenance, legal department, human resources, social assistance and warehouse. We held one collective interview with three company employees. Two ex-employees refused to participate in the study and one of the vic- tims could not attend the interview as he was in the ICU. Participant observation is a social science data col- lection technique that seeks to fit into a social group to understand their cultural meanings [16] and in this case addressed to understanding the work activity as a real scenario. This stage consisted of the obser- vation of the activities within the project for three months, for four hours daily. This approach was used as complementary to the Work Ergonomic Analy- sis especially in the phase of situated observation when we were seeking to understand the real work by interacting with the operators and collecting their verbalizations [17]. A resume of the data collecting instruments is given in Chart 1. 2.3. Data analysis In developing the interpretive synthesis and anal- ysis of the accident we conducted the event using the Organizational Analysis (OA) proposed by Dien, Llory and Montmayeul [12, 18] and the Model of Analysis and Prevention of Work-Related Accidents (MAPA) proposed by Almeida et al. [19]. The first model (OA) involves the operation of three main axes: the historical dimension, the trans- verse networks and vertical relationships of the organization. According to Llory, the analysis of acci- dents requires going back in time in order to put the phenomenon of deterioration in a prominent place: the analysis has to be traced back in the history of the organizations involved to highlight significant defective aspects [20]. The main components of the MAPA include the analysis of the usual work, analysis of the changes and barriers which led to aspects allowing conclusions on production management, workforce, maintenance, communications, safety management and conceptual expansion of the analysis to be made. The usual work is understood as the actual work or activity undertaken, which expresses what, why and how the operator does the job that is prescribed; it includes what to do in the face of variability and the adjust- ments that he makes based on the available resources, under real conditions and in actual experience. In contrast, the prescribed work or task is understood as all that is written formally in the procedures and standards of the company and all that is expected (including what is informally accepted to be done) of the operator: the theory of “how it should be done” [17]. According to the MAPA it is necessary to under- stand the usual work before analysing the accident. In other words, the analysis of an accident must under- stand as things usually go right as the basis to explain how things occasionally go wrong [21]. According to an ergonomic approach, qualitative methods seem to be appropriate to define not only the underlying causes, but also the relations between them [22, 23]. For the production and the analysis of the information, we try to understand not only the accident, but also the safety management and culture, the operational feedback from other events (incidents and accidents), the production pressures, the complexity of the organization, the Pathogenic Organizational Factors (POF) and the Resilient Orga- nizational Factors (ROF) [12, 18]. We also seek to understand how real performance at work is dif- ferent from prescribed safety procedures, and how those organizational factors influence workers’ deci- sions to cope with these differences. This study was approved by the Committee of Ethics on Research of the School of Public Health of the University of São Paulo (Process nº 1886113.5.0000.5421). 3. Results Having delineated the methodological considera- tions of this study, we now will describe the empirical results, summarizing the key points on: 1 - the com- pany report 2 – the usual work and variations, 3- the analysis of changes made, 4- the analysis of barriers, and 5 - the organizational analysis. 3.1. The company report Company B investigated the accident but their con- clusions did not go beyond immediate causes. In order to better understand some technical aspects of the accident, we resume here two specialists’ analysis attached to the report. The investigation board asked for an LPG system report. Experts using Software Indiss to simulate the LPG pressure relief and the time required to equal- ize the pressures found that the product in the pipe was the result of a defective, inadequate release. A U TH O R C O P Y 622 S.L. Beltran et al. / Challenging the immediate causes at work accident investigation Chart 1 Methodology synthesis Tool Objectives What and who How long Documentary Review Identifying victims, companies involved and project 14 documents directly related to the accident 3 months (before fieldwork) Knowing prescribed work 7 documents related to the project Understanding technical causes 6 safety management+ 14 “accident alerts”6+ 12 accident videos Identifying barriers 1 HR manual Understanding safety rules 5 articles published in Union’s journal 1 month (after fieldwork) Collective Work Analysis (CWA) Understanding the usual work 16 company employees (operators and maintenance technicians) 2 hours and a half at the meeting Understanding hierarchical relationships. 1 month in review and analysis One-to-one and group interviews Understanding organization’s history, hierarchical and cross-sectional relationships, usual work, changes in accident, safety and production management. 36 company and contractor’s employees Between 60 and 90 minutes each individual interview Three company employees at a group interview Two hours at group interview One month for transcription Four months on analysis Participant observation Understanding the usual work, hierarchical and cross-sectional relationships, the safety management and the safety culture. About 50 company and contractor’s employees involved in the project Three months on fieldwork Three months on analysis TOTAL About 59 documents. 55 employees in interviews and ACT. 10 months on data collection and analysisAbout 50 employees under observation Table 2 Detail of accumulation of remaining LPG Time Elapsed (hours) Mass inside the manifold (kilograms) 16 463.5 18 329.5 20 194.3 22 49.74 22h40m 14.15 24 14.15 Source: Internal investigation report. The depressurization process started about 2pm on September 10th and continued until 10am on Septem- ber 11th, therefore for around 20 hours. Through simulation, it was possible to calculate the approx- imate performance of the remaining mass of LPG in the pipe in the course of the depressurization time (see Table 2). The total depressurization would occur in around 22 hours and 40 minutes, when the pressure of the system would balance that of the torch. But oper- ators do not have access to this software in their daily decision-making. The release of the sphere started without water purging. After identifying the passage of LPG through the valves, the operators tightened those valves and decided to inject water. Even so, the purge did not reach the sphere (see Fig. 3). Another document analyzed was a technical report on the source of ignition. Its aim was to identify the possible sources of ignition that led to the explosion. The report concluded that there was circumstantial evidence that the universal electric motor of a torque wrench machine had been the source of ignition. It also established that the LPG density associated with the scaffold floor arrangement, installed below the flange level, may have contributed to the presence of an explosive atmosphere around the electrical equip- ment that was on the scaffold floor (see Fig. 2). With the technical data from the company’s board of inves- tigation we drew a timeline summarizing the main immediate causes (see Fig. 4). 6One page document with the main conclusions of the acci- dent investigation. It is used as a “lesson learned” by the entire organization. A U TH O R C O P Y S.L. Beltran et al. / Challenging the immediate causes at work accident investigation 623 Passage of LPG Water purgeVictim’s position Fig. 3. Purge made in sphere 7 (not reaching sphere). Fig. 4. Immediate timeline. 