A Technique for the Retrospective and Predictive Analysis of Cognitive Errors for the Oil and Gas Industry ( TRACEr-OGI )

Human error remains a major cause of several accidents in the oil and gas (O&G) industry. While human error has been analysed in several industries and has been at the centre of many debates and commentaries, a detailed, systematic and comprehensive analysis of human error in the O&G industry has not yet been conducted. Hence, this report aims to use the Technique for Retrospective and Predictive Analysis of Cognitive Errors (TRACEr) to analyse historical accidents in the O&G industry. The study has reviewed 163 major and/or fatal O&G industry accidents that occurred between 2000 and 2014. The results obtained have shown that the predominant context for errors was internal communication, mostly influenced by factors of perception. Major accident events were crane accidents and falling objects, relating to the most dominant accident type: ‘Struck by’. The main actors in these events were drillers and operators. Generally, TRACEr proved very useful in identifying major task errors. However, the taxonomy was less useful in identifying both equipment errors and errors due to failures in safety critical control barriers and recovery measures. Therefore, a modified version of the tool named Technique for the Retrospective and Predictive Analysis of Cognitive Errors for the Oil and Gas Industry (TRACEr-OGI) was proposed and used. This modified analytical tool was consequently found to be more effective for accident analysis in the O&G industry.


Introduction
In the recent past, human error has been blamed for most of the serious disasters in the oil and gas (O&G) industry.Alexander L. Kielland (1980) with 123 fatalities, Ocean Ranger (1982) with 84 fatalities, Glomar Java Sea (1983) with 81 fatalities, Piper Alpha (1988) with 167 fatalities and Sea Crest (1989) with 91 fatalities all show that poor decisions and human error were at fault.Most of these errors were traced to the structure, culture and procedures of the organisation [1].Gordon [2] asserts that accidents similar to the examples above demonstrate that the interaction of human, technical, organisational, social and environmental factors all affect the output of a very complex system.Lord Cullen's recommendations following the Piper Alpha explosion and fire in 1988 were the origin of the Offshore Installations (Safety Case) Regulation 1992 which is implemented to reduce the risk of hazards emerging from major accidents on offshore installations [3,4].The Safety Case regulation required offshore industries in the UK to perform risk assessments for new and existing platforms.In the context of this requirement, the duty holder is responsible for identifying hazards, evaluating risk and carrying out accident analysis with the aim of demonstrating that measures are implemented to reduce any risk as low as is reasonably practical (ALARP) [4].A trend of offshore accidents and their fatalities before and after the Safety Case regulation is shown in Figure 1 below [5].
Safety 2017, 3, 23 2 of 21 evaluating risk and carrying out accident analysis with the aim of demonstrating that measures are implemented to reduce any risk as low as is reasonably practical (ALARP) [4].A trend of offshore accidents and their fatalities before and after the Safety Case regulation is shown in Figure 1 below [5].It could be argued that following the recommendations of Lord Cullen's (1990) report after the Piper Alpha ordeal, there has been a wave of legislative change and improved commitments by oil companies worldwide [6,7].For example, the Royal Commission recommended the enactment of the Australian safety case regulation for major hazard facilities (similar to the UK Safety Case) following the investigation into the Esso Longford Gas Plant explosion and fire in September 1998 which killed two workers, caused colossal damage to the plant and left a major area of the State of Victoria without gas for 10 days [8].Moreover, although Norwegian offshore regulations date back to the 1960s, following the UK Safety Case regulation and the creation of UK HSE, the Norwegian Petroleum Safety Authority (similar to UK HSE) began in 2004 to regulate petroleum activities in the Norwegian Continental Shelf (NCS).

Human Error and Performance Influencing Factors
Arguably, legislation like the UK Safety Case regulation seems to drive improvements in health and safety management in some parts of the world [9].For example, following the regulation, conscious attempts have been made to reduce human error in offshore oil and gas facilities [4].Therefore, many human error identification (HEI) tools have been developed for the process industry worldwide to aid accident investigators and to learn from incidents.Notable examples of these tools include the Generic-Error Modelling System (GEMS) [10][11][12], the Human Factors Investigation Tool (HFIT) for Accident Analysis [13], the Cognitive Reliability Error Analysis Method (CREAM) [14], the Technique for Human Error Rate Prediction (THERP) [15], the Human factors analysis and classification system for the oil and gas industry (HFACS-OGI) [16], the railway accidents (HFACS-RAs) [17].the Predictive Analysis of Cognitive Errors (TRACEr) [18][19][20] and System Action Management (SAM) [21].Over time there has been steady progress in the development of these tools that has aided accident investigators and helped extract vital information from process accident reports.Despite this however, substantial barriers remain in the development and application of human error identification and accident analysis tools in the O&G industry.It could be argued that following the recommendations of Lord Cullen's (1990) report after the Piper Alpha ordeal, there has been a wave of legislative change and improved commitments by oil companies worldwide [6,7].For example, the Royal Commission recommended the enactment of the Australian safety case regulation for major hazard facilities (similar to the UK Safety Case) following the investigation into the Esso Longford Gas Plant explosion and fire in September 1998 which killed two workers, caused colossal damage to the plant and left a major area of the State of Victoria without gas for 10 days [8].Moreover, although Norwegian offshore regulations date back to the 1960s, following the UK Safety Case regulation and the creation of UK HSE, the Norwegian Petroleum Safety Authority (similar to UK HSE) began in 2004 to regulate petroleum activities in the Norwegian Continental Shelf (NCS).

Human Error and Performance Influencing Factors
Arguably, legislation like the UK Safety Case regulation seems to drive improvements in health and safety management in some parts of the world [9].For example, following the regulation, conscious attempts have been made to reduce human error in offshore oil and gas facilities [4].Therefore, many human error identification (HEI) tools have been developed for the process industry worldwide to aid accident investigators and to learn from incidents.Notable examples of these tools include the Generic-Error Modelling System (GEMS) [10][11][12], the Human Factors Investigation Tool (HFIT) for Accident Analysis [13], the Cognitive Reliability Error Analysis Method (CREAM) [14], the Technique for Human Error Rate Prediction (THERP) [15], the Human factors analysis and classification system for the oil and gas industry (HFACS-OGI) [16], the railway accidents (HFACS-RAs) [17].the Predictive Analysis of Cognitive Errors (TRACEr) [18][19][20] and System Action Management (SAM) [21].Over time there has been steady progress in the development of these tools that has aided accident investigators and helped extract vital information from process accident reports.Despite this however, substantial barriers remain in the development and application of human error identification and accident analysis tools in the O&G industry.

