A Framework Based on a Systems Approach to Developing Safety Indicators in Fish Farming

Abstract

The fish farming industry is one of the industries in Norway with the highest occupational fatality and injury rate. Despite the serious health, safety, and environmental issues in the industry, little is done to measure changes in safety over time beyond the traditional Lost Time Injury (LTI) registrations. In this article the objective is twofold; (i) to propose a framework for developing safety indicators based on Systems-Theoretic Process Analysis (STPA), and (ii) to apply the framework to find indicators relevant for hazards in operations where subcontractors participate. STPA uses a hierarchical portrayal of the system in focus, in contrast to sequential models, and views safety as a control problem. It is believed that a systemic approach to indicator development better captures the complex safety challenges in aquaculture. Thirteen indicators are identified within areas such as maintenance, training, and planning. The indicators identified may function as a basis for decisions and actions that must be undertaken to ensure safe operations.

1. Introduction

The Norwegian fish farming industry, mainly producing Atlantic salmon, has traditionally been placed in the sheltered fjords along the coast. The industry is now expanding towards offshore and more exposed locations, as the demand for space has increased with the need for a more sustainable fish production [1]. Already the industry faces challenges with operational safety for its relatively sheltered production sites. The fish farming industry has one of the highest incident rates for both occupational injuries and fatalities when compared to similar industries, after fisheries but before agriculture and the offshore oil and gas supply fleet [2].

Safety challenges have been found at all levels of the organizations in the fish farming industry [3,4]. Employees are exposed to hazards through manual labor using sharp objects, such as hooks and knives. Serious injuries and fatalities have been reported in relation to operations using heavy machinery, such as cranes and winches [5]. In addition to the intrinsic challenges of working with such equipment, the forces from the environment constantly influence operations. Crane operations have also been pointed out as one of the most critical work tasks with regards to incidents leading to the escape of salmon, which is a major concern in the fish farming industry [6,7].

Human and organizational factors such as interaction with technology, the physical work environment and workload, work pressure, training, skill, experience, co-operation, communication and safety management have been identified contributors to escape events and also linked to occupational safety [4,8]. Investigations into fatal accidents in the Norwegian fish farming industry show that the systems designed to ensure competence regarding risks in operations and the methods used to communicate these risks were found to be inadequate, leading to an insufficient understanding of risk [9,10].

With the growth in the fish farming industry, larger production units, and a higher number of fish being farmed, new work practices have been implemented. These changes have led to the establishment of subcontractors offering expertise and specialized equipment for performing new types of operations. A concern with this development is how to ensure safety in operations with the increasing use of subcontractors. Milch and Laumann [11] reviewed inter-organizational complexity with regards to accident risk and found that four main themes are treated in research: economic pressures, disorganization, a dilution of competence, and organizational differences. The study found that inter-organizational complexity can hinder efficient safety management and thus elevate the risk. Some of these issues have already been identified in fish farming safety research. For example, economic pressure and disorganization have been discussed as organizational factors influencing safety in fish farming [4,12].

Safety management is a requirement in several regulations for fish farming, such as the internal control regulations that require documentation of safety-related objectives, responsibilities and the identification of hazards, accompanying risks, and mitigating efforts [13,14]. Even though the Norwegian fish farming industry has come a long way in establishing and implementing safety management systems in recent years, the investigation into serious incidents and fatalities show that the monitoring and evaluation of the effectiveness of these systems are lacking [9,10,15]. Fish farming safety management should therefore include the identification and monitoring of safety influencing factors at all levels.

A method for monitoring safety is the use of performance indicators [16,17]. Several definitions of performance indicators exist [18]. We base our work on a definition provided in Øien et al. [17], where an indicator can be seen as an observable quantity that relates to an aspect of safety, used to evaluate the effectiveness of safety management systems. The fish farming industry is not yet utilizing the knowledge of safety indicators and there is a potential for improving safety management in fish farming if relevant safety indicators are developed and properly implemented. Systems thinking is an approach used for safety engineering and management [19]. This approach may also be relevant to use for safety challenges in the fish farming industry, and further, to identify relevant safety indicators. A framework for developing safety indicators can be used by fish farming companies at a company level or for individual fish farms. Once the safety indicators are identified, if they are supported by a leadership commitment, they may be used by Occupational Health and Safety (OHS) practitioners to make strategic decisions about safety, and as a tool for communicating about safety in the organization [20].

The objective of this paper is twofold: (i) to establish a framework based on a systems thinking approach that can be used for developing safety indicators for sea-based Atlantic salmon fish farming, and (ii) to demonstrate the framework and identify relevant safety indicators. The work related to the latter objective is based on input from interviews with actors in the industry, focusing on the fish farming operations involving subcontractors. In addition, registrations of Lost Time Injuries (LTIs) and unwanted occurrences (UOs) in one major fish farming company during one year were used to identify indicators, supported by accident investigation reports [3,9,10,15].

The structure of the paper is as follows: Section 2 introduces the background for the framework and the data collection for the example. Section 3 presents the framework for identifying indicators and an application of the framework to find safety indicators for Norwegian fish farming operations involving subcontractors. Section 4 discusses the results. Section 5 concludes the analysis.

2. Method

2.1. Literature Review

2.1.1. Accident Models

Accident models are mental models of how we picture an accident in terms of causality [21] and how we are used to discovering how accidents might occur or why an accident has happened [22]. The accident model used, such as in accident investigations, influences the causes found for the accidents [23,24]. Accident models are generally divided into three categories where there has been a developmental trend [18,22]. The first category is the sequential model, where accident causation is seen as a linear sequence. The second category is the epidemiological accident model, where latent failures and conditions in the organization also contribute to the accident. The third category includes systemic and hierarchical models that aim to capture accident causation in more complex systems. Systemic accident models view accidents as emergent phenomena that are the result of complex interactions between different system components [19]. These accident models aim to explain accident causality in a complex sociotechnical system, a concept developed in the last half of the 20th century, described as the combinations of social and technical aspects and their interactions in a system [22,25]. In this paper, the fish farm company is viewed as a sociotechnical system and referred to both as a system and an organization.

In a safety perspective, the sociotechnical system may be portrayed as a control structure with interacting components [26]. Leveson [27] argues that it is in the interaction of components that the safety of a system can be determined, which is a major shift from the traditional sequential accident models. Further, accidents occur when component failures, external disturbances and/or dysfunctional interactions among system components are not adequately handled. The fish farm organizations are today parts of a complex industry involving many different actors and interactions, and a systemic approach seems therefore feasible as a basis for developing safety indicators for fish farming.

In the accident perspective Systems-Theoretic Accident Model and Processes (STAMP) [19], a system is represented by a control structure, consisting of many control loops, where the higher level controls the lower level through constraints and are adjusted based on the feedback given by the lower level [19]. The control and feedback in each control loop are conveyed using a set of communication channels. In an organizational setting these can be procedures and economic priorities (controls), and reports and requests (feedback). The Systems-Theoretic Process Analysis (STPA) is a hazard analysis technique based on STAMP [19] and can be divided into two main steps: (i) examine the control loops in the socio-technical system to find the control requirements and inadequate control actions that can lead to hazards, and (ii) identify scenarios that may lead to unsafe control hazards.