3.2. Usual work Interventions in equipment or pipelines in haz- ardous areas of the refinery are always preceded by a work permit process. The accident happened during the release of an LPG manifold, so we present three main aspects of the activity of releasing this kind of equipment in the project: work permits, resources and purging. Work permits-. After the daily hand-over, opera- tors begin to release the equipment, first of all for higher-risk activities or those that have greater prior- ity. Operators must go into the field to perform this activity, but depending on the number of work per- mits or the distance between the work teams, they can only move up to those fronts that will undertake more high-risk activities. An example of how the number of work permits varies is what happens during a main- tenance shutdown. Refinery operators reported that they have already released more than 20 work permits in a routine day. And in operations such as mainte- nance shutdowns they have released as many as 80. So the operator cannot check where the work is actu- ally going to be done to sign the permission and ends up signing the document in his office. This situation is similar in construction work going on in the refin- ery, as the number of work fronts varies greatly during the period of construction but the number of operators who sign the work permits does not. Resources -. Equipment releases at the refinery are only usually performed by the operator but depend- ing on the complexity of the operation some support A U TH O R C O P Y 624 S.L. Beltran et al. / Challenging the immediate causes at work accident investigation may be required. Other operators or safety techni- cians may be asked to provide this support, as also may those of outsourced routine maintenance com- panies. This support could also include the loan of tools. Specifically for this project, the support of routine maintenance was not requested, but it was required of company M, even when this kind of sup- port was not clearly specified in the ante-project of the contract. Purging -. A procedure used as part of the release of equipment is known as purging. This is a pro- cess by which waste fuel products are cleaned and their leakage into the atmosphere prevented when the equipment or the line is open. Purging can be undertaken with various products. Usually this refin- ery uses water because it is a product available in all of the units. For other products such as nitrogen the hiring of specialist subcontractors, which raises the cost of interventions, is required. According to an operator, in this refinery water is used in 99% of releases. Thus in this project, and also in this refinery, oper- ators do not check all the documentation to release each work permit, sometimes they need to ask out- sourced companies informally for some help, and they were accustomed to using water in the purging of equipment. Operators fail to comply with all the demands of the work prescribed. The several reasons given as to why operators do not have to follow all the stages of the prescribed work were summarized as follows: failures in the procedures (lack of clarity or applicability, obsolescence, contradictions between documents); time pressures (the demand on the part of shift-workers to fulfill their own tasks, the require- ments of production, the cost of renting a machine or the project deadlines); lack of resources (non- availability of a co-worker or the lack of tools or equipment). An example of the contradictions experienced by workers can be shown from employees’ narratives: “A practical example is the work permit. A person obtains a permit to do a job and then uses it to do a service for which it was not intended. It’s difficult. Serious cases happen. For example, welding with an inappropriate permit in hazardous areas“. “The main difficulties of a safety technician are that you get to the area for the release and people want to skip steps in the procedure. In the day to day routine this is difficult. The workers ask: ‘But, isn’t it possible to skip this step here?’ You suffer this pressure. Production always wants to get on with the job”. 3.3. Analysis of changes The LPG-C5+ project included the release of eight LPG spheres to implement the connections between the existing and the new system. Six spheres had already been released and the accident happened on the release of the seventh sphere. The method used to make the first six releases was investigated. Several changes occurred between them, involving individ- uals, the material and the task. The major changes made between releases are shown in Chart 2. The operator who performed the releases of the first six LPG spheres was “A”. He was known among the employees of the companies B and M as a care- ful operator and was nicknamed “Aquaman” by his colleagues because he used to finish the water purg- ing with soaking wet clothes. “A” accompanied the construction phase of the project from the beginning and was scheduled to be transferred to the office to draw up new procedures. So operator “H” joined the team and released some equipment, but only got as far as initiating the release of the seventh sphere of LPG (because it led to the accident). We inquired about the various kinds of time pres- sure: production pressures, project schedule and the operator’s own agenda. We investigated whether the “operating windows”7 or requirements of the client companies had created some time pressure relating to the releases of the LPG spheres, but this was ruled out right at the beginning according to some managers’ interviews. The project was on time as the final delivery of the project was scheduled for August 27th, 2015. During the first semester of 2014, the manager of the Transfer and Storage Area (TSA) and the Project Implementa- tion Department (PID) decided that it was possible to speed up the project and changed the deadline to July 8th, 2015. But the real expectation was brought for- ward by five months and they planned a new deadline for March 2015. To meet this new target, it was neces- sary to work on the critical path of the project, the one that included the “vital” interventions. The installa- tion of the valve on the manifold of the seventh LPG sphere was one of those interventions included in the critical path. 7The time frame according to which the equipment could be released for the intervention, so as to fulfill its production schedule. In this case, the delivery of products to customers. A U TH O R C O P Y S.L. Beltran et al. / Challenging the immediate causes at work accident investigation 625 Chart 2 Changes made between LPG spheres’ releases Changes Spheres 1–6 Sphere 7 Operator “A” “H” Outsourcing workers Technicians with experience in hazardous areas Some technicians did not have specific experience in hazardous areas, not even training in LPG risks Materials Non-use of wrench torque machine Use of wrench torque machine with electrical pump Task Spheres released with complete purging of water after 24 hours of depressurization Beginning of release without water purging and after 20 hours of depressurization. A partial purge was made later (without its reaching the sphere, however) So the decision to involve “H” in the project was not arbitrary but was taken by some of the managers. They decided that “H” should be the TSA operator to join the support team for the release of equip- ment as “A” had been transferred for the development of new procedures. “H” was widely recognized in the refinery and among some PID and TSA man- agers for his technical knowledge and his experience in the field. But they also recognized several other features of his personality which we interpret as fol- lows: “H” was one of those workers who preferred “field-work” (not bureaucratic office work) and was accustomed to working with fewer procedures and greater autonomy; he was not in the habit of thinking much about the risks involved before acting. He also received the nickname “Highlander”, as the operators call their teammates who skip safety procedures and are inclined to take risks. Further, four out of the six victims were from the outsourced company M. Some of them had no experi- ence in working in the hazardous areas of the project. When