Abstract
Abstract: Decision making is a central component in the management of safety-critical operations. Some attempts have been made to employ Quantitative Risk Analysis as input to such decisions. Although adequate for long-term planning where the average risk is the relevant parameter, such systems tend to fall short in operational and instantaneous decisions where 'average risk' is of less relevance. In this paper we investigate how operational and instantaneous risk can be managed and supported.
Our analysis is based on interviews and observation studies at a major plant processing hazardous fluids and gas. We suggest a typology for decisional situations at the plant, and relate these to well-known traditions in the literature of decision-making theory. Strategic decisions in the plant fit well into the characteristics of rational choice theory, operational decisions are well described in terms of bounded rationality, and, finally, instantaneous decisions are typically taken as described by naturalistic decision making theory.
We suggest several principles for improving decision support. While many decisions today are based on a high degree of probabilistic information, we see a need to deploy more factual information to make the risk picture more relevant for both operational and instantaneous decisions. In addition, the available probabilistic information is often inaccurate; improving the probabilistic information base, through more nuanced criticality factors for example, will also be an improvement. Finally, a basic premise for improvements in the decision process, is the need to be conscious regarding what should be considered strategic, operational and instantaneous decisions.
Introduction
Investigations of major accidents usually point at flaws in the decision making process at some stage when accidents are explained. Decisions of significance can be made long before an accident, such as those related to design or to long term planning, but also by 'sharp end' personnel immediately before an initiating event. In the National Commission's report after the Deepwater Horizon disaster, for example, it is stated that better management of the decision making processes in BP and other companies was an important factor that could have prevented the incident, and several concrete examples of decisions that increased the risk at Maccondo before the catastrophe were given (National Commission, 2011: 125) .
Improving decisional support is thus one measure that can prevent major accidents. Prevention of major accidents may be achieved either by preventing incidents to occur, or by preventing incidents developing into major accidents, the latter is mainly achieved through the emergency response planning and associated equipment. In practice it will often be a combination of the two approaches. The main emphasis in this paper is on prevention of incidents to occur, corresponding to the left hand side of a typical Bow-tie diagram. This implies that emergency response and mitigating systems are not focused on.
The aim of this paper is twofold: (1) Using an onshore plant processing hazardous fluids/gas as a case study, we will first describe concrete decisional situations of relevance to major accident prevention. (2) Based on this, we will discuss principles for decision support which are of relevance for different decision situations. Different tools and methods for providing risk information as decision support are used in the process industries (e.g. Reniers et al., 2006; Mazri et al., 2014) , including qualitative risk analysis and numerical information based on Quantitative Risk Analysis (QRA). It has become increasingly clear, however, that present methods of quantitative risk analysis do not always provide adequate support for operational decisions in the oil and gas industry. One reason for this is that the analyses mainly cover technical aspects of design, and only reflect operational and organisational issues to a limited degree. The current methods and approaches used for risk analysis have to a large extent also been developed from methods originating in the nuclear industry. These methods provide useful decision support for selecting design solutions, operating practices and other solutions which, as an average over a (long) period of time, will give the lowest risk. This may be called average risk [over a long period] . It should be emphasized that 'average risk' implies averaging some risk value over at least a year, and should not be confused by specific metrics like Fatal Accident Rate (FAR) or Individual Risk per Annum (IRPA). However, these methods do not necessarily give good answers if we want to decide about whether a specific situation or a specific operation is safe or not. In such a situation, we are not interested in average risk, but in what may be called 'the instantaneous risk', associated with this particular situation. Averaging over a long period is not sufficient.
It may be argued that the quantitative risk analysis was never intended to support operational decision-making, although a number of attempts have been made in recent years to use QRAs also for this purpose. On the other hand, when considering what oil companies use in relation to major hazard decision-making in the operations phase, there are no other quantitative tools available, although qualitative methods like Safe Job Analysis, HAZOP and others are extensively used.
The quantitative risk analysis also provides input to the preparation of the emergency response plan, which is a fundamental tool in the decision making process. This is certainly a relevant aspect; however it is applicable for decision-making after the occurrence of an incident. The main focus in this work is on prevention of incidents, such as hydrocarbon leaks. This paper builds on work performed in an initial phase of the project 'Modelling instantaneous risk for major accident prevention' (MIRMAP). In particular, MIRMAP seeks to develop a concept for living risk analysis 1 , as a supplement to traditional risk analysis. The scope of the project includes decision situations on both on-and offshore facilities that involve major accident risk, directly or indirectly. According to the Petroleum Safety Authority in Norway, a major accident can be defined as "an acute incident, such as a major discharge/emission or a fire/explosion, which immediately or subsequently causes several serious injuries and/or loss of human life, serious harm to the environment and/or loss of substantial material assets" (PSA, 2013).