2.1.2. Approaches to Developing Safety Indicators

Safety performance indicators have been developed and used in many industries, for example, nuclear power, the chemical process industry, and the offshore petroleum industry [17]. International organizations and governmental agencies suggest using safety indicators and have developed guidelines for identifying indicators [28,29,30]. In Norway, the Petroleum Safety Authority (PSA) has developed a method (RNNP (RisikoNivå Norsk Petroleumsvirksomhet—Risk Level Norwegian Petroleum Industry)) to measure the risk level in the petroleum industry based on, among other things, major hazard risk indicators [31]. A method for developing organizational safety indicators in the petroleum industry was adapted to the aquaculture industry, and was found to be a promising tool in audits related to escape events [13]. Performance indicators are also used to measure OHS [20,32].

There are three general needs and uses for indicators [33]: (i) to monitor the safety level in a system, (ii) to decide where and how to take action if needed, and (iii) to motivate those in a position to take necessary action. Several research papers have presented and discussed the different categorizations, developments, and uses of indicators in different industries [16,17,18,34,35]. Øien, Utne et al. (2011) proposes to distinguish between the terms risk indicator and safety indicator; when indicators are identified based on risk-based models, the indicators are called risk indicators. A change in the indicator should, therefore, reflect a change in the risk level produced by the risk model. According to Øien, Utne et al. (2011) an indicator should be called a safety indicator when the method to identify the indicator is based on accident models other than a risk model, e.g., incident-based approaches [36], resilience-based approaches [37] or systems thinking [21,38].

STPA has earlier been used to develop safety indicators. Dokas, Fehan et al. [38] used STPA to develop an early warning sign identification approach. The method was employed to analyze the technical early warning signs in drinking water treatment works where an increase in the number of early warning signs was found compared to what was already identified. Leveson [21] used STPA to develop leading indicators, where the assumptions underlying engineering decisions and management/organizational safety control structure were identified as the basis for leading indicators.

A common distinction with regards to indicators is between personal safety indicators (minor accidents indicators) and process safety indicators (major accident indicators) [39]. Hopkins [39] argues that the distinction is important because the causes and consequences for major and minor accidents are different and thus not relatable as indicators. For example, there have been several instances where major accident events have happened in organizations with very few or no injuries (e.g., the Deepwater Horizon accident [40] and the Texas City accident [41]). Kjellén [42], however, argues that accidents should rather be characterized by the loss of control and transfer of energy (Haddon’s energy-model) that happens in different accident types. This view might be more relevant to the type of production performed at fish farms. Critical fish farm operations (e.g., crane operations) include hazards that can cause both major accidents (serious/several injuries and fatalities, escape of salmon) and minor accidents (occupational injuries). The distinction between personal safety indicators and process safety indicators may thus be less relevant for fish farming, and the hazards present in operations will be the deciding factor of classification.

The terms leading and lagging are also used to describe indicators in the literature. Leading indicators are used when the aim is to measure the factors that tend to occur before an incident happens and that may have an effect on safety, i.e., being “proactive”. On the other hand, a lagging indicator measures factors that are related to an actual incident or near-miss and is thus considered “reactive” [17,29]. Companies in the fish farming industry have incorporated registrations of LTIs and OUs in their safety management systems, which can be described as lagging indicators as they relate to incidents in the past. These already established safety indicators (LTI and UO) are not covered by the framework in this paper, but instead may be used as inputs to identify relevant scenarios used as a basis for deciding safety indicators. As such, the safety indicators presented in this paper tend to be leading rather than lagging, and what they measure mainly precede incidents.

2.2. Data Collection for the Development of the Safety Indicator Framework and Example

2.2.1. Data Collection

The collection of information about the work practices in fish farming has been done through interviews with three fish farm managers, one former fish farm manager, and two subcontractor managers. In addition, one author participated in a two-day workshop where a large part was group work discussing hazardous operations. After the workshop a joint interview with two fish farm managers was conducted. The first interviews were individual, semi-structured phone interviews lasting 30–60 min, whereas the joint interview related to the workshop, was a semi-structured interview conducted with the interviewees present.

All the interviewees had management positions at different levels in the organizations, being fish farm managers, central coordination managers, and managers of the company. All, but one, from a fish farming company, had operational work experience. The fish farming companies involved represent some of the largest producers of Atlantic salmon (both companies have more than 500 employees in Norway), and, thus, use work methods for large, established companies. Both companies have their main sea-based production in the fjords. As the companies represent a major share of the salmon market, they are also representative of how fish farming is conducted in Norway. The two informants from the subcontractor companies (both companies with more than 100 employees) were on long term contracts with the fish farming companies. The topics we addressed in the interviews were how the collaboration between the different actors work in fish farm operations before, during, and after the operation, and how hazards and risks for personnel and fish are handled. The interview data is treated in accordance with directives from the Norwegian Social Science Data Services [43].

LTI and UO registrations for 2014 from a major Norwegian fish farm company (Trondheim, Norway) were also collected in addition to documentation on risk assessments done in the company. Published accident investigations were also used as background information, e.g., for identifying relevant hazards. As part of the validation process, the proposed indicators were discussed with a Health, Safety, Environment and Quality (HSEQ) manager in one of the major fish farm companies.

2.2.2. Framework Development

The framework presented in this paper is based on the Systems-Theoretic Accident Model and Processes (STAMP) and the Systems-Theoretic Process Analysis (STPA) [19] and further adapted to identify the safety indicators of fish farming operations. The framework focuses on the identification of hazards, the control of these, and how they can be used as a basis to define the relevant safety indicators of an existing system (as opposed to the design of a new system). The first steps of the framework, based on STPA, guides the analysis towards finding relevant scenarios from which the safety indicators are determined. The last steps of the framework, are based on the evaluation of the indicators and their implementation. This approach towards finding indicators, based on a scenario–indicator relationship, is found to be an accepted way towards establishing safety indicators in methods and the theories developed [18].

The safety indicator is a novel concept to safety management in fish farming. Likewise, efforts that are established work methods in other industries, such as advanced risk and reliability assessments or company internal accident and incident investigations, are not a common part of fish farming safety management. Even documentation regarding personnel training and strategies for the use of safety critical equipment has been insufficient [9,44]. Hence, these issues are kept in mind when establishing the framework in the paper and setting the criteria for evaluating the indicators. With input from the interviews and data collection in fish farming, as well as knowledge regarding the needs in this industry, the safety indicator framework was developed as an iterative process. The framework has been developed with the aim that it should be readily implemented in the fish farming industry today.

3. Results

3.1. Steps of the Framework

The proposed framework is divided into the three main phases and in total seven steps:

• Phase 1

  Step 1.1

  Define system boundaries

  Step 1.2

  Identify hazard

  Step 1.3

  Identify safety requirements

• Phase 2

  Step 2.1

  Identify control actions

  Step 2.2

  Identify indicators

  Step 2.3

  Assess indicators

• Phase 3

  Step 3.1

  Implement the indicator program

The steps are shown in Figure 1, and presented in detail in the following.

