Has Reason’s Cheese gone stale?

Courtesy of James Reason, the Swiss Cheese Model has advanced thinking considerably in the explanation, and in the prevention, of major accidents in the energy industry. Reason forced us to think in more than one dimension and to consider ‘defences in depth’ to avoid undesirable events happening in our industry. These defences include hardware, people, systems and processes.

Reasons ‘Defences in Depth’, 1997


In recent years, industry has adopted many tools, processes and models based on this barrier model aimed at preventing and minimising the risk of Major Accident Hazards being realised. This has without doubt progressed the understanding of the primary causal factors of these events, but we are still, with an unnerving regularity, having unplanned hydrocarbon releases and major accidents. In the UK North Sea, hydrocarbon leaks have reduced in recent years, however, in the period April 2013 to April 2014 there was a 20% increase in leaks (source HSE). This year alone, four workers were killed and several injured, following a fire and explosion on the Pemex Abkatun platform in the Gulf of Mexico, and six workers were killed on the Cidade de Sao Mateus FPSO in Brazil following a pump room explosion.

Certainly, there will have been in-depth analyses carried out by investigators to understand what barriers have failed and resulted in these tragic events. We have a very effective tool to analyse and present these findings through the barrier model, but, it did not prevent the event. Is this because Reason’s model was not applied, not understood, or limited in some other way?

I think there is a limitation of this model, which is this – it is targeted at avoidance of an undesirable event in isolation. To offer a simple analogy of football, if the only strategy was to avoid conceding goals, we wouldn’t be a very successful team. A holistic approach would have a strong defence, midfield and forwards. We would have clear strategies for developing the performance of the team as a whole, identifying barriers to improving overall performance, not just defending. We would have arrangements in place to reflect on performance and identify what areas require further improvement.

By adjusting our mindset to go beyond barriers to avoiding undesirable events happening, we would open up fresh thinking and new ideas, such as identifying barriers to Best Practice. By understanding the barriers to best practice we could strengthen our prevention safeguards and create a larger gap between daily operations and the risk of a major accident, and at the same time, providing significant leeway when organisational drift reduces performance over time.


Moving towards Best Practice

Moving towards Best Practice













Of course, it can be argued that this is just another way of presenting an ‘ALARP’ justification, but there is a difference. In our day to day management of operations, if we think ‘what can I do today that will make a shift towards better practice’, rather than the approach of ‘what do I need to do to meet a minimum standard’ then new opportunities arise. It might be something as simple as focussing on better quality risk assessments for work activities, or investing more effort in integrity management strategies, or looking at opportunities for the team to work more to its strengths.

During the design stage of major developments, how well do we really meet Inherent Safety in Design goals (rather than falling into the reverse ALARP trap)? Testing the design against best practices, and taking into account all the necessary trade-offs, will result in a safer design and a smoother passage through regulatory assessment.

Taking yet another view, Dave Brailsford of Team Sky provides a powerful example of moving towards best practice over a long period of incremental improvements, or as he called it;

the aggregation of marginal gains

To address the question raised in the title of this blog, Reason’s cheese model has been immensely successful in advancing preventive measures, and is perhaps not yet stale! But we need new metaphors to energise our thinking and to move to a different level of performance and we need alternative models to stimulate fresh debate on achieving best practice.







Systems Thinking – a fresh way of looking

Systems Thinking – a fresh way of looking…

Image courtesy of Michael Leunig

In our energy industries, how many thorny issues keep recurring, how do we find it difficult, if not impossible to get to the root of issues and make changes that make a difference in the long term?  Why is there often conflict and surprises when a well-intended intervention is made? Why do procedures get blamed when things go wrong?  There are many examples, but here are two from my own experiences;

  • Electronic Permit to Work Systems (read as a technical system) are intended to simplify maintenance and hazardous activities, whilst improving safety and operating efficiency. Over several years of the energy industry implementing such systems, electronic Permit to Work systems have added complexity, they have not reduced the frequency of failures in Control of Work, and the operating efficiency of the workforce has decreased considerably in recent years, where at best, an offshore installation may achieve 6 to 7 productive hours from any individual worker each shift.
  • Major Capital projects have run extraordinary late, averaging at least one year, and often more, beyond budget completion dates. As an inevitability, costs have also spiralled to orders of magnitude higher than original budgets, where the economic viability of the project itself becomes threatened. These outcomes are real, but the paradox is that every operating company is majoring in ‘Capital Efficiency’, and within the context of a mature industry that has been executing major projects for fifty years. A rational view would expect such a developed industry to be highly efficient at major project delivery, with advanced technology and experienced project teams in abundance.

With these two scenarios, what explanations can be offered to make sense of these puzzling dynamics…?

These examples illuminate the difficulty in dealing with real world complexity. To clarify, this is not scientific, mathematical or engineering complexity. This is the point! Managing real world complexity is to acknowledge that people, organisations, values, goals and behaviours are crucial factors when trying to find explanations for ‘systems’ that are not working. To treat human endeavours as a technical difficulty will result in a messy situation.

This is exactly the world of Systems Thinking. This approach invites a fresh way of looking at problems. The critical distinctions which make this approach different are:

  • It is holistic, rather than reductionist
  • It takes into account multiple perspectives (that all have different goals)
  • Causes and events are interconnected by feedback loops, rather than linear thinking
  • Systems of interest are used to understand interconnections, relationships and purpose

In very simple terms, it means stepping out of the weeds, and appreciating the whole situation, understanding the relationships and interconnections between events, behaviours and the underlying systemic structure.

Systems Thinking embraces these principles and with a range of methods, tools and approaches, allows new ways of looking at problems. For example, a systems approach to Permit to Work would use methods to explore why individuals are driven to populate the system with too much information creating the situation where the worker has a rucksack full of information to read before he can carry out a routine task. Aspects such as leadership behaviours or attitudes to blame would be much more important than the technical system in play.

With the Capital Project example, taking a Systems approach would require a concerted effort to understand the perspectives of supply chain dynamics, it would look at the historical cycles of the skilled labour market, and it would look at how projects are organised and how they collaborate across organisational boundaries.

The proof is in the eating of course. I have adopted a systems approach to a range of issues for many years, both on small and larger interventions. And from my experiences, all I can say is that it works.

Does it need an intensive period of study to put it into practice? My view is not. To acknowledge the principles of stepping back and thinking holistically is already a giant step forward.