1

PETRONAS TECHNICAL STANDARDS

HEALTH, SAFETY AND ENVIRONMENT

TRIPOD-DELTA – THE INVESTIGATION TOOL

(GUIDELINE)

PTS 60.0502

JUNE 2006
Rev 1

PTS 60.0502
JUNE 2006
 2

PREFACE

PETRONAS Technical Standards (PTS) publications reflect the views, at the time of publication, of
PETRONAS OPUs/Divisions.

They are based on the experience acquired during the involvement with the design, construction, operation and
maintenance of processing units and facilities. Where appropriate they are based on, or reference is made to,
national and international standards and codes of practice.

The objective is to set the recommended standard for good technical practice to be applied by PETRONAS'
OPUs in oil and gas production facilities, refineries, gas processing plants, chemical plants, marketing facilities
or any other such facility, and thereby to achieve maximum technical and economic benefit from
standardisation.

The information set forth in these publications is provided to users for their consideration and decision to
implement. This is of particular importance where PTS may not cover every requirement or diversity of
condition at each locality. The system of PTS is expected to be sufficiently flexible to allow individual
operating units to adapt the information set forth in PTS to their own environment and requirements.

When Contractors or Manufacturers/Suppliers use PTS they shall be solely responsible for the quality of work
and the attainment of the required design and engineering standards. In particular, for those requirements not
specifically covered, the Principal will expect them to follow those design and engineering practices which will
achieve the same level of integrity as reflected in the PTS. If in doubt, the Contractor or Manufacturer/Supplier
shall, without detracting from his own responsibility, consult the Principal or its technical advisor.

The right to use PTS rests with three categories of users:

1) PETRONAS and its affiliates.

2) Other parties who are authorised to use PTS subject to appropriate contractual
arrangements.

3) Contractors/subcontractors and Manufacturers/Suppliers under a contract with users referred

to under 1) and 2) which requires that tenders for projects, materials supplied or generally
work performed on behalf of the said users comply with the relevant standards.

Subject to any particular terms and conditions as may be set forth in specific agreements with users,
PETRONAS disclaims any liability of whatsoever nature for any damage (including injury or death) suffered
by any company or person whomsoever as a result of or in connection with the use, application or
implementation of any PTS, combination of PTS or any part thereof. The benefit of this disclaimer shall inure
in all respects to PETRONAS and/or any company affiliated to PETRONAS that may issue PTS or require the
use of PTS.

Without prejudice to any specific terms in respect of confidentiality under relevant contractual arrangements,
PTS shall not, without the prior written consent of PETRONAS, be disclosed by users to any company or
person whomsoever and the PTS shall be used exclusively for the purpose they have been provided to the user.
They shall be returned after use, including any copies which shall only be made by users with the express prior
written consent of PETRONAS. The copyright of PTS vests in PETRONAS. Users shall arrange for PTS to be
held in safe custody and PETRONAS may at any time require information satisfactory to PETRONAS in order
to ascertain how users implement this requirement.

PTS 60.0502
JUNE 2006
 3

HSE MANUAL AMENDMENT RECORD SHEET

Chapte Section Description Issue Date Rev Date App’d by:

r No. No. No. (initial)
No.
All All Tripod-Delta–the 1 June 0 IGA
Prediction tool 05

Chapte Section Description Issue Date Rev Date App’d by:

r No. No. No. (initial)
No.
All All Tripod-Delta–the 2 June 1 June IGA
investigation tool 06 06

PTS 60.0502
JUNE 2006
 4

CONTENTS
Introduction 5
1 Management Overview 6
1.1 Incidents: Setting the Scene 7
1.1.1 Why incidents occur 7
1.1.2 Addressing the problem 7
1.2 Tripod: The Theory 8
1.2.1 Background 8
1.2.2 Tripod accident causation model 9
1.2.3 Active Failures (Unsafe acts and Technical failures) 9
1.2.4 Preconditions 9
1.2.5 Latent failures 10
1.2.6 Controls and System Defences 11
1.3 Tripod Applications 11
1.3.1 Tripod-DELTA: Pro-active diagnosis of
level of control Applications 11
1.3.2 Tripod-BETA: Analysis during Incident Investigation 12
1.3.3 The Benefits of Tripod 12
1.4 Tripod-DELTA: The Mechanism 11
1.4.1 Introduction 13
1.4.2 Indicator Questions 14
1.4.3 Prior to implementation 16
1.4.4 Implementation 17
1.5 Running Tripod-DELTA Surveys 17
1.6 Tripod Benefits and Best Practice 20
1.6.1 The benefits of DELTA 20
1.6.2 Three Case studies 22
2 Tripod-DELTA Surveys: Do's and Don'ts 27
3 Generating Actions 27
3.1 Action generation process 27
3.2 Action generation process pitfalls and countermeasures 31
3.3 Brainstorming techniques 33
3.4 Action close out and feedback 35
APPENDICES
I BRF Definitions
III BRFs and features
IV Remedial Action Worksheet - Worked Example

GLOSSARY 58
GLOSSARY OF ABBREVIATIONS 66

PTS 60.0502
JUNE 2006
 5

INTRODUCTION

Tripod-DELTA is a diagnostic tool for incident prevention based on the Tripod Theory of
accident causation. Questionnaires extracted from a pre-established database of indicator
questions are completed by site representatives. Answers to the questionnaires are
summarised as a profile showing the relative 'health' of the HSE management of an
operational unit in 11 separate areas.

This document is presented in three ‘stand alone’ chapters each aimed at a specific
readership. For this reason, some duplication between chapters is inevitable.

Chapter 1 summarises the underlying Tripod Theory and defines the 11 Basic Risk Factors
(BRFs). An overview is given of the profiling mechanism, resources involved and the
benefits of the application.

Chapter 2 addresses the organisational requirements for initial implementation of Tripod-

DELTA in an area of operations - planning , training, resources and communications - and
the procedure for customising a generic database.

The purpose of Chapter 3 is to provide guidance to team leaders and participants running
Tripod-DELTA Surveys. Human error and the Tripod Theory are discussed, a Tripod-
DELTA Survey is described and guidance is given on interpretation of profiles and the
process of generating an action plan to address the underlying causes.

For a full overview of the history and TRIPOD concepts, an CD Rom can be optioned from
the TRIPOD Foundation

PTS 60.0502
JUNE 2006
 6

1 MANAGEMENT OVERVIEW

This chapter offers a concise overview of Tripod-DELTA (Diagnostic EvaLuation

Tool for Accident Prevention) directed primarily at senior management.

The best way for an organisation to deal with incidents (in this document the term
incident encompasses dangerous occurrences, near misses and all recordable
incidents and accidents) is to prevent them from ever happening. Incidents cost time,
money and sometimes even lives. By devoting resources to prevention an
organisation can optimise the business instead of being side-tracked into dealing with
the consequences of incidents.

DELTA is a proactive safety tool aimed at incident prevention. It has been

specifically designed for operations where remedial information used to improve
safety is scarce because of reduced incident frequency or to set a base line in new
companies.

DELTA works as a self diagnostic tool which, once implemented, has been
developed to run in companies by line personnel with minimum effort but maximum
effectiveness. Organisations with a high incident frequency will benefit also from
Tripod-BETA, the retrospective application of Tripod, dealing with incident analysis.

The programme is not a replacement for other safety initiatives, but works in
conjunction with HSE Management Systems and Health Safety Environment (HSE)
Cases, supported under the HSE MS Guidelines.

The main benefits of DELTA are summarised as:

• examines the organisation as a whole and not just safety in isolation

• feedback on potential incident causes before incident occurrence

• prioritisation of action to prevent incidents, targeting resources where they are

most needed

• a low maintenance system coupled with a high quality deliverable

• exposes latent failures not normally addressed by traditional safety tools

• self diagnostic run by the line with assistance from the HSE department/focal
point

• continual improvement through regular Tripod-DELTA Surveys

• profiling can be conducted at any time therefore avoiding peak work periods

• dissemination of improvements to multiple sites.

PTS 60.0502
JUNE 2006
 7

1.1 INCIDENTS: SETTING THE SCENE

1.1.1 Why incidents occur

In recent years most organisations have implemented comprehensive safety

measures. Initiatives such Unsafe Act Auditing (UAA), STEP change in safety,
SMAT and STOP have contributed to a fall in reportable incidents. However, almost
no organisation has reached a consistently flawless level of operations. This is
because no matter how well an operation is run, error producing factors will always
exist. Such factors include time pressure, continual operational changes in a dynamic
environment and the fact that over time, known risks are underestimated and
procedures are violated.

Although these factors may continue to trigger incidents, their end result can be
controlled to a certain degree. If the organisation is working safely and efficiently the
potential of incidents arising from such factors will be reduced. High quality
operations are more adept at dealing with crises than organisations pushed beyond
their limit. In poor quality operations a small crisis is often the straw that breaks the
donkeys back, and something that started out as relatively insignificant becomes a
full scale disaster.

1.1.2 Addressing the problem

Error-producing factors can result in either technical failure or human errors. Over
the years much work has been done to improve the technical aspects of operations.
As technology has progressed, machinery and equipment have become more reliable
and safer to operate.

Very little, however, has been done with regard to failures of a human nature. If
anything, human error has been used as a scapegoat when no other causes for an
incident could be identified.

Research has confirmed that humans will always commit errors and violations. This
does not mean that all humans commit the same types of errors. Inexperienced
people, for instance, tend to make slips or lapses, e.g. fumbled gear change, exiting a
motorway one junction too early or late. Highly experienced people, on the other
hand, are more likely to commit violations. Violations are deliberate deviations from
a planned action sequence. They are often caused by a persons superior
understanding of an operation. It is therefore impossible to label a particular type of
individual as prone to making errors. Often, the best personnel make the worst
mistakes.

Tripod is a system that addresses human error. It reveals where human errors stem
from and attempts to minimise its consequences.

Tripod-DELTA addresses the latent failures that are behind active failures, most of
which are caused by human error. It reveals the factors that increase the likelihood of
human errors so that they can be addressed.

PTS 60.0502
JUNE 2006
 8

1.2 TRIPOD: THE THEORY

1.2.1 Background

The Tripod theory recognises 11 determinants, which are critical to the level of
control in an organisation. These determinants are called Basic Risk Factors (BRFs).
When insufficiently controlled, these BRFs act as Latent Failures in a system and are,
in the background, responsible for disruption of the intended business processes.
These disruptions may become visible as incidents and accidents. The level of
control of these BRFs is indicative for the quality of the management of all
business/production processes in different types of organisations (Figure 1).

D
DFF D
DEE B R F s:
OR HW DE De si gn
HW Ha rd war e
MM M ain ten an ce M an ag emen t
IG HK Ho u sekeep ing
H U MA N M
MMM EC Er ro r En fo rci n g Co n di tion s
BE IN G
EIN PR Pr oce du re s
TR T rain in g
CO H
HKK CO Co m m un i catio n
IG Inco m p atib le Go als
T
TRR EC OR Or gan iza tio n
DF De fen ces
PR

Figure 1 Basic Risk Factors

The Tripod theory has served as basic concept for a method to measure the
performance (read: level of control on processes) of an organisation. This method is
called Tripod-DELTA Survey and is designed to detect weak areas in the
environment in which people are operating. The survey uses questionnaires to collect
data relating to factual verifiable operational experiences.

In order to adapt the survey to the practical requirements of the end users, the relative
abstract BRFs are each subdivided into 4 aspects (Drivers, Resources, Methods and
Output). Each individual aspect is addressing a specific organisational level
responsible for the quality of the aspect concerned (Figure 2).

Management Supervision Operatives

RESO URCE S
TI ME, MO N EY, PEOPLE, MATERI AL S

DR IVER S O UPU T
STA ND ARD S, POLI CI ES WO RKI N G EN VI RO NMEN T

MET HOD S
PLAN S, COO RD IN ATI ON ,EX ECUTI ON

Figure 2 Aspects of Basic Risk Factors

Survey results are presented in a quantitative (a graphical profile) as well as in a

qualitative way (a textual explanation about what aspect is weak/strong).

PTS 60.0502
JUNE 2006
 9

1.2.2 Tripod accident causation model

Tripod is an approach to hazard management aimed at the underlying causes of

accidents. It takes its name from the three key aspects of accident causation and is
represented as a three-footed diagram (Figure 3). It is best introduced by taking each
foot in turn.

Latent
Failures

Precondition

Active Failures Accidents

The “Scene”
Controls/Defences

Figure 3 The Tripod framework

1.2.3 Active Failures (Unsafe acts and Technical failures)

Active failures are the events defeating the controls and defences on the hazard
trajectory. In many cases these are the actions of people - categorised as unsafe acts
in Tripod terminology.