The term 'instantaneous risk' is in this paper used without a precise definition, except that it refers to risk during a short period. Average risk in a QRA study is typically averaged over a 12 month period. 'Instantaneous risk' applies to a substantially shorter period, without specifying exactly how long period, but may cover one day, one shift, one hour, etc., see further discussion in Yang (2014) . QRA studies usually express FAR values averaged over a year.
It should be noted that 'instantaneous risk' implies some kind of systematic and documented assessment. The implication of this is that the subjective, unsystematic and undocumented assessment of the situation made indirectly by an operator when deciding how to perform an activity or in what sequence several activities shall be carried out, is not classified as assessment of 'instantaneous risk'. This should not be taken to imply that such indirect evaluations necessarily are of substandard. It may on the other hand be a good assessment of how work can be performed safely, if the individual is very experienced and has a good overview of the situation and all applicable operational restrictions. But it lacks a systematic approach to ensure that all relevant factors have been considered, and it is completely undocumented. Sometimes the situation may also be so complex that an unsystematic assessment may be insufficient.
The main context of the paper is as previously mentioned the prevention of occurrence of incidents. This implies that the assessments referred to here are related to decision-making which will influence the likelihood of occurrence of incidents, such as which activities to allow in parallel, what restrictions to put on execution of activities, what extent of independent verification to be performed, etc. We do not refer to decision-making relating to emergency response, which is quite different, e. g. involving stronger time constraints and other priorities in an evolving situation.
Decision making has been subject to extensive attention by different theorists. In the next section we will present some main contributions to the field, representing different views on the subject. In Section 3, the methodological approach of the study is presented, followed by results from the case study in Section 4. In Section 5, and based on the findings from the case study, we will discuss principles for decision support that may improve the quality of decisions in the process industry.
Decisions and decision making in the literature
Major accidents are often associated with human interventions, and investigations will typically identify choices and decisions made before the accidents, and how these contributed to losses of barriers or the actual triggering of the event 2 . These can be purely operational decisions, such as which tool or method an operator uses, or more long term choices such as which maintenance strategy a plant should apply. Understanding decision making is, consequently, important for preventing major accidents in processing plants. It is not just a matter of having the right information and the right tools, but also of actually making the right decisions.
The Oxford English Dictionary offers two definitions of decision. The first points at the outcome of a process: "The final and definite result of examining a question; a conclusion, judgement". The other focuses on the process itself: "The making up of one's mind on any point or on a course of action; a resolution, determination". This process is usually labelled decision making.
It is reasonable to talk about a decision when there is a time lag between consideration, conclusion and the action or outcome of the decision. This time lag varies. In decisions concerning strategic and operational matters the reasons for a specific choice between alternatives can usually be given before an action takes place or before a settlement is reached. An example is the planning of an operation. In other situations the time lag is minimal. This may be the case in emergency situations, where it may be more correct to talk about a "reaction". This means that there is no time for systematic evaluation of alternatives, because action has to be taken immediately, and reasons for the choice can only be given in retrospect.
Different empirical situations, theoretical perspectives and methodical approaches give rise to a range of different traditions of decision making. These traditions can be categorised and organised in different ways (see, e.g. Lipshitz et al., 2001) . In this article we will organise the theoretical contributions into three categories:
1. The theory of rational choice, which presupposes clearly identified and defined situations, clear roles and responsibilities, clearly defined alternatives, and unlimited time and resources.
2. The theory of bounded rationality, which presupposes clearly identified and defined situations, but which takes into account that roles and responsibilities can be less clear, that alternative decisions can be only partially developed, and that time and resources may be limited.
3. The theory of naturalistic decision making is based on in-depth empirical studies of 'real life' decision processes. It acknowledges that situations may be difficult to identify and define, that roles and responsibilities may be unclear, and that decision alternatives may be poorly developed, and also highly constrained by time and resources
The first two categories will be presented together, as the second, to some extent, builds on and is an elaboration of the first.
Rational choice and bounded rationality
Decision making is often considered a "rational process", meaning that decisions are based on a systematic evaluation of consequences measured against preferences 3 . James March (1994:2) states that such processes follow a logic of consequence. A rational decision procedure is then characterised by making a choice, by answering four basic questions with the aim of choosing "the best alternative": Rational choice may be considered the foundation of some of the basic risk approaches applied in high-risk industries. Hayes (2013:13) draws special attention to the use of QRAs and the use of the 'as low as reasonably practicable' (ALARP) principle in this respect 4 . QRAs build on developing a representative set of causal chains for fatal scenarios, and include considerations of probabilities and consequences for each step. Options that have acceptable risk levels should be subject to an ALARP evaluation, involving, if necessary, cost-benefit considerations of measures that can reduce the risk further.
The description of rational choice processes, as indicated in the four questions above, may still be considered ideal-typical, and are seldom credible portraits of how decisions are made in real-life situations. Studies of organisational decision making (Cyert and March, 1963; March and Simon, 1958; Simon, 1957) introduced doubt regarding the validity of this model of rational choice, and coinedthe concept of bounded rationality, pointing to the way decision makers adapt to the scarcity of attention and the exhaustiveness of thoroughgoing information processing. In addition, Simon (1978) suggested that comprehensive analysis is often not necessary for adaptation, since real-world problems tend to be loosely coupled, and may be addressed by bounded rationality in a sequential fashion.
