Introduction
This chapter presents some elements of an ongoing study investigating the way in which safety is produced in normal operation within a ‘large technical system’ (LTS) operating high pressure gas transmission networks. Although relying strongly on the original manuscript of the 2011 resilience engineering symposium (Le Coze et al., 2011), this new version, apart from updating and expending some sections, opens up more on the ‘engineering’ part of the study, or what we have described elsewhere for instance as the move from description to prescription (Le Coze et al., 2012). In particular, in this new version, one core issue that is raised, beyond the ability to provide descriptions of resilience (or variability, as it will be next explained), is how outsiders participate in the way an organisation manages safety, for example, through the prescriptions that take shape as a result of the descriptions (and interpretations) that they provided.
This is an important part of any safety research. Indeed, the opportunity to develop safety research with practical purposes (for example, maintaining or improving safe operations) requires being in a position to produce a favourable environment, in which different categories of people (for example, top managers, managers, operators) are, at the start, interested, then convinced about the value of the approach. Although an important part of any safety endeavour, these issues are not always transparent in scientific publications, and this chapter intends to start reflecting on this. This contribution has therefore an experimental nature, mixing both descriptions and how these descriptions, intentionally or intentionally, influence the ‘object’ of study.
High Pressure Gas Transmission Network as a Large Technical System (LTS)
The analytical category of LTS was developed about 20 years ago to describe numerous infrastructures (networks) that appeared to share common features. One pioneer in the field is the historian of technology Hughes (1983) who studied the electricity network, from its invention to its wide spread throughout society in North America. This work allowed in the following years a spark of interest in the research community and to gather other researchers already partly involved in this area (two important conferences were held in the 1980s on this subject, leading to the publication of two books, Mayntz, Hughes, 1988, La Porte, 1991). In all these contributions, it is made explicit that beyond the electrical case studied by Hughes, it is interesting to identify a much wider category of systems, which, according to Joerges (1988: 24), ‘(1) are materially integrated, or “coupled” over large spans of space and time, quite irrespective of their particular cultural, political, economic and corporate make-up, and (2) support or sustain the functioning of very large numbers of other technical systems, whose organisations they thereby link’. For this author, examples of LTS can, as a consequence, be ‘integrated transport systems, telecommunication systems, water supply systems, some energy systems, military defence systems, urban integrated public works’ and so on.
Of course, with a safety perspective, a very well-studied case of LTS comes to mind: aviation. From pilots’ psychological models elaborated by psycho-cognitive scientists to cabin crew communication and coordination issues (leading to crew resource management programs) as well as ATC studies (Air Traffic Control) by ergonomists (Sperandio, 1977) and high reliability organisation researchers (Roberts, Rochlin, 1987), there is a very large literature dedicated to the safety aspects of this particular LTS. However, other LTS have not been granted as much attention as aviation in the past decades of research on safety, at least to the authors’ knowledge. For example, one can think of electrical grids or gas transmission networks, to which serious safety issues are associated.
For instance, a ‘black out’ can have severe indirect consequences on the exploitation of highly hazardous technological installations depending on such networks. A recent incident in a nuclear power plant in Sweden in 2006 showed very well this issue when its diesel generators failed to start as expected for cooling down the reactor’s core, following a ‘black out’ of the electrical network supplying energy. Although an indirect consequence, the centrality of such an LTS requires that its functioning becomes an integrated part of prevention of major hazard. As far as high pressure gas transmission networks are concerned, they can have direct (as well as indirect) consequences. One such direct consequence is the loss of containment of pressurised gas, leading, potentially, to explosions and fires which may cause several casualties.
The Threat Of ‘External Interference’
One of the specificities of the gas transmission networks in general is that they are opened to potential ‘external interference’. Indeed, pipelines are not confined within the boundaries of an industrial site. They cover a very wide geographical area, and represent in France a total of around 40,000 km (Figure 2.1), operated by two different companies (south-west and rest of France).
Figure 2.1 The French gas transmission network
As a result, one specific safety activity that has been considered in this study is the identification and prevention by the exploiting company of ‘external interferences’ on gas pipelines. For an LTS such as high pressure gas transmission networks, any urban, municipal or civil engineering (from now on in the text described as ‘UMCE’) work carried out nearby pipelines and requiring drilling or digging with tractors is a potential threat to their integrity.