Not all active failures are human actions. Physical failure of controls/defences also
occurs due to conditions such as over stress / loading, corrosion or metal fatigue.

Knowing the form of human error helps in the identification of preconditions (see
Figure 4).

H
H uu m
m aa nn E
E rr rr oo rr ss

IInn ttee nn dd ee dd A
A cc ttiioo nn ss U
U nn iinn ttee nn dd ee dd A
A cc ttiioo nn ss

V
V iioo llaa ttiioo nn ss M
M iiss ttaa kk ee ss LL aa pp ss ee ss S
S ll ii pp ss
B a s ic E r r o r T y p e s

UU nn iinn ttee nn ttiioo nn aa ll RR uu llee ss oo rr MM ee m m oo rryy AA ttttee nn ttiioo nn

RR oo uu ttiinn ee KK nn oo w w llee dd gg ee FF aa iilu
l u rree FF aa iilluu rree
SS iittuu aa ttiioo nn aa ll bb aa ss ee dd
OO pp ttiimm iizz iinn gg
EE xx cc ee pp ttiioo nn aa ll

Figure 4 Sources of human error

1.2.4 Preconditions

Preconditions are the environmental, situational or psychological 'system states' or

'states of mind' that promote or directly cause active failures. Table 1 illustrates the

PTS 60.0502
JUNE 2006
 10

connection between unsafe acts and typical preconditions.

Table 1 Errors (active failures) and preconditions

Error type Description Possible Causes Precondition
Slip Unintended Attention failure Distraction from task
deviation from a Mistiming Preoccupation with other
correct plan of action tasks
Lapse Omission/ repetition Memory failure Change in nature of task
of a planned action Change in task
environment
Mistake (rule- Intended action Sound rule applied in Failure to recognise correct
based) inappropriate to the inappropriate area of application Failure
circumstances circumstances to appreciate rule
Application of unsound deficiencies
rule
Mistake Erroneous Insufficient knowledge or Organisational deficiency
(knowledge- judgement in experience - immaturity Inadequate training
based) situation not covered Time/emotional pressures
by rule
Routine Habitual deviation Natural human tendency Indifferent environment
violation from required to take path of least effort (no penalties; no rewards
practice for compliance)
Exceptional Ad hoc infringement Wide variety - dictated by Particular tasks or
violation of regulated practice local conditions circumstances not planned
for
Act of Deliberate violation for malicious reasons - falls outside the scope of most
sabotage accident/ incident scenarios

1.2.5 Latent failures / conditions

The core of the Tripod risk management concept is that accidents have their primary
origins in latent rather than active human failures / conditions. Latent failures, the
third foot of the Tripod framework, stem from decisions or actions taken by other
more remote parts of the organisation. These may lie dormant for a long time, their
accident-producing consequences only becoming evident when the active failures
resulting from their presence combine with local triggering factors (technical faults,
environmental conditions, a typical system states, etc) to breach the system's
defences.

The defining characteristic of latent failures / conditions is that they were present
within the organisation well before the onset of a recognisable accident sequence. In
some cases, their history may stretch back several years. The effect of a latent failure
may have a widespread impact on operations.

In order to reduce incident frequency one must first have an understanding of how
incidents happen. Tripod research identified two types of failure: active failures and
latent failures. Their roles in incident causation will be explained using the example
of the Kings Cross Tube fire in 1987 (UK).

In this disaster, the triggering event was a discarded cigarette. It combined with the
accumulating rubbish in the vicinity – unsafe act / condition leading to the
subsequent inferno. Because of this the cause of the incident was labelled as a 'human

PTS 60.0502
JUNE 2006
 11

error'. Latent failures, however, included wooden escalators, poor fire fighting /
detection equipment, (lack of) maintenance philosophy, etc, that had been present a
long time before the event of the discarded cigarette.

Even though the occurrence of some active failures will be inevitable, their effects
can be reduced considerably by eliminating as many latent failures as possible. For
example, if the cigarette would have been dropped whilst the fire fighting / detection
equipment were in good working order, the active failure would most probably not
have resulted in catastrophe.

Active failures (human errors) come in many different forms, and are therefore hard
to predict. Latent failures are present all the time but are often hidden, overlooked or
tolerated in an organisation. Latent failures often stem from decisions made at a
much earlier time. These decisions may have been correct at the time they were
made, however, in a dynamic environment such as the oil and gas industry,
yesterday's best decision can be tomorrow’s worst source of error.

Tripod-DELTA aims at identifying and reducing latent failures so that when the
inevitable active failure (human error) occurs, it does not result in an incident. In
Tripod these latent failures are called Basic Risk Factors or BRFs (See also
paragraph 1.2.1).

1.2.6 Controls and System Defences

Hazard controls and recovery measures are put in place based as part of the Hazards
and Effects Management Process (HEMP). Risk management objectives are set out
for critical processes and activities. Often these controls and defences are considered
the means of protection against damage or losses. In Tripod these elements are
recognised as valuable entities, however acting as last line of defence only.

1.3 TRIPOD APPLICATIONS

Tripod research demonstrated that assessments of the degree to which these BRFs are
controlled in an activity or facility provide an accurate picture of its overall 'health'.
A Tripod assessment is quantified in terms of 'level of control' of each of the 11
BRFs and is represented by the height of a bar in a histogram format. This histogram
is called a Safety State Profile (SSP).

The two applications, proactively in the Tripod-DELTA technique and

retrospectively in Incident Analysis, Tripod-BETA, are described briefly below.

1.3.1 Tripod-DELTA: Pro-active diagnosis of level of control Applications

Much of the evidence proving that there are problems in an organisation is scattered
about, or has become invisible and accepted as part of the conditions under which
people work. Questionnaires extracted from a pre-established central database of
indicator questions (called: Delta-base) are completed by all members of an
organisation. Answers to the questionnaires are summarised as a profile showing the

PTS 60.0502
JUNE 2006
 12

relative 'health' of an organisation in 11 separate areas (Basic Risk Factors).

The responses to the questions indicate a 'desirable' or 'undesirable' condition relating

to the BRF. The Safety State Profile shows the relative level of control of each BRF.

Examination of a Safety State Profile can generate the following results:

1. Determine the organisation's performance in the individual BRFs and establish in

which order of priority the BRFs should be tackled for improvement.

2. Compare profiles of the same unit or activity taken from previous assessments to
determine if improvements have been made.

3. Compare profiles for one unit against another similar units (Benchmarking).

Note: For "unit" one can also read "area" or "company".

Tripod-DELTA is an exercise that takes place outside the environment of accident

investigation and is thus a proactive rather than a retrospective risk management tool.

1.3.2 Tripod-BETA: Analysis during Incident Investigation

Tripod-BETA is a methodology for conducting the incident analysis in parallel with

the investigation, supported by a PC-based tool. Interaction between these two
processes - investigation and analysis - provides the investigators with confirmation
of the relevance of their fact gathering and highlights avenues of investigation
pointing to the identification of latent failures. The benefit to the analysis process is
that logical anomalies can be highlighted and resolved while the investigation is still
active.

The net result should be a deeper and more comprehensive investigation and a clearer
understanding of the failures that must be addressed in order to make significant and
lasting improvements in accident prevention.

The methodology is supported by software that provides the means to collect and
assemble the facts from the investigation and manipulate them on screen into a
graphic representation of the event and its causes - an accident tree. The program
tests the tree structure to ensure that it is logical in terms of the Tripod theory of
accident causation. A draft accident report can be generated for final editing using a
word processing package.

1.3.3 The Benefits of Tripod

The main benefits Tripod can offer are:

• a principled way of understanding how accidents happen

Tripod explains the real reasons why intended processes are disturbed, how an
organisation's resistance to these disturbances can be enhanced and what to do to
improve resistance.

PTS 60.0502
JUNE 2006
 13

• early pro-active feedback on potential accident causes

The completion of SSPs provides feedback about risk management effectiveness

of an organisational unit at a much earlier stage in the traditional accident
causation sequence.

• Managing and controlling identified latent failures

This is the principal feature of the Tripod approach. By monitoring and

influencing the BRFs, an organisation can maintain a high degree of risk
management. These are the controllable factors contributing to incidents. Risk
management means increasing resistance to ever-present hazards and inevitable
unsafe acts and conditions. Imposed understanding of the BRFs and the fallible
decisions by managers and others that lead to latent errors will enable improved
decisions and fewer latent errors to be introduced into the system. The BRFs - the
vital indicators - will reveal the true state of organisational risk management
health, an especially important requirement as accidents become rarer events.

More information about the Tripod applications can be found on the internet sites:
www.tripod.nl and http://www.eqe.co.uk/software/eqesoftframe.html

1.4 TRIPOD-DELTA: THE MECHANISM

1.4.1 Introduction

DELTA is a proactive tool that functions by taking a 'safety health check' of an

organisation. In the same way that a doctor measures vital signs (e.g. heart rate,
cholesterol, albumen, etc) as indicators for the overall health of a patient, DELTA
uses 'indicator questions' to measure an organisation’s health. Each indicator question
is tailor-made for the operation in question, and is specific to one of the 11 BRFs.
Indicator questions are objective, and can only have one desirable answer, either 'yes'
or 'no'.

During a Tripod-DELTA Survey questionnaires are answered by as many as possible

members of the organisation. In order to obtain a clear picture of the state of affairs,
people on all levels of the organisation are involved. This includes semi-permanent
contractor personnel. After answering the questionnaires the responses are analysed
and a detailed report, including the Safety State Profile is generated.
Much in the same way a doctor, after a diagnosis, can warn a patient of imminent
illness and thus prevent its manifestation, DELTA can forewarn an organisation of
potential future problem areas. This gives the organisation time to put problems right
before they potentially develop into an incident. DELTA profiling exercises are
normally carried out every six to twelve months.

A Delta profile is a ‘safety state profile’, the BRFs are represented in the columns
and a measure of 'control' is represented on the y-axis (see Figure 6). The higher a
particular BRF bar, the more signs to control the latent failure have been detected in
that BRF and therefore the more the BRF poses a threat to the safety of the

PTS 60.0502
JUNE 2006
 14

organisation.
100
90
80
70

Error Enforcing Conditions

More Control

Maintenance Management
60

Communication

Incompatible Goals
50

Defences
Hardware

Procedures

Training
Housekeeping

Organisation
40

Design
30
20
10
0

Figure 6 DELTA profile

By representing the relative difference in control between BRF areas, a profile allows
a manager to prioritise improvement actions. This prioritisation process supports the
manager in allocating resources where they are most needed. For reasons of
manageability it is recommended to focus on the 3 lowest scoring BRFs.
In the illustration, Design, Housekeeping and Organisation are the most problematic
BRFs (the lower bars). Available resources should concentrate on improving these
areas first. On the other hand Defences, Error Enforcing Conditions and
Communication (the highest bars) are the areas with the least number of deficiencies.
They require less attention for the time being.

When the generated profile has been studied, the responsible management can
determine in what way improvement of weaker BRFs should be derived. There are
many ways to achieve this and every specific operation will find its own preferred
way of tackling the problem areas identified.

As an example, three improvement actions can be generated for each of the three
lowest scoring BRFs in the profile. In the same way a patient takes more exercise and
eats more healthily in order to prevent future illness, an organisation must improve its
problem areas by generating and implementing improvement actions. This process in
Tripod is called action itemising. Management involvement at this stage is strongly
recommended to ensure commitment to the implementation of action items.

It is important to remember that a Tripod-DELTA Survey can be run regardless

whether an incident has occurred or not. In that way improvements can be made
before personal injury, material loss or environmental damage have occurred.

1.4.2 Indicator Questions

At the heart of DELTA are indicator questions. Much in the same way a doctor
makes a diagnosis by asking a patient questions about their health, DELTA uses
indicator questions to determine the safety health of an operation. DELTA uses a
database of approximately 1100 indicator questions. The intent of indicator questions
is to diagnose rather than to audit or investigate. An indicator question should have

PTS 60.0502
JUNE 2006
 15

the following characteristics:

• it can only be answered with 'Yes' or 'No'

• it has only one desirable answer, which can be 'Yes' or 'No'

• it is objective, i.e. it does not ask about feelings, awareness, etc

• it is measurable, i.e. it has a specified time frame or frequency

• it is specific to the operation

• it is specific to a BRF

• it is auditable - the answer is based on facts that can be verified

• it is specific to a single item or item group, e.g. it refers to lifting equipment

rather than to equipment in general

• it is directed at a specified individual or group, e.g. it refers to 'you' or to 'the

drilling crew'.

PTS 60.0502
JUNE 2006
 16

An example of a good indicator question is:

Have you worked more than 16 consecutive hours in the last seven days?