Bounded rationality is thus related to simplifications of highly complex situations, commonly resulting in the introduction of experience-based 'rules of thumb' by decision makers.
Hayes ' (2012, 2013) studies can serve as an example, involving personnel in control rooms handling situations where information about the causes of deviations is scarce. She discusses the decision making strategies of experienced operative personnel, involving the application of self-imposed situation-specific limits in those cases where even override procedures are not suitable. Thus, rather than acting only on predetermined constraints and protocols, such personnel draw a "line in the sand" for when shutdown procedures should be started, based on a dynamic evaluation of the barriers in the system. This allows the leverage both to avoid unnecessary shutdowns, but also to respond to perturbations in a more flexible manner, employing their expertise. Hayes' discussion is interesting, as it both shows the intricate ways in which rule-based and resilience-based safety is intertwined, but also as her operative experts may inspire more dynamic ways of developing formal risk assessments, and adapting the risk picture to evolving situations. Hayes does not argue against risk analysis as such, rather she illustrates how a situation specific assessment of barriers is key to risk management in the operational phase. This of course relies on a well-designed system with appropriate barriers installed.
Numerous other studies within organisations have demonstrated that most decision making is better described as the outcomes of limited (bounded) rationality. This means that not all alternatives are known, not all consequences are considered and not all preferences are taken into consideration. Decision makers tend to consider only a few of all possible alternatives. Neither are all consequences taken into consideration; some are focused and some are ignored. Instead of searching for the "best possible" solution, one is chosen that is "good enough", characterised as a satisficing strategy (Simon, 1956 ).
Naturalistic decision making
Naturalistic decision making (NDM) is the strand of decision research that has been most oriented towards decisions as they unfold in real-world settings. NDM represents a shift from a domainindependent general approach to decision making, to a knowledge-based approach addressing decision makers with substantial experience (Klein, 2008) . There is no canonical definition of NDM, but it is possible to describe characteristics of situations typical of NDM. Decision situations studied in NDM involve characteristics such as: 1) Ill-defined goals and ill-structured tasks, 2) Uncertainty, ambiguity, and missing data, 3) Shifting and competing goals, 4) Dynamic and continually changing conditions, 5) Action-feedback loops (real-time reactions to changed conditions), 6) Time stress, 7) High stakes, 8) Multiple players, 9) Organisational goals and norms, and 10) Experienced decision makers (Klein and Klinger, 1991) .
Although much research prior to the emergence of naturalistic decision making had also been interested in these types of settings, the investigation of how people actually make decisions had mainly been limited to experimental studies in well-structured, carefully controlled settings, involving inexperienced participants (Klein, 2008; Klein and Klinger, 1991) .
Where the theory of bounded rationality points mostly to practical limitations of rational choice theory, NDM grew out of a more radical critique of the basic assumptions of rational choice theory. 1) Instead of rational, concurrent choice among alternatives ('Do A because it has superior outcomes to its alternatives'), NDM focuses on various forms of experience-based matching, in the sense 'Do A because it is appropriate for situation'. 2) Instead of predicting which options should be implemented, NDM describes the cognitive processes of decision makers. 3) Instead of abstract formal models, NDM suggests that proficient decision makers are driven by domain-and contextspecific experience and knowledge. 4) Instead of prescriptive models derived from normative models, regardless of these models' descriptive validity, NDM adheres to empirical-based prescription, based on descriptive models of expert performance.
NDM is thus more oriented towards the local, particular and actual than rational choice theory's orientation towards the generalised, theoretical and formal. This is reflected in the different models suggested for NDM; being largely empirical, they describe the process of decision making through, for example, recognition-primed decisions, explanation-based decisions, search for dominant structures, image theory and argument-driven action (Lipshitz, 1993) .
For decision-making in real-life situations where time is limited, coping strategies are heuristic and pragmatic rather than probabilistic. The actual conditions and the actors' experience count more than statistical considerations, and providing and presenting adequate information to improve situation awareness, as well as training in interpretation and decision making under realistic conditions are thus adequate measures to improve decision making from the perspective of NDM. The naturalistic decision making strand of research and its forerunners depicts complex decision processes, acknowledging the significance of contextual conditions and trade-offs between conflicting goals. Hollnagel (2009) discusses this in terms of the ETTO principle (efficiencythoroughness trade-off), and describes how people, groups and organisations in real life situations have to make trade-offs between how much time and resources they spend on the thorough planning of activities and on executing them. In 'fluid' situations when conditions are changing fast, for example, thorough planning can be a waste of resources, as a plan can describe a situation that is no longer valid. Hollnagel (ibid: 25) explicitly criticises classical rational decision theory for treating time-limitations as non-existent, which is very seldom the case in 'real' working situations.