TRACEr Taxonomy
Unlike other human error identification, TRACEr is a human error identification tool that considers the human machine interface, the cognitive framework of the end user coupled with external factors that may affect the user's performance.It takes into account the physical (e.g., intoxication, fatigue), the psychological (e.g., state of mind, stress, decision-making) and the external (e.g., organisational factors, weather).This combination of characteristics presents an open image of the event [20,22].TRACEr was developed in line with two models, namely the Model of Human Information Processing (M-HIP) and the Simple Model of Cognition (SMOC).The first model, the M-HIP developed by Wickens [23], was based on investigating how physical parameters affect the cognitive process.In this model, human information processing is the basis of human performance as this determines how an individual perceives and processes information before making decisions [24].The second model, the SMOC [14], contains elements of cognition and their interactions, including planning/choice, observation/identification and action/execution [14].Although a detailed explanation of the TRACEr taxonomy is beyond the scope of this paper, a brief explanation is offered.TRACEr has seven taxonomies divided into three major divisions (Table 1): (1) Context of the Accident; (2) Operator's Context and (3) Error Recovery [20,22].These are further divided into subdivisions for a more effective coding process as shown in Table 1 below.[20,22].

Major Divisions Categories
Context of the incident Although TRACEr was initially developed for retrospective, predictive and real-time accident analyses in air traffic control [20], other high risk industries such as maritime and railways have used successfully modified versions of TRACEr [19,[24][25][26][27].However, there are scarcely any published accounts where TRACEr has either been modified for the O&G industry or used in its original form for accident analysis.A TRACEr taxonomy for the O&G industry therefore would be both useful and obtainable, as in other high risk industrial sectors.Consequently, the aim of the present study is twofold: (1) to analyse retrospective accident cases using TRACEr to determine specific adaptations necessary to make it more effective for the O&G industry (Section I); (2) to propose a TRACEr taxonomy for the O&G industry: TRACEr-OGI (Section II).

Data Collation
To analyse retrospective accident cases using TRACEr, 167 accident reports with at least one fatality or extensive damage to the facility were retrieved from the International Association of Oil & Gas Producers (IOGP) database.IOGP is the single association representing companies involved in the exploration and production of oil and gas at a global level to establish reliable data.IOGP data is collected and analysed through known international practises, so there should be a high probability that the content and structure of the data provides reliable information about these accidents.Furthermore, only accidents with full details or those in which the investigation was completed were used in this analysis.

Data Coding Process and Analysis
Publically available IOGP offshore accident reports were coded based on TRACEr's seven subdivisions (Table 2).The coding involved identifying the subdivisions associated with TRACEr that contributed to these accidents.Each report was read thoroughly before the coding process.The presence of any given 'taxon' was coded 1 to indicate the presence of a category or 0 to indicate the absence of a category, as illustrated in Table 2 below.The coded data was cross-tabulated for statistical analysis and categories that were not present in any of the accidents were excluded.Furthermore, only accidents with full details or those in which the investigation was completed were used in this analysis.

Data Coding Process and Analysis
Publically available IOGP offshore accident reports were coded based on TRACEr's seven subdivisions (Table 2).The coding involved identifying the subdivisions associated with TRACEr that contributed to these accidents.Each report was read thoroughly before the coding process.The presence of any given 'taxon' was coded 1 to indicate the presence of a category or 0 to indicate the absence of a category, as illustrated in Table 2 below.The coded data was cross-tabulated for statistical analysis and categories that were not present in any of the accidents were excluded.

Context of the Incident
A total number of 2615 errors were coded from 163 accident reports between the years 2000 and 2014 in Offshore Platforms.Following a thorough evaluation of the accident reports in three categories, the first level of the TRACEr taxonomy analysis was as follows: Task Error (56%), Error Information (24%) and Casualty Level (20%).
The percentages of main actors in the reviewed accident's chain of events are shown in Figure 2 below, while accident classifications are shown in Figure 3.

Task Errors
This paper has considered only offshore accidents.However, these accidents are also related to mobile drilling units (MODUs), mobile production units (MOPUs), Monohulls and all fixed offshore units.Monohulls include floating production storage and offloading (FPSOs), floating storage vessels (FSOs), Floating Offshore Production Units (FPUs) and Floating Storage Units (FSUs).The fixed offshore units considered were bottom-fixed installations (manned or unmanned) designated for accommodation, drilling, production, compression, injection/riser, pumping or a combination of these [28].
The Task Error Categories were as follows: supervision, standard operation procedure, external communication, internal communication and handover/takeover (Figure 4).Internal communication was found to be present in 55% of the 587 task errors coded.Supervision and external communication were present in 29% and 12% respectively, making them the second and third most significant trends.

Error Information
It is important to identify the equipment used in any activity that has led to an accident [22].Much could be learned from technical equipment in the lead up to accidents, including improving the system of work, job procedures, industry standards and guidance and equipment design (ergonomics) among others.Results have shown that the main error information represents 24% of the accidents coded.However, details of the Technical Equipment shown in Figure 5

Task Errors
This paper has considered only offshore accidents.However, these accidents are also related to mobile drilling units (MODUs), mobile production units (MOPUs), Monohulls and all fixed offshore units.Monohulls include floating production storage and offloading (FPSOs), floating storage vessels (FSOs), Floating Offshore Production Units (FPUs) and Floating Storage Units (FSUs).The fixed offshore units considered were bottom-fixed installations (manned or unmanned) designated for accommodation, drilling, production, compression, injection/riser, pumping or a combination of these [28].
The Task Error Categories were as follows: supervision, standard operation procedure, external communication, internal communication and handover/takeover (Figure 4).Internal communication was found to be present in 55% of the 587 task errors coded.Supervision and external communication were present in 29% and 12% respectively, making them the second and third most significant trends.

