A Technique for the Retrospective and Predictive Analysis of Cognitive Errors for the Oil and Gas Industry (TRACEr-OGI)

Abstract

Human error remains a major cause of several accidents in the oil and gas (O&G) industry. While human error has been analysed in several industries and has been at the centre of many debates and commentaries, a detailed, systematic and comprehensive analysis of human error in the O&G industry has not yet been conducted. Hence, this report aims to use the Technique for Retrospective and Predictive Analysis of Cognitive Errors (TRACEr) to analyse historical accidents in the O&G industry. The study has reviewed 163 major and/or fatal O&G industry accidents that occurred between 2000 and 2014. The results obtained have shown that the predominant context for errors was internal communication, mostly influenced by factors of perception. Major accident events were crane accidents and falling objects, relating to the most dominant accident type: ‘Struck by’. The main actors in these events were drillers and operators. Generally, TRACEr proved very useful in identifying major task errors. However, the taxonomy was less useful in identifying both equipment errors and errors due to failures in safety critical control barriers and recovery measures. Therefore, a modified version of the tool named Technique for the Retrospective and Predictive Analysis of Cognitive Errors for the Oil and Gas Industry (TRACEr-OGI) was proposed and used. This modified analytical tool was consequently found to be more effective for accident analysis in the O&G industry.

1. Introduction

In the recent past, human error has been blamed for most of the serious disasters in the oil and gas (O&G) industry. Alexander L. Kielland (1980) with 123 fatalities, Ocean Ranger (1982) with 84 fatalities, Glomar Java Sea (1983) with 81 fatalities, Piper Alpha (1988) with 167 fatalities and Sea Crest (1989) with 91 fatalities all show that poor decisions and human error were at fault. Most of these errors were traced to the structure, culture and procedures of the organisation [1]. Gordon [2] asserts that accidents similar to the examples above demonstrate that the interaction of human, technical, organisational, social and environmental factors all affect the output of a very complex system.

Lord Cullen’s recommendations following the Piper Alpha explosion and fire in 1988 were the origin of the Offshore Installations (Safety Case) Regulation 1992 which is implemented to reduce the risk of hazards emerging from major accidents on offshore installations [3,4]. The Safety Case regulation required offshore industries in the UK to perform risk assessments for new and existing platforms. In the context of this requirement, the duty holder is responsible for identifying hazards, evaluating risk and carrying out accident analysis with the aim of demonstrating that measures are implemented to reduce any risk as low as is reasonably practical (ALARP) [4]. A trend of offshore accidents and their fatalities before and after the Safety Case regulation is shown in Figure 1 below [5].

It could be argued that following the recommendations of Lord Cullen’s (1990) report after the Piper Alpha ordeal, there has been a wave of legislative change and improved commitments by oil companies worldwide [6,7]. For example, the Royal Commission recommended the enactment of the Australian safety case regulation for major hazard facilities (similar to the UK Safety Case) following the investigation into the Esso Longford Gas Plant explosion and fire in September 1998 which killed two workers, caused colossal damage to the plant and left a major area of the State of Victoria without gas for 10 days [8]. Moreover, although Norwegian offshore regulations date back to the 1960s, following the UK Safety Case regulation and the creation of UK HSE, the Norwegian Petroleum Safety Authority (similar to UK HSE) began in 2004 to regulate petroleum activities in the Norwegian Continental Shelf (NCS).

Human Error and Performance Influencing Factors

Arguably, legislation like the UK Safety Case regulation seems to drive improvements in health and safety management in some parts of the world [9]. For example, following the regulation, conscious attempts have been made to reduce human error in offshore oil and gas facilities [4]. Therefore, many human error identification (HEI) tools have been developed for the process industry worldwide to aid accident investigators and to learn from incidents. Notable examples of these tools include the Generic-Error Modelling System (GEMS) [10,11,12], the Human Factors Investigation Tool (HFIT) for Accident Analysis [13], the Cognitive Reliability Error Analysis Method (CREAM) [14], the Technique for Human Error Rate Prediction (THERP) [15], the Human factors analysis and classification system for the oil and gas industry (HFACS-OGI) [16], the railway accidents (HFACS-RAs) [17]. the Predictive Analysis of Cognitive Errors (TRACEr) [18,19,20] and System Action Management (SAM) [21]. Over time there has been steady progress in the development of these tools that has aided accident investigators and helped extract vital information from process accident reports. Despite this however, substantial barriers remain in the development and application of human error identification and accident analysis tools in the O&G industry.