Rasmussen's work on risk handling in relation to conflicting objectives addresses some of the same issues (Rasmussen, 1997; Rosness et al., 2010) . In his model, actual work practices are seen as a result of optimising conflicting objectives such as work load/job satisfaction, economic viability and acceptable risk. Within some boundaries, employees have the freedom to explore how work practices can be balanced to meet such different objectives. This balancing is compared to seemingly random 'Brownian movements' of particles in liquids or gas, caused by collisions with other particles.
According to Rasmussen's model, accidents happen when the boundary of acceptable risk is crossed in an irreversible way. This may be caused by 'forces' that drive the work practices in this direction, such as time pressure, cost reductions and efficiency measures 5 . Safety management can serve as a 'counter force', maintaining safety margins and containing working practices within a safe 'working space'.
Methods: observations and interviews
The empirical basis for this paper includes observations and interviews performed at a major plant processing hazardous fluids and gas. A research team consisting of five researchers visited the plant on three occasions. A two day visit was carried out by the research team in January 2014, focusing on day-to day operations. The next two visits were conducted in April 2014, and focussed on longer term planning activities related to projects and modifications. A meeting dedicated to risk considerations in the longer term was observed, and the meeting coordinator was interviewed. Table  1 provides an overview of the number of meetings that were observed and people that were interviewed. In most instances, two researchers observed the meetings. An observation form was developed on the basis of the research questions, and this was applied for taking structured notes. After the meetings, the researchers composed joint notes from the meeting, based on their individual observations.
In addition to observations, semi-structured interviews were conducted. Several of the interviews were carried out as group interviews of the participants in the meetings, supplemented by individual interviews of personnel not participating in the meetings. In both instances, an interview guide was applied that described the topics that should be addressed, and also provided a list of instructive questions that could be asked, depending on the role of the informants. Most of the interviews were recorded and later transcribed.
The notes and transcriptions were analysed thematically, involving: 1) the decision situations that could be identified at the plant, where considerations of major accident risk were of relevance; 2) availability and use of information in these decision situations; and 3) possible flaws in the decision making process at the plant. In the structuring of our empirical work from the case plant, we further found it useful to distinguish between three different types of decisions, partly based on a typology by Yang (2014) : (1) strategic decisions, (2) operational decisions and (3) instantaneous decisions. We see strategic decisions as long term decisions related to future modification, projects and design, for example, which typically involve a time perspective of months and years. Consequently, strategic decisions have a bird's eye view on how to perform concrete operations. Operational decisions are of a more short term character, with a time horizon of days and weeks, and involve coordination and planning for the safe and effective completion of concrete tasks such as maintenance work. Instantaneous decisions are spontaneous decisions made by sharp-end personnel in their performance of tasks, such as those related to the sequence of tasks, involvement of other personnel, responses to deviations and anomalies etc. Instantaneous decisions also include decisions made in emergency situations triggered by danger signals, made to avoid or adapt to hazardous situations.
The case study: Decisional situations of relevance for major accident risk
The study of the case plant revealed several arenas, activities and plans where major accident risk was addressed. An overview of these is illustrated in Figure 1 . At the case plant, the strategic, long term decisions are made in relation to a Main plan and an Operational plan. Project activities (e.g. major modifications) also involve decisions with a longer time horizon. Major accident risk related to these plans and activities is considered in a dedicated Risk consideration meeting. A risk tool is used as an important support in this meeting. Operational decisions are made on a daily basis in the Notification meeting and the Work permit coordination meeting. In the Work order coordination meeting, incoming work orders are planned for the upcoming 14 days, documented in a work order plan. Instantaneous decisions are made by 'sharp end' personnel, related to performance of maintenance tasks and other types of work.
Previous investigations illustrate the relevance of the three decision types for major accidents. The types give the opportunity to describe major accidents as trajectories, where a set of decisions dispersed over a (sometimes long) time span interact and contribute to the event. For example, the report from the National Commission (2011: 122-125) after the Macondo accident, describes decisions made in different points in time which contributed to the catastrophe; e.g. decisions related to changes in drilling procedures (strategic), the decision to bypass pits and conduct simultaneous operations during displacement (operational), and the decision not to performing further well integrity diagnostics after unexplained pressure test results (instantaneous). Studies of the Snorre A blowout in 2005 Vikland, 2006, 2009) highlight decisions that are made at different stages of the operations and that contribute to the development of the blowout and eventually to the prevention of a more comprehensive catastrophe. Examples are the decisions inscribed in the work program prepared by the onshore planning department to pull the scab-liner and thus reducing the number of intact well barriers to one (strategic), the decision to actually implement the plan and pull the scab-liner (operational), and the decisions by a crew of 35 persons not to evacuate despite the risk of installation capsize (instantaneous) and to toggle the power supply so that the mud pumps could be used to kill the well (instantaneous).