workers are not fully aware of the dangers to which they are exposed, they usually rely on the expe- rience and decisions of the operators who lead the field activities. On the material level, the main change made con- cerned the use of a torque wrench. In dealing with the first six LPG spheres the workers had used just hand tools. But given the difficulties encountered in open- ing other flanges with hand tools, “H” asked company M’s team for an electrical torque wrench. Contractor M owned the torque wrench machine but the inter- nal report did not analyse how the tool had been brought into the area. Neither company M nor the refinery undertakes the direct identification of intrin- sically safe tools (the electrical equipment that can be used in hazardous areas). And by the time of the most intense construction phase of the project, there were four satellite warehouses scattered in the project works. The central warehouse was far from the work areas and it was not possible to know if these satellites were as rigorous as the central one. Besides, some contractors said that actually it was kind of usual to use electrical machines in explosive areas, once some operator had authorized it. Finally, we analyzed two changes at the task level: the purge and the anticipated opening of the pipe. The water purging of the first six spheres reached two meters in height inside each sphere (see Fig. 5) and the pipe was opened 24 hours after depressurization had begun. We understand that if “H” had waited to complete 23 hours of depressurization or had planned a com- plete purge, the release would only had have begun after 1pm. That meant that company M’s workers would not be able to install the valve before the end of their shift (ending at 5pm), thus incurring overtime or delaying the work until the next day. Additionally, reaching the sphere with the purge would take three days instead of one. Moreover, an aspect of the analysis of the pro- duction management must be taken into account: the performance of the management of company B’s employees. This evaluation is made only by the immediate boss of each employee on each level (not only on the shop floor). At the end of the year each manager assigns a grade as an assessment of the worker’s performance. If the evaluation is positive, the employee earns a 3% wage increase the following year (in addition to the legal adjustment). Thus there is a financial reward in the hands of supervisors and managers. In the specific case of “H", he had already been awarded so much that his salary exceeded that of some of his supervisors and managers. On the other hand, for a worker who rates safety as more impor- tant than production, his chiefs can exercise public constraints. Production management analysis seems to bring a common element to light: the choice of “H” as the operator who would make the release of critical inter- ventions. This choice would on the one hand meet demands to hasten the delivery of the project and on A U TH O R C O P Y 626 S.L. Beltran et al. / Challenging the immediate causes at work accident investigation Fig. 5. Purge made in spheres 1–6 (reaching sphere). the other be due to the promotion of workers who perform faster releases – even skipping safety steps. And this aspect is a part of the organization’s culture. 3.4. Analysis of barriers In this paper we present the analysis of the absence or failure of five prevention barriers (those used to prevent the occurrence of events, an explosion in this case): the purging, the work permit process, the safety technician’s authorization, the gas alarm and the right to refuse to work. We do not know whether “H” knew that the purging was incomplete. Some workers reported that he did in fact know it, but “it was his particular way of doing things not to complete all the safety procedures”. That was why he was called “Highlander” whereas the other operator was called “Aquaman”: because, in contrast, he used to finish the water purging in soak- ing wet clothes. The hypothesis we develop as to the reasons that led him to skip these steps is given in section 3.3. Furthermore, the contractors in this team did not know about the purging procedure since they did not participate in the planning of this activity. The work permit process failed at two points. First of all, the team used an electrical torque wrench that was not supposed to be used in this area. In this project there was difficulty in recognizing at what moment contractors would be working in hazardous areas or in “new areas” (where there were no inflammable sub- stances). Most of the contractors who participated in this team were accustomed to using this machine just in new construction areas (as set out in section 3.3). The torque wrench manual warned against using the electric pump in explosive environments or in the clearing area of inflammable substances, but the man- ual was not available for them, nor had it even been translated into Portuguese. We regard the second aspect of the work per- mit process, the safety technician’s authorization, as being in itself a prevention barrier. For work in dan- gerous areas, in this case with the risk of a gas leak, it is mandatory to call a safety technician to monitor the air with a gas detector before the pipeline is opened. And it is not usual in this refinery to work in a haz- ardous area without this authorization. Nevertheless, the day before the accident, “H” caused a small propane leak (controlled locally). In the evening other operators and safety technicians from TSA discussed this incident as well as planning the release of the seventh sphere (which would be completed the fol- lowing day). They made it clear to “H” that they could not support the way in which he intended to release the line (without using water). Our interpretation is that “H” decided not to call the safety technician the next day, before starting the opening of the flange, A U TH O R C O P Y S.L. Beltran et al. / Challenging the immediate causes at work accident investigation 627 because he realized that the safety technician would not permit the release, so he (“H”) took a gas detector himself. The reasons why “H” would give priority to production aspects rather than to safety procedures are discussed in Section 5. When the gas leaked, workers heard the gas detector’s alarm, but they did not evacuate the area immediately. The gas detector sounded the alarm for four minutes and then “H” switched it off. Workers who had undertaken similar jobs before commented that even when there had been a gas leak and the gas detector’s alarm had been heard, they had continued to work as usual. They also stated that they trusted in an expert operator rather than in the measurements of any equipment and that they used the detector rather just to tick the box on the permit-to-work than as a prevention barrier. The internal rules of the company recognize the right of refusal to work. But in this company, outsourced workers cannot always use this right, according to the data collected at the CWA and in interviews. If the outsourced workers had had a bet- ter knowledge of the risks existing in the hazardous area and of the product present in the pipeline, they could have taken the decision to abandon their support of the activity or to stop work and evacuate the area as soon as the leak was detected. However, they had not received any specific training to cope with such inflammable hydrocarbons as GLP. They were not familiar with the basic characteristics of the product and knew even less about its reactions. Consequently their lack of training and / or the impossibility of using their right of refusal led them to trust the deci- sions taken by “H”. Further, workers at all levels of the organization recognized that training for out- sourced staff is ineffectual by virtue of the short-term contracts under which they are employed. Prevention barriers could have been discussed in previous meetings between those responsible for the release (TSA) and those supporting the release (com- pany M). But in this project this kind of meeting was only held for other releases after this accident. The failure of some preventive barriers has become usual within the refinery and several field workers admit- ted that production targets led to great pressure being exercised on them to skip (or get round) these barri- ers. On this project the overtime reported in the three months prior to the accident exceeded that allowed by Brazilian legislation, and this supports the hypothesis that managers had to hurry their work on the critical course of the construction project in order to meet the new deadline. 