Ghislenghien’s Disaster (2004)
The accident of Ghislenghien in Belgium in 2004 (24 persons killed, 132 severely injured) is one illustration of the type of scenario which can lead to major consequences. This accident was caused by a weakened pipeline’s structure following an ‘external interference’, which would have been caused, from a ‘sharp end’ point of view and according to the current explanations, by a truck involved in UMCE nearby. After hitting the pipeline without noticing and/or informing the operating company about it, the incident remained totally unknown until the pressure increased in the pipeline and that the weakened structure, where the tractor hit, failed to contain the rising pressure. It created a high pressure gas leak, which led to a rupture and then to a huge flame when ignited by a source of energy (Figure 2.2).
This disaster is an illustration of the challenge faced by companies managing high pressure gas transmission networks for identifying, locating and assessing any works being performed nearby their pipelines.
Case Study Introduction: Managing the Threat of Mechanical Damage on Gas Transmission Pipeline
As stated, the threat of external interference, leading to mechanical damage and potentially adverse consequences, is at the heart of safety management systems of gas transmission operating LTS. The present study, involving one of the two French companies operating a 32,000-km gas network, focused on this specific risk of external interference, aiming to grasp the complexity of managing prevention measures.
Figure 2.2 Ghislenghien’s disaster (2004)
In a nutshell, several levels of preventive measures, ranging from national initiatives to local ones, are put in place to monitor and adequately respond to this risk. Empirical observations have been restricted to local measures in this study. At this level, prevention is based on a decentralised mode of organisation: indeed, for a given territory, a ‘sector’ (composed of a team of between 6 and 12 individuals, in this case study it was 6) is in charge of the maintenance and the surveillance of pipelines. The sector selected by the company for the study was considered as a ‘good’ one, with good results and with a good image within the organisation. Located in a complex urban context of a major city, it requires a high level of interaction between many different actors including engineering contracting and subcontracting companies, municipal employees, architects and so on. It is thus representative a priori of resilience characteristics of the LTS.
Observing and Engineering Resilience In LTS
Elements of Methodology
The approach retained for describing, understanding and explaining the activity of a team within a sector (S1) involved in prevention of ‘external interference’ (through the angle of resilience) relied on participant observations and interviews in 2010. A similar study was then conducted in 2011 in a different type of sector (S2), but methodologies were similar, although refined in the second study given the knowledge of the first empirical case study. In 2012, managerial activities (MA2) were explored (after a first series of series of interviews in 2011 with middle managers interviews MA1) but neither are introduced or discussed in this chapter. In this chapter, we refer mainly to empirical data of S1, although in the engineering section, a broader view is offered of the interaction between the different empirical studies. Interviews were conducted with the manager of the team and then the team members, with a focus on three of them involved, directly or indirectly, in ‘external interference’ prevention activities.
Interviews were performed at times collectively but also individually, and oriented on specific topics, depending on the function of the interviewee. Questions covered different topics included task complexity, expertise required (technical, relational) for handling work situations, relationship at work between employees and management, training, information flows about work issues and incidents and so on. The same people were sometimes interviewed twice, in order to come back on some aspects missed in the first interview or deepen our comprehension of the activities.
Furthermore, participant observations of activities within and outside the sector premises were performed, consisting in taking into account technological interfaces, communication and coordination between employees, and also understanding the different steps followed for performing tasks while interacting with employees from UMCE companies. When possible, some observed activities were questioned ‘on the spot’ (as someone learning his job would probably do). For example, following a decision that seemed to rely on a judgment that was unclear from an outsider point of view, it was asked of the employee, when possible, to explain about the rationale behind his/her decision. The idea is to get to know some of these implicit judgments that one observes in work situations and which provides some clues about the acquired expertise of the agents.
The main purpose of these series of interviews and observations was to get close to the specificity of the work activity at the ‘sharp end’. When interviews and observations were done separately by researchers, feedback sessions were organised between the observers in order to cross data, and discuss interpretations and hypotheses. Five days were spent observing and interviewing. This ‘immersion’ within the activity of the sector was prepared few weeks before, by a description and understanding of the more global (regulatory, economical and political) context of this LTS. Several meetings with knowledgeable engineers and managers in this domain allowed the team of observers to get to know the context.