In the following we will present the findings related to our study, organised into strategic, operational and instantaneous decisions (subsection 4.1-4.3). Most emphasis will be placed on operational and instantaneous decisions, as these may benefit the most from alternative forms of risk analyses.
Strategic decisions
The strategic decisions at the case plant are made in relation to longer term planning in a Main plan and an Operational plan, as well as risk considerations in a dedicated risk plan meeting.
The main plan presently has a 1-6 year scope, and is revised quarterly in main planning meetings. Two management levels are formally involved in the plan, which is meant to increase their involvement and focus.
The operational plan has a scope from 3 to 12 months and is revised on a monthly basis. Two management levels are formally involved in the same way as for the main plan.
Risk should be considered both in the main and the operational plan. In the main plan, activities that involve risk should be pointed out and described. In the operational plan, such activities should also be planned in time and considered in more detail. Check lists are used in the revisions of both plans to ensure that risk is considered, as well as other factors (comprehensibility of the plan, framework conditions etc.).
The purpose of the monthly Risk Consideration Meeting is to identify activity conflicts, at both a 3 and 12 month time horizon. Participants are HSE personnel and planners working with plant integrity and projects and operations, and there is also a safety delegate. Prior to the meeting, different plans from Projects, Modifications and Operations are assembled in an overall plan.
Data from the overall plan is exported to a Risk tool, which shows fatal accident rate (FAR) values for each construction area, based on the QRA for the plant and the planned activity. If the risk level is above a predefined acceptance level, compensating actions should be taken. Two versions are generated, one with a one-year resolution and the other with a three-month resolution. The focus in the meeting is on trends in FAR-values and also plant areas that stand out with high FAR-values and manning in particular periods. During the meeting, possible reasons for peaks in FAR-values and work hours in specific areas are discussed, and possible risk reducing measures suggested. This will in practice involve a reduction of activity.
Operational decisions
The most important operational meetings at the case plant include the Notification meeting, the Work Order Coordination meeting, and the Work Permit Coordination meeting. An overview of participants and activities in the meetings is given in Table 2 . The Notification meeting takes place every morning and includes the area manager, the operational manager, operational engineers, representatives from different support disciplines (mechanical, electrical) and the maintenance manager. The operational engineers are responsible for different systems in the area. The main activity is to review the notifications of errors and malfunctions of equipment and systems received from operators the preceding day and night. Usually, a notification contains a description of the error, possible causes, possible consequences if measures are not taken, and sometimes also suggestions for solutions.
If the equipment in question has a tag number, a criticality level (high, medium or low) is predefined in their maintenance IT system. The predefined level is a joint measure that considers both criticality for production and consequences of malfunctioning on major accident risk. The criticality can be redefined in the meeting, for example if redundancy is lost. Then a work order is produced, which is later handled by planners (see the Work Order Coordination meeting). Operational engineers play a key role in the meeting, and should provide information and considerations regarding work on "their" systems. It should be noted that the classification with respect to major hazard risk reflects the effect of the failure during stable operation. The effects on major hazard risk from carrying out the repair work are not reflected in the classification.
Decisions that are taken in the meeting include: 1) Acceptance or return of notifications due to missing information etc.; 2) Final classifications of notifications (high, medium, low criticality); 3) Whether or not a work order should be generated.
The Work Order Coordination Meeting involves planners and representatives from the mechanical, installation and electrical maintenance disciplines. The purpose of the meeting is to plan the work for the coming 14 days. The work orders are related to both corrective and preventive maintenance.
Each work order is pre-set with a 'required end date' according to its criticality. The work which is closest to the deadline is usually given priority. Depending on the resources available, some work orders will be postponed. The main decisions in the meeting thus concern when each work order should be completed, related to available resources and the 'required end date' that is set. Project activities are also illustrated in the plan, but are not planned further, as personnel resources outside Operations are dedicated to completing them. No criticality is set for modification and project activities.
The present prioritisation in the Work Order Coordination meeting is not based on major accident risk. The absence of formal risk considerations in this meeting was considered a weakness by some of the informants. A comment from Operations was that "…there is a missing link between the planning tools and risk in the longer term -in the two week perspective…". Indirectly, major accident risk is reflected in the criticality factor that is predefined for each work order, but only partially, as the factor also includes production criticality in a joint measure. The level of criticality for the work orders is set in the Notification meeting. An improvement would be if the major hazard risk could be reflected more explicitly, including also the effect on major hazard risk during the execution of the repair work itself. More concrete considerations of major accident risk in the Notification meeting would benefit the next stage in the planning process -the Work Order Coordination Meeting.
It should be beneficial and within reach to make such risk considerations at this stage. This would reveal conflicts at an earlier stage and would also add another dimension to the decision criteria which are presently used -'required end date' and available resources. A concept that provides information on instantaneous risk could be used to add this dimension to the decision situation.