3.5. Organizational analysis 3.5.1. Historical dimension We have chosen five key moments in the history of the refinery that we relate to the safety culture: a) the beginning of the operation in the eighties when the company was still managed by the mili- tary at the end of the Brazilian dictatorship. Some older managers tend to maintain the refinery’s own autocratic style – a reflection of the former mili- tary administration - which hinders communication and any relationship with the shop-floor workers. b) The intensification of outsourcing in the nineties with the consequent weakening of the relationships between workers and their precarious working con- ditions (deterioration of the internal communication processes, an increase in the transfer of tasks of super- vision from the direct worker to outsourced workers, a high turnover of contracted personnel, a decrease in the quantity and quality of training given to out- sourced workers and a weakening of the collective representation of workers). The decrease in the num- ber of the company’s employees has increased in the present decade, when a significant number of workers began to retire or to join the company’s vol- untary dismissal plan. These dismissals have not been accompanied by a corresponding number of new hir- ings, despite the significant increase in production. Therefore, the company is facing a loss of qualifi- cation of its technical body. c) Certifications of the OSHA and ISO management systems in the 2000 s in order to accompany global trends. The procedures followed in all the company’s refineries needed to be standardized to work within the same certification classification. Each refinery had its own certification until the nineties. Employees claim that this process led to a more bureaucratic management, as one oper- ation worker describes: “It’s very bureaucratic. We’re bogged down in paper-work. There are more and more checklists (. . .) Currently people are more con- cerned with filling in the forms than performing their tasks properly”. d) The modernization and expansion of the refinery between 2005 and 2012 that brought a rapid turnover of mid-level managers and therefore a decrease in the number of shop-floor workers. As the company saw it, with the modernization of the var- ious units that began to be automated, they would no longer need so many operators. But the work- load of those operation technicians did not diminish, since, from then on, they assumed more adminis- trative and supervisory functions. e) The “pre-salt” project in this decade that is of national impor- A U TH O R C O P Y 628 S.L. Beltran et al. / Challenging the immediate causes at work accident investigation tance and is considered a priority by the company and for the refinery. At the time of the accident, the refinery needed to run the LPG park expansion project, as it would be the first of all the refiner- ies in the country to receive pre-salt products by pipeline. These historical aspects are related to the current safety culture. In the context of the technological and organizational advances in the Brazilian oil and gas sector, it is expected that operators should assume polyvalent roles [24] and attain more demanding production goals within an out-dated safety con- text. The last two moments analyzed, the expansion of the refinery and the pre-salt project, are modern initiatives that will determine the future of the orga- nization. But these moments meet and clash with the vestiges of an out-dated authoritarian style, with the adverse effects of outsourcing and a bureaucratic management at the refinery. Thus the company’s his- tory has created conditions that have degraded the safety culture and led to several accidents. These aspects are also related to the accident we analyzed. The outsourcing process and the decrease in the number of company employees in this refin- ery have been a challenge to the fieldwork: operators claim that new (outsourced) technicians working on projects do not know the units or the equipment as well as the old (company) technicians. On the other hand, there were not enough experienced operators to release the complex equipment used in this project. The OSHA certification has increased the number of documents required to release equipment, and the shop floor workers on this project claimed that many of those documents were being filled out without ful- filling all the required safety conditions, just to get the necessary permits and fulfill the tasks involved. As the company itself reported, there were inconsistencies among the documents required for releasing. Fur- thermore, the specific procedure for releasing GLP spheres is the same for all this company’s refineries, thus allowing fewer variations. Finally, the priority status of the pre-salt project could have influenced the managers in their decision to bring forward the deadline of the project, as we shall see later in the transversal dimension. 3.5.2. Vertical dimension We established three categories to develop the anal- ysis of the vertical dimension. The first relates to the shop floor level. The second level concerns the mid- dle managers (local managers of the refinery). And the highest hierarchical level is the corporate one that includes the management team that operates from headquarters. Both shop floor workers and employees with man- agement responsibilities are agreed that the company has traditional hierarchical relationships and a mul- tiplicity of procedures and is very slow to change. Several discontinuities may be found between the three hierarchical levels. One is the fact that the field work is conceived, designed and planned by the cor- porate level with little participation of shop-floor workers. Recently, the company began to integrate shop-floor workers in the elaboration of procedures. But usually outsourcing companies are not included in the elaboration of the specific procedures and risk analysis for each activity, even when their workers are the ones who actually carry out the tasks. Company B does not have a feedback mechanism by which the shop-floor workers are able to adjust the new procedures to the realities of their process units, but a system that allows only superficial mod- ifications. This is consistent with the finding in the historical dimension about the lack of procedural flexibility. Another discontinuity between hierarchical lev- els is to be seen in the conception they have of the causes of accidents. Some managers blame workers for not following the prescribed rules and recommen- dations disseminated through lessons learned. They claim that workers receive enough training and that the company invest heavily in safety. But shop-floor workers generally believe that work-related accidents take place due to the dynamics of work and the pres- sure to produce. This is why the company employees’ union had been acting as a “whistle blower” [18] denouncing specific cases where pressures resulting from production targets and project deadlines inter- fered negatively with safety practices, leading to false safety barriers. 