Task Errors
This paper has considered only offshore accidents.However, these accidents are also related to mobile drilling units (MODUs), mobile production units (MOPUs), Monohulls and all fixed offshore units.Monohulls include floating production storage and offloading (FPSOs), floating storage vessels (FSOs), Floating Offshore Production Units (FPUs) and Floating Storage Units (FSUs).The fixed offshore units considered were bottom-fixed installations (manned or unmanned) designated for accommodation, drilling, production, compression, injection/riser, pumping or a combination of these [28].
The Task Error Categories were as follows: supervision, standard operation procedure, external communication, internal communication and handover/takeover (Figure 4).Internal communication was found to be present in 55% of the 587 task errors coded.Supervision and external communication were present in 29% and 12% respectively, making them the second and third most significant trends.

Error Information
It is important to identify the equipment used in any activity that has led to an accident [22].Much could be learned from technical equipment in the lead up to accidents, including improving the system of work, job procedures, industry standards and guidance and equipment design (ergonomics) among others.Results have shown that the main error information represents 24% of the accidents coded.However, details of the Technical Equipment shown in Figure 5

Error Information
It is important to identify the equipment used in any activity that has led to an accident [22].Much could be learned from technical equipment in the lead up to accidents, including improving the system of work, job procedures, industry standards and guidance and equipment design (ergonomics) among others.Results have shown that the main error information represents 24% of the accidents coded.However, details of the Technical Equipment shown in Figure 5 below shows that equipment involved in 58% of accidents are drilling tools, drilling pipes, risers and drill collars.Most of these form part of the drilling string.Another example of technical equipment is the Control System at 34%.Attention was also given to alarm systems monitoring gas releases and other surveillance systems.These were involved in 4% of the total accidents coded.However, the coding of most equipment errors was challenging.
Safety 2017, 3, 23 6 of 21 equipment involved in 58% of accidents are drilling tools, drilling pipes, risers and drill collars.Most of these form part of the drilling string.Another example of technical equipment is the Control System at 34%.Attention was also given to alarm systems monitoring gas releases and other surveillance systems.These were involved in 4% of the total accidents coded.However, the coding of most equipment errors was challenging.

Casualty Level
The final and coincidentally the lowest level within the Context of the Incident is the Casualty Level (Figure 6).This is because it occupies 20% of the Context of the Incident and the total number of accidents analysed.The Primary High Casualty which characterised accidents that have led to fatalities or permanent disabilities was 10%.The Primary Low Level of Casualty involved accidents with significant but not necessarily permanent injuries.The Secondary High Level involved accidents that caused minor injuries but led to severe damage to equipment while the Secondary Low Level involved accidents with minor or no injuries and minor or no damage to equipment.

Operator Context
The first category of TRACEr taxonomy (Context of the Incident) focused more on identifying the errors, the location in which they took place and the people involved.The second category (Operator's Context) is the largest level of the TRACEr taxonomy.As noted earlier, this category focuses on the factors that may or may not have influenced the performance of the operator.From Table 1

Casualty Level
The final and coincidentally the lowest level within the Context of the Incident is the Casualty Level (Figure 6).This is because it occupies 20% of the Context of the Incident and the total number of accidents analysed.equipment involved in 58% of accidents are drilling tools, drilling pipes, risers and drill collars.Most of these form part of the drilling string.Another example of technical equipment is the Control System at 34%.Attention was also given to alarm systems monitoring gas releases and other surveillance systems.These were involved in 4% of the total accidents coded.However, the coding of most equipment errors was challenging.

Casualty Level
The final and coincidentally the lowest level within the Context of the Incident is the Casualty Level (Figure 6).This is because it occupies 20% of the Context of the Incident and the total number of accidents analysed.The Primary High Casualty which characterised accidents that have led to fatalities or permanent disabilities was 10%.The Primary Low Level of Casualty involved accidents with significant but not necessarily permanent injuries.The Secondary High Level involved accidents that caused minor injuries but led to severe damage to equipment while the Secondary Low Level involved accidents with minor or no injuries and minor or no damage to equipment.

Operator Context
The first category of TRACEr taxonomy (Context of the Incident) focused more on identifying the errors, the location in which they took place and the people involved.The second category (Operator's Context) is the largest level of the TRACEr taxonomy.As noted earlier, this category focuses on the factors that may or may not have influenced the performance of the operator.From The Primary High Casualty which characterised accidents that have led to fatalities or permanent disabilities was 10%.The Primary Low Level of Casualty involved accidents with significant but not necessarily permanent injuries.The Secondary High Level involved accidents that caused minor injuries but led to severe damage to equipment while the Secondary Low Level involved accidents with minor or no injuries and minor or no damage to equipment.

Operator Context
The first category of TRACEr taxonomy (Context of the Incident) focused more on identifying the errors, the location in which they took place and the people involved.The second category (Operator's Context) is the largest level of the TRACEr taxonomy.As noted earlier, this category focuses on the factors that may or may not have influenced the performance of the operator.From Table 1 above

Cognitive Domain-External Error Mode
The External Error Mode evaluates the observable outcomes of the external errors shown in Figure 8: Communication, Selection/Quality and Timing/Sequence.The analysis showed poor selection/quality at (57%) of the EEM category, Poor communication at (26%) followed by inappropriate timing/sequence at (17%).

Cognitive Domain (Internal Error Mode)
A total of 692 errors were coded under the cognitive domain internal error mode representing 52% of the Operator's Context (Figure 7 above).Further analyses of observable outcomes are shown in Figure 9 below.They cover action, decision-making, memory, perception and violation.The IEM considered in the first category, Action, are Selection error (32%), Timing error (31%) and Information transmission error (29%).Selection errors typically involve mistakes in the selection or choice of procedure, method or equipment for a particular task.The timing errors were due to time lapses.This could include actions that were not performed in time or errors performed coincidentally at a time when equipment failed, or an operator was found to be handling another task.Other errors in this category include information transmission error, errors due to actions not performed, data entry errors and the recording of unclear information.
The second category of the IEM is Decision-making, including Poor decisions and planning (41%) and Late decision/planning (36%), followed by No decision/planning (15%

Cognitive Domain-External Error Mode
The External Error Mode evaluates the observable outcomes of the external errors shown in Figure 8: Communication, Selection/Quality and Timing/Sequence.The analysis showed poor selection/quality at (57%) of the EEM category, Poor communication at (26%) followed by inappropriate timing/sequence at (17%).
Context which accounts for 50.71% of all errors coded.The Operator's Context was further analysed based on categories of observable outcomes presented in Figure 7

Cognitive Domain-External Error Mode
The External Error Mode evaluates the observable outcomes of the external errors shown in Figure 8: Communication, Selection/Quality and Timing/Sequence.The analysis showed poor selection/quality at (57%) of the EEM category, Poor communication at (26%) followed by inappropriate timing/sequence at (17%).