Elements of Theory
Theoretical background for this study includes disciplines such as engineering, psychology, cognitive science, management and sociology applied to safety. The notion of resilience (Hollnagel et al., 2006, Hollnagel, 2009) has been approached in our studies through the concept of variability, and we would tend to see resilience, although this is not definite at this stage, as the positive side of this variability. In theory, and in light of our empirical data, the whole issue seems to have become, from a safety management point of view:
• First, to be able to locate, describe and understand the variability considered to be a problem for safety (negative variability), then try to eliminate or compensate for this variability.
• Second, to be able to locate, describe and understand the positive variability (resilience) in order to maintain, support, share and officialise it when and if found relevant to do so.
• Third, to be able to locate, describe and understand the neutral variabilities, namely the variabilities that are not considered to be a problem but only alternative ways of doing a specific job.
• Fourth, to be able to locate, describe and understand the ambiguous variabilities namely specific practices without clear signs about their positive, negative or neutral sides.
What is interesting with these distinctions from a theoretical point of view is that it is possible, for instance, to indicate variabilities that people agree to be negative but remain engrained in the functioning of the LTS because of the lack of solutions available to make them evolve. These become part of the latencies well documented in safety after disasters, since Reason’s formulation (Reason, 1990). There are some examples available in our data for such situations. If these situations are local practices allowing the job to be done, they are not necessarily in theory expected to be maintained. Such a problem is to be dealt at managerial levels.
Of course, there are a lot of obstacles along the way to obtain a clear-cut categorisation in real-life situations that could be applied on a daily basis. First, variabilities observed (whether positive, negative, neutral or ambiguous) only make sense in relation to other variabilities that can somehow compensate each other. Any situation combines multiple variabilities in order to cope with specific contexts, depending also obviously on the choice made in terms of how activities are analysed and decomposed.
Second, because we can only be sure in hindsight about the boundaries created through the combination of positive, negative, neutral or ambiguous variabilities, this type of classification as applied to specific situations in real-life context remains a collective and multidimensional construct, including cognitive, social, cultural and political features. The norms, against which practices (and variabilities) can be scrutinised in real-life situations, whether in hindsight or foresight, are indeed not objectively defined but collectively constructed (Le Coze, 2012).
Main Safety Measures for Preventing External Aggressions
In order to prevent ‘external interference’ on pipelines, a number of ‘in-depth defences’ are implemented, ranging from technical to national level:
• Technical: increased resistance of pipelines, mechanical protection, above-ground (yellow) signalisation and so on.
• Regulatory: request for information about pipeline location by companies intending to dig (DR ‘demande de renseignements’), declaration of start of projects (DICT ‘déclaration d’intention de commencement de travaux’).
• Operational: answers to requests for information (DR), risk assessment on work sites following DICT by companies digging for UMCE work, surveillance of work sites and pipelines and so on.
• Organisational: training of organisation’s employees, information to municipalities and civil, urban or municipal engineering companies about the regulation (DR, DICT), incident analysis at national level and so on.
The case study focused mainly on the operational type of measures, not forgetting the other equally important aspects of pipeline damage prevention, which have yet less been described in a first approach.
Some Results
A Task Requiring Constant Adaptations
One very explicit feature of the task of preventing ‘external interference’ appeared to be the ability of some ‘home-made’ experts to adapt to daily variations of work constraints. Whereas from the description available in the procedures where the task is seen as a sequential series of steps (Figure 2.3), it turns out to be quite different when observed in practice in both S1 and S2.
In theory, indeed, preventing ‘external interference’ consists in receiving an information request (DR) by a company intending to perform UMCE work on a given area, asking the organisation exploiting the pipelines about the presence or not of a pipeline nearby planned UMCE work. If it is a positive answer, then this company must warn the organisation (through a DICT) at least 10 days prior to the intended start date so that an employee of the LTS exploitation can come and assess the situation on site. The employee of the LTS then locates the pipeline (using specific equipment), and indicates to the UMCE company the safety measure to be taken given the specific situation. The company man then operates supervisory work until the end of the project to identify any damages that would have been caused to the pipeline. All this is represented in Figure 2.3.