The answer to this question is either 'Yes' or 'No'. However, the desirable answer
is 'No'. It is objective, measurable and specific to you as an individual. The
question is relevant to the BRF Organisation.

Some questions are designed so that the desirable answer is a 'No' and others are
designed so that the desirable answer is 'Yes'. This is to prevent an answering
group assuming that all 'Yes' answers are necessarily desirable.

Example 1. Desirable Answer 'No':

Have you received imitation spare parts, where original parts are a requirement?

Example 2. Desirable Answer 'Yes':

Has there been a fire drill in the last week?

ASPECTS AND FEATURES

The BRF is a relatively broad category, identifying a topic on an abstract level.

Within each BRF four aspects (Drivers, Resources, Methods, and Output) have been
defined. Also for each individual BRF specific features, related to this BRF, have
been defined. When a Tripod-DELTA Survey is conducted these aspects and features
are considered in the analysis process, so that the final report as delivered to the unit
involved will relate to its operations as practical as possible.

Aspects and Features have proven to be useful prompts for the generation of remedial
actions.

1.4.3 Prior to implementation

Although Tripod-DELTA is a powerful tool, it cannot be implemented everywhere.

Prior to the implementation of Tripod-DELTA, three questions should be considered:

WHERE? In order to generate meaningful profiles operational units are

profiled instead of the organisation as a whole. Operational units
are relative small parts of the organisation which are partly self-
regulatory. A single drilling rig is a good example of an
operational unit.

WHEN? Tripod-DELTA is a tool specifically designed for operational units

where incident information used to improve safety is scarce
because of low incident frequency or to determine a base line for
improvement. Tripod-DELTA provides points for improvement
without the requirement to have incidents, and thus assists an
organisation in maintaining low incident statistics.

PTS 60.0502
JUNE 2006
 17

WHAT? For operational units that do not have a low incident frequency
Tripod-DELTA may be less appropriate. There may be more
benefit from the retrospective application Tripod-BETA to assist in
the analysis of incidents, thereby providing information concerning
points for improvement.

WHO? Anyone related to the operation to be surveyed. This includes top

management as well as semi-permanent contractor personnel. A
minimum period of 3 months of involvement with the particular
operation is a requirement. In order to verify reliability and
validity of the responses on the questionnaires, the group of
respondents should not be less than 40 people.

1.4.4 Implementation

Effective management of Tripod will require a series of regular activities that should
be integrated within your HSE program. Although in-house applications have been
developed, in general OPU/JV's will not have resources for managing and running
Tripod-DELTA surveys. Tripod Diagnostics International B.V. (TIBV) can be
contacted to carry out the required surveys for you. They will provide you with the
questionnaires, analyse the responses and produce a full survey report including your
Safety State Profile.

This will reduce the preparation and analysis of the survey, but you will still be
responsible for arranging your own generation of improvement actions.

Information associated with this option may be obtained from TIBV.

1.5 RUNNING TRIPOD-DELTA SURVEYS

Following is a step-by-step overview of the survey process.

STEP 1 - (All parties) Preparation

• Assignment of Focal Point (liaison between Tripod International (TIBV) and

your operational organisation).

• Determine what Staff Positions are taking part in the survey.

• Determine which Departments/Units are taking part in the survey.

• Determine the amount of respondents per Department.

• Communicate the Company terminology of Staff Positions and Disciplines /

Departments to TIBV?

• Discuss with TIBV what type of questions is to be issued to whom (generic /

PTS 60.0502
JUNE 2006
 18

specific)?

• Determine method of distribution of questionnaire (personal issue / mail? At

work / home?)

• Assign Response Managers. These people will distribute the questionnaires over
a limited group (max. about 20 people).

NOTE: Internal information/announcement about the "things to come" in relation with a Tripod DELTA Survey by line
supervisors to respondents is strongly recommended.

STEP 2 - (All parties) Development of Questionnaires

(1 week after receipt of above information)

• OPTIONAL: Question Generation Session (only in case you want to include

operation specific questions. This is NOT a requirement!)

• Draft questionnaire to be scrutinised by Focal Point on jargon.

• Final questionnaire to be approved by Focal Point.

• Final amount of questionnaires to be communicated.

• Distribution dates to be set.

• Delivery date and address of questionnaires to be agreed.

STEP 3 - (All Parties) Distribution of Questionnaire

(1 week after approval by Focal Point)

• OPTIONAL: Kick-off meeting with Focal Point and Response Managers.

• Issue of Questionnaires to Response Managers.

• Agreement on Closing Date (latest date to return completed questionnaires).

• Distribution of Questionnaires to Respondents.

NOTE: Questionnaires are delivered with blank envelopes to ensure confidentiality.

STEP 4 - (PETRONAS) Completion of Questionnaires by Respondents

• Keep tight control on "who has returned his/her completed questionnaire".

• Focal Point to monitor progress in collection of completed questionnaires.

STEP 5 - (TIBV) Reporting

PTS 60.0502
JUNE 2006
 19

(4 weeks after receipt of completed questionnaires by TIBV)

• Approval by client to TIBV to start analysis (no additional material (late arrivals)
can be processed after that moment!).

• Agreement on Delivery Date of Survey Report by TIBV to Focal Point.

• Determine amount of Survey Reports required.

OPTIONAL: Presentation of Survey Results by TIBV to Client.

PTS 60.0502
JUNE 2006
 20

STEP 6 - (PETRONAS) Action Planning

Action planning is the crucial stage in the Tripod process. The action planning allows
you to make the journey back from the relative abstract Tripod report to the practical
underlying causes in your real world. Now you have three specific areas to focus on.
We have observed that creative solutions with a large impact at little cost are often
possible. Some users have found it helpful to plan and publish a budget for Tripod
Actions.

STEP 7 - (PETRONAS) Action

Following the action planning the remedial programme is actioned.

1.6 TRIPOD BENEFITS AND BEST PRACTICE

1.6.1 The benefits of DELTA

• resource prioritisation

Safety and quality are simple obstacles to attain if there is an unlimited resources to
spend. However, no manager has unlimited resources. DELTA identifies the BRFs
that pose the greatest concern in HSE management. By concentrating efforts in these
areas a manager can make efficient use of his available resources.

• proactive measures

When an incident occurs it cost time and resources. Management and the line has to
prioritise on recovery and investigation, deviating from their set business targets.
Traditional improvements in HSE management rely upon learning from mistakes.
Often, it is only after an incident has occurred that lessons are learned and
improvements are implemented. DELTA removes the incident out of the learning
cycle replacing it with the findings of a profile. B

By running DELTA, time spent on preventing incidents can be saved many times
over when compared to time spent dealing with the consequences of incidents.

• self diagnostic

After implementation, DELTA is run by the line. It is designed with efficiency in

mind to run without the intervention of external resources. As the technique is self-
diagnostic, the line and its management are the first to know about potential
problems. They can use their expertise to solve their own problems and therefore the
level of ownership is high.

• profiling between audits

Conventional audits are time consuming, costly and normally target an individual
installation. Often, they produce many action points simultaneously, implementation
of which requires a great deal of planning. With DELTA, however, action points are

PTS 60.0502
JUNE 2006
 21

self-generated and the quantity is limited to encourage proper implementation. They

are also often low in resources. Therefore the tool is efficient and can be run
regularly on several locations at a time in order to assess their 'safety health'.

PTS 60.0502
JUNE 2006
 22

• addresses hidden failures

Most safety systems only address issues that are known to be a problem. DELTA
addresses issues that, in many cases, are hidden (latent failures). It also acknowledges
that latent failures are contained throughout the organisation and not just in the safety
arena.

• good cost/ benefit ratio

A DELTA survey takes up relatively little time. Implementation can be achieved in

about a week and maintenance in terms of time and money is low. After the one-off
customising exercise the DELTA database can be used time after time without any
two questionnaires being the same.

Answering the questionnaire takes about three hours. Generating action items takes
about the same time. This process may be repeated two times a year. DELTA
encourages the generation of regular improvements to the operation. Tripod-DELTA
Surveys are run by the line at times convenient to the planning of operations.

By improving safety performance the organisation will become more efficient.

• human-tolerant system

Many safety systems continue to target humans as the cause of incidents. DELTA
acknowledges all humans are prone to making mistakes and that predicting and
preventing human errors is virtually impossible. It therefore concentrates on latent
failures that are structural present and are the underlying causes of incidents.

1.6.2 Three Case studies

1. REDUCING THE COMPLETION TIME FOR QUESTIONNAIRES

In order to reduce the time needed to complete questionnaires these are split into
different sub lists containing a limited amount of questions. Sub lists cover a reduced
number of BRFs. By a careful design all sub lists together cover all 11 BRFs, one
BRF is represented on all sub lists and serves as "anchor BRF" to verify whether
there are no significant differences in response patterns over the population.

In the case of company "A" the questionnaire was split into 4 sub lists which were
randomly distributed over the group "operational staff". Every sub list contained the
25 questions of BRF Procedures (the "anchor BRF"). The survey covered a group of
240 people working on 15 different work sites controlled by one organisation.

PTS 60.0502
JUNE 2006
 23

The results of this test are presented in Figure 3.

Company A (batch 1-4)

Absolute Score
100

90

80

70

Profiel score
60

50

40

30

20

10
0
Batch 1 Batch 2 Batch 3 Batch 4

Batch

Figure 3

Figure 3 shows the profile scores of the 4 different batches. The profile scores do not
differ significantly (75 + 2, n.s.). Also the distribution of the scores of the different
batches does not differ significantly.

Quality vs. Response time

Company A
Cumulative distribution 4 batches
100
90

80
Cumulative distribution

70
60

50
Batch 1
40
30 Batch 2

20
Batch 3
10
0 Batch 4
0-

11

21

31

41

51

61

71

81

91
10

-2

-3

-4

-5

-6

-7

-8

-9

-1
0

00

Percentile interval

Figure 4

Figure 4 presents the cumulative distribution.

Reduction of response time by splitting up Tripod-DELTA questionnaires
(respecting certain minimum group criteria) will not reduce the quality and
reliability of the survey results.

2. MEASURING THE RESULTS OF INTERVENTIONS; THE VALIDITY AND

RELIABILITY OF THE METHOD

The effects of Tripod interventions (validity) can be measured in two ways:

• No difference in profiles, in case there have been none or unsuccessful

interventions

• Improved scores in those areas where interventions have been successful.

PTS 60.0502
JUNE 2006
 24

Test-retest reliability of a survey is established by comparing profile scores of the

same population obtained by different checklists.

Company C:
C o m p a n y C : 1 9 9 7 vs .
A b s o lu te s c o re
100
90
80

70
Pr
o fil 60
e 50
sc
or 40
e 30
MM 1997
20
M M (q u e s t. 1 ) 1 9 9 9
10
0 M M (q u e s t. 2 ) 1 9 9 9
O p e r a tio n a l p e rs . S u p e rv is o r s

P o s itio n

Figure 5

Successful interventions

Company "C" was surveyed in 1997 and invested a substantial amount of money in
Maintenance Management as the survey showed this BRF as being the weakest area.

To verify the effect of this investment in Tripod terms the company decided to
conduct a re-survey on this BRF only, using a questionnaire with twice as much (50)
questions; a set of 25 questions identical to the first survey, and another set of 25
questions which were never asked in this company before.

All questions were drawn from the calibrated Tripod-DELTA question pool (Delta
Base) and mixed into a single questionnaire. As such this survey design complies
with the requirements to test the test – retest reliability of the survey method

Comparison of the 1997 and 1999 surveys show the effect of the investment:

"A significant increase in scores measured by both question sets (Figure 5)"

The high level of test – retest reliability of the Tripod-DELTA Survey can be
deduced by comparing the ‘MM Question set 1’ and ‘MM Question set 2’ results in
Figure 5. Both lists give equal profile scores, showing that survey results are
independent of the specific set of questions used and indeed indicative of the level of
control an organisation has over this BRF.

Note: The above applies only for sets of calibrated questions drawn from the Tripod-DELTA Base.

1. Successful interventions aimed at improvement of weak BRFs result in a

substantial increase of the BRF score.

2. The test-retest reliability of Tripod-DELTA Survey is acceptable

PTS 60.0502
JUNE 2006
 25

Company B:
Company B:1996 vs. 1999
Absolute Score
100

90

80

70

Profile score
60

50

40

30

20
1996
10
0 1999
DE HW MM HK EC PR TR CO IG OR DF

BRF

Figure 6

No successful interventions

Company "B" has been surveyed the first time in 1996. Based on the survey results
an ambitious plan was designed to improve the score on the weakest BRF
(Maintenance Management, MM).

After 3 years the management requested a second survey to verify whether planned
interventions had positive effects on the company's performance. The re-survey
showed no significant improvement in the area of maintenance (Figure 6).