3.5.3. Transversal dimension To analyse this dimension it was necessary to iden- tify three entities involved in the event: the group from company M, the PID and the TSA. The PID designed and managed the GLP-C5+ project and hired com- pany M to perform the EPC. The TSA is the area responsible for releasing the equipment for company M’s interventions. With the cross-sectional analysis we were faced with three major aspects: a) communications and trust between managers from PID and TSA were stronger than those among the field workers; b) those fragile relations between the field workers led to A U TH O R C O P Y S.L. Beltran et al. / Challenging the immediate causes at work accident investigation 629 Chart 3 Main barriers to the prevention of the accident Type of barriers Absent Failing Training Contractors without safety training in handling inflammable and combustible materials Methodological failures in other areas of training Documentary Torque wrench manual not translated into Portuguese Risk control documents prepared by different people. No interdisciplinarity and poor specificity Planning No previous meeting between worker responsible for releasing and supporting team Gas monitoring Safety technician was not called Gas detector shutdown on occasion of alarm the formation of ad hoc working groups on a daily basis; c) the lack of definition of the number of TSA operators that would be required to release the equipment from the first phase of the project. We can point to that decision as one of the compo- nents of the incubation period of the accident [2], as this decision was taken by managers later and more rapidly. Thus, through the organizational analysis of the event we were able to detect some factors which con- tributed to the deterioration of safety precautions and events that would turn out to be the underlying causes of the accident. A summary of the organizational event analysis will be presented in Chart 5. 4. Internal investigation methods We analyzed some aspects of the internal inves- tigation conducted by the company such as the composition of the board, the causes stated and the final recommendations. The board had 10 members but a low representation of shop-floor workers (three), and a high proportion of managers (seven), and no representative of com- pany M. None of the board members was an expert in human factors or had any training in organizational approaches. The board held less than 10 interviews, reviewed nine internal procedures and some technical reports. They did not analyse any prior similar incidents or accidents. They used the STEP8 technique to draw a time line that began in July 2014 when the PID planned interventions in the LPG spheres. Then the timeline jumped to September 9th, two days before the accident. There was no mention of any event previous to those dates anywhere in the report. The board described only the technical training of the victims but they did not discuss the effectiveness 8Sequentially Timed Events Plotting. or the scope of the training given. The board described the nine standards of company B which had been breached. But there was no questioning relating to or deep analysis of the possible reasons that led to those breaches. Then the board used a check list to identify the failures and finally a Tree Causes Analysis (TCA) separating immediate from basic and contributory causes. The report refers to basic causes in such a way as to suggest that there was what seems to have been a repetition of failures by using almost the same words (see Fig. 6, we use boxes and arrows to indicate possible associations made by the board members). The stated causes emphasize the origins behind aspects of the behavior of those involved that should clearly be taken as starting points and not endpoints of the analysis. No discussion of human and organi- zational factors appears in the report though they did write “we identified no other relevant factors”. The report presented four recommendations focused on reviewing and enhancing the use of proce- dures, and verifying that the standards would not be violated again. Nor were any changes at the admin- istrative level or in organizational culture suggested. Further to compliance with the documentary part, workers in the LPG-C5+ project observed other changes after the accident: new planning meetings, increased presence of operators in field activities, more gas monitors in the area and a new escape route from the manifold. None of those changes appeared as part of the analysis or as recommendations on the internal report. Thus company B is losing a valu- able opportunity to acquaint business units with these details and to program more effective controls on their projects. The National Oil, Gas and Biofuels Agency (Agência Nacional do Petróleo, Gás Natural e Biocombustı́veis, henceforth ANP) is one of the con- trolling agencies that intervene when an event occurs. Company B normally submit all their final accident A U TH O R C O P Y 630 S.L. Beltran et al. / Challenging the immediate causes at work accident investigation Chart 4 Summary of MAPA components Component Description Brief description of the accident During the removal of a 14 “ flange, a gas leak occurred that, in contact with a spark, caused an explosion. The fire killed the worker responsible for the task and wounded five others. Usual work and variations The release of equipment and lines for intervention includes planning stages (meetings, preparation of risk analysis, work permits and other documents) and the release stage itself in the field (application of isolation procedure and additional safety recommendations). Usually operators did not fulfill all the provisions set out in these steps because of the small team, lack of tools, time pressure or contradictions between the prescribed tasks, among other causes. Operators use individual and collective strategies to deal with these situations, including: prioritizing activities, requesting peer support, refusing to do a task, interpreting procedures individually, borrowing tools from colleagues or contractors. In the specific location of the accident there are three flanges. The floor of the installed scaffolding was irregular and there was no direct access to the street. Variations: Secondary tasks that may interact or interfere with the main tasks. Great number of risk analyses or work permits in maintenance shutdowns and modernization or expansion projects. Number of activities with higher risk requiring special attention. Non-availability of technical resources because they are occupied or defective Non-availability of human resources as support for the releases Need to use tools that were not foreseen in the planning of the activity. Changes in planning meetings (frequency, participants, etc.) Analysis of changes Individual: the leading operator of the releasing was changed. Lack of safety technician. Some contracted workers had no experience in hazardous areas. Tools: torque wrench with an electric pump used instead of the hand tools used in previous releases. Task: the pipeline was opened three hours before completing total depressurization and the release started without water purging. Subsequently incomplete purging was performed. Organizational: detailed in organizational analysis. Analysis of barriers Preventive barriers. a) Documentary: documents containing risk analysis and line insulation measures were prepared more than a year prior to the task’s performance. Torque wrench safety recommendations were not available in the field or in Portuguese. b) Training: courses for contracted workers contain methodological failures, contracted workers had no training in working in hazardous areas. c) Equipment: turning off the multi-gas and lack of training, with the customary character of working without it and with low valuation of alarms. d) Planning: lack of meetings of the parties responsible for the release (TSA) and the support (Company M) to discuss the technical details of the release. Conceptual expansion Overly standardized safety culture. Explanation of accidents at work by managers using the concept of “Brazilian sleight of hand". Predictable fraud barriers. Concluding summary The accident had its origin in the interaction of social and organizational factors, among them being: excessively standardized culture, management tools and outcome indicators that give a false sense of safety, the decision to speed up the project, the change of operator to facilitate this outcome and performance management that encourages getting round the usual barriers. Chart 5 Summary of the organizational event analysis Dimension Summary analysis Historical The expansion of the refinery and the subsalt project are modern initiatives that will determine the future of company B, but they meet and clash with the vestiges of an old authoritarian style, resulting in precarious work by outsourced services, the reduction of human resources and a bureaucratic