Figure 2.3 A sequential task, in theory
This is, however, in theory. In reality, it is difficult to implement all these steps sequentially. First, there are other activities not included, such as responding to invitations from UMCE companies to assist them before projects start, in order to get to know where the pipelines are. But there is also emergency engineering work that need to be treated immediately (such as, for example, water leaks to be fixed by water engineering companies which necessitates sometimes digging close to high pressure gas pipelines). Secondly, companies performing engineering work do not always warn 10 days ahead and it may happen they call the very same day they start the work. As this is not planned, solutions must be found to deal with the situation, and to establish priorities in the initial schedule. Instead of a linear sequence of activities, observations quickly reveal a different adaptive type of task, involving multiple parallel activities (Figure 2.4).
Figure 2.4 A task involving parallel activities
From Collective to Individual Expertise
All these activities cover a wide range of different aspects and skills: administrative, relational and technical. Depending on the time of year, workload varies. In the most intensive periods, trade-offs must be made between all these activities in order to allocate resources (time, expertise) for what the team considers as the UMCE works nearby to pipelines deserving the closest watch. The coordination between the members of the team is thus very important.
Defined for example by Weick as one dimension of ‘collective mindfulness’ (Weick, 2001), this collective side of the activity revealed in the case study interesting features including a mix of adaptations. In this team, it appeared that individual expertise was at the heart of the decision-making process, when circumstances pressed for adaptive patterns. While not in the hands of the manager of the team in S1 (who hasn’t got strong experience in the field of ‘external interference’ prevention), great flexibility was granted to one of the individuals in the team who was acknowledged by others as the expert in this area.
Organising his/her own schedule, s/he is in charge of balancing several factors for deciding in real time about the priorities when trade-offs must be made. Of course, s/he relies on written procedures provided by the organisation but, given the specificity of local urban contexts, s/he has to adapt this procedure in order to achieve what seems to him/her to be a satisfying response (Simon, 1947) to his/her local constraints and unplanned demands. His/her choices have an impact on the team workload, as s/he can, at times, when it is required, ask a colleague (or even his/her manager) to replace him/her for a planned visit. While s/he is replaced, s/he is then able to deal with an unexpected situation, such as emergency engineering work in a sensitive area for which s/he wishes to be present to ensure close supervision.
This employee commented this situation as an unusual one, as s/he could ‘give order to his own boss’. Whereas probably in many cases one could imagine the problem of such a situation, in this team, it was not an issue. A balance had been found between hierarchy and expertise, introducing here a key issue of power in teams. This is one side of the collective expertise of the team, which partly results from the managerial style of the team leader, willing to have an expert in the team leading some decisions for the rest of team, although not in a managing position.
Beyond this collective side of expertise, and as a complement, what has proved also very interesting to identify and to investigate are elements of decision-making processes on which this individual’s expertise relies. Without attempting to produce a final model of such a complex topic as decision-making, the strategy in this study was rather to see how data collected during interviews and observations could be exploited in order to indicate some of the key dimensions of this individual expertise. In this respect, the (methodological and theoretical) approach was close to principles of ‘macro cognition’ or ‘cognition in the wild’, considering cognition to be understood as individuals (‘cleverly’) adapting within their work context. Rather than expecting to fully understand cognition only through experiments (and also normative frameworks), field studies (‘in the wild’) become one input for understanding how cognition proceeds in the face of complex and dynamic environments (including interactions with various types of media – procedures, maps, screens) instead of simple and static ones.
Towards a Heuristic Model of Activity in the Domain of ‘External Interference’ Explicitly Indicating Variabilities
One first step was to group together many of the data that this expert processed in his/her activity. A first set of six groups of key dimensions were identified. They combine many different sides implied by ‘external interference’ prevention, among which are ‘itinerary’, ‘urban geography’, ‘pipeline’, ‘urban features’, ‘political context’ and ‘engineering’. Each group refers to specific topics, such as rush hour, depth of pipelines, UMCE companies, municipalities’ services and so on (Figure 2.5).