• Phase 1

  Step 1.1

  Define system boundaries

A common way of determining system boundaries is to consider what factors are possible to change. For example, if the analysis is done on a company level, elements such as government level departments can be excluded. However, it is evident that these influence the company and relevant laws and regulations should be documented. If the analysis is performed for only a part of the system, for example at a company level, the relations to adjacent elements should be documented.

Documentation that aids setting the system boundaries includes organization charts, policy documents, procedures, job descriptions and contracts with important subcontractors.

Step 1.2

Identify hazards

The next step of the framework is to identify the hazards to be mitigated with the safety indicator program. The definition of a hazard in STPA is “a system state or set of conditions that, together with a particular set of worst-case environmental conditions, will lead to an accident (loss event)” [21]. A feasible approach may be to define a main systemic accident that is to be avoided and then list the hazards that contribute to the accident. The schematic representation of the system from Step 1.1 may be used to identify where in the control structure the hazards will occur.

Step 1.3

Develop safety requirements

The safety requirements (also called constraints in STPA) are based on the hazards identified. We use requirements here rather than constraints to simplify the language and make the framework more accessible to the aquaculture industry, which does not have any tradition for developing or using safety indicators. These requirements must be fulfilled to avoid the identified hazards and to maintain a safe system and safe operations. In most cases, the requirements can be directly identified by stating how the hazards are mitigated or eliminated.

• Phase 2

  Step 2.1

  Identify control actions

The safety requirements are enforced through control actions. All control actions must be assigned to the actors in the control structure. If there are safety requirements identified that are not sufficiently covered by the safety responsibilities of the actors in the system, these must be assigned by new responsibilities and control actions. The existing safety responsibilities and control actions established in the system are compared to those found necessary to enforce as a result of the identified safety requirements from Step 1.3. The control actions already established can be found by analyzing the control structure, the operations’ procedures, and the job descriptions. In addition, interviews with relevant personnel can be conducted to identify undocumented responsibilities and control actions.

Unsafe execution of the control actions may lead to hazardous situations, and revealing these are the core of STPA. In STPA, four main types of unsafe actions should be considered: (i) a control action not provided or not followed; (ii) an unsafe control action provided; (iii) a control action provided too early or too late, i.e., at the wrong time or wrong sequence, and (iv) a control action stopped too soon or applied too long.

Step 2.2

Identify indicators

Scenarios of how unsafe control actions occur, together with coordination and feedback challenges of the control actions are used as a basis for identifying the safety indicators. Coordination challenges may occur when several actors share the responsibility for one control action. Insufficient feedback may lead to inadequate control actions. Previously registered accidents and incidents, such as LTIs and UOs, can be used as supporting documentation when identifying how unsafe control actions may occur.

Safety related issues are readily derived from the identified scenarios. These might be used as a basis for a safety auditing program, which is outside the scope of this paper. Safety indicators that can be measured quantitatively are often easier to monitor on a frequent basis, so where possible, the safety related issues should be translated into numbers or ratios, i.e., safety indicators [17].

Step 2.3

Assess indicators

The safety indicators that are identified must be evaluated. For example, it is important that an indicator can observed and quantified, is sensitive to change, transparent and easily understood, robust against manipulation, and valid [31,45]. The documentation of the data needed for the indicators may not always be readily available. This is especially relevant in an industry, such as fish farming, where safety management is focused on documenting safety information mainly to comply with regulations. As indicators measuring safety in the fish farming industry is a novel concept, the indicators need to be accessible and easily understood. There should be a consensus that the indicator is relevant for safety by the industry, but more importantly, in the specific company where the safety indicator program is being implemented. This makes implementing the safety indicators easier, with regards to gathering data and following up the results. If it is possible to change the reporting in a way that leads to the indicator no longer reflecting the intended safety issue, the indicator is not robust against manipulation. An example is injuries leading to lost time (LTIs) not being registered as such because the worker is assigned to other work duties outside the original contract. As the last example illustrates, it is not necessary to comply fully with all of the criteria for the indicator to be relevant. LTI is a widely used and recognized safety indicator. However, the limitations of this indicator should be known.

The following evaluation criteria based on Vinnem [31], Kjellén [45], [46] are set as a minimum for the implementation of safety indicators in fish farming,

• Is the indicator data already collected or may be collected?
• Is the safety relevance of the indicator understandable/agreed upon by the operators and managers using the safety indicator program?
• Is the indicator objectively measurable?
• Is the indicator robust against manipulation?

• Phase 3

  Step 3.1

  Implement the indicator program

A monitoring program for the safety indicators must entail information on how often data should be gathered, who should gather the data, and who is responsible for the follow-up of the indicators. The program should also indicate when actions must be taken as a result of information from the indicators, what type of action must be set in motion, and who is responsible.

In the next sub-Section, the framework for identifying the safety indicators presented above is demonstrated through an analysis of the control structure for fish farming operation that involves subcontractors, see Figure 3. The control system in Figure 3 is a general representation of how work is organized in the companies involved. Each step of the framework is presented (see Figure 1), and input to the identification of the indicators is based on interviews and observations with personnel in the industry.

3.2. Applying the Framework—An Example

• Phase 1

  Step 1.1

  Define system boundaries

The system boundaries can be drawn around the fish farm organization and the subcontractor. The legislators and their executant authorities are also important parts of the sociotechnical system, together with the fish farming companies. They provide the regulations that the fish farmers have to follow and they perform inspections to ensure conformity. Examples of safety relevant regulations can be found in Holmen, Utne [47]. Nevertheless, the focus should be on the fish farm organization and the components of the system to be analyzed should be within the organization’s reach to alter. Stakeholder that could influence aspects of the operations of fish farms are noted, such as the local community authorities, the local wild fish river owners, the media, the public, and environmental organizations. These should be kept track of as they potentially may influence parts of the fish farm operations. For example, the large concern with prevention of fish escape may shift the focus of the human operator away from his or her personal safety. Environmental organizations have performed stunts on fish farms, for example, using underwater cameras to monitor environmental impact under the fish farms, which could disturb normal operations due to, e.g., trespassing.

In Figure 2, a system control structure with boundaries and stakeholders is presented. Both system internal and external actors are portrayed in the structure. For specific companies, the structure could be more detailed in relation to the employee positions held within the companies.

Steps 1.2 & 1.3

Identify hazards & Develop safety requirements

The main accident in the focus of this analysis is: Workers severely injured or killed in operations involving subcontractors that are performed at the fish farm. Worker means employees from the fish farm and the subcontractor.

Other loss events that may be relevant are related to economic losses due to fish illness, fish escapes, security threats or purely economic consequences related to low efficiency in production and operations. In the example case, only personnel injuries and fatalities are focused on.