2. TRACEr Taxonomy

Unlike other human error identification, TRACEr is a human error identification tool that considers the human machine interface, the cognitive framework of the end user coupled with external factors that may affect the user’s performance. It takes into account the physical (e.g., intoxication, fatigue), the psychological (e.g., state of mind, stress, decision-making) and the external (e.g., organisational factors, weather). This combination of characteristics presents an open image of the event [20,22]. TRACEr was developed in line with two models, namely the Model of Human Information Processing (M-HIP) and the Simple Model of Cognition (SMOC). The first model, the M-HIP developed by Wickens [23], was based on investigating how physical parameters affect the cognitive process. In this model, human information processing is the basis of human performance as this determines how an individual perceives and processes information before making decisions [24]. The second model, the SMOC [14], contains elements of cognition and their interactions, including planning/choice, observation/identification and action/execution [14]. Although a detailed explanation of the TRACEr taxonomy is beyond the scope of this paper, a brief explanation is offered. TRACEr has seven taxonomies divided into three major divisions (

Table 1. Levels and subdivisions of TRACEr taxonomy [20,22].

Major Divisions	Categories
Context of the incident	Task Error Error Information Casualty Level
Operator Context	4. External Error Mode (EEM) 5. Cognitive Domain Internal Error Mode (IEM) Psychological Error Mechanism (PEM) 6. Performance Shaping Factors (PSF)
Error Recovery	7. Error Recovery

): (1) Context of the Accident; (2) Operator’s Context and (3) Error Recovery [20,22]. These are further divided into subdivisions for a more effective coding process as shown in Table 1 below.

Although TRACEr was initially developed for retrospective, predictive and real-time accident analyses in air traffic control [20], other high risk industries such as maritime and railways have used successfully modified versions of TRACEr [19,24,25,26,27]. However, there are scarcely any published accounts where TRACEr has either been modified for the O&G industry or used in its original form for accident analysis. A TRACEr taxonomy for the O&G industry therefore would be both useful and obtainable, as in other high risk industrial sectors. Consequently, the aim of the present study is twofold: (1) to analyse retrospective accident cases using TRACEr to determine specific adaptations necessary to make it more effective for the O&G industry (Section I); (2) to propose a TRACEr taxonomy for the O&G industry: TRACEr-OGI (Section II).

3. Analysis of Retrospective Offshore Accident Cases Using TRACEr (Section I)

3.1. Data Collation and Analysis

3.1.1. Data Collation

To analyse retrospective accident cases using TRACEr, 167 accident reports with at least one fatality or extensive damage to the facility were retrieved from the International Association of Oil & Gas Producers (IOGP) database. IOGP is the single association representing companies involved in the exploration and production of oil and gas at a global level to establish reliable data. IOGP data is collected and analysed through known international practises, so there should be a high probability that the content and structure of the data provides reliable information about these accidents. Furthermore, only accidents with full details or those in which the investigation was completed were used in this analysis.

3.1.2. Data Coding Process and Analysis

Publically available IOGP offshore accident reports were coded based on TRACEr’s seven subdivisions (

Table 2. Illustration of the sequence of TRACEr categories/taxa identified from the accident reports.

Year	No of Accidents	Supervision						LEVEL TOTAL
		Drilling	Production	Operations (Flaring, Completions)	Well Logging/TESTING	Crane Operations	Electrical/Mechanical Operations
2000	1	1	0	1	0	0	1	3
2000	1	1	0	0	0	0	0	1
2000	1	1	0	1	0	1	0	3
2000	1	0	0	0	0	0	0	0
2000	1	0	0	0	0	0	0	0

). The coding involved identifying the subdivisions associated with TRACEr that contributed to these accidents. Each report was read thoroughly before the coding process. The presence of any given ‘taxon’ was coded 1 to indicate the presence of a category or 0 to indicate the absence of a category, as illustrated in Table 2 below. The coded data was cross-tabulated for statistical analysis and categories that were not present in any of the accidents were excluded.

4. Result and Discussion of Analysis Using TRACEr

4.1. Context of the Incident

A total number of 2615 errors were coded from 163 accident reports between the years 2000 and 2014 in Offshore Platforms. Following a thorough evaluation of the accident reports in three categories, the first level of the TRACEr taxonomy analysis was as follows: Task Error (56%), Error Information (24%) and Casualty Level (20%).

The percentages of main actors in the reviewed accident’s chain of events are shown in Figure 2 below, while accident classifications are shown in Figure 3.

4.1.1. Task Errors

This paper has considered only offshore accidents. However, these accidents are also related to mobile drilling units (MODUs), mobile production units (MOPUs), Monohulls and all fixed offshore units. Monohulls include floating production storage and offloading (FPSOs), floating storage vessels (FSOs), Floating Offshore Production Units (FPUs) and Floating Storage Units (FSUs). The fixed offshore units considered were bottom-fixed installations (manned or unmanned) designated for accommodation, drilling, production, compression, injection/riser, pumping or a combination of these [28].

The Task Error Categories were as follows: supervision, standard operation procedure, external communication, internal communication and handover/takeover (Figure 4). Internal communication was found to be present in 55% of the 587 task errors coded. Supervision and external communication were present in 29% and 12% respectively, making them the second and third most significant trends.