In depth investigation, triggered by the outcome of the survey, showed that the
potentially effective improvement plan had been kept securely in a drawer after it had
been presented to the management

Tripod-DELTA Survey also indicate when improvement plans are NOT

implemented

Conclusion

The scientific approach of the Tripod-DELTA survey method eliminates the

influence of the (subjective) views of individual auditors or inspectors. Survey results
are determined by statistical processing of data without otherwise inevitable human
bias, which makes the tool a reliable method to conduct benchmark studies between
different organisations.

Benchmarks have been established already in the Dutch railways as well as in the
drilling industry. Also extensive surveys are currently conducted in the shipping
industry.

The application of Tripod-DELTA Surveys in organisations has shown that survey

results presented on aspect level give clear and tangible information to strategic as
well as operational management. This information has proven to be a sufficient basis
for the people who are responsible to develop an improvement plan for a particular
area of operation, which has shown to be relatively weak in order to “fix things”

PTS 60.0502
JUNE 2006
 26

before the “bang”. Moreover, as staff is held accountable for the quality of the
improvement plans, workforce involvement is enhanced for all levels in the
organisation. The results can also be used to optimise resources with less investment
in relative ‘strong areas’.

PTS 60.0502
JUNE 2006
 27

2 TRIPOD-DELTA SURVEYS: Do's and Don'ts

Do Don’t

• involve the operational units from • exclude personnel just because they
the start are not directly involved in DELTA

• keep people informed on DELTA • allow DELTA to be side-tracked

progress
• commence improvement actions
• ensure personal security by delivery before all parties involved are
of questionnaires in closed happy to proceed
envelopes.
• presume one 'keen' manager is
• ensure management are completely sufficient to complete the
behind DELTA implementation

• attempt to ensure there are no • implement for the wrong reasons.

hidden agendas for implementation.
• Run surveys too frequently

3 GENERATING ACTIONS

3.1 ACTION GENERATION PROCESS

The Tripod process so far has yielded a profile detailing areas of relative strength and
weakness. The next step is to address some of these weaknesses by identifying and
implementing corrective action. An action generation process is required to translate
the Tripod-DELTA Survey Reports to relevant actions.

Tripod relies on group sessions to carry out the action generation process. It is
recommended to compose a working group representing a “Diagonal Slice” from the
organisation: a representative selection of people from all levels and disciplines in the
organisation. A typical group size of 10 people is recommended. The potential
impact of the actions is proportional to the seniority of the decision-maker in the
group. The more senior the individual, the more significant the issues you can tackle.

Group dynamics make it hard to predict if the action generation process will run
smoothly or not. Section 3.2 details some typical pitfalls during the process. In
general, it will help to break the process into separate phases:

• Analysing the profile

• Finding issues

• Finding the underlying reasons and assessing the priorities

PTS 60.0502
JUNE 2006
 28

• Generating solutions and agreeing ownership.

A facilitator should be appointed to guide the process through these phases. The
facilitator should have a working knowledge of Tripod-DELTA, have a good
understanding of BRFs and, above all, should be able to manage the group dynamics.
The facilitator should be able to recognize the pitfall described in section 3.2 and
implement the appropriate “countermeasures”. The facilitator should check the level
of resource availability in advance and prepare an expectations profile. As facilitator
you may suggest actions, you may insist on decisions but the group must decide.

The facilitator should steer the right expectations. The group will produce some
decisions. The actions may be small but will focus on underlying issues. They may
not have any immediate impact but may set the scene for profound improvements in
the future.

The action generation process is need motivation and commitment. Experience has
shown that to generate 3 actions for a BRF may take the group up to 4 hours. You
may want to plan an away-day for the group or split the process in three separate
sessions (1 for each BRF, this also gives you the opportunity to involve three
separate groups of people to the process). At the end of the process, you should aim
for up to 10 high quality actions (3 per BRF and 1 for good measure), keen
volunteers to own these actions, and clear commitment and accountability of the line
management to close out the agreed actions.

PTS 60.0502
JUNE 2006
 29

A ctio n R o ad m ap

1 Prepare pa pers, slides,BRF’ , Fe atures, etc

s
100
90

2 D iscuss positive results

80
70
60
50
40
D iscuss m eaning of a poor BRF result 30

3
20
10
0

Select 3 BRFs for im provem ent

4
Brainstorming N ominal G roup R emedial A ction W orksheet

5 Flip chart / acetate Individuals w rite Inv ite group to list

issue s raised dow n features for top row
issues.

Ensure everyone is Individual is sues Work down /acro ss

6 and highlight
co ntributing are record ed
important combinations

Mov e on to nex t Focus on Focus

7 fe ature on
interesting
most
repeated issues
clusters

8 W hat can b e done to

remed y the issue

Cost/Benefit analysis to
9 prioritise biggest imp act fo r
least effort

Identify volunteer
10 focal point

11 Set “SM ART” targets

12 Select Max : 3 actions per BRF

Figure 7 Action Road map

Analysing the profile

Analysing your profile is the starting point for Action Generation. The profile
indicates which BRF’s you control best. In the example, Defences, Error Enforcing
Conditions and Communications are the best scoring BRF’s, while Design,

PTS 60.0502
JUNE 2006
 30

Organisation and Housekeeping score lowest. Can you recognise this? Recognising
why you perform strongly in certain BRF’s can help you assess why you are doing
worse in others.

Select the 3 BRFs which show to be least controlled.

100
90
80
70

Error Enforcing Conditions

More Control

Maintenance Management
60

Communication

Incompatible Goals
50

Defences
Hardware

Procedures

Training
Housekeeping

Organisation
40 Design

30
20
10
0

Figure 8 Delta profile

Finding issues

A BRF represents a complex management process. This management process

impacts on the organisation in a certain manner. For each industry, company or
division this impact may be different so you have to identify examples of failures in
your own organisation. To keep the link between BRF and real life examples a list of
features is helpful. Appendix III gives a number of features per BRF in a typical E&P
organisation. Review these features before you use them and make sure you have a
list that makes sense to people in your organisation. The list of features of the
particular BRF is used during brainstorming. The group focuses on the features one
by one to flush out current examples of the issues in their own organisation. The
issues brought up by the group give an overview of problems that exist in the
organisation as a result of deficiencies in the management of the BRF.

Finding the underlying reasons and assessing the priorities

The list of examples that have been generated during the “finding issues” phase may
not yet reveal the real underlying reasons. It is likely that the majority of examples
equate to ‘direct causes’. It is always useful to keep asking “why did it happen?” You
will probably find that various examples link to a few underlying reasons. When you
are certain that you have found the underlying reasons, priorities can be established.
A rough cost-benefit analysis should give the best candidates for remedial action.
Remember that the underlying reasons you have found are likely to be the underlying
causes contributing to your next incidents and you may want to implement some
quick fixes where you feel particularly exposed.

Generating solutions and agreeing ownership

Solutions should follow the “SMART” principle, that is, they should be Specific,
Measurable, Achievable, Relevant and Time constrained. Make sure that you can

PTS 60.0502
JUNE 2006
 31

implement the solutions in your own organisation and that you agree the resources
made available. Actions assigned to third parties are unlikely to be implemented, if
you find your problems involve third parties, involve them in the whole Tripod
process from start to finish next time you use it! Ask for volunteers to take ownership
of the actions. This does not imply that the volunteer does all the work himself, but
that he or she will be accountable for the progress of the action. Continue your cost-
benefit analysis and go for low cost – high impact actions. Aim for maximum 10
actions (3 per BRF plus one for good measure), but make sure those actions are
addressed effectively!

3.2 ACTION GENERATION PROCESS PITFALLS AND COUNTER

MEASURES

There are a few typical pitfalls that will impede the success of the action itemising
process. Ideally the discussions should revolve around underlying causes, but it is
very easy for discussions to deviate and get out of control. The facilitator must be
able to recognise the type of deviation and keep the discussion on target!
Curing World Hunger

Getting “Hung up”

Powerlessness

Lack of Lateral Thinking

Figure 9 Discussion Model

PTS 60.0502
JUNE 2006
 32
Given below are some more examples of these typical pitfalls and suggested
countermeasures.
Pitfall
Powerlessness The group doesn't commit itself
to the action itemising process at
all. Typical statements will be
made such as: "We've tried it all
before and it won't work", 'These
problems can only be solved by
senior management, not by us"
and "It is not within our power to
take these decisions".
Getting hung up The discussion revolves around
one topic, and comes back to this
topic whatever you try. This
would typically be a controversial
issue that is very much in the
foreground at the moment.
Typical issues to get hung-up on
are: down-manning, major
organisational changes, reduction
in remuneration, major changes to
the installation, big incidents etc.
Trying to cure The discussions are very general
world hunger and do bring up all sorts of big
issues, but not any that the group
can solve. The group is tuned in
to too high a level. There is
obviously no lack of issues here,
but the "assess and remedy" steps
are not working.
Lack of lateral In a way the reverse of "trying to
thinking cure world hunger". Now the
group is tuned into too low a level
and is not able to strike a link
between the features and the
environment they are in. They
may insist on reverting to the
Tripod questionnaire to address
the questions that were answered
unfavourably.
Countermeasure
The process facilitator should
ensure a decision-maker is
included in the group (OIM,
supervisor or anybody with a
reputation for taking
decisions). The process
facilitator may need to point
out that we can take decisions
within our own sphere of
influence and we can ask
others to take decisions in
theirs. Attempting to influence
is also a worthwhile action.
The process facilitator must
make the group aware that
important though their topic
may be, it is unlikely to be the
cause of all evil. Make a deal
with the group to use one
action for their topic, and to
avoid raising the topic during
the rest of the session
Use the Remedial Action
Worksheet to try and find
"concentrations" of issues.
Try the Nominal Group
technique and encourage the
group to think as laterally as
they can. Using the Remedial
Action Worksheet may not go
down well with the group but
may be used privately by the
facilitator to order the issues
and again try to find
"concentrations" of issues.
Guide the group towards your
conclusion.
PTS 60.0502
JUNE 2006
 33

3.3 BRAINSTORMING TECHNIQUES

There are many techniques for brainstorming. The facilitator needs to assess which of
the techniques suits himself, the group and the circumstances best. They are listed in
order of increasing structure. The simplest approach is "Brainstorming". Try this first
and if it doesn't suit, go for "Nominal Group" (where individuals have 15 minutes to
reflect on the issues before discussion starts) or the "Remedial Action Worksheet"
(where a detailed exploration of possible issues is carried out).
All three options help you to go through the "identify, assess, generate" process and
you may want to switch between them as the session gets along. The brainstorming
techniques will help you in the first place to identify the various issues that bother
you. Once this step is complete, the ensuing group discussion will help you to assess
what can be done on your location to deal with these issues. Again the remedial
action worksheet can be of help, as it may reveal common backgrounds to the various
issues you brought up. Next you should be able to pick the three or four issues that
you are going to address and assign action parties and target dates.

Brainstorming

1) Copy the profile, BRF definitions, features etc. onto acetate if you want to use an
overhead projector or onto paper with a copy for each participant.

2) Start on a positive note by considering the BRFs of least concern, i.e. the tallest
bars in the profile. Ask questions like, "What are we getting right here?" "What
can we learn?' "Can we use our strengths to tackle the areas we are concerned
about?'

3) Turn to the lowest bars, the BRFs of greatest concern, pick one to start with and
discuss its meaning (for definitions see Appendix I)

4) Put the list of relevant features (see Appendix III) on the overhead projector.
Explain that it is not exhaustive and ask the group if they can think of any
features that should be added.

5) Ask the group to mention issues in their work environment that come to mind
while looking at the first feature. Discuss the issue briefly and capture it as a one-
liner on acetate or flip chart.

6) Ensure that everybody in the group gets their chance to say something.

7) Ask individuals if they are happy with what you've got so far and if you can go to
the next feature. Go to the next feature until all features have been discussed.

Note: If progress seems slow, switch to the Nominal Group or Remedial Action Worksheet

8) By now you should have a list of issues. Go through each one and ask the group
what could be done to remedy the issue.

9) Conduct "cost/benefit" analysis to prioritise actions. Where can we make the

biggest impact for the least effort?

PTS 60.0502
JUNE 2006
 34

10) If a course of action is identified, ask for a volunteer to be focal point for this
action. Explain that being a focal point does NOT mean doing all the work
yourself, but does make you responsible for chasing up and reporting progress.
(Beware of persecuting the bringer of ideas. People will quickly fall silent if
automatically given responsibility for any ideas they suggest.)

11) Once a focal point has been identified, ask for a target date. Capture action, focal
point and target date on paper.

12) You should aim for a maximum of 3 actions for each BRF. Those issues that can
not be actioned can be kept for "future reference".

