DOI: 10.3303/CET2290123 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Paper Received: 22 January 2022; Revised: 28 March 2022; Accepted: 22 April 2022 
Please cite this article as: Lindgren M., 2022, Improving the management and use of operating instructions for process safety, Chemical 
Engineering Transactions, 90, 733-738  DOI:10.3303/CET2290123 
  

 CHEMICAL ENGINEERING TRANSACTIONS  
 

VOL. 90, 2022 

A publication of 

 
The Italian Association 

of Chemical Engineering 
Online at www.cetjournal.it 

Guest Editors: Aleš Bernatík, Bruno Fabiano 
Copyright © 2022, AIDIC Servizi S.r.l. 
ISBN 978-88-95608-88-4; ISSN 2283-9216 

Improving the Management and Use of Operating Instructions 
for Process Safety 

Mats Lindgren 

IPS, The Swedish Process Safety Association, Rönngatan 12, 426 77 Västra Frölunda, Sweden 
mats@ips.se 

A qualitative case study has been conducted about the management and use of operating instructions in a 
process plant in Sweden. The work was inspired by Dekker's notion of two paradigms in relation to procedures, 
where Model 1 is authoritarian and top-down, and Model 2 is flexible and consultative (Dekker, 2003). The 
results support Dekker's hypothesis, that organizations should strive towards Model 2 to make progress on 
safety. Based on the findings, a framework was developed to illustrate some potentially useful practices 
regarding the management and use of operating instructions. 

1. Introduction 
This paper is based on a thesis by this author, at the master programme in human factors and system safety at 
Lund University. The project consisted of a literature review and a qualitative case study at a large process plant 
in Sweden. The objective was to get a better understanding of challenges and opportunities for improvements 
related to the management and use of operating instructions in the process industry.  
The process industry, like other complex and high-risk industries, relies heavily on documented operating 
instructions for safe and reliable operations (Mannan, 2012). Problems with procedures are frequently implicated 
in accident investigations, including high-profile disasters like Piper Alpha, Texas City and Buncefield (Hopkins, 
2011). Many high-risk industries are trying to improve compliance with procedures (Hale & Borys, 2013a). 
However, excessive proceduralization and focus on rule-following can be counter-productive, according to 
several writers (Bieder & Bourrier, 2013). 
Sidney Dekker (2003) introduced the notion of two paradigms, Model 1 and Model 2, where Model 1 is 
authoritarian and inflexible, and Model 2 is consultative and flexible. Dekker and others (Hendricks and Peres, 
2021) suggest that most organisations should move towards Model 2 to make progress on safety. However, 
systematic use of ideas from Model 2 has not been studied in practice in the process industry, at least not by 
rigorous research. Hence, this thesis project was considered useful.  

2. Literature review 
2.1 The case for procedures 

Standardized and documented procedures are generally considered useful, or even necessary, in complex 
sociotechnical systems such as process plants (Hale & Borys, 2013a). The main reasons can be briefly 
summarized (Reason, 1997):  

• tasks can be complicated and difficult to remember 
• different actors need coordination 
• a reference for training and monitoring 
• as a form of 'organizational memory' 

2.2 The problem with procedures 

Violations can occur due to, e.g. (Hale & Borys, 2013a, p. 212): 

733



• Attitudes to and habits of non-compliance 
• Design/layout making violation necessary to achieve objectives 
• Management turns a blind eye or is inconsistent in sanctioning 
• Conflicting demands, pressure towards productivity 

An excessive amount of detailed operating instructions and demands for compliance and accountability can be 
counterproductive (Bieder & Bourrier, 2013). Due to the complexity of process plants, "we cannot cover every 
possibility in our instructions and the longer we make them, the less likely they will be read." (Kletz & Amyotte, 
2019). Furthermore, the willingness and capability to handle situations where instructions don't exist or don't 
work is impaired if people become too used to follow instructions, instead of using experience and tacit 
knowledge (Bergström et al, 2009). Fear of being held accountable for unintended consequences could also 
prevent people from taking own initiatives (Dekker, 2020).  