Cognitive Domain (Internal Error Mode)
A total of 692 errors were coded under the cognitive domain internal error mode representing 52% of the Operator's Context (Figure 7 above).Further analyses of observable outcomes are shown in Figure 9 below.They cover action, decision-making, memory, perception and violation.The IEM considered in the first category, Action, are Selection error (32%), Timing error (31%) and Information transmission error (29%).Selection errors typically involve mistakes in the selection or choice of procedure, method or equipment for a particular task.The timing errors were due to time lapses.This could include actions that were not performed in time or errors performed coincidentally at a time when equipment failed, or an operator was found to be handling another task.Other errors in this category include information transmission error, errors due to actions not performed, data entry errors and the recording of unclear information.
The second category of the IEM is Decision-making, including Poor decisions and planning (41%) and Late decision/planning (36%), followed by No decision/planning (15%

Cognitive Domain (Internal Error Mode)
A total of 692 errors were coded under the cognitive domain internal error mode representing 52% of the Operator's Context (Figure 7 above).Further analyses of observable outcomes are shown in Figure 9 below.They cover action, decision-making, memory, perception and violation.The IEM considered in the first category, Action, are Selection error (32%), Timing error (31%) and Information transmission error (29%).Selection errors typically involve mistakes in the selection or choice of procedure, method or equipment for a particular task.The timing errors were due to time lapses.This could include actions that were not performed in time or errors performed coincidentally at a time when equipment failed, or an operator was found to be handling another task.Other errors in this category include information transmission error, errors due to actions not performed, data entry errors and the recording of unclear information.
The second category of the IEM is Decision-making, including Poor decisions and planning (41%) and Late decision/planning (36%), followed by No decision/planning (15%).Incorrect or reflex decisions are made instantaneously or in an attempt to save a situation, thereby jeopardizing safety.For example, an operator tries to stop a falling object but is crushed by it.
The next category, Memory, involves the failure to monitor a process that should be under scrutiny thereby resulting in an accident.This includes Forgetting to monitor (46%) and Forgetting to request for or give information (35%).The perception error which relates to the main internal error mode category has a high relationship with the Not detected category (40%).This involves errors from failures that were not detected, for example failures in the system or equipment.The last category of the IEM is violation and relates to routine violations.These occur due to complacency in job routines or an underestimation of the dangers involved.are made instantaneously or in an attempt to save a situation, thereby jeopardizing safety.For example, an operator tries to stop a falling object but is crushed by it.The next category, Memory, involves the failure to monitor a process that should be under scrutiny thereby resulting in an accident.This includes Forgetting to monitor (46%) and Forgetting to request for or give information (35%).The perception error which relates to the main internal error mode category has a high relationship with the Not detected category (40%).This involves errors from failures that were not detected, for example failures in the system or equipment.The last category of the IEM is violation and relates to routine violations.These occur due to complacency in job routines or an underestimation of the dangers involved.Although there are two major branches of psychology that have a bearing on errors in safety and reliability, namely social and cognitive psychology, this paper is majorly on the cognitive aspects.The psychological error mode in the Cognitive Domain had 332 coded errors out of an overall 1326 for the Operator's Context.The PEM is 25% of the Operator's Context and is related to the perception category similar to the case of the IEM as seen in Figure 10 below.
The first category of the PEM, Action, is further broken down into Confused state (50%), Distraction (21%) and Fatigue (29%) as illustrated in Figure 10   Although there are two major branches of psychology that have a bearing on errors in safety and reliability, namely social and cognitive psychology, this paper is majorly on the cognitive aspects.The psychological error mode in the Cognitive Domain had 332 coded errors out of an overall 1326 for the Operator's Context.The PEM is 25% of the Operator's Context and is related to the perception category similar to the case of the IEM as seen in Figure 10 below.
The first category of the PEM, Action, is further broken down into Confused state (50%), Distraction (21%) and Fatigue (29%) as illustrated in Figure 10 below.The relationship between Action and Confused state is clearly illustrated.The Confused state is a state of mind in which fatigue and stress are likely to be contributory factors.The second category of the PEM is Decision-Making, which relates to the mindset category at 51%.Most decisions, especially in the context of incidents are strongly linked to the mindset of the personnel involved.The third category of the psychological error mode is Memory at 11%, in relation to the sub-level miscommunication at 50% which involves errors in communication during the various interactions between workers.The fourth and largest category of the PEM is Perception.Perception is linked with vigilance as evident in Figure 10 below at 78%.The category of vigilance evaluates the state of alertness and observance of the personnel on duty.Vigilance can also be influenced by a state of confusion or expectation which is evident when the employee expects the error to be averted by any other factor.The final category of the PEM is Violation which relates to complacency (58%).Complacency is strongly influenced by states of overconfidence, pressure and stress while on duty.
Safety 2017, 3, 23 9 of 21 fatigue and stress are likely to be contributory factors.The second category of the PEM is Decision-Making, which relates to the mindset category at 51%.Most decisions, especially in the context of incidents are strongly linked to the mindset of the personnel involved.The third category of the psychological error mode is Memory at 11%, in relation to the sub-level miscommunication at 50% which involves errors in communication during the various interactions between workers.The fourth and largest category of the PEM is Perception.Perception is linked with vigilance as evident in Figure 10 below at 78%.The category of vigilance evaluates the state of alertness and observance of the personnel on duty.Vigilance can also be influenced by a state of confusion or expectation which is evident when the employee expects the error to be averted by any other factor.The final category of the PEM is Violation which relates to complacency (58%).Complacency is strongly influenced by states of overconfidence, pressure and stress while on duty.