4.1.2. Error Information

It is important to identify the equipment used in any activity that has led to an accident [22]. Much could be learned from technical equipment in the lead up to accidents, including improving the system of work, job procedures, industry standards and guidance and equipment design (ergonomics) among others. Results have shown that the main error information represents 24% of the accidents coded. However, details of the Technical Equipment shown in Figure 5 below shows that equipment involved in 58% of accidents are drilling tools, drilling pipes, risers and drill collars. Most of these form part of the drilling string. Another example of technical equipment is the Control System at 34%. Attention was also given to alarm systems monitoring gas releases and other surveillance systems. These were involved in 4% of the total accidents coded. However, the coding of most equipment errors was challenging.

4.1.3. Casualty Level

The final and coincidentally the lowest level within the Context of the Incident is the Casualty Level (Figure 6). This is because it occupies 20% of the Context of the Incident and the total number of accidents analysed.

The Primary High Casualty which characterised accidents that have led to fatalities or permanent disabilities was 10%. The Primary Low Level of Casualty involved accidents with significant but not necessarily permanent injuries. The Secondary High Level involved accidents that caused minor injuries but led to severe damage to equipment while the Secondary Low Level involved accidents with minor or no injuries and minor or no damage to equipment.

4.2. Operator Context

The first category of TRACEr taxonomy (Context of the Incident) focused more on identifying the errors, the location in which they took place and the people involved. The second category (Operator’s Context) is the largest level of the TRACEr taxonomy. As noted earlier, this category focuses on the factors that may or may not have influenced the performance of the operator. From Table 1 above, the operator context was analysed under three headings: External Error Mode (EEM), Cognitive Domain divided into Internal Error Mode (IEM) and Psychological Error Mechanism (PEM) and Performance Shaping Factors (PSF). A total of 1326 errors were coded for the Operator’s Context which accounts for 50.71% of all errors coded. The Operator’s Context was further analysed based on categories of observable outcomes presented in Figure 7 below: External Error mode (EEM) (18%), Cognitive Domain (IEM) (52%), Cognitive Domain (PEM) (25%) and Performance Shaping factors (PSF) (5%). Analyses of the Cognitive Domains (IEM, EEM and PEM) are shown in Figure 8, Figure 9 and Figure 10 below.

4.2.1. Cognitive Domain-External Error Mode

The External Error Mode evaluates the observable outcomes of the external errors shown in Figure 8: Communication, Selection/Quality and Timing/Sequence. The analysis showed poor selection/quality at (57%) of the EEM category, Poor communication at (26%) followed by inappropriate timing/sequence at (17%).

4.2.2. Cognitive Domain (Internal Error Mode)

A total of 692 errors were coded under the cognitive domain internal error mode representing 52% of the Operator’s Context (Figure 7 above). Further analyses of observable outcomes are shown in Figure 9 below. They cover action, decision-making, memory, perception and violation. The IEM considered in the first category, Action, are Selection error (32%), Timing error (31%) and Information transmission error (29%). Selection errors typically involve mistakes in the selection or choice of procedure, method or equipment for a particular task. The timing errors were due to time lapses. This could include actions that were not performed in time or errors performed coincidentally at a time when equipment failed, or an operator was found to be handling another task. Other errors in this category include information transmission error, errors due to actions not performed, data entry errors and the recording of unclear information.

The second category of the IEM is Decision-making, including Poor decisions and planning (41%) and Late decision/planning (36%), followed by No decision/planning (15%). Incorrect or reflex decisions are made instantaneously or in an attempt to save a situation, thereby jeopardizing safety. For example, an operator tries to stop a falling object but is crushed by it.

The next category, Memory, involves the failure to monitor a process that should be under scrutiny thereby resulting in an accident. This includes Forgetting to monitor (46%) and Forgetting to request for or give information (35%). The perception error which relates to the main internal error mode category has a high relationship with the Not detected category (40%). This involves errors from failures that were not detected, for example failures in the system or equipment. The last category of the IEM is violation and relates to routine violations. These occur due to complacency in job routines or an underestimation of the dangers involved.

4.2.3. Cognitive Domain (Psychological Error Mode)

Although there are two major branches of psychology that have a bearing on errors in safety and reliability, namely social and cognitive psychology, this paper is majorly on the cognitive aspects. The psychological error mode in the Cognitive Domain had 332 coded errors out of an overall 1326 for the Operator’s Context. The PEM is 25% of the Operator’s Context and is related to the perception category similar to the case of the IEM as seen in Figure 10 below.

The first category of the PEM, Action, is further broken down into Confused state (50%), Distraction (21%) and Fatigue (29%) as illustrated in Figure 10 below. The relationship between Action and Confused state is clearly illustrated. The Confused state is a state of mind in which fatigue and stress are likely to be contributory factors. The second category of the PEM is Decision-Making, which relates to the mindset category at 51%. Most decisions, especially in the context of incidents are strongly linked to the mindset of the personnel involved. The third category of the psychological error mode is Memory at 11%, in relation to the sub-level miscommunication at 50% which involves errors in communication during the various interactions between workers. The fourth and largest category of the PEM is Perception. Perception is linked with vigilance as evident in Figure 10 below at 78%. The category of vigilance evaluates the state of alertness and observance of the personnel on duty. Vigilance can also be influenced by a state of confusion or expectation which is evident when the employee expects the error to be averted by any other factor. The final category of the PEM is Violation which relates to complacency (58%). Complacency is strongly influenced by states of overconfidence, pressure and stress while on duty.