Subcontractors are used in many of the major operations on fish farms involving the lifting and maintenance of components, such as the sinker tube and moorings. These operations require work vessels with cranes, winches, and arrangements to secure the equipment that is undergoing maintenance. An analysis of serious injuries and fatalities shows that blows from an object, entanglements and crush, and man over board are the most common modes of injuries and causes for fatalities [5,48]. Equipment such as cranes, winches, the net cage, and work vessels, used in operations where subcontractors are involved, are often involved in these types of injuries. Equipment may be unsafe to use because of the inadequate dimensioning of maintenance. Also, the unsafe use of equipment is a relevant hazard, and this is generally due to inadequate knowledge about operational limits or using uncertified equipment in lift operations. Unforeseen weather changes may present a hazard, and this is due to the inadequate planning of operations concerning anticipated wind, waves, and current. These mentioned hazards are general and located at the fish farm/net cage level in the control structure (see Figure 2) and may under unfavorable circumstances lead to accidents. For example, the inadequate securing of hawsers in tension in combination with an operator located in an unsafe zone and unforeseen waves can lead to a recoil of the hawser hitting the operator.

Another example is the work vessel being overloaded due to inadequate knowledge of the loading capacity, leading to a loss of stability and capsizing when the deck is covered with water. Such accidents have been investigated and show that higher levels in the organizations’ hazards may contribute to the accidents. [3,9,10]. Hazards from such inadequate safety measures in operations involving subcontractors should also be included as a basis for identifying safety indicators. Inadequate knowledge about hazards, inadequate preparation of emergency responses and equipment, inadequate monitoring of the environment, and inadequate learning from previous operations are all relevant hazards to include.

Using the hazards as the basis, the requirements for ensuring a safe operation may be defined. The hazards used for the analysis are listed in

Table 1. Hazards and safety requirements.

No.	Hazards	Safety Requirements
1	Unsafe equipment	Unsafe equipment must never be used in operations, e.g., technical integrity of work vessel, net cage, net etc. must be ensured.
2	Unsafe equipment use	Equipment must always be used in an adequate manner, e.g., equipment must be maintained and used according to manuals and procedures.
3	Inadequate operations monitoring	Monitoring of operations and the environment must be facilitated.
4	Inadequate consideration of weather in planning	The weather and weather forecast must always be considered in the planning of operations, e.g., make sure critical parts of operations and the environment are monitored and that systems are established for the gathering and analysis of data.
5	Inadequate hazard knowledge	Hazards in operations must be identified and knowledge about them communicated to all relevant actors.
6	Inadequate emergency response	Responses and necessary equipment for emergency situations must be prepared.
7	Inadequate knowledge extraction	Experience from previous operations must be collected and documented, and followed up by appropriate improvement changes in planning and procedures.

, together with the following safety requirements.

• Phase 2

  Step 2.1

  Identify control actions

A more detailed control structure is described in Figure 3. This is a portrayal of how a fish farm company is organized in relation to a subcontractor. The Area Manager is responsible for allocating the resources available to the Fish Farm Manager, and in some instances is responsible for ordering services from the Subcontractor. The Fish Farm Manager is the main point of contact to the Subcontractor with regards to planning operations. The Fish Farm Manager is responsible for all operations on the Fish Farm.

The operations are performed by the Fish Farm Operators and the Subcontractor personnel. In operations, there are often personnel from both employers, however, in the control structure only one Fish Farm Operator and one Subcontractor Operator are included. In some operations, also the managers from both employers participate. In almost all operations one or more Work Vessels from both employers are used. Feedback from the Subcontractors to the Fish Farm Manager must be provided so they can take relevant control actions. Examples of feedback are work status reports, internal risk assessments made by the Subcontractor, and the reporting of non-conformities.

The actors involved enforce the safety requirements on the lower levels through control actions. In this part of the analysis, control actions and responsibilities for carrying out the control actions already in use should be gathered and systematized for the analysis. An assessment of whether the current control actions sufficiently cover all the safety requirements developed reveals whether new control actions must be implemented. In

Table 2. Safety requirements and examples of control actions. The control loops show the responsible actor and the recipient actor. The first control action for each safety requirement are further analyzed, see Table 3.

No.	Hazard	Control Actions Examples	Relevant Control Loops
1	Unsafe equipment	Perform maintenance on safety critical equipment used in operations, including work vessel.	FFO-FFWV 1 SCO-SCWV
		Check that planned maintenance has been done on Work Vessel.	FFM-FFWV
		Perform maintenance on work vessel according to manual.	FFM-FFO
		Check that planned maintenance has been done on Subcontractor Work Vessel.	SCM-SCWV
2	Unsafe equipment use	Train operators in use of relevant/critical equipment.	FFM-FFO SCM-SCO
		Check that all equipment have relevant maintenance manuals and that they are implemented in procedures.	AM-FFM FFM-FFO
3	Inadequate operations monitoring.	Monitor safety relevant environmental forces on the fish farm	AM-FFM FFM-FFWV
4	Inadequate consideration of weather in planning	Allocate adequate time and resources for the operation with regards to weather.	AM-FFM FFM-SCM
		Anticipated weather must be documented before operation starts.	FFM-FFO
5	Inadequate hazard knowledge.	Plan and perform a Safe Job Analysis (SJA).	FFM-FFO FFM-SCM
		Make sure procedures are reviewed, available, and followed during operations.	AM-FFM FFM-FFO
		Make sure hazard and risk assessments are updated and available.	AM-FFM FFM- SCM
6	Inadequate emergency response.	Establish and provide emergency preparedness criteria and routines.	AM-FFM FFM- SCM
		Make sure personnel protection equipment (PPE) is available, complies with standards, and is used during the operation.	AM-FFM FFM-FFO
		Make sure communication channels are available and comply with standards.	AM-FFM FFM-FFO
7	Inadequate knowledge extraction.	Debrief after operations.	FFM-SCM FFM-FFO
		Review subcontractors for compliance (also in operations).	AM-SCM
		Follow up reported deviations.	AM-FFM FFM-SCM

¹ Area Managers (AM), Fish Farm Manager (FFM), Subcontractor Manager (SCM), Fish Farm Operator (FFO), Subcontractor Operator (SCO), Fish Farm Work Vessel (FFWV), Subcontractor Work Vessel (SCWV).

, the control actions identified are based on the hazards and the related safety requirements, and the information gathered from interviews.

All control actions must be evaluated if they can be executed in a way that can cause harm. Four main types of unsafe actions should be considered (cf. Section 3.1, Step 2.1). Selected control actions are evaluated in

Table 3. Unsafe control actions for selected control actions.

No.	Control Action	Not Providing Causes Hazard	Providing Causes Hazard	Control Action is Provided too Early or too Late, at the Wrong Time or Wrong Sequence
1	Perform maintenance on safety critical equipment used in operations, including work vessel.	Not performing maintenance according to plan.	Inadequate maintenance is performed.	Not performing timely maintenance (backlog).
2	Train operators in use of relevant/critical equipment.	Equipment operators do not have training.	Equipment operators do not have adequate training.	Equipment operators do not have updated training.
3	Monitor safety relevant environmental forces on the fish farm.	Not monitoring.	Inadequate monitoring.	Monitoring not done in a timely manner.
4	Allocate adequate time and resources for the operation with regards to weather.	Not allocating adequate time and resources for the operation.	Inadequate time or resources allocated for the operation.	Allocation of time resources for operations not performed in a timely manner.
5	Plan and perform a Safe Job Analysis (SJA).	Not planning and performing SJA.	Inadequately performed SJA.	SJA not performed in a timely manner.
6	Establish and provide emergency preparedness criteria and routines.	Not establishing and providing emergency preparedness.	Inadequate emergency preparedness.	Emergency preparedness routines not provided in a timely manner.
7	Debrief after operations.	Not performing debriefing after operations.	Inadequate debriefing after operations.	Debriefing after operations not performed in a timely manner.