Further Discussion
The analysis covered all areas including the context of the incident, operator context and error recovery.It was found that poor communication remains a major precursor to offshore accidents.This involved internal communication between the officers in charge and the personnel on duty, communication between the crane operators, drillers, floor men, roustabouts and other operators working hand in hand to ensure productivity on offshore platforms.However, major communication issues also involved drillers and assistant drillers.In most of the drilling operations on the platform, several injuries arose from tasks carried out by more than one operator simultaneously with no adequate communication as to when each person's task should be implemented.As noted by Graziano et al. [19] in the classification of human errors in grounding and collision accidents, it is difficult to use TRACEr to classify mechanical errors in the O&G industry caused by sudden facility failure without direct human participation.

Further Discussion
The analysis covered all areas including the context of the incident, operator context and error recovery.It was found that poor communication remains a major precursor to offshore accidents.This involved internal communication between the officers in charge and the personnel on duty, communication between the crane operators, drillers, floor men, roustabouts and other operators working hand in hand to ensure productivity on offshore platforms.However, major communication issues also involved drillers and assistant drillers.In most of the drilling operations on the platform, several injuries arose from tasks carried out by more than one operator simultaneously with no adequate communication as to when each person's task should be implemented.As noted by Graziano et al. [19] in the classification of human errors in grounding and collision accidents, it is difficult to use TRACEr to classify mechanical errors in the O&G industry caused by sudden facility failure without direct human participation.The Operator's Context revealed incorrect perception and therefore poor decision-making as its major contributor.The Performance Shaping Factors also formed part of the Operator's Context but it was revealed that its contribution to the whole was not significant.However, in this capacity, the major contributors to human error were the organisational factor Training and the personal factor Competence which has had an effect on major events.TRACEr moreover appeared to neglect some organisational factors contributing to error occurrence in the O&G industry.Baysari et al. [18] recommended modifications to include the following categories: environmental factors, infrastructure design/condition and safety.It may also be useful to consider these additional human factors as seen in the process industry: (1) personal/team factors (2) key job factors and (3) organisational factors.
The major contributors to Error Recovery were failures in the functional barrier system Primary Low Casualty level, in the context of the incident.It is recommended that the taxonomy be specifically adapted to make it more effective for the O&G industry.

Development of TRACEr for the Oil and Gas Industry (TRACEr-OGI) (Section II)
The results of Section I showed that the three major divisions and seven categories of TRACEr are flexible and adaptable to the O&G industry.However, the tool could benefit from the addition of more tasks and sub-tasks specific to this industry.For example during the coding process, the following common factors were difficult to code: failures due to inadequate facility (equipment error), national and international regulatory framework/standards, administrative duties such as inspections and enforcement of regulations and resources.Since the tool was designed to identify human factors which feed into human errors, the alignment of its taxonomy to the following major human factor contexts, namely job context, organisational/facility context and operator context would particularly enhance its usability in the O&G industry.
To ensure that the core theoretical underpinnings and framework of TRACEr are not lost in the development of the oil and gas version, existing versions (Table 3 below) and applications were reviewed to identify the taxonomy that would benefit the sector.The proposed modification also took into consideration oil and gas technical reports such as the 2014 Society of Petroleum Engineers (SPE) technical report The Human Factor: Process Safety and Culture.It was produced after a two-day summit held in July 2012 on human factors affecting the O&G industry and the best way forward [29].As an example, the concept of offshore managed pressure drilling (MPD) or the MPD system and its effect on human performance was reviewed, focusing on human error.The communication structure during MPD offshore drilling operation is shown if Figure 11 below.The Operator's Context revealed incorrect perception and therefore poor decision-making as its major contributor.The Performance Shaping Factors also formed part of the Operator's Context but it was revealed that its contribution to the whole was not significant.However, in this capacity, the major contributors to human error were the organisational factor Training and the personal factor Competence which has had an effect on major events.TRACEr moreover appeared to neglect some organisational factors contributing to error occurrence in the O&G industry.Baysari et al. [18] recommended modifications to include the following categories: environmental factors, infrastructure design/condition and safety.It may also be useful to consider these additional human factors as seen in the process industry: (1) personal/team factors ( 2) key job factors and (3) organisational factors.
The major contributors to Error Recovery were failures in the functional barrier system Primary Low Casualty level, in the context of the incident.It is recommended that the taxonomy be specifically adapted to make it more effective for the O&G industry.

Development of TRACEr for the Oil and Gas Industry (TRACEr-OGI) (Section II)
The results of Section I showed that the three major divisions and seven categories of TRACEr are flexible and adaptable to the O&G industry.However, the tool could benefit from the addition of more tasks and sub-tasks specific to this industry.For example during the coding process, the following common factors were difficult to code: failures due to inadequate facility (equipment error), national and international regulatory framework/standards, administrative duties such as inspections and enforcement of regulations and resources.Since the tool was designed to identify human factors which feed into human errors, the alignment of its taxonomy to the following major human factor contexts, namely job context, organisational/facility context and operator context would particularly enhance its usability in the O&G industry.
To ensure that the core theoretical underpinnings and framework of TRACEr are not lost in the development of the oil and gas version, existing versions (Table 3 below) and applications were reviewed to identify the taxonomy that would benefit the sector.The proposed modification also took into consideration oil and gas technical reports such as the 2014 Society of Petroleum Engineers (SPE) technical report The Human Factor: Process Safety and Culture.It was produced after a two-day summit held in July 2012 on human factors affecting the O&G industry and the best way forward [29].As an example, the concept of offshore managed pressure drilling (MPD) or the MPD system and its effect on human performance was reviewed, focusing on human error.The communication structure during MPD offshore drilling operation is shown if Figure 11 below.Furthermore, other techniques and taxonomies have been used in the O&G industry, for example HFACS-OGI, a modification by Theophilus et al. [16].Investigation tools for the petroleum industry, human factors investigation tool (HFIT) developed by Gordon [13], were also reviewed.Following team discussions with 10 oil and gas professionals and 40 oil and gas scholars, it was determined that TRACEr for the O&G industry should retain three major divisions.These are: (1) Context of the Accident; (2) Operator's Context and (3) Error Recovery which also take into account the physical, psychological and external factors.Following these reviews, the following TRACEr for the O&G industry (TRACEr-OGI) (Table 4 and Figure 12 below) has been proposed: WHAT is the task performed unsatisfactorily by (e.g., the drilling supervisor, drilling engineer, mud engineer, driller, . . .(Supervision, Standard Operation, Handover/Takeover, well testing, crane operations, electrical/mechanical operations, job hazard analysis and material and equipment)?selection).II.WHERE was the task performed (e.g., fixed platform, floating production storage and offloading, FPSO, helidecks, etc.)?III.WHO performed the task (e.g., the drilling supervisor, drilling engineer, etc)?