4.3. Further Discussion

The analysis covered all areas including the context of the incident, operator context and error recovery. It was found that poor communication remains a major precursor to offshore accidents. This involved internal communication between the officers in charge and the personnel on duty, communication between the crane operators, drillers, floor men, roustabouts and other operators working hand in hand to ensure productivity on offshore platforms. However, major communication issues also involved drillers and assistant drillers. In most of the drilling operations on the platform, several injuries arose from tasks carried out by more than one operator simultaneously with no adequate communication as to when each person’s task should be implemented. As noted by Graziano et al. [19] in the classification of human errors in grounding and collision accidents, it is difficult to use TRACEr to classify mechanical errors in the O&G industry caused by sudden facility failure without direct human participation.

The Operator’s Context revealed incorrect perception and therefore poor decision-making as its major contributor. The Performance Shaping Factors also formed part of the Operator’s Context but it was revealed that its contribution to the whole was not significant. However, in this capacity, the major contributors to human error were the organisational factor Training and the personal factor Competence which has had an effect on major events. TRACEr moreover appeared to neglect some organisational factors contributing to error occurrence in the O&G industry. Baysari et al. [18] recommended modifications to include the following categories: environmental factors, infrastructure design/condition and safety. It may also be useful to consider these additional human factors as seen in the process industry: (1) personal/team factors (2) key job factors and (3) organisational factors.

The major contributors to Error Recovery were failures in the functional barrier system Primary Low Casualty level, in the context of the incident. It is recommended that the taxonomy be specifically adapted to make it more effective for the O&G industry.

5. Development of TRACEr for the Oil and Gas Industry (TRACEr-OGI) (Section II)

The results of Section I showed that the three major divisions and seven categories of TRACEr are flexible and adaptable to the O&G industry. However, the tool could benefit from the addition of more tasks and sub-tasks specific to this industry. For example during the coding process, the following common factors were difficult to code: failures due to inadequate facility (equipment error), national and international regulatory framework/standards, administrative duties such as inspections and enforcement of regulations and resources. Since the tool was designed to identify human factors which feed into human errors, the alignment of its taxonomy to the following major human factor contexts, namely job context, organisational/facility context and operator context would particularly enhance its usability in the O&G industry.

To ensure that the core theoretical underpinnings and framework of TRACEr are not lost in the development of the oil and gas version, existing versions (

Table 3. List of TRACEr modifications and field of study reviewed in the development of TRACEr for the Oil and Gas Industry (TRACEr-OGI).

Studies Title/Reference	Technique (s) (TRACEr Version)	Field of Study	Predictive or Retrospective	Key Modifications, Recommendations and Use
Development and application of a human error identification tool for air traffic control [20]	TRACEr (Original)	Aviation (ATC)	Both	Comprehensive taxonomies describing context error, operation error and error recovery.
Error Classification for Safety Management: Finding the Right Approach [31]	TRACEr-lite (Derivative)	Rail	Retrospective	Simplification of TRACEr (IEM) and (PEM) to create TRACEr-lite’s internal (modes and mechanism).
Development, use and usability of TRACER-RAV(technique for the retrospective analysis of cognitive errors—for Rail, Australian version) [26]	TRACEr-RAV (Derivative)	Rail	Retrospective	Modified to be more user-friendly and comprehensive than The original Rail. Addition of Psychological Error Mode. Addition of classification (other rail personnel). Removal of error correction performance factors.
A reliability and usability study of TRACEr-RAV: The technique for the retrospective analysis of cognitive errors e for rail, retrospective [25]	TRACEr-RAV Australian version (Derivative)	Rail	Retrospective	Changed and simplified the original taxonomy categories to be shorter. Two violations types were removed. Addition to the information error category.
The classification and analysis of railway incident reports [27]	TRACEr Nottingham University version	Rail	Retrospective	Application of TRACEr in the railway context. Modification of performance shaping factors category to capture wider issues such as procedure and documentation, training and experience and communication.
Human error in European air traffic management: the HERA project [24]	TRACER- (the HERA project) Derivate Original	Air traffic management (ATM)	Both	TRACER is used for ‘HERA’—Human Error in Air Traffic Management (ATM) project.
Classification of errors contributing to rail incidents and accidents: A comparison of two human error identification techniques [18]	A comparison of HFACS and TRACEr-rail version	Rail	Retrospective	TRACEr is unable to capture factors associated with error occurrence. TRACEr-rail appeared to neglect some organisational factors contributing to error occurrence. Baysari et al. [18] recommended modification to include categories for environmental factors, infrastructure design/condition and safety culture (norms, organisational customs, etc.).
Predictive Analysis of Controllers’ Cognitive Errors Using the TRACEr Technique: A Case Study in an Airport Control Tower [32]	TRACEr (Original)	Aviation (Airport control tower)	Predictive	Application of TRACEr in airport control tower.
Structure of human errors in tasks of operators working in the control room of an oil refinery unit [24]	TRACEr (Original)	Oil and Gas (Refinery Unit)	Retrospective	Application of TRACEr in the refinery unit context.
TRACEr-MAR—applying TRACEr in a maritime context [33]	TRACEr-MAR	Maritime Context	Retrospective	Application of TRACEr in a maritime context.