2.3 Model 1 and Model 2 

Sidney Dekker introduced the idea of two different paradigms in relation to procedures, Model 1 and Model 2. 
Model 1 is a classic Tayloristic approach, where engineers and managers write and issue rules and procedures 
that workers are requested to follow. In Model 2, "safety results from people being skilful at judging when (and 
when not) and how to adapt procedures to local circumstances" (Dekker, 2003, p. 235). Rules can produce 
good safety results, especially for common workplace accidents such as slips, trips, and falls (Hopkins, 2011). 
However, according to Dekker, some risks, especially in complex activities, are difficult or even impossible to 
prevent without fundamental changes towards Model 2. 

2.4 A framework for rule management 

Hale and Borys (2013b) have proposed a framework to enable organisations in high-risk domains to improve 
their "rule management" towards Model 2, while still maintaining useful aspects of model 1, such as attention to 
detail, deference to expertise when required, and compliance with rules and procedures that make sense. The 
following steps are described as options within that framework (Hale & Borys, 2013b, p. 229): 

1. Monitor and analyze violations as a participative activity, in order to understand them. 
2. Audit violation potential. 
3. Redesign the job or equipment to remove the need for procedures or violations, or to 

support procedure use. 
4. Rewrite procedures with a well-designed process and to relevant criteria. 
5. Involve/consult/inform the workforce during the rewriting. 
6. Train and retrain in risk perception, the procedure and its use and adaptation. 
7. Anticipate the need for, and provide the authority and a system for, varying procedures. 
8. Promote a learning and sharing culture around compliance. 
9. Enforce, where the procedure is the agreed and appropriate best way of proceeding. 

2.5 An empirical study of Model 1 and Model 2 indicators 

Hendricks and Peres (2021) conducted a survey (questionnaire) of perceptions about procedures, behaviour, 
and safety outcome among 174 workers, mainly in the chemical and process industry in Canada and the US. 
Questions related to predictor variables such as attitudes towards and perceptions about procedures, as well 
as outcome variables, such as "How many incidents have you been involved in in your career?" and "How often 
do you deviate from procedures for a highly hazardous task?" (Hendricks & Peres, 2021, p. 4). The strongest 
correlations with outcome variables were found for perceived quality of procedures, i.e., "the better the quality, 
the fewer deviations, the more they used procedures, and the fewer incidents and near-misses per year" 
(Hendricks & Peres, 2021, p. 7). According to the author's, the results provide support for Dekker's Model 2.  

2.6 Conclusions from the literature review 

This brief literature review has demonstrated some common problems related to procedures in safety critical 
domains. Some potentially useful approaches have been proposed to reduce such problems, e.g., "...a 
significant culture-shift, perspective change or paradigm shift for many of those individuals and organisations 
operating under a pure model 1, to accommodate the ideas of the flexibility implied in model 2" (Hale and Borys, 
2013b, p. 229).  

734



3. Method 
The main research data was gathered through focus group discussions with employees at a process plant, who 
are involved in writing, updating, and using operating instructions. Subsequent thematic analysis enabled the 
researcher to make some conclusions about the practical application of Model 1 and Model 2 theories. 

3.1 The case 

The plant is in Sweden. It consists of several highly integrated process units, tank farms and a harbour, divided 
into three physical and organisational areas of operation. Large quantities of flammable liquids and gases are 
processed, at elevated temperatures and pressures. The plant operates continuously. There are five shifts, with 
about 50 operators on each, and about 600 employees altogether. Each area has an operations manager and 
3-4 operations engineers. Each shift has a shift manager and 3 area shift managers, and deputies. There are 
about 1400 operating instructions, and an additional 1200 checklists for different operator tasks, published via 
a computer-based document management system (SharePoint application). 