Nominal group technique

As with Brainstorming except for the following steps

1) Give group members 15 minutes to write down any issues prompted by looking
at the features.

2) Ask each individual to read out their list (ensure workforce goes first,
supervisors, managers, etc. last). Record each issue on an acetate. Avoid
discussion at this point.

3) When everybody has read their list, start discussion, concentrating on the most-
repeated issues.

Remedial action worksheet

As with Brainstorming except for the following steps

4) Invite group members to list the important features for the top row. Try to avoid
using the key reasons (Custom, Decision making and Responsibility) as features
as these are already listed in the first two columns of the work sheet.

5) Work down or across, considering each intersection in turn. Ask questions like,
"Why is the clarity of procedures a problem for us? Is it just something we've
come to expect? (Custom) Is it that we never have the information to sort it out?
(Decision making) etc."

6) Enter an example in the box if an issue is identified. Otherwise leave it empty. By

the time you've worked through the sheet, you will probably find you have spent
most of your time discussing relatively few boxes. Focus on the main of issues, a
line, a column, or an individual box.

PTS 60.0502
JUNE 2006
 35

GFT: HARDWARE Features

STEP ONE: Select up to five particularly significant features

Reasons 1: Ageing 2: Storage 3: Spares and 4: High 5:

STEP TWO: Working down columns or capacity tools maintenance
across rows ask for examples to
illustrate the combination of row with
column
Custom Industry norm
“Any examples Everybody does it like
where industry
norms/local habits
this
contribute to this
problem?” Local habits We had problems Forced to buy Unused spare parts We’re so good at
from day 1 but we spares at on site are making do. We
It has grown this way learned to live clearance sale discarded by should let it fall
with them after maker went clean-up crew over once and for
out of business all.
Decision Making Poor information We try to keep There’s never
“Any examples track of breakdown enough time for
Not all the facts are history but info survey so the
where poor
information/ lack
known is not reliable. agent’s man is
of decisions/ often called back
people out of None taken No process for Uncertainty of
touch contribute managing long term
What decision? aging/replacement developments makes
to this problem?”
issues for difficult
decisions
Out of touch They’ve no idea Maker went out of
the grief this business
Too early, late, far piece of kit gives
away us.
Responsibility Not defined Shell & contractor Unclear who is
“Any examples seem to disagree responsible for
Who is responsible? over who pays for acceptance of
where ill-defined/
under-used replacement materials
responsibilities
contribute to this Not used Equipment retained
problem?” after maker went
Failure or success out of business
have no consequence

STEP THREE: Address rows, columns or

individual boxes according to
concentrations of issues or particular
importance with actions

3.4 ACTION CLOSE OUT AND FEEDBACK

The only way to recoup the investments made in the Tripod-DELTA process is to
close out the agreed actions. Make sure that you record the actions. We suggest that
you record the Tripod-DELTA actions in the same systems that you use to log
incident or audit actions. If you successfully implement your actions (and all other
BRFs stay the same), you should see an improvement in your Tripod profile next
time around. The impact on your incident statistics is harder to predict. We know that
underlying causes of incidents usually have been dormant for many years so it is
most likely that your incident statistics will be influenced in the longer term.

PTS 60.0502
JUNE 2006
 36

APPENDIX I - BRF DEFINITIONS

GFT / Short Single Popular

BRF Definition Sentence Full Definition (Colloquial)
Initials Definition Definition
DE Design The creation of The creation of an appropriate* Applying
the optimum engineering solution to a specific set of common sense
ergonomic needs or circumstances, most often for the to equipment
solution to a interface between equipment and people. and machinery
particular set A design failure will most often be control layout
of needs or recognisable when there is a significant and positioning!
circumstances difference between the way the designer
intended something to be used and the Or
actual use to which it is put in practice. It
is often created when the designer is given Remembering
a poor or inappropriate specification or that equipment
where a piece of equipment is used in the and machinery
wrong context of place. control layout
and positioning
* In engineering terms, an ALARP (as low has to be used
as is reasonably practicable) solution by human
would be “appropriate” beings!
HW Hardware Tools, The quality of materials used in tools, Is the bit of kit
equipment and equipment and components insofar as it right for the
components to affects their ability to operate reliably, job?
work correctly, efficiently and effectively within the limits
efficiently and laid down by the designer, throughout their
reliably within lifecycle.
their specified
operational
limits
PR Procedures A clear, formal A formal, step by step description of the In the ideal
description of safest and most efficient way of carrying world, a
tasks to be out a particular task or operation. foolproof,
undertaken at competent
the operating It will incorporate the accumulated craft person’s guide
interface wisdom and practical knowledge gained to the job.
between through operating experience.
people and
equipment It will be in a clear, unambiguous form that
can be understood and utilised by a
competent person who may not, however,
have recent experience of the task.
EC Error Conditions, A serious circumstance or situation where “Flying by the
Enforcing circumstances an inadvertent error or deliberate violation seat of your
Conditions and situations is more likely to occur and have a serious pants” is not the
which will consequence; in the presence of hazardous best method of
significantly conditions there is a significantly enhanced dealing with
increase the risk of injury or damage. unexpected
chance that problems or
errors or Error enforcing conditions may be opportunities
violations will environmental (e.g. weather, social (e.g.
occur. over-confidence) or physical (e.g.
tiredness).

An error enforcing condition is usually

triggered by a change from the norm,
where a person’s ability to function in

PTS 60.0502
JUNE 2006
 37

his/her environment is compromised, and

where existing best practise procedures
and habits are likely to be ignored or
changed.
HK House The The provision and management of the A place for
Keeping maintenance resources and systems to keep a workplace everything and
of a clean and clean and tidy and remove waste on a everything in its
tidy workplace continuous basis. place.

Housekeeping becomes a latent failure

when it is neglected for a period of time
and when there is an awareness of such
neglect and nothing is done.
Housekeeping performance will only break
down if:

1) Management make site visits, are aware

of a poor performance but fail to take
remedial action.

2) Management make site visits but are

hoodwinked into thinking that there are no
problems.

3) Management do not make site visits at

all.
TR Training Provision of Development of competence in Have you got
appropriate procedures, equipment and systems to the knowledge
instruction to enable safe working practises to be and skill?
develop undertaken efficiently; this will be through
competence to coaching/mentoring as well as through
enable formal training courses. Training also
everyone to includes the consideration of the
carry out their appropriateness of qualifications and the
jobs safely to management of a system for the checking
the required of those qualifications.
standard.
IG Incompatible The increase in Conflict between the different priorities Keeping on the
Goals risk arising and goals of individuals, groups tightrope when
from the (departments) and the organisation can different
conflict create latent failures, particularly when weights keep
between management give little or no guidance on getting added to
different and the priorities. your balancing
unbalanced pole.
priorities. The conflicting goals that are inevitably
inherent in any organisation are
particularly likely to generate accidents
under extreme time pressure.

Errors are also likely when employees are

forced to continuously choose between
optimal working methods and the pursuit
of production, financial, political, social
and individuals goals.
CO Communicati The The transmission of clear, unambiguous Providing the
on transmission and intelligible information to the right right
and person at the right time to ensure the safe information to
understanding and effective functioning of all or part of the right person
of essential the organisation. Communications can at the right

PTS 60.0502
JUNE 2006
 38

information break down if: time.

1) The necessary communications systems

or channels do not exist.

2) The channels and systems exist but the

necessary information is not sent or is sent
too late to be of use.

3) The information is sent at the right time

but is misinterpreted or ignored by the
recipient.
OR Organisation The The structure of the company, its business Don’t let it “slip
implications philosophy, organisational processes and between the
for safety management strategies should prevent cracks”. It is
management safety responsibilities becoming poorly your
from the way defined and warning signs being responsibility!
the company is overlooked.
structured and
conducts its
business
MM Maintenance Systematised The development and use of appropriate Recognising
Management management management systems to maintain the that prevention
to ensure technical integrity of all processes, plant, is better than
correct equipment and tools The choice of cure
maintenance maintenance strategies should be suited to
of processes, the actual environment and sometimes
plant, allowing items to breakdown may be the
equipment and preferred option! (The execution of
tools maintenance is considered in GFT/BRF’s
Error Enforcing Conditions, Procedures,
Design, Hardware and Communication)
DF Defences Mitigation of Defences are what stop you getting hurt The “Last
the when all else has failed - they are the Chance Saloon”
consequences barrier between the “target” (you!) and the - defences
of human hazard. Defences should provide layered, should only
and/or in depth protection to warn of and guard become active
technical against the consequences of human or in the last
failure technical failure. Each layer comes into stages before an
operation on the failure of its predecessor; accident occurs.
this defence in depth sequence should have
the following components:

1) Detection/warning

2) Control and interim recovery to a

safe state

3) Protection and containment

4) Escape

PTS 60.0502
JUNE 2006
 39

APPENDIX III - BRFS AND FEATURES

INTRODUCTION

All incidents have immediate causes and underlying causes. In incident investigation, each
of the underlying causes can be attributed to one of the 11 BRFs (BRFs). With a pro-active
tool like Tripod-DELTA, in which we try to look ahead rather than into the past, we use the
term features rather than causes.

In our day to day management of safety, causes are easier to recognise than the rather
abstract BRFs (e.g. a piece of equipment broke because it was not fit for purpose means
more to us than to state that Hardware is the main BRF). In the same way, we use features
to clarify how the BRFs may affect us in real life. “Fitness for purpose” for example is a
feature of the Hardware BRF. You can imagine that if this feature is very well managed, the
chances of equipment breakdown will be less than if it were not. We can use the features to
give a more detailed definition of the BRFs.

In summary, looking back in time you find the causes, looking forward you can start from
the features.

In order to translate our Tripod profile into something more recognisable, we can check
which features of the BRF strike a chord. Each of the next 11 chapters discusses one BRF
plus its features. The list of generic features is not exhaustive and you may want to
supplement them with appropriate features for your location. If you do so, you should check
if your feature is not already mentioned with another BRF.

DESIGN (DE)

Design is defined as: The creation of the optimum ergonomic solution to a particular set
of needs or circumstances. It encompasses the design standards and specifications, the
availability of competent people, tools and technology, time and opportunity to perform
design activities, the design process and methods themselves, and the results of the design
effort in terms of ergonomics and fitness for purpose. A design failure will most often be
recognisable when there is a significant difference between the way the designer intended
something to be used and the actual use to which it is put in practice. It is often created when
the designer is given a poor or inappropriate specification or where a piece of equipment is
used in the wrong context or place.

Features for design

Feature Example
Design criteria The design criteria did meet the minimum requirements of the
operation
Legislation This design complies with all relevant legislation
Environment The option we chose was the only one that would have worked in
this environment
Life cycle focus We are now not suffering the results so that the project could be
within budget
Economics When the prices of our products dropped, we were not required to

PTS 60.0502
JUNE 2006
 40

modify the original design to reduce the original budget

Technology Because of the high temperatures and pressures involved, unproven
technology had to be used
Information The as built existed and was sufficient
Expertise We have an engineer competent in this discipline
Design aids We had a computer program available to perform an analysis
Time We could solve all design problems before the installation had to be
operational
Engineering All the right calculations and assessments were made
process
Operator We could rectify this early in the project because our operators were
consultation involved from the start
Project There is a logical succession of steps in the design process
management
Review We had independent reviews of our design work after each stage of
the design process
Handover We had a dedicated handover team to iron out any problems
Operational logic You have to move the toggle down to make the lift go up!
Status indication Thanks to the indicator I can reliably assess if there is pressure
trapped in the vessel
Ergonomic design I need a ladder to operate this valve
Designer – I do not think that we are using this equipment as it was intended by
operator mismatch the designer
Design error The operating envelope was correctly calculated, and prevented a
equipment failure.

Note: Design is about applying common sense to equipment and machinery control layout and positioning and about
remembering that they are to be used by human beings!

HARDWARE (HW)

Hardware is defined as: The capability of tools, equipment and components to work
correctly, efficiently and reliably within their specified operational limits. It encompasses
quality standards for hardware, the availability of hardware, the processes for selecting,
purchasing and storing hardware, and the fitness for purpose and quality of the hardware. It
looks at the quality of materials used in tools, equipment and components insofar as it affects
their ability to operate reliably, efficiently and effectively within the limits laid down by the
designer, throughout their lifecycle. Herein lies a clear difference with Design; if the limits
are found to be wrong, it is a Design issue, if a failure occurs within those limits, it is a
Hardware issue.