below) and applications were reviewed to identify the taxonomy that would benefit the sector. The proposed modification also took into consideration oil and gas technical reports such as the 2014 Society of Petroleum Engineers (SPE) technical report The Human Factor: Process Safety and Culture. It was produced after a two-day summit held in July 2012 on human factors affecting the O&G industry and the best way forward [29]. As an example, the concept of offshore managed pressure drilling (MPD) or the MPD system and its effect on human performance was reviewed, focusing on human error. The communication structure during MPD offshore drilling operation is shown if Figure 11 below.

Furthermore, other techniques and taxonomies have been used in the O&G industry, for example HFACS-OGI, a modification by Theophilus et al. [16]. Investigation tools for the petroleum industry, human factors investigation tool (HFIT) developed by Gordon [13], were also reviewed. Following team discussions with 10 oil and gas professionals and 40 oil and gas scholars, it was determined that TRACEr for the O&G industry should retain three major divisions. These are: (1) Context of the Accident; (2) Operator’s Context and (3) Error Recovery which also take into account the physical, psychological and external factors. Following these reviews, the following TRACEr for the O&G industry (TRACEr-OGI) (

Table 4. Levels and subdivisions of TRACEr-OGI taxonomy.

Major Divisions	Category	Subdivisions Example (Not Exhaustive)
Context of the incident	Task Error	Task error relate to WHAT is the task performed unsatisfactorily by (e.g., the drilling supervisor, drilling engineer, mud engineer, driller,… (Supervision, Standard Operation, Handover/Takeover, well testing, crane operations, electrical/mechanical operations, job hazard analysis and material and equipment)? selection). WHERE was the task performed (e.g., fixed platform, floating production storage and offloading, FPSO, helidecks, etc.)? WHO performed the task (e.g., the drilling supervisor, drilling engineer, etc)?
	2. Error Information	Error Information relates to: Equipment involved (e.g., drilling string, blow out preventer BOP, alarm system, control system, surveillance system, etc) Information not taken into account (size, dimension, etc).
	3. Equipment Error	Equipment Error relates to: Mechanical integrity (e.g., design error, installation error, operational error, corrosion, poor maintenance, inadequate inspection, etc.)
	4. Casualty Level	This defines the level of casual contribution. Minor Major Catastrophic
Operator Context	5. External Error Mode (EEM)	This is potential external error. This is majorly: Error of omission Error of commission Extraneous error
	6. Cognitive Domain Internal Error Mode (IEM) Psychological Error Mechanism (PEM)	The subdivision relates to the five cognitive domains originally proposed by Shorrock and Kirwan [20] and the addition of the sixth called sabotage. It focuses on the cognitive framework that potentially applies to the error coded. The cognitive domains are: Perception; Memory; Decision-Making; Action; Violation and Sabotage In the first four categories the error is non-intentional while in the last two categories ‘‘Violation and sabotage” the error is considered as an intended violation of rules. These two (IEM and PEM) represent the cognitive function that failed. For example: risk recognition failure poor decision-making no decision
	7. Performance Shaping Factors (PSF)/Human Factors	Relates to factors that influence the performance of the crew. The PSF categories for TRACEr-OGI are based three key areas involved in the oil and gas industry as follows IOGP [34]: Personal/Team factors Job factors Organisational factors
Control Barriers and Recovery Measure	8. Hardware Barriers	Relates to ‘primary containment, process equipment and engineered systems designed and managed to prevent loss of primary containment (LOPC) and other types of asset integrity or process safety events and mitigate any potential consequences of such events. These are checked and maintained by people (in critical activity/tasks) [35]’. Categories of hardware barriers implemented by the oil and gas industry are [35]: Structural Integrity Process Containment Ignition Control Detection Systems Protection Systems—including deluge and firewater systems Shutdown Systems—including operational well isolation and drilling well control equipment. Emergency Response Life-saving Equipment—including evacuation systems
	9. Human Barriers	Relates to ‘barriers that rely on the actions of people capable of carrying out activities designed to prevent LOPC and other types of asset integrity or process safety events and mitigate any potential consequences of such events [35]’. Categories of human barriers implemented by the oil and gas industry are [35]: Operating in accordance with procedures, e.g., Isolation of equipment overrides and inhibits of safety systems, shift handover. Surveillance, operator rounds and routine inspection Authorization of temporary and mobile equipment Acceptance of handover or restart of facilities or equipment Response to process alarm and upset conditions Response to emergencies

and Figure 12 below) has been proposed:

5.1. Analysis of the Proposed Taxonomy for the Oil and Gas Industry (TRACEr-OGI)

5.1.1. Context of the Incident

As noted in Table 1 above, Task Error deals with particular tasks, their locations and who performed them. In this paper, all information that helped to uncover any task error was taken into consideration. Categories based on the rig, the floating production storage and offloading (FPSO) and the decks were considered, among others. The user tasks classified for these locations are Supervision, Standard Operation Procedure, External Communication, Internal Communication, Hand-Over, and Take-Over.