management. Vertical Workers of company B were classed in three groups: the shop floor, refinery managers and corporate. Communications within the organization are slow, with little participation from the shop floor, some discontinuities, but the three hierarchical levels hold some views in common. Performance management gives managers too much power and weakens the collective spirit. Transversal Communications and trust between managers and between field workers of the three entities are patchy; fragile relations between field workers lead to the formation of ad hoc working groups; the lack of definition of the number of operators assigned to the project in the planning phase led to a hasty decision without adequate management of change. A U TH O R C O P Y S.L. Beltran et al. / Challenging the immediate causes at work accident investigation 631 Fig. 6. Failures and basic causes according to internal investigation. reports to ANP and they accepted its internal investi- gation into this accident without any comment as to causes. We argue that the internal investigation just indi- cated basic (visible) causes, while this research analysis indicates organizational (invisible) causes (See Fig. 7). In this company, the bias of blame seems to accept improper attitudes and operational discipline as underlying causes. In addition, two other categories “Inadequacy of the risk assess- ment” and “Failure in planning and risk analysis” were adopted based on the immediate results rather than on any actual exploration of each of these processes. 5. Discussion: An accident that began in the office So far we have indicated that “H” was in a hurry to carry out the release: he started without water purg- ing, he did not wait for the full line depressurization, then he conducted an incomplete purge, he did not call the safety technician to monitor the atmosphere, he improvised with a team of inexperienced helpers and a non-explosion proof torque wrench, he switched off the gas detector, he insisted on continuing to open the flange during the gas leak... but did the operator who was already known as a proficient worker have only individual motives for skipping all those safety steps? What is it that leads an operator to skip procedural steps and speed up a critical job like that? Some workers suggest that these facts are not fortuitous, but result from arbitrary decisions taken within the company. There are several operators also called ‘highlanders’ who skip safety rules and assigned work permits in order to prioritize produc- tion or project goals. On the other hand, there are some operators and safety technicians who take the rules word by word and delay the fulfilment of the same goals. Some of company B’s managers prefer those who facilitate the progress of the work and not safety. There was neither a bonus nor any other finan- cial award for advancing this project. But the success of this project including the fulfilment of its dead- lines would definitely be a very important factor in company M’s winning new bids and for company B’s managers getting better results in their perfor- mance evaluation. So both managers and operator would indirectly benefit from the speeding up of this project. A U TH O R C O P Y 632 S.L. Beltran et al. / Challenging the immediate causes at work accident investigation Fig. 7. Iceberg of basic and organizational causes. Almost all managers believe that the persistence of serious accidents is because of the “Brazilian way (of doing things)” or the “local culture” while some managers ask subordinates to “find a short cut” to complete the tasks. Managers consider it to be nor- mal for Brazilian workers to skip procedures or get round rules to make things happen more quickly. And some of them even consider that this problem has no solution, and that the company can do nothing to change this culture. But Daniellou et al. [25] argue that “working presumes the need to prioritize poten- tially conflicting prescriptions”. It means that given these contradictions, workers circumvent the rules so that tasks can be finished more quickly. The company’s culture encourages the carrying out of activities and even accepts the breaching of rules when supervisors ask for or approve of field work- ers “finding a quicker way” or seeking solutions to complete tasks. Then if the activity is successful the supervisor gives his worker a satisfactory evaluation. But if the activity ends in an accident, managers indi- vidualize responsibility refusing to recognize their contribution to the causes of such events. In other words, managers’ behavior conveys to employees that the most important value for the system is production. Companies in which employees repeatedly assume risks are described as organizations with a process of safety degradation that ends in unexpected events [2, 25]. This situation is far from being visible because of a lack of rules, but the excess of them, the lack of good examples, inconsistency between predicated and implemented work, and the real prior- ity’s being to achieve production goals no matter how. In this kind of situation the rules seems to be “alibi rules”. This company ostensibly promotes safety attitudes at the same time as it is pressing for the fulfilment of deadlines and production targets. It is totally contra- dictory that a company should preach that production and safety are equal values, if these are not practiced. This not only creates confusion and stress in every decision taken by workers but also leads to a lack of credibility of the values proclaimed by the company [25]. The reduction in the operators’ head-count arises from budget cuts that have been being implemented at the refinery since the nineties. Not only are there fewer operators in each unit, there are also fewer operators to support each project. Further, the short duration of contracts with maintenance contractors also leads to the deterioration of employees’ working A U TH O R C O P Y S.L. Beltran et al. / Challenging the immediate causes at work accident investigation 633 conditions. Less specific training, less time in each company, loss of skilled personnel and overtime that is not paid are some of the consequences of the high turnover among contractors [11, 26]. In addition, safety training in company B is based on theoretical and ideal situations of interventions instead of real situations that involve variations and contingencies. To discuss a real situation, work- ers could confront videos or photos that reflect their activities in order to analyze the risk, look at experiences and discuss the environmental con- ditions, the difficulties and the safety strategies used [27]. Company B does not take the knowledge and expe- rience of contractors who have worked there for many years into consideration. Thus, the company loses the opportunity to debate risky situations and antic- ipate them to elaborate procedures in accordance with reality and therefore with a greater possibility of satisfactory execution. In fact, company loses the opportunity of constructing a collective experience that aims the development of an integrated safety culture [28]. Company B is exceptional in the number and size of procedures for each specific task awaiting exe- cution. But, as described by Guerin, every task is different from every other, and variation in work is common [17]. Prescribed work is not the usual work and workers adopt strategies to cope with those changes, resulting in a wide variety of practices. The company adopts strategic action involving a discourse which would indicate a supposed safety culture. But the actual safety is characterized by excessive regulation, which draws attention to the procedures involved. A safety policy must express itself in a safety culture, understood as a set of prac- tices adopted by the community concerned. Safety culture progressed from being based on a shop-floor culture, to being more highly regulated [25]. In the specific case of this company, the safety culture is heavily tilted towards an excess of standards. There is also a strong belief within the company that if something is actually written down, that is sufficient guarantee that it will be carried out. The Safety Management System (SMS) of