Features for hardware

Feature Example
Quality standards We are very clear on what quality we want
Change policy There is a clear policy for exchange, update or removal of hardware
Maintainability It is clear how much maintenance is acceptable to keep our hardware
standards in running order
Standardisation We didn’t end up with one machine that is different from all the

PTS 60.0502
JUNE 2006
 41

others
Ageing The hardware we use, is completely up to date
Spares and tools We can get the spare parts or tools that we need to fix this machine
Documentation Information manuals or certificates are adequate and available
and Certification
Storage capacity We can hold all the spares we need
Availability of There are a number of manufacturers, giving us ample choice
choice
Budget We have sufficient budget to purchase all the equipment and tools we
need
Selection of tools I can always find the correct set of tools for the job I am doing, so I
don’t have to abuse any tools
Purchasing We have a good system that allows us to order up any parts or tools
that we need
Stock The spares we order are consistently in stock
management
Acceptance A good pre-acceptance test prevented this potential failure
testing
Feedback We have a system to log performance of all our hardware and feed it
back to manufacturers
Fitness for Great pump, providing the capacity we need.
purpose
Redundant This pump is a leftover from the old line-up, now it’s just in the way.
equipment
Quality The materials and the way it is screwed together are up to scratch
High maintenance The maintenance on this equipment is a lot less than expected
Overstressing We are not abusing this tool, thus it will not break
Note: When thinking of Hardware we should ask: Is the bit of kit right for the job?

PTS 60.0502
JUNE 2006
 42

MAINTENANCE MANAGEMENT (MM)

Maintenance Management is defined as: Systematised management to ensure correct

maintenance of processes, plant, equipment and tools. It encompasses the goals we aim to
achieve with maintenance, the availability of people, time, technical data and maintenance
equipment, the maintenance strategy, planning, co-ordination and failure mode analysis and
the operability we actually achieve with our maintenance effort. The focus is very much on
the development and use of management systems while most issues around the execution of
maintenance are covered under other BRFs. For example, if a maintenance procedure is
failing, it is primarily a Procedures issue, if a tool breaks during maintenance work for which
is was intended, it is still a Hardware issue.

Features for Maintenance Management

Feature Example
Philosophy We made a clear choice for breakdown maintenance for this piece of
equipment
Performance It is clear what availability we should be aiming for
Standards
Safety Criticality We aim to ensure maximum reliability for this safety critical
equipment
Continuity We can stop production to do the necessary maintenance
Contracting The maintenance is done by short term contractors who do know
enough about the plant
Maintenance The manufacturer did supply us with any maintenance procedures
procedures
Tools and We have all the special maintenance kit that goes with this machine
equipment
Time They can expect us to do a proper job in that time
Specialist advice We have somebody who can tell us how to maintain this equipment
Equipment Data is available on breakdown frequencies and potential
history consequences of this equipment breaking down
Planning We have a good system to help us plan our maintenance well in
advance
Co-ordination This is the second time this week we are out of service, first for
electrical maintenance, now for mechanical maintenance
FMEA We do a failure mode and effects analysis for every single bit of kit
on our installation
Feedback We keep telling them it breaks down too often, but nothing is done
about it
Audit and Independent inspection or audit looks into the maintenance
Inspection management
Up-time We achieved a better up time than we had hoped for
Reliability I’m confident that this pump will start up when we need it
Maintenance Knowing the history of this equipment, it’s maintenance frequencies
match and tasks are clearly right
Critical backlog Critical items do not get maintained in time because of backlog
Safety Our maintenance safeguards the safe performance of this equipment

PTS 60.0502
JUNE 2006
 43

Note: Maintenance Management is all about recognising that prevention is better than cure.

PTS 60.0502
JUNE 2006
 44

HOUSEKEEPING (HK)

Housekeeping is defined as: The maintenance of a clean and tidy workplace. It encompasses
the aspirations for cleanliness and commitment that our management shows in enforcing
those aspirations, the availability of people, time, cleaning aids and disposal facilities to
perform housekeeping, the policies, instructions, planning and monitoring of housekeeping
and actual cleanliness and order that we manage to achieve with our housekeeping efforts.
Housekeeping becomes a latent failure when it is neglected for a period of time and when
there is an awareness of such neglect and nothing is done about it. Management visits play
an important role in housekeeping and their absence, abuse or failure to take remedial
actions are clear signs that this BRF is compromised.

Features for Housekeeping

Feature Example
Cleanliness It is clear what is expected of us with respect to housekeeping
standards
Commitment The management does push us at all times to keep things clean
Ownership The mess isn’t our doing; however we will clean it up.
Incentives There are rewards and recognition for cleaning up
Management Site visits are not predictable, so we always clean up.
visits
Time The five minutes at the end of each job isn’t enough to clean properly
Cleaning aids I can get anything I need to clean up after the job
Disposal facilities We have different bins for different types of refuse so I can get rid of
everything
Procedures I have information how to clean up these stains.
People We do have sufficient staff to keep our working environment clean
Instruction We are always told during the toolbox talk what we need to clean
after the job
Monitoring We have a management visit every month, that helps to keep us on
top of housekeeping
Housekeeping We spend the last 10 minutes of every job cleaning up the workplace
routine
Housekeeping We have a system to periodically clean up every area and have
management assigned responsibilities to do so
Feedback Senior management is really aware of the situation, and is taking
action
Orderliness I don’t have to spent hours trying to locate these bits, they always in
the same place.
Cleanliness You could eat your lunch from this machine
Discipline People around here throw their waste in the bin, you don’t have tell
them
Overkill We are forced to spend way too much effort on all this housekeeping

Closing remark:

Housekeeping is about a place for everything and everything in its place.

PTS 60.0502
JUNE 2006
 45

ERROR-ENFORCING CONDITIONS (EC)

Error Enforcing Conditions are defined as: Conditions, circumstances and situations which
will significantly increase the chance that errors or violations will occur. They encompass
our working standards and social norms, the availability of systems for controlling climate,
lighting, noise and other aspects of our working environment, the way we manage personal,
physical and human relation issues and the culture that we achieve with our efforts. Error
Enforcing Conditions manifest themselves by the increasing likelihood that inadvertent
errors or deliberate violations occur and have a serious consequence. In the presence of
hazardous conditions they can easily lead to injury or damage. Error enforcing Conditions
may be environmental (e.g. weather), social (e.g. over confidence, macho culture) or
physical (e.g. tiredness). An error enforcing condition is usually triggered by a change from
the norm, where a person’s ability to function in his/her environment is compromised, and
where existing best practice procedures and habits are likely to be ignored or changed.

Features for Error Enforcing Conditions

Feature Example
Working “Safety first” is the consistent and clear message we are getting
standards
Social pressures I don’t want to stand out from the rest of the crew, so I go along with
this banter
Policies We have a clear policies on e.g. substance abuse and working in
adverse weather and I know how to implement these
Change The situation had slightly changed, making our normal way of doing
less dangerous
Personal I am very competitive, usually sociable but a bit grumpy in the
standards mornings
Climate control In areas where people work continuously temperature and humidity
are conditioned
Lighting We can read the gauges because there is sufficient light
Noise dampers I can sleep at night because the living quarters are quite.
Time I don’t feel pressured to finish this job before the end of my shift
Expert advice Counselling is available to help me deal with my personal problems
Man management Personal , personnel or contractual problems are being dealt with
effectively
Work We are not left to fend for ourselves, everybody seems to bother.
management
Group Morale, cultural or interpersonal problems etc. can be discussed
management openly and solutions are being sought
Self management I know myself well enough to stop when I need to
Error We have checks and balances to catch errors and omissions before
management they become critical
Change We are not excessively vulnerable during crew change
Hostile Rain, wind, darkness and cold etc. make life pretty dangerous at
environment times
Unfamiliarity The job or situation is new to us, so every step needs thinking
through

PTS 60.0502
JUNE 2006
 46

Lapses of It is difficult to keep concentrating under these conditions

concentration
Errors and We regularly deviate from the procedures, either intentionally or
violations unintentionally

PTS 60.0502
JUNE 2006
 47

Note: Error Enforcing Conditions is about realising that flying by the seat of your pants is not the best method of dealing with
unexpected problems or opportunities.

PROCEDURES (PR)

Procedures are defined as: A clear, formal description of tasks to be undertaken at the
operating interface between people and equipment. They encompass our aims for the
amount, level of detail and role that we assign to procedures, the availability of information,
materials, time and people to manage our procedures, the systems for control, quality
management and distribution of procedures and the transparency and fitness for purpose that
we achieve with our procedures. Procedures should provide a formal, step by step
description of the safest and most efficient way of carrying out a particular task or operation.
They aim to capture the accumulated wisdom and practical knowledge gained through
operating experience. They should be in a clear, unambiguous form that can be understood
and utilised by a competent person who may not, however, have recent experience of the
task. If these aims are met, but some individuals still choose to ignore procedures, it is likely
that other BRFs like Error Enforcing Conditions or Training are to blame. Deficiencies in
policies, management systems and standards are often mistakenly attributed to Procedures,
but these will usually point to other BRFs. For example if our equal opportunities policy was
not followed, this would be an Error Enforcing Condition; only if a specific personnel
selection procedure proves to be ambiguous can we consider it to be a Procedures issue.

Features for Procedures

Feature Example
Philosophy There is a clear philosophy on which operations do & don’t need
procedures
Standard formats All our procedures are written to an agreed standard format
Complexity of Procedures are needed because the tasks are too complex to
tasks remember
Legislation Legislation forces us to have a demonstrable record of the way we do
things
New technology We have to write new procedures to be able to operate this new
technology
Availability We did receive operating procedures with this piece of kit
Technical We do have somebody in the company that has the knowledge to
expertise write this procedure
Medium A procedure in the form of interactive computer software would be
much better than this huge pile of paper
Budget We do have sufficient budget to review these procedures
Support We have sufficient support to and manage, update and distribute
procedures
Distribution We have a system to control the distribution of new procedures so we
can be certain that we always have the latest version
Validation If they had asked us before introducing this procedure, these errors
could have been avoided
Change process It is clear how to go about getting this procedure changed
Procedure We have a structured approach to reviewing procedures and all
management responsibilities are defined

PTS 60.0502
JUNE 2006
 48

Feedback When we find errors in the procedure, we know who to speak to

Transparency This procedure is easy to follow and contains all the necessary
information
Fitness for The procedure fits the equipment we’ve got
purpose
Integration of With this procedure, the hazard assessment is included, so writing the
safety permit is easy
Quality The printing of this procedure is readable
Adherence We have very few deviations from procedures

Note: Procedures are, in the ideal world, a foolproof guide to the job for a competent person.

TRAINING (TR)

Training is defined as: Provision of appropriate instruction to develop competence to enable

everyone to carry out their jobs safely to the required standard. It encompasses the
competence standards, the availability of training courses, venues, means, trainers, mentors,
time and the opportunity to attend training, the methods for managing courses, nominations,
feedback and qualifications and the effectiveness, compatibility and competence achieved by
our training efforts. Training aims to develop competence in procedures, equipment and
systems to enable safe working practices to be undertaken efficiently. This can be through
coaching/mentoring as well as through formal training courses. Inappropriate competence
can be attributable to Organisation to start with, but when this competence is not developed
with time, Training is likely to by the culprit.

Features for Training

Feature Example
Competence It is clear why I am supposed to know all this stuff
standards
Accreditation This training will lead to my accreditation
Personal We have a program for improving our personal skills like negotiating,
development meeting effectively, interpersonal relationships etc.
Skill shortages We have to send people to this course because nobody knows how to
do the job
Technology We have to retrain all our people in these new computer skills
changes
Training The training centre had all we needed to practice our actions
resources
Instructors We did have enough instructors to help all of us with the tasks
Training time The number of days training we are allowed to spend each year are
enough to keep up with developments
Availability The waiting list for this course is too long
Budget The total training budget of the department is sufficient for our needs
Training methods There are clear guidelines when training should be formal, on the job,
by apprenticeship or by exercises etc.
Organisation and Every year, my training is assessed and courses planned accordingly
planning

PTS 60.0502
JUNE 2006
 49

Nomination We have a clear system for nominating people for training

Competence I have to sit an exam to prove that I am competent
testing
Follow-up There was no follow up to establish if the training did have the
required result or if the training had sufficient quality
Fitness for I really could apply what I learned in the course to the job
purpose
Competence I can prove that I am competent to do this job safely
Training quality The course was time well spent!
Timeliness I only got to go on the course too late, after I had finished the task
Intervention Somebody in the line struck me off this course for no apparent reason

Note: When thinking of Training you should ask: Have I got the knowledge and the skill?

COMMUNICATION (CO)

Communication is defined as: The transmission and understanding of essential information.