. No failure of type (iv)—“control action stopped too soon or applied too long”, was found to be relevant, and is therefore omitted from Table 3.

Step 2.2

Identify indicators

Each of the potential unsafe control actions in Table 3 must be evaluated with regards to how they may occur. Coordination of the control actions and feedback play an important role in how unsafe control actions may occur and should be considered for each of the control actions.

The relevant scenarios in which the unsafe control actions in Table 3 may occur, are further detailed based on interviews with personnel working in the fish farming industry (cf. Section 4.1). In addition, LTIs and UOs, registered in 2014 in a major fish farming company, and published accident investigations [3,9,10,15] are used as a basis. This ensures a reflection of relevant challenges in the fish farming industry today. The safety indicators are defined based on the scenarios that may lead to unsafe control actions, and listed in

Table 4. Suggested indicators related to the control action “Perform maintenance on safety critical equipment used in operations”.

1 Perform Maintenance on Safety Critical Equipment Used in Operations
Safety Related Issues	Numerical Indicator
Are maintenance tasks performed according to plan?	1.1 Ratio of planned maintenance task on critical equipment not performed (backlog).
Are the personnel performing the maintenance trained for the tasks?	-
Is the maintenance schedule based on user manuals, standards, and/or documentation?	-

,

Table 5. Suggested indicators related to the control action “Train operators in use of relevant/critical equipment”.

2 Train Operators in Use of Relevant/Critical Equipment
Safety Related Issues	Numerical Indicator
Are procedures for training established for both subcontractor operators and fish farm operators?	-
Is the training put in the context of actual operations performed?	-
Do all operators have individual training programs?	2.1 Ratio of personnel with individual training program.
Are temporary operators participating in operations that they do not have the training for?	2.2 Ratio of operations where untrained operators participate.
Are feedback reports for training received and followed up by higher level management?	-
How are new equipment and operations methods included in the training program?	-

,

Table 6. Suggested indicators related to the control action “Monitor safety relevant environmental forces on the fish farm”.

3 Monitor Safety Relevant Environmental Forces on the Fish Farm.
Safety Related Issues	Numerical Indicator
Is equipment for monitoring weather installed?	-
Are the procedures for how measurements are recorded and used in operations followed?	-
Are weather criteria/weather windows/operational limits developed for operations?	3.1 Ratio of operations without specific weather criteria/operational limits determined.
Is the type of influence of weather in operations recorded and evaluated?	3.2 No. of incidents in operations caused by harsh weather.

,

Table 7. Suggested indicators related to the control action “allocate adequate time and resources for the operation with regards to weather”.

4 Allocate Adequate Time and Resources for the Operation
Safety Related Issues	Numerical Indicator
Is the time allocated for operations with subcontractors often exceeded?	4.1 The share of operations with subcontractors exceeding the planned time.
Is the number of personnel participating in operations adequate?	4.2 The number of overtime hours in operations.

,

Table 8. Suggested indicators related to the control action “Plan and perform a Safe Job Analysis”.

5 Plan and Perform a Safe Job Analysis (SJA)
Safety Related Issues	Numerical Indicator
Is a SJA performed with subcontractors for all critical operations?	5.1 The ratio of operations where subcontractors participate in SJA.
Does the Fish Farm Manager responsible for SJA have training in performing a SJA?	5.2 The ratio of Fish Farm Managers responsible for SJA with SJA training.
Are procedures for a SJA developed? (Including who, why, when, where, what?)	-

,

Table 9. Suggested indicators related to the control action “Establish and make available emergency preparedness routines”.

6 Establish and Make Available Emergency Preparedness Routines
Safety Related Issues	Numerical Indicator
Roles and responsibilities of subcontractors during emergency preparedness are included in emergency preparedness plans.	6.1 Ratio of critical subcontractor involved-operations carried out without emergency preparedness roles and responsibilities assigned.
Subcontractors regularly participate in emergency preparedness exercises.	6.2 Ratio of subcontractors who participate in emergency preparedness exercises of critical operations.

and

Table 10. Suggested indicators related to the control action “debriefing after operations”.

7 Debrief after Operations
Safety Related Issues	Numerical Indicator
Are debriefing meetings held?	7.1 The ratio of safety critical operations where debriefing meetings are held.
Are all relevant personnel taking part in the summary meeting?	7.2 The ratio of debriefing meetings where both subcontractors and fish farmer are represented.

.

(1)

Perform maintenance on the safety critical equipment used in operations including work vessel.

Coordination and feedback: The Fish Farm Manager and Subcontractor Manager are responsible for planning and implementing a maintenance program on equipment in the respective companies. The maintenance can be carried out by the mangers and the operators (or external service personnel, i.e., Subcontractors). The responsibility of performing each maintenance action must be documented. Feedback must be given to the mangers on the progress of maintenance, and in addition, documented feedback on a maintenance program progress must be sent to higher level management. The Subcontractors should document the maintenance performed to the Fish Farm Managers.

Relevant known incidents and accidents:

• Emergency breaks not functioning when heavy weights are lifted with winches.
• Loss of work vessel due to inadequate maintenance of water tight hatches on deck.

Unsafe control actions:

• Not performing maintenance according to plan.

Scenario: If a maintenance program is not planned based on relevant requirements (e.g., from regulations, maintenance program analyses, and user manuals), critical maintenance tasks may not be carried out, or performed randomly. If the responsibility of performing each maintenance action is not documented, maintenance tasks might not be performed.

• Inadequate maintenance is performed.

Scenario: If the operators performing maintenance have inadequate training, inadequate maintenance may be performed. In addition, a lack of maintenance reports and verification of the maintenance work may allow inadequate maintenance being performed.

• Not performing timely maintenance.

Scenario: Time pressure might lead to maintenance tasks being postponed or omitted. If the maintenance schedule is not based on user manuals, relevant regulations, and sufficient documentation of user experience, maintenance intervals might not be adequate.

(2)

Train operators in use of relevant/critical equipment.

Coordination and feedback: Both Fish Farm Operators and Subcontractor Operators may work on the same equipment, e.g., the same Work Vessels, using the same cranes and winches and other equipment relevant to operations. Coordination challenges may arise when deciding who should be responsible for arranging the training of personnel and deciding on the type of training that needs to be carried out. The Fish Farm Manager has the main responsibility of ensuring that the Fish Farm Operators have sufficient training to perform operations with the necessary equipment. Regular reports of completed training progress must be sent to a higher-level actor, such as an Area Manager.

Relevant known incidents and accidents:

• Not using safeguarding equipment during operation.
• The crew on board the work vessel are in doubt as to how the emergency release should work and considered it safer to cut the hawser with a knife.
• The incorrect loading of the work vessel led to a loss of the vessel.
• The operator is located in an unsafe zone during operations.