The Work Permit Coordination Meeting is also a daily event that takes place in the afternoon. It involves the operation manager, the area manager, work permit coordinators, and HSE personnel. The meeting starts with a review of safety related information. The risk level is visualised by a short term version of the Risk tool which shows FAR-values for each construction area. In the short term version, FAR-values are estimated on the basis of the TRA for the plant, the number of 'hot' work permits and permits on process systems that are approved for the day, the number of persons that are planned to work in the area, and car traffic. This is followed by information regarding the state of emergency preparedness, and barriers that are not functioning are given special attention, including deadlines for re-establishment and related responsibilities. A map of the plant, showing diffuse leaks is also available in the room.
The work permit applications are then reviewed. Most of these have been pre-approved by the work permit coordinator, but are still presented to the group for final approval. The area manager formally approves the work permits in the meeting. Special attention is given to work permit applications that involve work on safety systems, 'hot' work (welding etc.), and work on process systems. The risk tool is used actively in the review. If the FAR values reach a level above the predefined limits, some jobs will be postponed so that an acceptable level is reached. Other measures could include temporary closure of roads to limit the presence of possible ignition sources. Other, more routine work applications are grouped together and approved jointly without much discussion.
Decisions in the meeting concern: 1) Approval of work activities; 2) If the estimated FAR-values are satisfactory; 3) If and what compensatory measures are necessary, based on information about the state of the system.
The day-today coordination between Operations on the one hand and Projects and Modifications on the other can be improved according to those interviewed in Operations. One stated that "…their activities just pop up in the work permit system. What we need is weekly information on status, the number of people involved, an estimation of the number of applications for work permits, etc.". So, according to Operations, there is a need for more and more continuous information from projects and modifications. "They are digging in our garden" another participant states, underlining the clear responsibility that Operations has regarding what happens in the area.
There are several other meeting arenas in Operations, but these are mostly dedicated to status information etc., and not primarily for decision making. Examples include the shift handover meeting, and meetings for operations managers of different areas of the plant. In the latter meeting, issues include the production and technical status of the plant, review of reports of deviations and unwanted incidents etc.
Instantaneous decisions
Making big and small decisions on the fly is a part of every work process. In our study, the work of the operators at the processing plant is the best example of instantaneous decisions and their relevance for safety. The operators are in charge of designated areas of the plants, and manage all the work conducted there on their shift. They also prepare the system for planned maintenance activities. Although individual tasks are structured by procedures and plans and the operators participate in more long term-oriented and structured decision processes, much of the work of an everyday shift involves situating plans within the flow of unfolding events, such as the specific circumstances of the day, weather, workload, new employees etc. The previous stages of the planning process presents the operator on a day shift with a list of accepted work permits. They must consider these in light of the circumstances and of each other and organise them into a workable whole. This means that they have to consider possible interactions between jobs (SIMOPS) and how jobs individually and in combination may trigger chains of events, weakened barriers etc. 6 While the individual work permits have, at least to some extent, been evaluated up-front, the final call of executing them on shift is given to the operator. They have to be comfortable with the specific activities going on. Although the planning can always be more systematic, and some of these decisions may be taken earlier, the operators' flexibility to make adjustments and juggle activities is a key resource in terms of getting things done while maintaining the integrity of the plant (see, e.g. Hepsø, 2006) .
Based on interviews and observations, we have seen two types of 'sharp end' activities that are presently not subject to very formal risk considerations. These are: 1) actual prioritisation of work permits, presently done by operators in the field; 2) Maintenance preparation and resetting tasks, such as those related to valves removed from the process system for maintenance.
A common observation in interviews and observations is that after the approval of permits in the WP meeting, the operator has to make the final decisions about which work is to be performed in their area. While the decision support system places some limitations on the number of permits and more specifically the different types of permits, the final coordination of tasks is performed by the operator. They will have to consider where specifically in the plant the job is performed and when specifically in the shift it is performed. This means that they must coordinate the jobs at a more detailed level, both temporally and spatially.
A job involving welding, for example, may only take fifteen minutes, and thus fit neatly into the same shift as a job on HC systems, as long as it is ensured that they do not take place at the same time. Thus, the operator's micromanagement of the jobs will be a key to their safe execution. Similarly they will consider the spatial (and functional 7 ) proximity of the jobs that are within their area, and on this basis consider which jobs to allow and deny. "The operator is our last barrier" is a typical statement in the interviews. For some types of couplings and interaction effects, operators seem to be the most important barrier, as they arrange the sequence and execution of approved jobs on the shift, sometimes with pressure added from contractors wanting to get started. Decision support, both to improve the actual decisions and to support the operators against pressure and impatient contractors, may thus be useful. As it must support, not replace, their expert judgement in specific individual situations, caution must be taken to avoid overly automated systems.