com- pany B focuses too closely on ‘behavioral safety’, adopting the Dupont safety program, which has been criticized and was highlighted recently because of the chemical disaster in La Porte, Texas (November 2014). And as the Chemical Safety Board pointed out in its BP Texas Refinery report (March 2005), this behavior-based program did not typically examine safety systems, management activities, or any pro- cess of safety-related activities [9]. According to the National Council for Occupational Safety and Health (COSH) in the US [29]: By focusing on individual action instead of engineering and process controls, experts say, DuPont’s approach: a) Blames workers for their own workplace injuries and illnesses. b) Dis- courages reporting of workplace incidents. c) Increases the risk of workplace hazards – because unreported incidents cannot be investigated to determine causes or steps for future prevention. Company B performs rapid and superficial analy- ses when investigating accidents. The causal method used by this company are criticized by many authors because of its limitations in taking into account inter- actions between events, temporal dependencies and non-causal relations between events. In other words, these methods are insufficient to reveal the organi- zational factors lying behind the occurrence and/or development of an accident [30]. Investigations should mobilize more complex and sophisticated scientific theories and notions, in particular of a non- linear nature [13]. Neither external experts nor contractors’ represen- tatives are invited to participate in the investigation board. For us this points to a limitation of the analysis and an inability to see the accident from indepen- dent angles [2]. In the Norwegian petroleum industry, depending on the complexity and/or seriousness of cases, a decision may be taken to carry out an indepen- dent investigation. This decision will be influenced by an evaluation of the potential damage caused by the accident, as well as the potential learning effects [15]. Company B’s board stopped their analysis when they concluded that there had been human error and they did not explore any possible organizational causes. When they arrived at the conclusion that improvisation and failure to follow procedures were the causes of the accident this led them to ignore the existence of workers’ strategies adopted to adapt to changes in the job. Limiting the conclusions and rec- ommendations at the level of the employee reflects a tendency to blame the victim [31]. This practice limits the scope of corrective actions [32]. If Com- pany B’s representatives on the investigation board considered organizational aspects, they did so only informally, because many of these causes are consid- ered too confidential to be adequately disclosed. And as for the role of government agencies, we analyse the ANP’s role. ANP is a control organism A U TH O R C O P Y 634 S.L. Beltran et al. / Challenging the immediate causes at work accident investigation for both production and safety aspects. ANP does not undertake independent investigations and its role as a reviewer of internal investigations is questionable as the agency also takes care of production questions. One of the most powerful recommendations of the Cullen Report on the Piper Alpha disaster relates to this issue. The control of safety aspects of the plat- forms was transferred from the agency that regulates oil production aspects (Department of Energy) to the agency that controls only safety aspects (Health and Safety Executive or HSE) [33]. It is similar in Norway where The Norwegian Petroleum Safety Authority (PSA) is responsible for the supervision of safety pro- cedures in offshore petroleum activities. In addition, the PSA investigates serious accidents/incidents on its own initiative [15]. Fajer and Fischer [34] studied Brazilian air accident investigations and pointed out that agencies in that sector “have a close relationship with the government, and due to such subordination it is possible there are influences on the results” relat- ing to contributory factors, especially organizational aspects. For us, this is similar to what is happen- ing with the double role of ANP (safety control vs. production control). In the region where this accident happened, the control agencies do not work together and commu- nication between them is poor. That leads to the expenditure of greater effort with poor results and it contributes to another POF: weak policy action. Company B is not taking advantage of its investi- gation as an opportunity for organizational learning. As seen in the two BP accidents, Texas Refinery and Deepwater Horizon, five years apart, the company repeated the same mistakes in the internal analysis of the second event [10]. As Figueiredo asserted, if a company does not take accident investigation as a good opportunity for organizational learning, members of the organization will have forgotten lessons rather than learning them [11]. Not only are the victims of an accident - but also the com- pany’s other employees – capable of understanding the organizational aspects lying behind the event. If shop floor workers perceive that no actions are taken to correct those aspects, they will stop believing in investigations and pay no more attention to the rec- ommendations made. Accidents are usually investigated by just analysing the event itself, but it is essential that researchers should stand back from it and scrutinize all aspects of the organization, the factors that facil- itate the emergence not only of this but also of other events. This is why we could not discuss this accident in isolation without looking at other organizational details. 6. Conclusions and recommendations This accident rested on a network of organizational factors and had an incubation period. The internal investigation presented a time line starting just two months before the event. We analyzed aspects of organizational culture to understand how the acci- dent had been being constructed over many previous years. We reveal factors through the organizational approach that the internal investigation with its behavioral approach had ignored. The perpetuity of the type of approach used in company B’s internal investigations does not lead to the prevention of fur- ther accidents. The organization believes that it is controlling the risks through corrective actions when actually they are in a reactive and non-anticipatory position. They are in fact reinforcing the same rules or creating new procedures with little participation on the part of field workers. A weak safety policy and a strong normatized policy where employees are not actually heard, just creates a situation of fatigue, disbelief and disrespect for the rules and procedures. This degraded safety mode only leads to the occurrence of new accidents. The managers of this organization generally believe that their SMS and OSHA certification make for safer field activities. This attitude only leads to the belief that the company is self-sufficient. Instead, according to our analysis, their SMS will not in fact make their activities safer, but only demonstrates that the company is doing no more than fulfilling all the requirements for industrial safety required by the let- ter of the law. Companies should invite contractors to participate in the elaboration of technical and safety procedures and risk analysis. These analyses should be interdis- ciplinary and should certainly involve one or more of those who are involved in the performance of the tasks concerned. In the analysis of an accident the organizational aspects could be as important as the technical ones. The technical explanation is important as providing the strings that must be followed through to arrive at the practical situations and as a source of reflection on specific preventive measures. The technical aspects are a starting point, though if only they are considered no organizational analysis is in fact undertaken. A U TH O R C O P Y S.L. Beltran et al. / Challenging the immediate causes at work accident investigation 635 We strongly recommend that accident investiga- tions consider the following aspects: budget cuts, reduction of the number