Error Information
Error Information relates to: Equipment involved (e.g., drilling string, blow out preventer BOP, alarm system, control system, surveillance system, etc) II.Information not taken into account (size, dimension, etc).

Equipment Error
Equipment Error relates to: I. Mechanical integrity (e.g., design error, installation error, operational error, corrosion, poor maintenance, inadequate inspection, etc.)

Casualty Level
This defines the level of casual contribution.In the first four categories the error is non-intentional while in the last two categories "Violation and sabotage" the error is considered as an intended violation of rules.These two (IEM and PEM) represent the cognitive function that failed.For example: I.
risk recognition failure II.poor decision-making III.no decision Human Barriers Relates to 'barriers that rely on the actions of people capable of carrying out activities designed to prevent LOPC and other types of asset integrity or process safety events and mitigate any potential consequences of such events [35]'.Categories of human barriers implemented by the oil and gas industry are

Hardware Barriers
Relates to 'primary containment, process equipment and engineered systems designed and managed to prevent loss of primary containment (LOPC) and other types of asset integrity or process safety events and mitigate any potential consequences of such events.These are checked and maintained by people (in critical activity/tasks) [35]'.Categories of hardware barriers implemented by the oil and gas industry are [35]:

Human Barriers
Relates to 'barriers that rely on the actions of people capable of carrying out activities designed to prevent LOPC and other types of asset integrity or process safety events and mitigate any potential consequences of such events [35]'.Categories of human barriers implemented by the oil and gas industry are [35]: Operating in accordance with procedures, e.g., Isolation of equipment overrides and inhibits of safety systems, shift handover.As noted in Table 1 above, Task Error deals with particular tasks, their locations and who performed them.In this paper, all information that helped to uncover any task error was taken into consideration.Categories based on the rig, the floating production storage and offloading (FPSO)  As noted in Table 1 above, Task Error deals with particular tasks, their locations and who performed them.In this paper, all information that helped to uncover any task error was taken into consideration.Categories based on the rig, the floating production storage and offloading (FPSO) and the decks were considered, among others.The user tasks classified for these locations are Supervision, Standard Operation Procedure, External Communication, Internal Communication, Hand-Over, and Take-Over.
The O&G industry is characterised by the rapid and steady technological development of essential safety critical equipment [36].Examples are alarm systems, control systems and surveillance systems, etc.The second context of the incident Error Information was used to classify information not taken into account (size, dimension, etc.) [4,21,22].This information is usually connected to the exact location where the error occurred, for example deck dimension, vessel size, etc. [22].
The third context of the incident and a major modification is the addition of Equipment Error used to classify mechanical errors.Although TRACEr considers both equipment and information not taken into account, Graziano et al. [22] noted that TRACEr could not code mechanical errors caused by sudden facility failure without direct human participation.In the O&G industry, there is a very strong relationship between the contributory elements of asset integrity, namely personnel integrity, operational integrity and mechanical integrity [37].Studies have shown that these three elements are 'interrelated and the performance of one element has a great influence on the others'.[37] Typical examples of equipment error in the O&G industry include corrosion, Struvite related pipe explosion, cavitation, hydrogen shock, thermal fracture and pressure burst, among many others [37,38].
The last context of the incident is the Casualty Level, which for TRACEr-OGI was divided into minor, major and catastrophic levels.The catastrophic level involves accidents that led to fatalities and extensive facility damage, the major level involves incidents that resulted in major facility damages or severe/permanent injuries, while the minor levels involve accidents with minor damage to equipment and slight injuries to personnel requiring first aid attention.

The Operator's Context
As in the original TRACEr, this section of the taxonomy focused more on the internal and external factors that affect the performance of the operator.The Operator's Context includes (1) the External Error Mode (EEM-Table 5) and (2) the Cognitive Domains encompassing Internal Error Mode (IEM-Table 6) Psychological Error Modes (PEMs-Table 7) and Performance Shaping Factors (PSFs-Table 8) [22,39].Performance Shaping Factors (PSFs) represent a key modification of the Operator's Context in the TRACEr-OGI proposition.The PSFs classify those factors which influence or are capable of influencing the performance of the operator or team, thereby aggravating the error occurrence or also assisting in the error recovery [25].Baysari et al. [18] observed that TRACEr-rail appeared to neglect some organisational factors contributing to error occurrence and has recommended modifications to include environmental factors, infrastructure design/condition and safety culture (norms, organisational customs, etc.).However, TRACEr-OGI also proposes the inclusion of Performance Shaping Factors (PSF) and Human Factors categories to better capture all latent factors.Examples which could affect performance in the O&G industry (e.g., on offshore platforms) considered for this study are illustrated in Table 8 and Figure 13 below.

Control Barriers and Recovery Measures
Control Barriers and Recovery Measures are the final categories of the TRACEr-OGI taxonomy, divided into Hardware Barriers and Human Barriers [35].They assist in observing and understanding whether or not barriers to prevent threats and causes of accidents and measures to recover from the consequences of events have worked successfully.Where the barriers have worked, the incident entry is classified as a near miss and where they did not work, it becomes an accident.That said, near misses were not considered in the context of this study.Figure 14

Workplace and Equipment Design)
Ergonomics, workspace design, maintenance reliability, interface, etc.