It is clear from this description that only individuals with years of experience are in a position to provide comfort for the decision-making process involved. One reason for having a specialised ‘expert’ in this team and to allow him/her flexibility of decision is to find an answer to this problem of knowing sufficiently well the area, the UMCE companies (see groups in Figure 2.5) and so on in order to elaborate appropriate choices in real time when needed.
Figure 2.5 Expertise at the centre of many different topics
A similar study conducted in 2011 in a different type of sector (S2) with the same methodology allowed us to draw on the first conclusions to further deepen our understanding of these cognitive processes. Although the second sector was very different in terms of environment and constraints, strong similarities could be identified in terms of expertise. In particular, this expertise was found to rely upon two important cornerstones:
• A great prudence towards uncertainties facing ‘external interference’ activities (for example, on UMCE companies themselves, their behaviour, on possible accident scenarios, on the evolutions of the activity or even on judicial exposition in case of problems).
• A great sensitivity towards interpersonal interaction strategies to be put in place, and the development of key expertise in this field (for example, developing strategies to collect information, convince, reprimand and so on as, for instance: questioning practices, finding the right way of speaking, increasing dramatic intensity in the speech and so on).
At first sight, many aspects of the expertise described in the first sector can thus be seen, thanks to additional data from S2, as the (collective) ability to adapt one’s response in-between acceptable limits of ‘variability’ (including the many types of variabilities, introduced earlier in section 4.2). One way to suggest a first model of the activity was as a consequence to include the notion of expertise at the heart of it, based on a combination of collective and individual dimensions. For describing expertise, Klein’s approach proved useful (Klein, 2009). Synthethised through four key features: mental simulations, intuition, mastery of time horizon and knowledge by expert of his own limit, they were illustrated by some of the stories collected during observations and interviews.
For example, cases of ‘intuition’ or ‘mental simulations’ were used as illustration of how expertise shaped decision-making. Combining the various features of the activity together led to the following model Based on a wide range of data collected by the expert on many different topics (Figure 2.6), divided in categories of ‘global context’ and ‘specific context’, individual expertise combined with collective expertise allow the team to adjust in real time their schedule in order to maximise chances of being at ‘the right place at the right time’. Figure 2.6 shows an updated model of the activity of ‘external interference’ highlighting this central concept of ‘variability’.
This notion is at the heart of this LTS’s issues. Indeed, due to historical and structural aspects, it has the strong particularity of being both a decentralised system and a very open system (for example, UMCE). In such a configuration, the issue of variability introduced here plays a central role, perhaps more than in other systems, indeed:
• Operators are left to decide for themselves how they organise their activity given specific contexts: there are more than 80 sectors, for which direct supervision by management is impossible.
• Working situations cannot be entirely controlled by the company, which has no direct grasp on its external environment (for example, UMCE).
Figure 2.6 An updated model of sector activity putting forward the central concept of ‘variability’ emerging from empirical studies
In short, variability can be seen through a number of adaptations in operational practices, as a consequence of the level of autonomy left by management to operators to perform their work. In practice, limits to this variability are however explicitly or implicitly defined through:
• Acquired knowledge in sectors about how to adapt to local and historical specificities;
• A certain level of rationalisation of task sought by central management in order for the variability caused by necessary local initiatives to remain in-between acceptable limits as far as safety is concerned.
This notion of acceptable variability boundaries links back to the level of centralisation or decentralisation, as well as the question of regulation modes thus raising organisational issues.
From Description to Prescription
In this last section, we want to discuss some of the points made earlier in the introduction about the ‘engineering’ part of this study, that we translate in the question of how some descriptions (and interpretations) provided at one stage are translated into prescriptions, namely official changes on the part of the organisation (that is, networks of actors, inside or outside the organisation, which have the power to make these changes) regarding its approach of the management of safety. At this stage, the section will deliberately remain sketchy, but is meant to indicate future directions for more elaborated developments based on more extensive presentations of empirical results and of our context (including the complex relationships between the company investigated and the members of this project).