The O&G industry is characterised by the rapid and steady technological development of essential safety critical equipment [36]. Examples are alarm systems, control systems and surveillance systems, etc. The second context of the incident Error Information was used to classify information not taken into account (size, dimension, etc.) [4,21,22]. This information is usually connected to the exact location where the error occurred, for example deck dimension, vessel size, etc. [22].

The third context of the incident and a major modification is the addition of Equipment Error used to classify mechanical errors. Although TRACEr considers both equipment and information not taken into account, Graziano et al. [22] noted that TRACEr could not code mechanical errors caused by sudden facility failure without direct human participation. In the O&G industry, there is a very strong relationship between the contributory elements of asset integrity, namely personnel integrity, operational integrity and mechanical integrity [37]. Studies have shown that these three elements are ‘interrelated and the performance of one element has a great influence on the others’. [37] Typical examples of equipment error in the O&G industry include corrosion, Struvite related pipe explosion, cavitation, hydrogen shock, thermal fracture and pressure burst, among many others [37,38].

The last context of the incident is the Casualty Level, which for TRACEr-OGI was divided into minor, major and catastrophic levels. The catastrophic level involves accidents that led to fatalities and extensive facility damage, the major level involves incidents that resulted in major facility damages or severe/permanent injuries, while the minor levels involve accidents with minor damage to equipment and slight injuries to personnel requiring first aid attention.

5.1.2. The Operator’s Context

As in the original TRACEr, this section of the taxonomy focused more on the internal and external factors that affect the performance of the operator. The Operator’s Context includes (1) the External Error Mode (EEM—

Table 5. External Error Mode Taxonomy of observable outcomes.

External Error Mode
Communication	Selection/Quality	Timing/Sequence
Transmitted Incomplete information	Too little Action	Prolonged Action
Recorded Incorrect Information	Omission	Late Action
Failure to transmit information	Too much action	Early Action
Recording unclear information	Wrongly Directed Action
Transmitting unclear Information	Right on Wrong Object Action
Failure to Record Information	Wrong on Right Object Action
Failure to sort information or sorting wrongly	Wrong on Wrong Object Action

) and (2) the Cognitive Domains encompassing Internal Error Mode (IEM—

Table 6. Internal Error Mode Taxonomy observable outcomes.

Cognitive Domain:	Example
Perception	Not detected, Late Detection, Read Amiss, Hear Amiss, See Amiss
Memory	Late/Omitted Action, Forgetting to Monitor, Forgetting to request for or give information, Forgetting temporal information.
Judgement, Planning and Decision-Making	Wrong decision/Planning, No decision/Planning, Late Decision/Planning, Read Amiss, Hear Amiss, See Amiss, etc.
Action Execution	information transmitted error, timing error, selection error, action not performed, data entry error, recording wrong unclear info
Violation	Routine Violation Intended Violation (In routine and intended violation, there is no intention to cause deliberate harm)
Sabotage	In this form of violation, all layers of protection are deliberately removed with the intention to cause harm.

) Psychological Error Modes (PEMs—

Table 7. Psychological Error Mode taxonomy.

Cognitive Domain: Psychological Error Mode Observable Outcomes
Action	Decision-Making	Memory	Perception	Violation
Confused State	Mind-set	Over Confidence	Confused State	Over Confidence
Intrusion of Habit	Failure to consider side or long effect	Memory Overloaded	Vigilance	Complacency

) and Performance Shaping Factors (PSFs—

Table 8. Performance shaping factor/human factor [16,40].

Human Factor Categories	Performance Influencing Factor Categories	Performance Influencing Sub-Categories
Personal/Team Factors	Individual factors	Health, Emotional tension, Age, Gender, etc.
	Dependent factors	Skill level, Contractor adaptability, Knowledge and Experience, Motivation, Safety awareness, Personal/team factors/competence, Supervision, Tiredness, Stress, and Fatigue, Illness, Discomfort, Workload, Crew resource management, Personal readiness, etc.
Job Factors	Anthropometry	Basic layout of the working environment
	Environment and Factors (e.g., working conditions)	Weather, Timing, Physical environment (e.g., physical conditions like temperature, humidity, light, noise, etc.), Contractor Environment, Technological Environment, etc.
	Design of Human-Machine Interface (HMI)	Positioning and layout of HMI, Usability, Quality of feedback, etc.
Organisational Factors	Employee related factor	Organisational Policies, Process Safety Culture, Safety Climate, Resource management, Organisational process, Management of change, Inattention, Staffing (clearness in responsibilities), Level of training and instruction on work/task, Inadequate supervision, Supervisory violations Planned inappropriate operations, Failed to correct known problem, etc.
	Standard factor	Company standards, rules, and guidance, Task design Permit to work, Safe system of work procedure, etc.
	External influences	International industry standards National regulatory framework, Approved Code of Practice (ACoP)

) [22,39].