3.2 Document review 

To prepare for the group discussions, and as a form of triangulation, some pertinent company documents were 
obtained and reviewed by the researcher. Company representatives assisted in selecting relevant documents. 
The types of documents were: 

• Instructions for plant start-up 
• Instruction for furnace mode change 
• Instruction for abnormal situation 
• Work permit procedures 
• Incident investigations 
• Process safety event statistics 
• Safety climate questionnaire results 
• Guideline for writing operating instructions 
• Template for operating instructions 

3.3 Group discussions 

Group discussion ("focus groups") is a common qualitative research method, which was considered more useful 
for this project than individual interviews, due to the stimulation provided by group interaction. A company 
representative assisted in selecting the informants, based on a mixture of purposive and convenience sampling. 
There was one meeting with each group. 
 

Group 1  
Shift operators 
Area 1 

Group 2  
Shift operators 
Area 2 

Group 3  
Shift operators 
Area 3 

Group 4 
1 area operations manager, 1 shift 
manager, 2 area shift managers, 3 
operations engineers 

4 persons (1 female, 3 
males). Average of 15 
years with the company 
(range 2–38 years). 

6 persons (all 
male). 
Average of 16 years 
with the company 
(range 6–39 years). 

6 persons (2 
females, 4 males). 
Average of 8 years 
with the company 
(range 2–20 years). 

9 persons (1 female, 8 males).  
Average of 24 years with the 
company (range 15–38).  

Table 1 Focus Groups 

A set of questions was prepared before the meetings, inspired by the literature review and the document review: 
• When and how do the operators use operating instructions? 
• What are the advantages of, and problems with, operating instructions? 
• When and how can deviation from operating instructions occur? 
• Are the operators blamed or disciplined for not following operating instructions? 
• Who is involved in the writing and updating of operating instructions? 
• What are the problems in relation to writing and updating of operating instructions? 
• What do you think about the document system and the template for operating instructions? 

The informants were encouraged to discuss quite freely. All the questions were not spelled out exactly as 
listed but covered indirectly. 

735



4. Findings and discussion 
The framework shown in Figure 1 below was developed by the researcher, to show how the findings from the 
literature review and the case study can be applied in practise. It is inspired by a similar diagram used by Hale 
and Borys (2013b, p. 224), described as "essentially neutral between Model 1 and 2", with "a cyclical nature, 
emphasising...that rule management is a dynamic process of adaptation... (Model 2)". The findings from the 
case study are discussed for each of the numbered boxes. 

 
Figure 1: Framework for the management and use of operating instructions 

4.1 Changes to equipment, operations, or organisation 

In process plants, there are usually numerous changes to equipment or operations, as companies strive for 
efficiency and success. Usually, such changes will create a need for new or updated operating instructions, that 
must be dealt with by the organisation. For example, in the case study plant, a new process unit was constructed 
a few years ago, which resulted in 92 new operating instructions. Furthermore, organisational changes mean 
that writers of instructions, and the operators affected by particular instructions, change from time to time, with 
implications for e.g., updating (4.2) and communication and training (4.3). 

4.2 Communication and training 

Instructions for plant shutdowns and start-up are reviewed in group sessions with operators prior to planned 
shutdowns and start-ups. Emergency instructions are practiced or discussed with operators annually. Training 
and information about the work permit procedure is conducted regularly. For straightforward routine tasks with 
relatively low risks, training is mainly on-the-job with an experienced colleague. Using applicable instructions 
during training doesn't seem to be common. Hence, if experienced operators are deviating from an instruction, 
the same deviation will often be repeated by new operators. It would probably be worthwhile to encourage the 
use of operating instructions during training, and to include some questions about instructions in the competence 
check-out procedures. Important changes in instructions seem to be communicated quite effectively at the case 
study plant, especially safety related changes that need to be implemented more or less immediately. Other 
changes can sometimes be released in the document system but remain unnoticed by the operators.  