Culture and Working Environment
National, local and workplace culture, social and community values

Control Barriers and Recovery Measures
Control Barriers and Recovery Measures are the final categories of the TRACEr-OGI taxonomy, divided into Hardware Barriers and Human Barriers [35].They assist in observing and understanding whether or not barriers to prevent threats and causes of accidents and measures to recover from the consequences of events have worked successfully.Where the barriers have worked, the incident entry is classified as a near miss and where they did not work, it becomes an accident.That said, near misses were not considered in the context of this study.Figure 14

Reliability and Usability of the Proposed TRACEr-OGI
Following the modifications to TRACEr, it was anticipated that TRACEr-OGI would be less difficult to use, more suitable and more comprehensive in identifying errors and moreover, could be applied more consistently (i.e., show greater inter-rater reliability).The inter-rater reliability is the most critical criterion on which to judge a taxonomy [25].Inter-rater is a measure of the extent to which different raters give the same coding for the same observed performance [13,41].Another critical criterion when adopting a tool in a new context is its usability (is it ambiguous or easy to use?) [20,25,26,42].Improved usability will mean less errors and improved consistency [25,42].Therefore, the inter-rater reliability and usability of the two human error identification tools were compared: TRACEr and the proposed TRACEr-OGI.To achieve this, eighteen participants were required to use TRACEr and TRACEr-OGI to code a notable offshore accident following the procedure outlined in Section 3.1 above.The participants were nine Oil and Gas Engineering MSc students and nine Petroleum and Environmental Technology MSc students.All participants had oil and gas related undergraduate degree with some previous work experience in oil and gas industry.Before the coding process, participants took an 11 week long process safety module with specific topics on human factors (HF) and human error identification (HEI).They had also used TRACEr for a coursework exercise.IBM Statistical Package for the Social Sciences (SPSS) 24 was used to determine the inter-rater reliability for each of the rater pairs within a group.In line with the method outlined by Baysari et al. [25], the participants were given a usability questionnaire at the end of the coding process for both TRACEr and TRACEr-OGI.IBM SPSS 24 was also used to derive the proportion (%) in each group that agreed with the usability questionnaire statements.

Results
The most common error categories chosen by the raters were the Causality level (where 96% and 97% of raters chose this category); the Cognitive Domain (93% and 92%) and Error Information (93% and 92% ) for TRACEr and TRACEr-OGI respectively (Table 9 below).It should be noted that the new categories of Equipment Error and Control Barriers and Recovery Measures were consequently nil for TRACEr, but scored 72% for TRACEr-OGI in Table 9 below.It could be argued that subcategories of Control Barriers and Recovery Measures, which are divided into easily identifiable oil and gas barriers, simplified error identification at 90% (Table 9).Significantly, mechanical errors caused by sudden facility failure without direct human participation which had been difficult to capture using TRACEr [22], could now be captured with TRACEr-OGI.Raters noted that it was now easier to code errors due to failures in process equipment.

Reliability and Usability of the Proposed TRACEr-OGI
Following the modifications to TRACEr, it was anticipated that TRACEr-OGI would be less difficult to use, more suitable and more comprehensive in identifying errors and moreover, could be applied more consistently (i.e., show greater inter-rater reliability).The inter-rater reliability is the most critical criterion on which to judge a taxonomy [25].Inter-rater is a measure of the extent to which different raters give the same coding for the same observed performance [13,41].Another critical criterion when adopting a tool in a new context is its usability (is it ambiguous or easy to use?) [20,25,26,42].Improved usability will mean less errors and improved consistency [25,42].Therefore, the inter-rater reliability and usability of the two human error identification tools were compared: TRACEr and the proposed TRACEr-OGI.To achieve this, eighteen participants were required to use TRACEr and TRACEr-OGI to code a notable offshore accident following the procedure outlined in Section 3.1 above.The participants were nine Oil and Gas Engineering MSc students and nine Petroleum and Environmental Technology MSc students.All participants had oil and gas related undergraduate degree with some previous work experience in oil and gas industry.Before the coding process, participants took an 11 week long process safety module with specific topics on human factors (HF) and human error identification (HEI).They had also used TRACEr for a coursework exercise.IBM Statistical Package for the Social Sciences (SPSS) 24 was used to determine the inter-rater reliability for each of the rater pairs within a group.In line with the method outlined by Baysari et al. [25], the participants were given a usability questionnaire at the end of the coding process for both TRACEr and TRACEr-OGI.IBM SPSS 24 was also used to derive the proportion (%) in each group that agreed with the usability questionnaire statements.

Results
The most common error categories chosen by the raters were the Causality level (where 96% and 97% of raters chose this category); the Cognitive Domain (93% and 92%) and Error Information (93% and 92%) for TRACEr and TRACEr-OGI respectively (Table 9 below).It should be noted that the new categories of Equipment Error and Control Barriers and Recovery Measures were consequently nil for TRACEr, but scored 72% for TRACEr-OGI in Table 9 below.It could be argued that subcategories of Control Barriers and Recovery Measures, which are divided into easily identifiable oil and gas barriers, simplified error identification at 90% (Table 9).Significantly, mechanical errors caused by

Discussion and Conclusions
Learning lessons from the analysis of a large set of offshore accident data could help to improve safety performance.Hence, the present study aimed to apply TRACEr in the O&G industry to determine changes required to make the tool more useful and effective and to propose TRACEr-OGI, a version specific to the industry.This tool was used for a systematic and retrospective analysis of 163 offshore accident reports.It was shown that the tool was useful in identifying task errors, predominant contexts in which these errors occurred and any contributory factors.Results found that poor communication remains a major precursor to offshore accidents, including internal communication between officers in charge and personnel on duty, communication between crane operators, drillers, floor men, roustabouts, and other operators working on offshore platforms.Major communication issues were also found to involve drillers and assistant drillers.Several injuries arose from a lack of communication between operators working simultaneously on drilling operations tasks.The Operator's Context revealed errors in perception and subsequent poor decision-making as its major contributors.The Performance Shaping Factors formed part of the Operator's Context but its overall contribution was insignificant.Overall, the major contributors to human error were the organisational factor Training and the personal factor Competence.The major contributors to Error Recovery were failures in the functional barrier system Primary Low Casualty level, in the context of the incident.It is recommended that the taxonomy be specifically adapted to makes it more effective for the O&G industry or used with another human factor analytical tool.
This study was limited by a number of factors.Some of the reports were not sufficiently exhaustive to reveal the true state of the accident.Hence, error detection was a challenge in these situations.Accident codes under violations, both routine and intended, were challenging as it was difficult to assess whether the employee acted deliberately or out of ignorance or reflex.Again, it was challenging to ascertain the state of mind of an individual before the violation leading to an accident had occurred.For example, it was difficult to identify when stress, pressure, confused state or overconfidence under the psychological error mode was involved.Moreover, the classification of errors using the TRACER and TRACEr-OGI may sometimes be subject to interpretation with respect to accident reports.In such cases, the experience and knowledge of the analyst are as important as the systematic coding of the events.
In conclusion, the results showed that the specific adaptation of the taxonomy for the O&G industry would be useful, or that it could be used with another human factor analysis tool.For example, although it proved difficult to use TRACEr to code equipment failures, TRACEr-OGI was not only able to identify human errors aligned to job context, organisational/facility context and operator context, it was also able to capture equipment error.It was shown therefore that TRACEr is sufficiently flexible and adaptable for the O&G industry.Although as expected the results of the modification made marginal difference in usability and reliability, TRACEr-OGI enhanced percentage rater agreement.It also made the coding of key aspects of oil and gas facility failures possible.The results of the modification therefore could inform potential decisions that will aid offshore process safety development.