Performance Shaping Factors (PSFs) represent a key modification of the Operator’s Context in the TRACEr-OGI proposition. The PSFs classify those factors which influence or are capable of influencing the performance of the operator or team, thereby aggravating the error occurrence or also assisting in the error recovery [25]. Baysari et al. [18] observed that TRACEr-rail appeared to neglect some organisational factors contributing to error occurrence and has recommended modifications to include environmental factors, infrastructure design/condition and safety culture (norms, organisational customs, etc.). However, TRACEr-OGI also proposes the inclusion of Performance Shaping Factors (PSF) and Human Factors categories to better capture all latent factors. Examples which could affect performance in the O&G industry (e.g., on offshore platforms) considered for this study are illustrated in Table 8 and Figure 13 below.

5.1.3. Control Barriers and Recovery Measures

Control Barriers and Recovery Measures are the final categories of the TRACEr-OGI taxonomy, divided into Hardware Barriers and Human Barriers [35]. They assist in observing and understanding whether or not barriers to prevent threats and causes of accidents and measures to recover from the consequences of events have worked successfully. Where the barriers have worked, the incident entry is classified as a near miss and where they did not work, it becomes an accident. That said, near misses were not considered in the context of this study. Figure 14 below illustrates a generic arrangement of control barriers and recovery measures in the O&G industry.

6. Reliability and Usability of the Proposed TRACEr-OGI

Following the modifications to TRACEr, it was anticipated that TRACEr-OGI would be less difficult to use, more suitable and more comprehensive in identifying errors and moreover, could be applied more consistently (i.e., show greater inter-rater reliability). The inter-rater reliability is the most critical criterion on which to judge a taxonomy [25]. Inter-rater is a measure of the extent to which different raters give the same coding for the same observed performance [13,41]. Another critical criterion when adopting a tool in a new context is its usability (is it ambiguous or easy to use?) [20,25,26,42]. Improved usability will mean less errors and improved consistency [25,42]. Therefore, the inter-rater reliability and usability of the two human error identification tools were compared: TRACEr and the proposed TRACEr-OGI. To achieve this, eighteen participants were required to use TRACEr and TRACEr-OGI to code a notable offshore accident following the procedure outlined in Section 3.1 above. The participants were nine Oil and Gas Engineering MSc students and nine Petroleum and Environmental Technology MSc students. All participants had oil and gas related undergraduate degree with some previous work experience in oil and gas industry. Before the coding process, participants took an 11 week long process safety module with specific topics on human factors (HF) and human error identification (HEI). They had also used TRACEr for a coursework exercise. IBM Statistical Package for the Social Sciences (SPSS) 24 was used to determine the inter-rater reliability for each of the rater pairs within a group. In line with the method outlined by Baysari et al. [25], the participants were given a usability questionnaire at the end of the coding process for both TRACEr and TRACEr-OGI. IBM SPSS 24 was also used to derive the proportion (%) in each group that agreed with the usability questionnaire statements.

Results

The most common error categories chosen by the raters were the Causality level (where 96% and 97% of raters chose this category); the Cognitive Domain (93% and 92%) and Error Information (93% and 92%) for TRACEr and TRACEr-OGI respectively (

Table 9. Average percentage agreement from all participants using TRACEr and TRACEr-OGI.

Categories	% of Raters Who Found this Category to Be a Cause of the Accident
	TRACEr	TRACEr-OGI
Task error	94	78
Error information	93	92
Equipment Error	-	72
External error modes	65	75
Cognitive domain	91	93
Internal error modes	77	83
Psychological error mechanisms	65	79
Performance shaping errors	89	80
Causality level	96	97
Control Barriers and Recovery Measure	-	90
Mean	67	84

below). It should be noted that the new categories of Equipment Error and Control Barriers and Recovery Measures were consequently nil for TRACEr, but scored 72% for TRACEr-OGI in Table 9 below. It could be argued that subcategories of Control Barriers and Recovery Measures, which are divided into easily identifiable oil and gas barriers, simplified error identification at 90% (Table 9). Significantly, mechanical errors caused by sudden facility failure without direct human participation which had been difficult to capture using TRACEr [22], could now be captured with TRACEr-OGI. Raters noted that it was now easier to code errors due to failures in process equipment.

A key statistic for the measurement of inter-rater reliability was Cohen’s kappa, developed by Jacob Cohen [43]. Values of Cohen’s kappa can vary from 0 to 1, where a value of 0 denotes no agreement between raters, while a value of 1 reflects perfect reliability between raters. The essence of this reliability test was to ascertain whether TRACEr-OGI would obtain a percentage agreement of at least 70%. The results for the raters with Kappa values ≥ 0.6 (named R1 to R4) are displayed in

Table 10. The percentage agreement among raters for TRACEr-OGI.