Unsafe control actions:

• Equipment operators do not have training.

Scenario: Training programs and sufficient follow up are not developed for the individual operator, which may lead to no training or random training. Also, time pressure is a factor that might lead to the operator participating in work in which they have no training. Temporary or new operators are especially vulnerable with regards to a lack of training.

• Equipment operators do not have adequate training.

Scenario: The training program is not adequately defined, such as when the focus of the training is solely on individual equipment and not on how it is to be used in operation. Training does not sufficiently include knowledge of risk assessment and operations.

• Equipment operators do not have updated training.

Scenarios: Time pressure may lead to new equipment and work methods being introduced during operations without adequately updating operator training. It is not defined what equipment or operations require new training.

(3)

Monitor safety relevant environmental forces on the fish farm.

Coordination and feedback: The Area Manager and the Fish Farm Manager are responsible for facilitating and implementing the monitoring of environmental forces, such as measurements of wind and waves. The Area Manager is responsible for purchasing the equipment used, while the Fish Farm Manager is responsible for monitoring during operations. For example, in fish farming it is a challenge to develop general decision criteria for operational limits according to environmental data. The monitoring of environmental forces is not commonly done on fish farms localities and neither is strain on equipment. Fish farm localities differ greatly with regards to weather forces, and many resources would be required to establish operational limits for each fish farm. There are no regulations demanding continuous measuring and monitoring, and this has not been prioritized by the industry. Thus, it is usually the case that decision criteria for operational limits does not exist and making safety critical decisions are left to the actors involved.

Relevant known incidents and accidents:

• Well boat losing control when departing fish farm in strong winds, fish farm collapses.

Unsafe control actions:

• Not monitoring environmental forces/Inadequate monitoring.

Scenario: No or inadequate monitoring of environmental forces in operations will be the case if the right equipment is not procured, or if the routines of implementing the measurements are not established. This is the situation for most fish farms today. For example, there are no regulations that require the monitoring of wind speed, and this is probably why the monitoring of environmental forces in general is scarce.

• Monitoring not done in a timely manner

Scenario: If measurement intervals and responsibilities and procedures are not determined, the measurement equipment could have been installed, but recordings are insufficient for operational support.

(4)

Allocate time and resources for operation with regards to weather.

Coordination and feedback: For some operations the Area Manager is responsible for planning whether a Subcontractor should be employed, while the Fish Farm Manager is responsible for planning the operation together with the Subcontractor. The Subcontractor must document and report the time and resource requirements for performing the job. Conflicting objectives (e.g., safety vs economic efficiency) must be made visible through stating the risks of not allocating sufficient time and resources for the operation.

Relevant known incidents and accidents:

• Taking “shortcuts” and not following procedures (standing in unsafe zones during crane operations).
• Time pressure is general concern with Fish Farm Managers.

Unsafe control actions:

• Not allocating the required time or resources for the operation/Inadequate time or resources allocated for the operation

Scenario: When there are no criteria and procedures regarding, for example, how weather should be accounted for in the allocation of time and the resources for operation, too little resources might be allocated due to economic pressures. Time pressure can arise when the Subcontractor has new assignments preceding the operations and/or if problems during an operation occur leading to delays. If the Fish Farm Manager does not have sufficient information about how much time an operation requires, not including enough time buffer for an operation may happen.

• Allocation of time and resources for the operation not performed in a timely matter

Scenario: If the allocation of time and resources is made too early, the resource need might have changed due to unforeseen circumstances, such as a change in the weather forecast. If done too late, resources might not be available.

(5)

Plan and perform a Safe Job Analysis (SJA).

Coordination challenges and feedback: The Fish Farm Manager is the person responsible for performing the SJA. A SJA is a risk assessment of operations that also covers how operations are organized. The main goal of performing the SJA is to coordinate a common understanding and awareness of hazards during operations. Particularly the allocation of responsibilities of the actors is important to address in the SJA. When several operations are being performed on the net cage, they must be properly coordinated and defined in the SJA. In addition to underlying information, such as risk assessments and procedures (from both Fish Farm and Subcontractor), important feedback in the planning and performing of a SJA comes from the experience of each of the participants in the operations. All operators involved in the operation should therefore contribute to a common understanding and assessment of the hazards involved.

Relevant known incidents and accidents:

• Being hit by equipment released from tension while in dangerous zones.
• Subcontractor operator hit by wire released from tension.
• Subcontractor operator injured walking into equipment on deck.
• Subcontractor operator injured while helping operators who fell overboard.
• Personnel crushed between work vessel and net cage, while helping person who fell overboard.
• Personnel being crushed between net cage railing and crane in unsafe zone.
• Parallel work not coordinated, and weights dragged overboard by team on opposite side of net cage.
• Parallel work not coordinated leading to a diver being dragged up by a camera.

Unsafe control actions:

• Not planning and performing a SJA

Scenario: This unsafe control action can happen if there are no procedures stating there should be a SJA performed before operations. This also implies that an assessment should be made for which types of operations a SJA should be performed. The assessment can be based on a set of criteria, such as what operations are considered challenging with regards to injuries and accidents, the type of equipment used, the resources required and the general complexity of the operation. The SJA can be adapted to the type of operation performed.

• An inadequately performed SJA

Scenario: Inadequate SJA analysis can happen if a fish farm manager does not have sufficient knowledge of how and why a SJA should be performed. In addition, the input to the analysis could be inadequate, e.g., risk assessments and procedures. If these are not complete, understandable, accessible, or properly taken into consideration, the SJA can, as a result, be inadequate. Also, an inadequately performed SJA could be the result if some of the actors who participate in the operation (e.g., from the subcontractor) does not attend the SJA.

• A SJA not performed in a timely manner

Scenario: This unsafe control action can happen when there is no procedure stating the specifics of how and when a SJA should be performed. A SJA-meeting should normally be held on the first day of an operation. If a SJA is not conducted in a timely matter, either the SJA could be irrelevant when the operations start due to changes, important aspects about hazards might be forgotten or not known by the operators, or there could be insufficient time to complete the SJA before the work operation starts.

In addition, the results of the SJA must be conveyed to all new participants of the operation.

(6)

Establish and provide emergency preparedness criteria and routines.

Coordination challenges and feedback: In an emergency situation where subcontractors are part of operations, there must be a clear distribution of emergency preparedness routines and responsibilities. Even though the fish farm company has internal routines of emergency preparedness, such as phone lists and emergency services to notify, the role of the participants from the Subcontractor should be clear.

Unsafe control actions:

• Not establishing and providing emergency preparedness

Scenario: Emergency preparedness routines are required by regulations and notification lists should be readily available at various locations at the fish farm. However, a complete emergency preparedness should also include regular exercises and this might not be followed up if not included in the emergency preparedness plans.

• Inadequate emergency preparedness

Scenario: Fish farmers must have an emergency preparedness plan, but it may not include the role of subcontractors. The plans are in some cases only lists of who should be notified in case of emergencies. Knowledge and responsibilities of first aid procedures and how first aid equipment is to be employed must be shared with subcontractors, and first aid rehearsals should be completed in co-operation with subcontractors.