Some of the planned maintenance activities in Operations are presently completed without work permits, although such activities include interventions in HC systems. An example is the preparation for removal of a pump for overhaul, demanding, for example, blinding and isolation of the pump before removal, and resetting after the overhaul is completed. The replacement of the pump is normally covered by a work permit, but the preparation for the work and the resetting after the pump replacement are usually performed without work permits. It has been demonstrated that there is a clear correlation between manual intervention activities and the occurrence of HC leaks for offshore installations (Vinnem, 2012; , Vinnem & Røed, 2013 . Similar studies have not been carried out for onshore plants, but they are unlikely to be significantly different. Between 50% and 60% of all leaks with an initial leak rate above 0.1 kg/s have been shown to be associated with performance of manual [maintenance] work on pressurised systems for offshore installations. This ratio has been virtually unchanged since at least the turn of the century. Vinnem et al. (2007) presented indications that the ratio might be significantly lower in the UK sector, although data has so far not been available to substantiate this observation. It has also been demonstrated (Vinnem, 2012; , Vinnem & Røed, 2013 that the majority of the leaks associated with manual work are caused by faults made during isolation and blinding, as well as reinstatement (the reverse 'process'). The studies by Vinnem and Røed also document that a lack of verification of the planned valve and blinding list, as well as lack of verification of the implementation and reinstatement of the valves and blindings are two of the main contributing factors to leaks.
It would thus be preferable, with regard to major accident risk, that maintenance activities involving HC system intervention are subject to formal risk considerations. Inclusion in the work permit system would assure that such considerations take place.
Discussion and implications

The use of probabilistic and factual information
The first aim of the paper was to describe some concrete decision situations at a case plant, which were of relevance for major accident prevention. Different strategic, operational and instantaneous decisions have been presented, as well as some flaws in the decision process that may influence the risk of major accidents. Figure 1 summarizes the description of the decisional situations. Although it is limited to the case plant, we see the detailing level as a fairly representative illustration of the decision process in the Norwegian petroleum industry. Further, we regard the tripartition of decisions to be of relevance also for other industries.
On a general level, the three different decision situations (strategic, operational, instantaneous) varied according to the type of information that was used as a basis for the decisions. Some types of information can be regarded as probabilistic, considering, for example, the probability that equipment may fail, which may be used in the TRA for the plant. Other information types were factual, such as the number of approved work permits on a particular day and the number of contractors planned to work in an area. Generalised, the use of different types of information may be illustrated as in For strategic, long term decisions, a considerable proportion of the basis for considering major accident risk will be probabilistic information, which to some extent may be found in the TRA for the plant. The ideal for the strategic decision processes seems to be in accordance with rational choice theory (March, 1994) , where one seeks to reveal the different strategic alternatives, their consequences, and tries to find the best solutions when related to major accident risk, production, and project progression.
The operational decisions were based on a mix of probabilistic and factual information. Examples of probabilistic information sources were the short term version of the risk tool and the predefined criticality of equipment in SAP. Factual information included an overview of diffuse leaks, a document considering the state of emergency preparedness and planned man-hours in different areas. The complex and information-dense nature of the operational decision situations, makes the concept of bounded rationality highly relevant. Personnel in operations have to extract and combine relevant information from different sources. In such a situation, it seems likely that they are not able to consider all possible alternatives or consequences, and will be apt to apply a satisficing strategy (Simon, 1956) , and make decisions that are "good enough" based on their experience and knowledge.
The instantaneous decisions made by operators were largely based on factual information. While the long term plan considered the number of activities, the decisions made by operators handled the specific tasks, interactions between tasks and the state of barriers. Based on the state of the process and the barriers at a given point in time, progression of concrete work tasks, personnel waiting to get their work done, weather conditions etc., the operators had to coordinate activities to ensure safety and efficiency. Their decision making context involves several hallmarks of naturalistic decision making (Klein & Klinger, 1991) , such as ambiguity, dynamic and continually changing conditions, time pressure, and high stakes related to major accident risk and efficiency.
The application of different types of information described above, has some implications for how decisions may be supported. This is discussed in the following.
Principles for decision support
The second aim of the paper was to discuss some principles for decision support for situations where the decisions taken have relevance to major accident risk.
We have illustrated that the strategic, operational and instantaneous decision processes are different, not only regarding time horizon, but also when it comes to the type of information that is applied, and the kind of personnel that is involved in the processes. Principles for decision support should reflect such differences. Typically, one would regard the thorough and rational process found in strategic planning as optimal, and seek to mimic those processes for other processes, but this may not be an appropriate strategy. As one approaches the operational sharp end, risk is not about abstract numbers but about concrete singular tasks and their coordination. The representation and analysis of risk must therefore be different. Considering our observations of decisions at the case plant in light of decision theory, we see some principles to pursue further that may improve the consideration of major accident risk in the process industry.