of employees, unions’ or employees’ (whistle blowers’) warnings, underlying causes for not following the recommended proce- dures, interference of production targets or deadlines, similar prior incidents, and other aspects that might arise from further analyses. The ergonomics of the activity as understood by means of the oper- ators’ know-how contributes to the understanding of organizational causes. It helps broaden the view of experts in classical disciplines such as Safety and Occupational Health, who see risk as a mode external to work and isolated from the activity itself [35]. In a case like this where there are seriously injured victims, the company should invite a specialist in human and organizational factors, preferably exter- nal to the company, to be part of the investigation board. Control agencies should fulfill an interdisciplinary function. Permanent investigation entities (such as investigation boards) should be formed within the company and by the government also. Accident inves- tigation can become a dangerous organizational tool when all its diagnostic and analytical potential is not made full use of. This study has addressed only the diagnosis of an accident, so we would like to point out that we did not interfere in the process of work of this company to get the organizational changes necessary to prevent new unexpected results such an accident. It is necessary to change the approach, deepening every detail of the investigation and assuming a posi- tion of self-criticism. It is essential to look back to past accidents, learn from them and implement systems that can avoid repeating them. Acknowledgments This study was undertaken as part of a Research Project supported by Fundação de Amparo a Pesquisa do Estado de São Paulo (FAPESP). We must also thank the Labour Attorney’s Office of the Public Ministry of Labour for their support in the collection of data. The leading author was a student of the Programa Estudantes-Convênio de Pós-Graduação (PEC-PG) and held a scholarship from the Conselho Nacional do Desenvolvimento Cientı́fico e Tecnológico (CNPq) of Brazil. Conflict of interest None to report. References [1] ILO. Safety in numbers. Pointers for a global safety culture at work. Ginebra: International Labour Office; 2003, p. 27. [2] Stoop J, Dien Y, Dechy N, Tulonen T. Past and future in accident prevention and learning: Single Case or Big Data? Safety and reliability enhancement throughout Europe: Looking back, looking ahead. ESReDA 50th Seminar; Sevilla, Spain: European Safety, Realiability & Data Asso- ciation; 2016. [3] IOGP. Safety Performance Indicators - 2016 data. London: International Association of Oil and Gas Producers; 2017. [4] MTPS, DATAPREV. Anuário Estatı́stico de Acidentes do Trabalho AEAT 2014. Brasilia: INSS MTPS DATAPREV; 2014. [5] MTPS, DATAPREV. Anuário Estatı́stico de Acidentes do Trabalho AEAT 2103. Brasilia: INSSA MTPS DATAPREV; 2013. [6] FUP. Óbitos por acidentes de trabalho tı́picos nas unidades do sistema Petrobrás. Rio de Janeiro: FUP; 2013. [7] Sindipetro-SJC. Acidentes de trabalho. Tocha. 2008:1. [8] Jeffrey K. Review: Lord Cullen - What have we learned from Piper Alpha? Finding Petroleum [Internet]. 2013. Available from: http://www.findingpetroleum.com/n/Review Lord Cullen what have we learned from Piper Alpha/044b511 3.aspx. [9] CSB. Refinery, Explosion and Fire. BP Texas City. Final Investigation Report. Washington: US Chemical Safety and Hazard Investigation Board; 2007. [10] Graham B, Reilly WK, Beinecke F, Boesch DF, Garcia TD, Murray CA, et al. Deep Water. The Golf Oil Disaster and the Future of Offshore Drilling. Washington: National Commis- sion on the BP Deepwater Horizon Oil Spill and Offshore Drilling; 2011. [11] Figuereido M. A face oculta do ouro negro. trabalho, saúde e segurança na indústria petrolı́fera offshore da Bacia de Campos. Niteroi: Editora da UFF; 2012. [12] Dien Y, Dechy N, Guillaume E. Accident investigation: From searching direct causes to finding in-depth causes – Problem of analysis or/and of analyst? Safety Science. 2012;50(6):1398-407. [13] Stoop JD, Sidney. Are safety investigations pro-active? Safety Science. 2012;50(6):1422-30. [14] Dien Y, Dechy N, Stoop J. Perspectives regarding industrial events investigation. Safety Science. 2012;50(6):1377-9. [15] Okstad E, Jersin E, Tinmannsvik RK. Accident inves- tigation in the Norwegian petroleum industry–Common features and future challenges. Safety Science. 2012;50(6): 1408-14. [16] Ferreira LL. Análise coletiva do trabalho: Quer ver? Escuta. Revista Ciências do Trabalho. 2015;4:125-37. [17] Guérin F, Laville A, Daniellou F, Duraffourg J, Kerguelen A. Compreender o trabalho para transforma-lo: A prática da ergonomia. 2 ed. São Paulo: Blucher; 2004. [18] Llory M, Montmayeul R. L’accident et l’organisation: Ed. Préventique; 2010. [19] Almeida IM, Vilela RAG, Silva AJN, Beltran SL. Modelo de Análise e Prevenção de Acidentes - MAPA: Ferramenta http://www.findingpetroleum.com/n/Review_Lord_Cullen_what_have_we_learned_from_Piper_Alpha/044b5113.aspx http://www.findingpetroleum.com/n/Review_Lord_Cullen_what_have_we_learned_from_Piper_Alpha/044b5113.aspx http://www.findingpetroleum.com/n/Review_Lord_Cullen_what_have_we_learned_from_Piper_Alpha/044b5113.aspx A U TH O R C O P Y 636 S.L. Beltran et al. / Challenging the immediate causes at work accident investigation para a vigilância em Saúde do trabalhador. Ciência & Saúde Coletiva. 2014;19:4679-88. [20] Llory M. Accidents industriels: Le coût du silence. Opérateurs privés de parole et cadres introuvables. Paris: L’Harmattan; 1996. [21] Hollnagel E. Safety-I and Safety-II. The past and future of safety management. Farnham: Ashgate; 2014. [22] Jackson-Filho J, Fonseca E, Lima F, Duarte F. Orga- nizational factors related to occupational accidents in construction. Work. 2012;41:4130-6. [23] Prottesa VM, Oliveira NC, Andrade ABO. Ergonomic work analysis as a tool of prevention for the occupational safety and health management system. Work. 2012;41:3301-7. [24] Alvarez D, Figueiredo M. “Meetings on the work": An analysis device for understanding the articulation between outsourcing and organizational innovations. Work. 2012;41:4590-7. [25] Daniellou F, Simard M, Boissières I. Human and organiza- tional factors of safety: State of art. Toulouse: Foundation for an Industrial Safety Culture (FonCSI); 2011. [26] Ferreira LL. Dois estudos sobre o trabalho dos petroleiros. Production. 1996;6(1):07-32. [27] Rocha R, Figueiredo V, Baptista AK. Knowledge manage- ment for counterbalancing the process of loss of skills at work. In: Arezes PMFM, Carvalho PVR. Ergonomics and Human Factors in Safety Management. Industrial and Sys- tems Engineering Series. Boca Raton: CRC Press 2016, pp. 207-30. [28] Rocha R, Mollo V, Daniellou F. Work debate spaces: A tool for developing a participatory safety management. Applied Ergonomics. 2015;46:107-14. [29] Coshnet. Chemical Disaster in La Porte, Texas US: National Council of Occupational Safety and Health; November 2014 [Available from: http://www.coshnetwork. org/backgrounder-chemical-disaster-la-porte-texas. [30] Dien Y, Llory M, Montmayeul R. Organisational accidents investigation methodology and lessons learned. Journal of Hazardous Materials. 2004;111(1–3):147-53. [31] Vilela RAG, Iguti AM, Almeida IM. Culpa da vı́tima: Um modelo para perpetuar a impunidade nos acidentes do tra- balho. Cadernos de Saúde Pública. 2004;20:570-9. [32] Almeida IM. Trajetória da análise de acidentes: O paradigma tradicional e os primórdios da ampliação da análise. Interface - Comunicação, Saúde, Educação. 2006;10(19):185-202. [33] Lilley S. The case for safety. The North Sea Piper Alpha Disaster. Cleveland: Nasa Safety Center; 2013. [34] Fajer M, Fischer FM. Air accident investigation among reg- ulatory agencies. Work. 2012;41:175-7. [35] Vilela RAG, Almeida IM, Mendes RWB. Da vigilância para prevenção de acidentes de trabalho: Contribuição da ergonomia da atividade. Ciência & Saúde Coletiva. 2012;17:2817-30. View publication statsView publication stats http://www.coshnetwork.org/backgrounder-chemical-disaster-la-porte-texas http://www.coshnetwork.org/backgrounder-chemical-disaster-la-porte-texas https://www.researchgate.net/publication/324881404