Figure 1 .
Figure 1.Process of accident trends in the oil and gas industry from 1971 to 2012 [5].

Figure 1 .
Figure 1.Process of accident trends in the oil and gas industry from 1971 to 2012 [5].

4 . 1 .
Context of the IncidentA total number of 2615 errors were coded from 163 accident reports between the years 2000 and 2014 in Offshore Platforms.Following a thorough evaluation of the accident reports in three categories, the first level of the TRACEr taxonomy analysis was as follows: Task Error (56%), Error Information (24%) and Casualty Level (20%).The percentages of main actors in the reviewed accident's chain of events are shown in Figure2below, while accident classifications are shown in Figure3.Safety 2017, 3, 23 4 of 21

Figure 2 .Figure 2 .
Figure 2. Main actor in the chain of events.
, the operator context was analysed under three headings: External Error Mode (EEM), Cognitive Domain divided into Internal Error Mode (IEM) and Psychological Error Mechanism (PEM) and Performance Shaping Factors (PSF).A total of 1326 errors were coded for the Operator's Context which accounts for 50.71% of all errors coded.The Operator's Context was further analysed based on categories of observable outcomes presented in Figure 7 below: External Error mode (EEM) (18%), Cognitive Domain (IEM) (52%), Cognitive Domain (PEM) (25%) and Performance Shaping factors (PSF) (5%).Analyses of the Cognitive Domains (IEM, EEM and PEM) are shown in Figures 8-10 below.Context which accounts for 50.71% of all errors coded.The Operator's Context was further analysed based on categories of observable outcomes presented in Figure 7 below: External Error mode (EEM) (18%), Cognitive Domain (IEM) (52%), Cognitive Domain (PEM) (25%) and Performance Shaping factors (PSF) (5%).Analyses of the Cognitive Domains (IEM, EEM and PEM) are shown in Figures 8-10 below.

Figure 7 .
Figure 7. Percentages for the Operators Context.

Figure 8 .
Figure 8. Percentages for the External Error Mode.

Figure 7 .
Figure 7. Percentages for the Operators Context.

Figure 8 .
Figure 8. Percentages for the External Error Mode.

Figure 9 .
Figure 9. Percentages for Sub-levels of the Internal Error Mode (IEM).

Figure 9 .
Figure 9. Percentages for Sub-levels of the Internal Error Mode (IEM).
to the five cognitive domains originally proposed by Shorrock and Kirwan[20] and the addition of the sixth called sabotage.It focuses on the cognitive framework that potentially applies to the error coded.The cognitive domains are: [35]:I.Operating in accordance with procedures, e.g., Isolation of equipment overrides and inhibits of safety systems, shift handover.II.Surveillance, operator rounds and routine inspection III.Authorization of temporary and mobile equipment IV.Acceptance of handover or restart of facilities or equipment V. Response to process alarm and upset conditions VI. Response to emergencies Safety 2017,

5. 1 .
Analysis of the Proposed Taxonomy for the Oil and Gas Industry (TRACEr-OGI)5.1.1.Context of the Incident

1 .
Analysis of the Proposed Taxonomy for the Oil and Gas Industry (TRACEr-OGI)5.1.1.Context of the Incident
below illustrates a generic arrangement of control barriers and recovery measures in the O&G industry.People Physical and Mental Characteristics Skill and knowledge, expectation, attention, motivation, goal, fatigue, stress, etc. Age, health (fitness for duty), body size, strength, etc. Management Systems Organisation & Process Management Management commitment, change management, incident investigation, hazard and process hazard identification, risk assessment, safe system of work, procedure, training, etc.

21 Figure 14 .
Figure 14.Generic arrangement of control barriers and recovery measures in the O&G industry (Adapted from IOGP [35]).

Figure 14 .
Figure 14.Generic arrangement of control barriers and recovery measures in the O&G industry (Adapted from IOGP [35]).

Table 1 .
Levels and subdivisions of TRACEr taxonomy

Table 2 .
Illustration of the sequence of TRACEr categories/taxa identified from the accident reports.

Table 2 .
Illustration of the sequence of TRACEr categories/taxa identified from the accident reports.

No of Accidents Supervision LEVEL TOTAL Drilling Production Operations (Flaring, Completions) Well Logging/TESTING Crane Operations Electrical/Mechanical Operations
below shows that below shows that above, the operator context was analysed under three headings: External Error Mode (EEM), Cognitive Domain divided into Internal Error Mode (IEM) and Psychological Error Mechanism (PEM)) and Performance Shaping Factors (PSF).A total of 1326 errors were coded for the Operator's Figure 5. Subtask for User Equipment.

Table 1
above, the operator context was analysed under three headings: External Error Mode (EEM), Cognitive Domain divided into Internal Error Mode (IEM) and Psychological Error Mechanism (PEM)) and Performance Shaping Factors (PSF).A total of 1326 errors were coded for the Operator's Figure 6.Percentages of Casualty level.
). Incorrect or reflex decisions Figure 7. Percentages for the Operators Context.
). Incorrect or reflex decisions Figure 8. Percentages for the External Error Mode.
below.The relationship between Action and Confused state is clearly illustrated.The Confused state is a state of mind in which

Table 3 .
List of TRACEr modifications and field of study reviewed in the development of TRACEr for the Oil and Gas Industry (TRACEr-OGI).

Table 4 .
Levels and subdivisions of TRACEr-OGI taxonomy.

Table 5 .
External Error Mode Taxonomy of observable outcomes.

Table 11 .
Participants rating of ease of use.