• Emergency preparedness routines not provided in a timely manner

Scenario: Regular emergency preparedness exercise might not be carried out if this is not included in emergency preparedness plans.

(7)

Debrief after operations.

Coordination challenges and feedback: Several actors are responsible for the control action debriefing after operations because both the subcontractor and the fish farm personnel should attend the debriefing. The experience from all the participants of the operation is important feedback.

Unsafe control actions:

• Not performing a debriefing after operations

Scenario: If the debriefing is not established as an integrated part of the operation there might not be allocated time for it, or all relevant personnel might not attend. If the operations for which a debriefing should be held is not defined, debriefings may not be prioritized for critical operations.

• Inadequate debriefing after operations

Scenario: An inadequate debriefing could be the result if not all actors in the operation participate in the debriefing. If feedback from debriefing is not documented, relevant necessary changes might not be made in procedures.

• Debriefing after operations not performed in a timely manner.

Scenario: If the debriefing meetings are not held shortly after the completion of an operation, e.g., due to subcontractors moving on to new operations, relevant and important safety aspects might be lost.

Step 2.3

Assessment of indicators

In the previous subsection, 13 numerical indicators were identified. With a more comprehensive analysis of all the unsafe control actions identified, an even larger list of indicators would be the result. The potentially large number of indicators reflect that safety is often a multifaceted problem and many aspects should be considered. However, the resources required to follow up on the indicators will increase with the number of indicators, and a manageable number of indicators should be selected. The evaluation of the indicators according to set criteria can be an aid in prioritizing which indicators to implement (Phase 3). In

Table 11. Safety indicator evaluation.

No.	Indicator	Data Already Collected or Possible to Collect	Understandable/Agreed upon	Objectively Measurable	Robust against Manipulation
1 Perform maintenance on safety critical equipment used in operations
1.1	Ratio of planned maintenance task on critical equipment not performed (backlog).	Yes, information about maintenance is already registered, tough safety critical equipment might not be defined.	Yes, uncompleted maintenance of safety critical equipment is clearly safety relevant.	Medium, safety critical equipment must be defined.	No, dependent on a definition.
2 Train operators in use of relevant/critical equipment
2.1	Ratio of personnel with individual training program.	Yes, individual training programs can be documented.	Yes, training programs are important for safe operations.	Medium, the content of the training programs may vary.	No, dependent on an evaluation of content in training program.
2.2	Ratio of operations where untrained operators participate.	Yes, as number of operations and training are both registered.	Yes, operations should only be completed with trained personnel.	Medium, in some operations untrained personnel participate, but without much responsibility.	No, dependent on an evaluation of the degree of participation of untrained personnel.
3 Monitor safety relevant environmental forces on the fish farm
3.1	Ratio of operations without specific weather criteria/operational limits determined.	Yes, operational limits can be registered in procedures.	Medium, there is no established consensus on how weather criteria/operational limits should be defined.	Medium, weather criteria/operational limits must be defined.	No, dependent on a definition of operational limits.
3.2	No. of incidents in operations caused by heavy weather.	Yes, it is possible to register influence from weather in incidents-reports.	Yes, influence from weather is relevant for safe operations.	Medium, influence must be defined.	No, dependent on an evaluation of influence.
4 Allocate adequate time and resources for the operation
4.1	The share of operations with subcontractors exceeding planned time.	Yes, operations exceeding planned time is information possible to register.	Medium, is especially relevant if time pressure and stress arise due to the extra work time.	Yes, the amount of extra time should also be registered.	Yes.
4.2	Number of overtime hours in operations.	Yes, overtime is registered.	Yes, overtime can lead to fatigue and stress among the personnel during operations.	Medium, overtime may be both planned and unplanned.	Yes.
5 Plan and perform a Safe Job Analysis (SJA)
5.1	The ratio of operations where sub-contractors participate in the SJA.	Yes, SJA must be documented, and may thus be registered.	Yes, SJA is a safety measure that is generally agreed upon as relevant for safety.	Medium, given that SJA procedures are developed for safety critical operations.	No, dependent on a definition of safety critical operations.
5.2	The ratio of Fish Farm Managers responsible for SJA with SJA training.	Yes, training and education are information registered about the employees.	Yes, SJA training is a safety measure that is generally agreed upon as relevant.	Yes, e.g., completed courses in SJA training are objectively measurable.	Yes, (but SJA training must be updated).
6 Establish and provide emergency preparedness criteria and routines
6.1	Ratio of critical subcontractor involved-operations carried out without emergency preparedness roles and responsibilities assigned.	No, for this information to be registered, separate emergency plans for each subcontractor must be developed, and this is not currently part of emergency plans.	Yes, roles and responsibilities during emergencies are important to establish.	Medium, given that new emergency plans are developed.	No, dependent on developing new emergency plans.
6.2	Ratio of subcontractors who participate in emergency preparedness exercises of critical operations.	Yes, participation is possible to register.	Yes.	Medium, all personnel must participate.	No, dependent on an evaluation of who should participate.
7 Debrief after operations
7.1	Ratio of critical operations where debriefing meetings are held.	Yes, this is information that is easy to register.	Yes, debriefings are considered relevant for safety.	Yes, given that debriefing procedures are developed.	No, dependent on a definition of debriefing
7.2	Ratio of debriefing meetings where both sub-contractors and fish farmers are represented.	Medium, who should be present at meetings must be defined in procedures.	Medium, how all relevant personnel are included in a debriefing must be defined in procedures.	Medium, requirements for whether this indicator is met must be defined in procedures.	No, dependent on an evaluation of who should be present for meetings.

, the identified indicators are evaluated according to the criteria from Section 3.1 within the range yes, medium, and no. The evaluation is based on general knowledge and information of the industry, and on the interviews with personnel from fish farms and subcontractors. This means that some of the indicators might be evaluated somewhat differently in specific companies. However, the evaluations have also been discussed and validated with a HSEQ manager in one major fish farming company.

All indicators except three are found to be satisfying the criteria “Data already collected or possible to collect”. This is based on whether the information is already documented or if it is possible to start collecting the information based on already existing information.

Many of the indicators graded as medium for the criteria “Understandable/agreed upon” and “Objectively measurable”, are dependent on additional definitions. Based on the interviews with personnel in the industry these definitions are non-existent or formally in use, e.g., “safety critical equipment”, “safety critical operations”, and “operational limits”. These definitions can be developed, but work is needed at the company level for the indicators to satisfy the criteria “understandable/agreed upon” and “objectively measurable”. The lack of necessary definitions are also the main reason why very few indicators can be categorized as robust against manipulations. For the indicators to be robust against manipulations there must be no uncertainty in what events to include or not in registrations. An important job, when implementing the indicators, will thus be to agree on the necessary definitions. This would also be important with regards to general safety decisions in the company.

The evaluation of the indicators according to the criteria gives support for selecting which indicators may be implemented in an indicator program. The indicators 3.1, 6.1, and 7.2 could be considered to be excluded from a program as these are the ones that satisfy the least criteria.