It encompasses the needs and reasons to communicate, the availability of communication
hardware, people and time, the communication channels, language and interference and the
measure of success that we achieve in transferring our information. Communication aims for
a clear, unambiguous and intelligible transmission of information to the right person at the
right time to ensure a safe and effective functioning of all or part of the organisation.
Communication can break down if the necessary communication systems or channels do not
exist, if the information is not sent or is sent too late to be of use or if the information is
misinterpreted or ignored by the recipient. Whenever there is a misunderstanding between
people there is likely to be a Communication failure. Persistent misunderstanding can
however point at Procedures, Organisation or Training. For example loosing the line of sight
when using hand signals to your crane driver is a Communication issue, however if you
consistently use the wrong hand signals Training might be implicated.

Features for Communication

Feature Example
Need for We need to be kept informed about the status while we are doing this
information job
Standardisation We are aiming to standardise signals across all areas
Threats Nobody wants to be the messenger of the bad news
Disturbance A special means of communication is needed in the high noise area
Technology We have to measure and communicate a lot more indicators than we
used to
Hardware We have got enough portable radio’s to go around
availability
Information I have means of directly communicating to all relevant people
channels
Opportunity I did get a chance to discuss our plans before we started on the job
Somebody to I tried to ring them time and time again, without getting an answer
answer
Information skills I know how to operate these radios and computers

PTS 60.0502
JUNE 2006
 50

Language I understand the accent of some of my team members

Information There is a clear method to identify, assess and implement the
management communication structures needed
Selection We really know what information is to be transmitted, to whom and
with which priority
Protocol We have a clear understanding when to use particular
communication methods (hand signs, verbal, written, electronic etc.)
Feedback The receiver always feeds back to the sender to check that the correct
message has been received
Clarity I am always 100% clear what they mean
Inform. overload The message may have been received, but got lost in a large pile of
others
Interpretation of They placed my information in the wrong context
information
Distortion Parts of the message were unreadable
Timeliness They send me that message ages ago, by the time I needed the
information I had forgotten

Note: Communication is all about providing the right information to the right person at the right time.

INCOMPATIBLE GOALS (IG)

Incompatible Goals are defined as: The increase in risk arising from the conflict between
different and unbalanced priorities. They encompass criteria for setting and prioritising
goals, the availability of time, money, people and means to achieve goals, the methods used
for assessing priorities and managing conflicts and the effects we suffer from conflicting
goals. Conflict between the different priorities and goals of individuals, groups
(departments) and the organisation can create latent failures, particularly when management
give little or no guidance on the priorities. The conflicting goals that are inevitable in any
organisation are particularly likely to generate accidents under extreme time pressure. Errors
are also likely when employees are forced to continuously choose between optimal working
methods and the pursuit of production, financial, political, social and individual goals.

Features for Incompatible Goals

Feature Example
Hierarchy of We have policies which describe our main priorities
goals
Acceptance We always know which goals to accept and which to reject
criteria
Personal priorities If it was up to me personally, we would do things differently
Progress With every passing year, the environmental targets get more stringent
Change This change is redefining the goalposts again
People We have sufficient people to achieve all our goals
Means The equipment, procedures, technical backup is all available to
pursue our goals
Time We have been given sufficient time to achieve our goals
Money To be able to achieve our aims we are going to need a lot more

PTS 60.0502
JUNE 2006
 51

budget
Expertise We have somebody in our team who is able to prioritise our goals
Priority setting In our planning meetings we prioritise the tasks in hand
Defining actions We are usually able to translate our goals in to appropriate actions
Programs We have a structured program for achieving our goals, one after the
other
Management Our management is pretty good at juggling the different priorities
Feedback I do think our management knows what the results of their demands
are
Balance We are able to keep a reasonable balance between our goals
Sense of direction I am sure where they want us to go, the goals seem to contradict
Achievements We have achieved 3 of our goals completely and are well on our way
of achieving the others
Clarity It is clear to me what they are expecting with regards to this goal
Flexibility We managed to change our plans when the goalposts were moved
earlier this year

Note: Incompatible Goals are all about keeping on the tightrope when different weights keep getting added to your balancing pole.

PTS 60.0502
JUNE 2006
 52

ORGANISATION (OR)

Organisation is defined as: The implications for safety management from the way the
company is structured and conducts its business. It encompasses our organisational culture,
policies and standards, the availability of manpower, budgets and support systems, the
definition of responsibilities, tasks and authorities, the planning and co-ordination of tasks,
the competence and discipline of people and the transparency, flexibility and ability to
manage change that we achieve in our organisation. The structure of the company, its
business philosophy, organisational processes and management strategies should prevent
safety responsibilities becoming poorly defined and warning signs being overlooked. The
organisation plays an important role in many other BRFs, for example, Maintenance
Management or Housekeeping are implicated if we fail to organise for specific maintenance
or housekeeping tasks. Only if this failure to organise is persistent or widespread for the
majority of tasks is Organisation implicated. Competence can be an Organisation issue when
we are suffering from a widespread lack of competence, if this situation persists however,
Training is the more likely BRF.

Features for Organisation

Feature Example
Business drive Business is booming, so we have to expand our organisation
Organisational We aim to build a flat organisation, without separate staff
goals departments
Change The changes in economic climate force us to reduce our staff
Re-organisation This company is forever re-organising without much success it seems
Culture Our company really attempts to empower the workforce
Skill pool We just do have enough specialists available
Office space We have grown out of our offices, we really ought to move
People We need more people to do the job
Career prospects We are not losing a lot of people due to lack of career prospects
Budget Because we are able to pay top wages, we attract the best people
Defining We have clearly defined responsibilities
responsibilities
Structure Everybody knows who he is reporting to
Competence We have systems in place to develop the competencies of all staff
assurance
Contracting We effectively supplement our own staff with contractors when
required
Management We have an effective management system based on a recognised
systems standard
Discipline It seems some people don’t work the hours they get paid for and
waste an awful lot of time
Flexibility We are quite good at moving people around the organisation to meet
our changing needs
Transparency It is clear what this department is doing in our organisation
Contingency Whenever there is an emergency, we keep control
Ability to manage After each change, we manage to respond and improve our business
change performance

PTS 60.0502
JUNE 2006
 53

Note: Organisation is all about not letting it slip between the cracks. It is your responsibility!

PTS 60.0502
JUNE 2006
 54

DEFENCES (DF)

Defences are defined as: Mitigation of the consequences of human and/or technical failure.
They encompass legislation, performance standards and commitment to improve H,S&E, the
availability of people, time, systems and PPE to manage hazards, the processes for managing
hazards and the level of safety that we achieve with our efforts. Breaches in the Hazard
Management Process (Identify, Assess, Control and Recover) implicate Defences. For
example, if an incident occurs during a critical activity and it transpires that elements of the
workscope are not described in the Permit to Work, the identification of hazards will have
failed, constituting a breach of Defences. Defences usually only apply to safety critical
systems or activities. The majority of our control and recovery measures consist of
procedures, pieces of hardware that need to be designed and maintained or skills like fire
fighting that need to be trained. Often the BRFs related to these activities are implicated
rather than Defences; only when these measures are absent or are clearly not fit for purpose
can we speak of a Defences failure. For example if a fire detection system fails because of
insufficient maintenance, Maintenance Management is most likely to be implicated. Only
when it transpires that we failed to define the correct maintenance requirements to meet our
performance standard, we should consider it a Defences failure.

Features for Defences

Feature Example
Legislation Legislation forces us to constantly improve our safety measures
Performance We have clear standards for all our safety critical equipment and
standards activities
Commitment We have the commitment to improve beyond the minimum
requirements
Initiatives There are always initiatives in progress aiming to improve safety
Reputation It is very important to protect our reputation so we have to perform
well
Equipment We have insufficient equipment to deal with spills
PPE We have personal protective equipment to deal with all our needs
Means of escape In case of an emergency we have sufficient means of escape
Emergency We don’t have enough people to tackle a major emergency
Response Teams
Specialist advice We have specialist advisors to help us deal with all H,S&E issues
Hazard Mgmt. We have a structured approach to identifying, assessing, controlling
Process and recovering all conceivable hazards
Permit to Work Our PTW system allows for effective execution of our hazard mgmnt
system process
Competence We have a system in place to ensure that we are competent to
assurance perform all safety critical activities
Verification We assume that it all works, but we have no approach to verify this
Lateral learning We are constantly aware of the safety issues around us and apply
those lessons that are relevant to us
Contingency plan We have clear plans to help us deal with contingencies of any kind
Containment We will not be able to contain a spill of this kind
Emergency During our last emergency response training, all scenarios were dealt

PTS 60.0502
JUNE 2006
 55

response with effectively

Misperception of With the benefit of hindsight, we should have known that it was far
risk more risky than we thought
Performance Our LTIF and TRCF have room for improvement

Note: Defences are your “last chance saloon” – be prepared to act in the last stages before accident occurs.

PTS 60.0502
JUNE 2006
 56

APPENDIX IV - REMEDIAL ACTION WORKSHEET - WORKED EXAMPLE

Step 1

Select up to five particularly significant features and fill them in as column headings.

Step 2

Working down the columns or across the rows, ask for examples suggested by the
combination of row with column.

Step 3

Address rows, columns or individual boxes according to concentrations or particular

importance of issues.

Action

In this example we notice the boxes in the columns under ‘Ageing’ and ‘High maintenance’
and in the row, ‘Local habits’ are mostly full.

We may choose to address these issues with high level actions such as:

• set up an ‘ageing hardware’ task force

• conduct a maintenance strategy review

• benchmark our local approach to Hardware management against similar sites

Alternatively, we may decide that a specific action will have a more significant impact, e.g.:

• commit to obtaining a decision on who pays for replacement hardware

• seek agreement with clean up crew on management of clean up.

There is no prescription. No-one knows where the next bright idea will come from. Strive
to keep your minds open and listen carefully to one another.
GFT: HARDWARE Features
STEP ONE: Select up to five particularly significant features

Reasons 1: Ageing 2: Storage 3: Spares 4: High 5:

STEP TWO: Working down columns or
capacity tools
and maintenanc
across rows ask for examples to
illustrate the combination of row with e
column
Custom Industry
“Any examples
where industry
Everybody does it
norms/local habits this
contribute to this
problem?” We had problems Forced to buy Unused spare parts We’re so good at
Local from day 1 but we spares at on site are making do. We
It has grownthis learned to live clearance sale discarded by should let it fall
with them after maker went clean-up crew over once and for
out of business all.
We try to keep There’s never
Decision Poor track of breakdown enough time for
“Any examples
where poor
Not all the facts history but info survey so the
information/ lack known is not reliable. agent’s man is
of decisions/ often called back
people out of No process for Uncertainty of
None managing long term
touch contribute
to this problem?”
What aging/replacement developments makes
issues for difficult
decisions
They’ve no idea Maker went out of
Out of the grief this business
Tooearly, late, piece of kit gives
away us.
Shell & contractor Unclear who is
Responsibilit Not seem to disagree responsible for
“Any examples
where ill-defined/
Whois over who pays for acceptance of
under-used replacement materials
responsibilities
contribute to this Equipment retained
problem?”
Not used after maker went
Failure or out of business
have no

STEP : Address rows, columns

individual
THREE or boxes according
concentrations of issues or
importance with
particular

PTS 60.0502
JUNE 2006
GLOSSARY
For the purposes of this, the following definitions apply.

acceptance criteria Expresses the level of health, safety and/or environmental

performance deemed acceptable for a given period or phase
of activities. They may be defined both in quantitative and
qualitative terms.

accident An 'incident' where “harm” is done to the target.

activity Work to be carried out as part of a process characterised by a
set of specific inputs and tasks that produce a set of outputs
to meet customer requirements.)

activity specification The documentation of an activity outlining the hazard

sheet management objectives when undertaking the activity, the
methods to achieve the objectives, the business controls to
ensure achievement of the objectives and the person
accountable for achievement of the objectives.

acute effect An effect occurring suddenly and immediately / in a short

time following exposure.

As Low As ALARP involves balancing reduction in risk against the

Reasonably time, trouble, difficulty and cost of achieving it. At this level
Practicable the incremental time, trouble, difficulty and cost of further
(ALARP) reduction measures become “unreasonably” disproportionate
to the additional risk reduction obtained.

assessment (or The process of analysing and evaluating hazards. It involves

evaluation) both causal and consequence analysis and requires
determination of likelihood and risk.

barrier A measure put in place to prevent the release of a hazard, or

to provide protection once a hazard or effect is released.
Barriers may be physical (shields, isolation, separation,
protective devices) or non-physical (procedures, warnings,
training, drills).