4.3 Using instructions during work 

Each unit is usually cold started only once every few years, and an individual operator may only be involved in 
the start-up of each unit a few times during an entire career. The control room operators therefore rely on the 
start-up instruction to take the right actions, and give the right instructions to the outside operators. They must 
keep track of many concurrent activities and monitor a lot of process parameters on the panel displays. The 
steps in the start-up instructions, presented in a sequence, often need to be modified, rearranged, or run 
concurrently, due to dynamic developments and practical issues. The start-up instructions are in a checklist 
format, where the control room operator must sign-off each step on a paper-based "master copy” and add 
comments about anomalies and adaptations. This is essential so that an incoming shift can know the state of 
the plant and the start-up. The area shift manager and the operations engineers will also look at it now and then, 

736



to give advice and directives to the operators. The outside operators often use printed copies of the instruction, 
but do not have access to the master copy in the control room. Therefore, they may not have a complete 
awareness of the situation, but rely on instructions from the control room operator. The operators at the case 
study plant are obliged to consult the area shift manager whenever they find a need to deviate from instructions. 
That makes sense, since one person alone can easily overlook an undesired effect of a deviation. As an 
alternative, in the spirit of Model 2, it might be possible to allow pairs of sufficiently competent operators to 
proceed with some deviations without prior approval from the area shift manager. In practice, that probably 
occurs every now and then, but it might be difficult to formalise. 

4.4 Supervision and monitoring 

Analysis of gaps between Work-As-Imagined and Work-As-Done (Hollnagel, 2014) can be used to improve 
instructions and their use. Systematic monitoring of compliance with operating instructions could be in the form 
of behaviour observations and audits. It has been shown that behaviour observation techniques can lead to 
improved compliance when it comes to rather simple and straightforward rules (Hopkins, 2011), but an 
authoritarian "top-down" style (Model 1) is considered counter-productive (Dekker, 2020). At the case study 
plant, operators, area shift managers, operating engineers and operating managers seem to be quite open and 
constructive in discussions about operational issues. Audits are conducted for some key procedures, such as 
work permits and isolations for maintenance, and by-passing of safety instrumented functions. The incident 
investigations at the case study plant reviewed by the researcher included some recommendations to revise 
operating instructions. That is a common outcome of incident investigations (Bieder & Bourrier, 2013). It makes 
sense when deficiencies in instructions are revealed by an investigation, but the effectiveness could be 
questionable, or even counter-productive, if changes in instructions are used only as a "quick fix" (Lundberg et 
al, 2010).  

4.5 Document system 

The informants were very critical about the document system. Nearly all had difficulties finding instructions at 
times. Similar problems have been reported in a study of workers knowledge of rules and procedures within the 
petroleum industry by Dahl (2013), who pointed also at the bad signal value of poor document system usability. 
Those who are involved in writing and updating instructions at the case study plant also had difficulties with 
system functions like document tagging, due date reminders and the review and approval automated work-flow. 
It appears that the system is not very user-friendly, and only limited training has been provided since the system 
was implemented 4-5 years ago. Some super-users were appointed at that time, but at present they don't seem 
to be very active in training or coaching other users. It seems very likely that these types of problems will affect 
people's attitudes towards the development and use of instructions in a negative way. 

4.6 Suitable writers and sufficient time 

In the case study plant, operations engineers have traditionally been responsible for writing and updating 
operating instructions. That makes sense since they are usually appointed based on prior experience and 
competence as operators and shift supervisors. Perhaps because they have that background, they may not 
bother to consult with operators about the best ways to operate. Furthermore, they are usually very busy people, 
torn between being out in the plant, attending meetings and acute problem solving. The ability to write well can 
also vary. Hence, the organisation seems to struggle somewhat to develop and maintain high quality operating 
instructions. Some operators in the focus groups have recently been asked to assist with reviewing and updating 
some instructions in their area. When they finish a draft, it is sent to the area shift manager and the operations 
engineers for review, and perhaps adjustments, then to the operations manager for approval and release. 
Sometimes this process is delayed due to other, more urgent work, which can cause some frustration. 