It is also meant to provide a better grasp and refinement over the link between our ability to describe and make sense of real-life situations thanks to the help of relevant models, and the ability to shape activities in a direction that we could consider improving operations from the point of view of safety. This includes several issues:
• Designing a research framework in which researchers and practitioners will interact in an appropriate manner in order to collectively move towards, if possible, safer operations.
• Finding a balance between the need for describing and interpreting real-life situations, and the development of useful tools or instruments (whether conceptual or methodological) that actors of the company (and sometimes also outside the boundaries of the formal company – for example, in this case, the UMCE actors) will use in their daily operations.
• Remaining sensitive to the developing needs and ideas produced by different categories of actors in the company regarding their own practices while interacting with them through interviews, observations and feedback sessions. Tools have to be appropriate to these different categories of actors and real life contexts.
In this respect, if we stand back, we can represent our different studies in the past three years (2010–12) as follows:
2010
• Empirical fieldwork (interviews and observations) in operations (first sector, S1)
• Interpretations of data
• Feedback to practitioners met during observations and interviews
• Report with interpretations
• Feedback to the internal department which funded the study,
• Definition of further needs.
2011
• Second empirical fieldwork (interviews and observations) in different type of operations (second sector, S2)
• Interviews with middle managers of Entity (MA1)
• Feedback (at different levels)
• Report and proposition of practical recommendations
• Design of a training course on Human Factor for operations.
2012
• Third empirical fieldwork (interviews) with top managers of an Entity (managerial activities MA2)
• Interpretations of data
• Working group on ‘variability’ (WG1)
• Feedback (at several different levels)
• Report and proposition of practical recommendations.
It turns out that these stages have regularly consisted in different cycles, alternating:
• descriptions of work situations
• interpretation of data
• feedback sessions with different actors
• opportunities for further developments discussed with different actors of the organisation, but also,
• translations of discussions into relevant programs for the future
• and, at times, new type of prescriptions.
This cyclical structure repeated several times on different topics has been incremental and has now led to some new prescriptions. One is briefly commented here.
Based on our descriptions of the expertise of operators, the company has shifted its strategy regarding procedural content definition and communication. Instead of prescribing precisely what is expected from agents to the extent that it is impossible to comply with the document in most real-life situations, much more space is now left to the judgments of agents that are in a position to appreciate what type of tradeoffs need to be made more locally. But this move was made possible because our empirical descriptions made visible what was left invisible, namely the professionalism and expertise of the category of operators dealing with external interferences. In this respect, interpretations had a performative effect by opening new prospect in the prescriptive philosophy of the company in relation to operations. Of course, this new approach has to be backed up by the ability to create spaces where the various types of variabilities can be regularly discussed and addressed. Spaces that now also need to be designed and experimented (a pilot study was studied in 2012, WG1).
Conclusion
This study presented here has the purpose of observing some of the features of operations and to imagine ways of being practical in order to promote, maintain or create safe activities through new concepts, including the recently framed concept of resilience. After describing the specificity of LTS, and associating high pressure gas transmission networks to this category, the chapter introduces the threat of ‘external interference’ as one activity to be studied. LTS are opened systems that need to be managed in order to cope with this specific threat. The study relies on interviews and observations for approaching what could be seen as the properties of individuals and team dealing with the prevention of ‘external interference’. The chapter shows a collective and an individual expertise, allowing flexibility and quality of decision making to be obtained when necessary. A heuristic model, as a first attempt to capture characteristic of activity within this LTS, is suggested. It includes the issue of variability, in relation to the topic of resilience. The elements of descriptions obtained through empirical fieldwork is then introduced in the broader issue of a better understanding of how we move from description to prescription. A cycle, or pattern, combining different steps is identified and shortly commented on in relation to effective prescriptions which derived from the project.
Commentary
The step from description to prescription brings forward the potential conflict between what people actually do and what the prescriptions require them to do. This is also known as the discrepancy between work-as-done and work-as-imagined. While it is essential that some prescriptions for work are created in order to further the purposes of productivity and safety, it is equally essential that such prescriptions recognise the benefits of performance variability and performance adjustments. People at the sharp end have to continuously organise their work to overcome various forms of external interference. The prescriptions of work should help that rather than hinder that.