Raters * (R)	Percentage Agreement	Kappa (k) *	p-Value	Percentage Agreement	Kappa (k) *	p-Value
	TRACEr-OGI			TRACEr
R1 vs. R2	91.6%	0.746	0.00	86.7%	0.725	0.00
R1 vs. R3	92.7%	0.764	0.00	84.6%	0.679	0.00
R1 vs. R4	88.5%	0.644	0.00	83.9%	0.664	0.00
R2 vs. R3	91.6%	0.724	0.00	86.7%	0.723	0.00
R2 vs. R4	89.5%	0.669	0.00	87.4%	0.738	0.00
R3 vs. R4	92.7%	0.753	0.00	89.5%	0.779	0.00

* Only inter-raters with Kappa values ≥ 0.6 were rename R1 to R4 and shown. Cohen suggested the Kappa result be interpreted as follows: values ≤ 0 as indicating no agreement and 0.01–0.20 as none to slight, 0.21–0.40 as fair, 0.41–0.60 as moderate, 0.61–0.80 as substantial, and 0.81–1.00 as almost perfect agreement [44].

below. Columns 3 and 6 show the rater pairs with a substantial level of agreement, having a Cohen’s kappa value above 0.6. In instances where Cohen’s kappa values of 0.644 and 0.669 (TRACEr-OGI) and 0.679 and 0.664 (TRACEr) were observed, for consistency these values are said to be at the threshold of acceptability. The Kappa value was found to be satisfactorily consistent as there was at least 83.9% agreement between the rater pair under consideration and all the values were significant at a level p < 0.05. However, TRACEr-OGI had a better overall percentage agreement.

The majority of the raters as shown in

Table 11. Participants rating of ease of use.

Questions	TRACEr	TRACEr-OGI
How easy did you find it while completing the steps?	78	83
Where the instructions/directions easy to follow?	78	89
Did you find the category descriptions easy to use?	78	83
Did the tool cover all of your errors/factors?	78	83
Were the categories independent?	56	61
Were the examples included helpful?	94	89
Was the recording form easy to use/follow?	100	94

found the steps of both TRACEr (78%) and TRACEr-OGI (83%) easy. However, more raters found TRACEr recording form easier to use than that of TRACER-OGI.

7. Discussion and Conclusions

Learning lessons from the analysis of a large set of offshore accident data could help to improve safety performance. Hence, the present study aimed to apply TRACEr in the O&G industry to determine changes required to make the tool more useful and effective and to propose TRACEr-OGI, a version specific to the industry. This tool was used for a systematic and retrospective analysis of 163 offshore accident reports. It was shown that the tool was useful in identifying task errors, predominant contexts in which these errors occurred and any contributory factors. Results found that poor communication remains a major precursor to offshore accidents, including internal communication between officers in charge and personnel on duty, communication between crane operators, drillers, floor men, roustabouts, and other operators working on offshore platforms. Major communication issues were also found to involve drillers and assistant drillers. Several injuries arose from a lack of communication between operators working simultaneously on drilling operations tasks. The Operator’s Context revealed errors in perception and subsequent poor decision-making as its major contributors. The Performance Shaping Factors formed part of the Operator’s Context but its overall contribution was insignificant. Overall, the major contributors to human error were the organisational factor Training and the personal factor Competence. The major contributors to Error Recovery were failures in the functional barrier system Primary Low Casualty level, in the context of the incident. It is recommended that the taxonomy be specifically adapted to makes it more effective for the O&G industry or used with another human factor analytical tool.

This study was limited by a number of factors. Some of the reports were not sufficiently exhaustive to reveal the true state of the accident. Hence, error detection was a challenge in these situations. Accident codes under violations, both routine and intended, were challenging as it was difficult to assess whether the employee acted deliberately or out of ignorance or reflex. Again, it was challenging to ascertain the state of mind of an individual before the violation leading to an accident had occurred. For example, it was difficult to identify when stress, pressure, confused state or overconfidence under the psychological error mode was involved. Moreover, the classification of errors using the TRACER and TRACEr-OGI may sometimes be subject to interpretation with respect to accident reports. In such cases, the experience and knowledge of the analyst are as important as the systematic coding of the events.

In conclusion, the results showed that the specific adaptation of the taxonomy for the O&G industry would be useful, or that it could be used with another human factor analysis tool. For example, although it proved difficult to use TRACEr to code equipment failures, TRACEr-OGI was not only able to identify human errors aligned to job context, organisational/facility context and operator context, it was also able to capture equipment error. It was shown therefore that TRACEr is sufficiently flexible and adaptable for the O&G industry. Although as expected the results of the modification made marginal difference in usability and reliability, TRACEr-OGI enhanced percentage rater agreement. It also made the coding of key aspects of oil and gas facility failures possible. The results of the modification therefore could inform potential decisions that will aid offshore process safety development.