First, it should be beneficial to improve the factual information base for instantaneous decisions. Instantaneous decisions that occur in such a fashion that they are difficult or impossible to plan in advance, should be supported as such. For this kind of decision support, we may look to the field of naturalistic decision making for advice about what shape such decision support should take. As indicated above, better tools, methods and practices for providing and presenting more and better factual information to improve situation awareness of concurrent activities, of the state of relevant barriers for individual jobs and the system as a whole is one way forward. Decisions may be supported by visualising hazardous couplings between activities, such as how a spark appearing from one activity can ignite a leakage caused by another, or how a truck accident in this area can affect other activities. While such tools exist for the pre-planning stages, simple interactive visualizations supporting the operators day to day or shift to shift managing of planned tasks, contingencies and variability can support the decisions the operators have to make during each shift. Maps and activity charts can be improved, simple interactive tools recognising that the "juggling" nature of these decisions may be useful. This can be seen as an isolated initiative, but should preferably be seen in combination with the additional strategy of explicit training in decisional situations.
Secondly, the study has illustrated that there is room for improvement of the probabilistic information base. One example from the case plant involved the predefined criticality factor for equipment. This factor was a combined measure, reflecting both the consequences of equipment not functioning on major accident risk during stable production and the consequences for production. Splitting the two would provide a better foundation for the decisions, but also the risk during execution of the repair work should ideally be addressed.
Thirdly, it should also be prudent to arrange for the use of more factual information earlier in the planning process. One example from our case was that personnel from Operations were concerned that they received information from Modifications and Projects too late to coordinate the activities properly. Operations complained that their activities "…just pop up in the work permit system.." One way of addressing the expressed need for coordination is to establish a formal arena for the actors where they can meet regularly and exchange factual information. This may fill a gap in risk planning, regarding both time and the involvement of Operations.
Fourth, thorough considerations should be made about what should be considered operational and instantaneous decisions. Some decisions that are today managed as instantaneous are eligible to be managed as operational decisions. In our observations we saw potential for alleviating the burden of operators by handling more task coordination, and specifically analysing the risk related to task interdependency and the influences of simultaneous activities, at an operational decision level. In practice, when constructing a 14 day plan, the focus today is on logistics. If one is able to increase the analysis of possible conflicts and interactional issues here and present it to the operator in a reasonable way, their work can be safer and easier.
One concrete example from the case study, was that some maintenance activities involving blinding, isolation and resetting were completed without work permits, although such activities included interventions in HC systems and a substantial probability of leaks (Vinnem, 2012; Vinnem, 2013) . Involving these activities in the work permit system, and thus within the operational decisional sphere, should decrease major accident risk.
It may be argued that lifting decisions from the instantaneous to operational level implies an increased centralization of decision-making, and moving decisions to some extent away from 'the sharp end', where, some would argue, better knowledge about the plant is present. With this reasoning, the lifting of some decisions to an operational level would imply a possible increase in major hazard risk, i.e. the opposite of what is the aim. Several studies of HC leaks (Vinnem, 2012; Vinnem & Røed, 2013) have demonstrated that operational activities, including simultaneous activities, as well as restrictions placed on detection systems and other mitigating barriers imply such complex decision situations, that ad-hoc decision-making by individual operators are inclined to miss the extent of complexity, and thus make errors which lead to unplanned and unwanted release of HC due to unforeseen interactions. Insights from Perrow's 'Normal accident theory ' (1999: 332) also lend support to this. Here, one argument is that tightly coupled systems should have a centralization of authority in order to handle conflicts that single employees are not aware of. For example, if two trains accidentally are in the same track moving against each other, a central authority that can see the whole picture is best suited for solving the situation. This also applies to isolation and blinding of process lines as preparation for maintenance work. There are therefore good reasons why some of the decisions may benefit from being lifted to an operational level, where some kind of systematic tools may be employed.
It is common practice that activities involving blinding, isolation and resetting are completed outside of the work permit system, even though such activities involve intervention in the HC systems (Vinnem, 2012; Vinnem, 2013) . Involving these activities in the work permit system may not be realistic, but the risk aspects should nevertheless be included in the decision-making within the operational decisional sphere as argued above, in order to reduce major accident risk.
Conclusion
This empirical study of the processing industry has illustrated that decision making relevant to major accident risk cannot be considered as a single, coherent activity. The time lag between consideration, conclusion and the outcome of decisions varies considerably for strategic, operational and instantaneous decisions. The information base, as well as the personnel involved, also varies between the three types.
Decision support for major accident prevention should also be nuanced and reflect these differences. When considering better means of support, different decision making theories provide a starting point for carving out some principles. The theories of rational choice, bounded rationality and naturalistic decision making are all of relevance in this respect. Better decision support should involve considering the quality of both probabilistic and factual information. The use of more factual information earlier in the planning process will also provide added value. To be conscious of what should be considered strategic, operational and instantaneous decisions is a basic premise for improvements in the decision process.

{'paper_id': '109585859', 'title': 'Decisions and decision support for major accident prevention in the process industries', 's2_url': 'https://api.semanticscholar.org/CorpusID:109585859', 'source': 'S2ORC'}