Basic Risk Factor Underlying organization factor in a system that increases the
vulnerability of the system to being disrupted, i.e. incidents
and / or accidents

‘bow-tie’ diagram A pictorial representation of hazard management from

identification through release to potential consequence if not
managed / uncontrolled. The left side of the diagram is
constructed from the fault tree (causal) analysis involving
those agents capable of releasing the hazard the controls for
each threat and any factors that escalate likelihood. The right
side is constructed from the (hazard) event tree

PTS 60.0502
JUNE 2006
 (consequence) analysis involving preparation made before
hand that bring the released hazard back under control failing
which the measures in place to reduce the severity of the
final consequence. The centre of the bow tie is commonly
referred to as the ‘top event’.

causal analysis The process of determining potential combinations of

circumstances leading to a top event.

chronic release The continuous or ongoing release of a hazard or effect

normally in the form of a discharge, emission or exposure.

Company An organisation engaged, as principal or contractor, directly

or indirectly, in the exploration for and production of oil
and/or gas. For bodies or establishments with more than one
site, a single site may be defined as a company.

Cost benefit analysis The means used to assess the relative cost and benefit of a
number of risk reduction alternatives. The ranking of the risk
reduction alternatives evaluated is usually shown graphically.

Critical activities Activities that have been identified by the Hazards and
Effects Management Process as vital to ensure asset integrity,
prevent incidents, and/or mitigate adverse HSE effects.

Defences All controls, barriers and recovery preparedness measures, in

place to manage a hazard.

Environment The surroundings and conditions in which a company

operates or which it may affect, including living systems
(human and other) therein.

Environmental effect A direct or indirect impingement of the activities, products

and services of the company upon the environment, whether
adverse or beneficial.

Environmental effects A documented evaluation of the environmental significance

evaluation of the effects of the company’s activities, products and
services (existing and planned).

Escalation An increase in the consequences of a hazardous event.

Escalation control Measures put in place to block or mitigate the effects of
escalation factors. Types include guards or shields (coatings,
inhibitors, shutdowns), separation (time and space),
reduction in inventory, control of energy release (lower
speeds, safety valves, different fuel source) and non-physical
or administrative (procedures, warnings, training, drills).

Escalation factor Conditions that lead to increased risk due to loss of controls

PTS 60.0502
JUNE 2006
 or loss of recovery capabilities (mitigation or life saving).
Escalation factors include: abnormal operating conditions,
e.g. maintenance mode, operating outside design envelope;
environmental variations, e.g. extreme weather and tidal
conditions; failure of barriers, e.g. maintenance failure, due
to explosion or fire, introduction of ignition source; human
error, e.g. lapses, rule violations; no barrier provided, e.g.
not possible or too expensive. Escalation Factors may
concurrently affect the control and/or recovery of more than
one hazard.

Evaluation see ‘assessment’

Event An occurrence or situation represented as a node in event

and fault trees (e.g. gas leak, status of gas detection system,
status of ESD system).

Event tree A tree-like diagram consisting of nodes and connecting lines

used to formulate potential escalation scenarios. The nodes
correspond to the different stages in an escalating incident
sequence, and the two lines which lead out of the nodes
correspond to the paths of success or failure in mitigation of
the incident. Event tree analysis evaluates the potential
outcomes following a hypothetical top event. With event
trees one looks ‘forward’ in time to determine what could
occur, e.g. consequence of an event.

fault tree A tree-like diagram showing how hardware faults and

human errors combine using 'and/or' logic to cause system
failures. When quantified, fault trees allow system failure
probability to be calculated. With fault trees one looks
'backwards' in time to determine what has to happen for an
event to occur.

hazard The potential to cause harm, including ill health and injury,
damage to property, products or the environment;
production losses or increased liabilities.)

hazard analysis The systematic process of developing an understanding of

hazards. The process consists of hazard identification,
assessment and risk determination.

hazard assessment The process whereby the results of an analysis of a hazard

are considered against either judgement, standards, or
criteria which have been developed as a basis for decision
making.)

hazardous event The 'release' of a hazard. The undesired event at the end of
the fault tree and at the beginning of an event tree. The

PTS 60.0502
JUNE 2006
 centre point in a Hazard 'Bow-Tie'. Where one hazardous
event is followed by others, then the 'Top Event' is the first
hazardous event. (see Top Event)Hazardous events
include: Loss of Containment, Structural Failure, Dropped
Objects, Exceeding Occupational Exposure Limit, Loss of
Control, Falls to Same Level, Falls to Lower Level,
Oxygen Deficiency, Loss of Separation, Electrical Shock,
and Explosion.

Hazards and Effects The structured hazard analysis methodology involving

Management Process hazard Identification, Assessment, Control and Recovery
(HEMP) and comparison with screening and performance criteria.
To manage a hazard completely requires that all four steps
must be in place and recorded.

Hazards and Effects A hazard management communication document that

Register demonstrates that hazards have been identified, assessed,
are being properly controlled and that recovery
preparedness measures are in place in the event control is
ever lost.

Health, Safety and The company structure, responsibilities, practices,

Environmental procedures, processes and resources for implementing
Management System health, safety and environmental management.)
(HSE MS)
Health, Safety and The broad goals, arising from the HSE policy, that a
Environmental (HSE) company sets itself to achieve, and which should be
strategic objectives quantified wherever practicable.

In PETRONAS terminology this means objectives. Goals

which the organisation wishes to achieve over the long-
term provide a basis for judging progress and
achievements. Strategies provide the framework for plans
to achieve the objectives used as a screen for possible
plans.

Health, Safety and A public statement of the intentions and principles of

Environmental (HSE) action of the company regarding its health, safety and
Policy environmental effects, giving rise to its strategic and
detailed objectives.

incident An unplanned event or chain of events which has caused or

could have caused injury, illness and/or damage (loss) to
assets, the environment or third parties. (The word
'accident' is used to denote an incident, which has caused
injury, illness and/or damage, but the term also has
connotations of 'bad luck' in common speech and is
therefore avoided by others. In this manual, only the term
'incident' has been used - in the above sense which

PTS 60.0502
JUNE 2006
 embraces the concept of 'accident').)An incident involves
the release or near release of a hazard.

initiating factor See 'threat'.

likelihood analysis The process of estimating the likelihood of an event. Also

referred to as probability analysis.

mitigation Measures taken to reduce the consequences of a potential

hazardous event. Mitigation measures include:

• 'active' systems intended to detect and abate

incidents (gas, fire, and smoke alarms,
shutdowns, deluge)

• 'passive' systems intended to guarantee the primary

functions (fire and blast walls, protective coatings, drain
systems) and

• 'operational' systems intended for emergency

management (contingency plans, training, drills).

PTS 60.0502
JUNE 2006
Manual of Permitted Defines the limit of safe operation permitted for a
Operations (MOPO) particular asset if control and/or mitigation measures are
reduced and/or removed with the objective of maintaining
a tolerable level of risk. Considers combinations of hazards
and hazardous events.

performance criteria Performance criteria describe the measurable standards set

by company management to which an activity or system
element is to perform. (Some companies may refer to
performance criteria as goals or targets.))

performance indicator Comparative, quantitative measures of actual events,

against previously specified targets, which provide a
qualitative indication of future projected performance
based on current achievement.

physical effects The estimation of the magnitude of a potential 'top event'

modelling using mathematical models and correlations. The models
and correlations are typically design tools, such as:
dispersion, fire-heat flux and temperature versus time,
explosion overpressures and structural response.

prevention Completely eliminating a threat, escalation factor or a

hazard.

procedure A documented series of steps to be carried out in a logical

order for a defined operation or in a given situation.)

process A logical sequence of inter-related activities.)

Quantitative Risk Quantitative evaluation of the risk imposed by a system
Assessment (QRA) design, whether those risks are from human, hardware or
recovery preparedness software failures, or environmental events, or from
measures(sometimes combinations of such failures/events.
'recovery measures') All technical, operational and organisational measures that
limit the chain of consequences arising from the first
hazardous event (or 'top event'). These can 1) reduce the
likelihood that the first hazardous event or 'top event' will
develop into further consequences and 2) provide life
saving capabilities should the 'top event' develop further.

risk A term which combines the chance that a specified

undesired event will occur and the severity of the
consequences of the event.)

risk classification A rating used to derive an appreciation of the relative risk

from a hazard. The Risk Matrix may be used to assist to
determine this rating. Both the relative probability and the

PTS 60.0502
JUNE 2006
 potential consequence are categorised by 5 point scales.
The product of the two is the risk classification.

risk matrix The matrix portraying risk as the product of probability and
consequence, used as the basis for qualitative risk
determination. Considerations for the assessment of
probability are shown on the horizontal axis.
Considerations for the assessment of consequence are
shown on the vertical axis. Four consequence categories
are included: impact on people, assets, environment and
reputation. Plotting the intersection of the two
considerations on the matrix provides an estimate of the
risk.

routine release See 'chronic release'.

safe A condition in which all hazards inherent in an operation
have either been eliminated or are controlled such that their
associated risks are both below a tolerable threshold and
are reduced to a level which is as low as reasonably
practicable.

Safety (HSE) Case A demonstration of how the Company HSE objectives are
being met in a methodical and auditable reference
document. A completed Case will provide a reference
document to all information relevant to the safety and
health of the operations personnel, environment and
resources on an installation.

screening criteria The values or standards against which the significance of

the identified hazard or effect can be judged. They should
be based on sound scientific and technical information and
may be developed by the company and industry bodies, or
provided by the regulators.

shortfall An area for improvement.

statement of fitness An affirmation by the asset holder that (HSE) conditions

are satisfactory to continue operation.

task A set pattern of operations which alone, or together with

other tasks, may be used to achieve a goal.

threat A possible cause that will potentially release a hazard and

produce an incident. Threat classes include damage caused
by: thermal (high temperature), chemical (corrosion),
biological (bacteria), radiation (ultraviolet), kinetic
(fatigue), electrical (high voltage), climatic condition (poor
visibility), uncertainty (unknowns) or human factors
(competence).

PTS 60.0502
JUNE 2006
threat barrier All measures taken to reduce the probability of release of a
hazard. Measures put in place to block the effect of a
threat. Types include guards or shields (coatings,
inhibitors, shutdowns), separation (time and space),
reduction in inventory, control of energy release (lower
speeds, safety valves, different fuel source) and
administrative (procedures, warnings, training, drills).

tolerability criteria Expresses the level of risk deemed tolerable for a given
period or phase of activities. May be expressed
qualitatively or represented quantitatively on the Risk
Matrix by shaded areas.

top event The 'release' of a hazard. The undesired event at the end of
the fault tree and at the beginning of an event tree. The
centre point in a 'Bow-Tie' Diagram.

worst case consequence The worst possible HSE consequence in terms of harm
resulting from a hazardous event. For this to occur, all
critical defences in place must have failed.

PTS 60.0502
JUNE 2006
GLOSSARY OF ABBREVIATIONS

A glossary of commonly used abbreviations in used specifically in the PTS guides.

ALARP As Low As Reasonably Practicable

CEN Comité Européen de Normalisation
CFC ChloroFluoroCarbon
CML Centrum voor Milieukunde (University of Leiden)
E(I)A Environmental (Impact) Assessment
EMAS Eco-Management and Audit Scheme
E&P Exploration and Production
EPI Environmental Performance Indicator
EVABAT Economically Viable Application of Best Available Techniques
EMS Environmental Management System
ETSAR Environmental Target Setting And Ranking
EU European Union
FAR Fatal Accident Rate
GES Global Environmental Standards
HCFC Hydro Chloro Fluoro Carbon
HEMP Hazards and Effect Management Process
HFC HydroFluoroCarbon
HIA Health Impact Assessment
HRA Heath Risk Assessment
HSE Health, Safety and Environment
HSE MS Health, Safety and Environment Management System
IAG Internal Audit Guidelines
IABC Internal Audit Board Committee
IPIECA International Petroleum Industry Environmental Conservation Association
ISO International Organisation for Standardisation
JV Joint Venture
LCA Life Cycle Assessment (sometime also referred to as Life Cycle 'Analysis')
LTI Lost Time Injury
LTIF Lost Time Injury Frequency
LSA Low-Specific-Activity
MEE Minimum Environmental Expectation
MS Management System
NGO Non-Governmental Organisation
NORM Naturally Occurring Radioactive Material
NVO New Venture Organisation
OBM Oil-Based Mud
PERI Public Environment Reporting Initiative
PI Performance Indicator
PGBC Petronas Guidelines for Business Conduct
REIM Ranking of Environmental Investments Model
SBM Synthetic-Based Mud
SETAC Society of Environmental Toxicology and Chemistry
SD Sustainable Development
SIA Social Impact Assessment
SPE Society of Petroleum Engineers

PTS 60.0502
JUNE 2006
TRC Total Recordable Cases
TRCF Total Recordable Case Frequency
TROIF Total Reportable Occupational Illness Frequency
VIR Vehicle Injury Rate
VOC Volatile Organic Compound
WBM Water-Based Mud
WICE World Industry Council for the Environment

PTS 60.0502
JUNE 2006