• Phase 3

  Step 3.1

  Implementing the indicator program

At set intervals, the program should be evaluated with regards to how well the indicators themselves function and whether the program is effective. Points to evaluate include whether the indicators still satisfy the criteria above and if changes in the system have made any of the indicators obsolete. The timeliness of collecting the data must be assessed in addition to whether data are collected by the appropriate personnel. The responsibility for registering the data may be allocated to different levels in the company. For example, the indicators reflecting conditions on a specific fish farm, such as “the ratio of safety critical operations where SJA is performed”, should be registered by the responsible Fish Farm Manager onsite. Indicators reflecting the organization as a whole, such as “the ratio of fish farm managers without SJA training” may be registered by higher level safety management.

4. Discussion

4.1. Framework and Safety Indicators

Safety management in fish farming has mainly focused on complying with regulations [47]. For example, there is little use of safety indicators in the industry, except for Lost Time Injuries (LTI), and thus the concept of monitoring and documenting information regarding safety is not as common as in other industries where safety work is more mature. There is now a drive, however, towards developing methods and tools to enhance safety beyond the minimum required to comply with regulations [47]. The framework for identifying indicators in this paper aims to be a contribution to this development. The focus when developing the framework has been to identify indicators that point to the control actions in place for preventing hazards.

The framework presented in this paper has been adjusted to fit the needs of the fish farming industry. Safety indicators are not extensively used in the industry and an introduction to the concept should be done in a stepwise and lucid manner. The structured presentation of the framework and the visual connections of the system control structure support the introduction of a new concept. The hazard identification process can be focused towards specific areas of interest, such as parts of the whole control structure.

The comprehensiveness of the framework enables identification of a detailed list of safety indicators. The evaluation of the indicators may help in prioritizing what indicators to include in an indicator program. The focus of the framework is to identify all possible contributions to an unsafe control situation in a system, and the selection of the final indicators is made at a late stage in the approach. The structure of the process towards identifying indicators is based on STPA, which contributes to a thorough understanding of the hazards within the system analyzed. An advantage of applying the proposed framework is that improvements in the system can be made based on the results from the hazard analysis. For example, the step in the framework that entails the identification of responsibilities to fulfill the safety requirements may reveal responsibility-gaps in the organization. These responsibilities could then be allocated to the relevant actors of the system, and contribute to safer work operations. Such an analysis and implementation of improvements is also in line with requirements of safety regulations in Norway, such as the Internal Control Regulations [14].

When the indicators are updated, an appropriate response is required. The rules for how to act and who should be responsible when indicator values change in an unwanted manner or when they exceed a specific threshold must be set when the indicator program is implemented. Some of the indicators may also be seen as “problems to be fixed” rather than indicators to be monitored “continuously”. For example, ratio of operations without operational limits or the ratio of fish farmers without SJA training. In theory, operational limits could just be established and training is something that is straight forward to implement. However, in the fish farming industry operational limits are not extensively implemented and SJA training of workers is not always adequate. A safety indicator monitoring the number of safety critical operations carried out without implemented operational limits or SJAs performed without proper training are matters directly relevant for safety. In addition, they also pinpoint that operational limits should be developed and that SJA training is needed for fish farm managers.

For some indicators it may not be easy to determine a specific acceptable performance level, for example the indicator “Number of overtime hours in operations”. In these cases, the trend may be more important to monitor. How often the data for the different indicators should be collected and analyzed must be decided depending on how often there is an expected change in the indicator. The indicators should be assessed regularly in safety management meetings in the same manner as traditional lagging indicators (such as LTI).

The indicators in the framework are focused towards hazards related to operations. Subcontractors are often part of the most hazardous operations. The indicators in this paper support some of the safety challenges found in previous research about the use of subcontractors [11]. For example, the Safe Job Analysis (SJA) may be viewed as a counter measure of disorganization and confusion of roles and responsibilities. A SJA increases a common understanding of hazards in the operations, and the indicators related to SJA (especially 5.1) can thus be seen to measure safety aspects relevant for disorganization. Some of the safety related issued and indicators identified could also be implemented as part of a safety auditing program directed towards subcontractors.

The indicators have been discussed with a higher-level HSEQ manager from a major fish farming company. All indicators, except one, are considered to reflect current safety relevant issues. The indicator related to roles and responsibilities in emergency preparedness was the only one which was found less relevant. The emergency plans are not developed with subcontractor’s participation in mind, but focuses on internal and external notification routines. In general, the proposed indicator set was found to be promising as a tool to communicate safety issues both to higher-level management and to operators working on the fish farms.

4.2. Limitations

The comprehensiveness of the framework requires time and resources when applying it to a system with several actors in a large control structure. Expertise related to the system itself, its hazards, work methods, and safety expertise would be beneficial. A large amount of information is also produced, which must be stored in a systematic manner. The comprehensiveness of the framework may work against an actual implementation in the fish farming industry. Still, the efforts required to implement the framework are not high compared to the knowledge and overview of the safety management system gained by implementing the framework.

In the implementation of the framework the operators working on the fish farm are being merged into one actor in the control structure. This is a simplification that could lead to some coordination issues being missed. The number of actors and levels added to the control structure, which forms the basis for the analysis, is a trade-off with regards to the resources available to perform the analysis.

The indicators identified through the implementation of the framework are not linked to any specific operations, but to the hazards and the control actions in the control structure. Technical factors and engineering decisions regarding the fish farm itself, and the equipment used during operations have not been the focus of the analysis. These aspects could be focused on in a more detailed control structure where the fish farm is described and safety critical equipment analyzed.

In fish farming, there is a wide range of accidents and hazards, or safety aspects, which could be relevant to monitor, e.g., food safety, technical safety of fish farms related to escapes, safety in design of work vessels, and health and safety of personnel [47]. The safety aspects could also potentially influence each other. For example, prioritizing safety for the personnel may in some cases potentially increase the likelihood of fish escape events [12]. These situations are not accounted for in this paper.

5. Conclusions

This article proposes a framework for developing safety indicators in fish farming based on a systems approach to safety. Thirteen safety indicators were identified by employing the framework, and, after an evaluation of the indicators, nine indicators may be considered for implementation.

The framework provides a comprehensive step-wise analysis of fish farming modeled as a hierarchical control structure, where the hazards and the unsafe control actions form the basis for identifying the safety indicators. The framework may be used in safety management of a fish farm on company or site level. As the analysis identifies potential hazards in the system, it can also be used for purposes, such as internal control, where mitigating measures can be developed based on the identified unsafe control actions and any revealed gaps in work responsibilities. Since the framework is rather comprehensive, it demands sufficient resources to perform a complete analysis. Sufficient resources need also to be available for the implementation and use of the safety indicator program.

The framework has been exemplified for fish farm operations with subcontractor participation. The use of subcontractors has increased with the growth in the fish farming industry, and they are involved in many hazardous operations. The application of the framework and the resulting safety indicators show that the framework is suitable for identifying relevant safety issues that should be monitored on a regular basis by the fish farming industry. Future work should focus on implementing the indicators in a fish farm company and testing them over a longer time period.