4.7 Writer's guide and support 

An idea discussed with one of the informants would be to appoint a 'writing coach', someone with an operations 
background and some interest in and talent for writing good instructions. He or she could develop the existing 
guideline for the format and style of operating instructions, rewrite some instructions as good examples, identify 
instructions that need extra work, and assist writers with advice and comments on drafts. He or she should 
spend some time reading relevant literature, or perhaps take part in formal training, about human factors and 
procedures. 

737



5. Conclusions 
Organizations should continue to invest in the development of operating instructions, especially for safety critical 
tasks, and encourage operators to use them. Model 2 theories are indeed useful, to improve the quality and use 
of instructions. The framework proposed by the researcher supports such developments. Key activities are: 

• Monitoring and follow-up of gaps between work-as-done and work-as-imagined 
• Involvement of operators in the development of instructions 
• Training in the interpretation and adaptation of instructions  

 
While operator involvement is essential, operations engineers are still appropriate 'owners' of the instructions. 
Appointment of a talented 'writing coach', and development of an internal 'writer's guide' seem worthwhile, to 
develop and maintain an appropriate format and style. Future research to test the effects of such initiatives 
seems warranted. 
Generalisability and transferability cannot be claimed based on a case study of one plant. However, based on 
the literature review and the researcher's experience from the process industry, these conclusions might well 
be valid for most process plants. 

References 

Bergström, J., Dahlström, N., van Winsen, R., Lützhöft, M., Nyce, Dekker, S., 2009. Rule- and role-retreat: An 
empirical study of procedures and resilience. Journal of Maritime Research, 6 (3), 41-58. 

Bieder, C., Bourrier, M. (Eds.)., 2013. Trapping safety into rules: how desirable or avoidable is proceduralization 
(Kindle edition). Ashgate Publishing Limited. Farnham, UK. 

Dahl, Ø., 2013. Safety compliance in a highly regulated environment: A case study of workers' knowledge of 
rules and procedures within the petroleum industry. Safety Science 60, 185-195. 

Dekker, S., 2003. Failure to adapt or adaptations that fail, contrasting models on procedures and safety. Applied 
Ergonomics 34, 233-238.  

Dekker, S., 2020. Safety after neoliberalism. Safety Science, May 2020, 1-6. 
Hale, A. & Borys, D., 2013a. Working to rule, or working safely? Part 1: A state of the art review. Safety Science 

55, 207-221. 
Hale, A. & Borys, D., 2013b. Working to rule, or working safely? Part 2: The management of safety rules and 

procedures. Safety Science 55, 222-231. 
Hendricks, J.W. & Peres, S.C., 2021. Beyond human error: An empirical study of the safety Model 1 and Model 

2 approaches for predicting workers' behaviors and outcomes with procedures. Safety Science 134, 1-10.  
Hollnagel, E., 2014. Safety-I and Safety II; The Past and Future of Safety Management. An Ashgate Book. CRC 

Press, Taylor & Francis Group. Boca Raton, USA. 
Hopkins, A., 2011. Risk-management and rule-compliance: Decision-making in hazardous industries. Safety 

Science 49, 110-120. 
Kletz, T. & Amyotte, P., 2019. What went wrong? (6th ed). Butterworth-Heinemann. doi.org/10.1016/B978-0-

12-810539-9.09975-4. 
Lundberg, J., Rollenhagen, C., Hollnagel, E., 2010. What you find is not always what you fix - How other aspects 

than causes of accidents decide recommendations for remedial actions. Accident Analysis and Prevention 
42, 2132-2139. 

Mannan, S. (Ed.), 2012. Lees' Loss Prevention in the Process Industries, 4th ed. Waltham, Elsevier.  
Reason, J., 1997. Managing the Risks of Organizational Accidents. Ashgate Publishing Limited. Aldershot, 

England. 

738


	lp-2022-abstract-070.pdf
	Improving the Management and Use of Operating Instructions for Process Safety