Control-of-work technology has to work in the conditions people actually face. The technology may be sophisticated, but its purpose is simple: help people plan and carry out hazardous work safely and efficiently, often under pressure and with little margin for error.
The users of such software may be experienced, competent and committed to doing the job properly. They are also subject to fatigue, pressure, distraction and cognitive bias. Any safety software that ignores this reality is leaving an important part of the risk unmanaged.
This was the starting point for Scott Bredin’s presentation at the Zero Harm, Zero excuses event in Johannesburg. Drawing on Daniel Kahneman’s work on human cognition, Scott explored why electronic permit-to-work systems matter, and how they can be designed for the way people actually work.
Piper Alpha and the limits of human performance
Any discussion about electronic permit-to-work systems eventually comes back to Piper Alpha.
The 1988 disaster remains one of the clearest examples of how failures in communication and work control can combine with ordinary human actions to produce a catastrophic result. A maintenance permit had been issued on the day shift for work on a pressure safety valve that was protecting a backup condensate pump. Critical information about the equipment’s condition was lost because the permits were filed separately, and the day shift failed to verbally communicate the status during handover. The safety valve had been removed by the maintenance team and replaced with a temporary blind flange that was only hand-tightened. When the operating pump tripped later that night, the control room operators attempted to start the backup pump to restore production, entirely unaware that its safety valve was missing
The result was a gas leak, followed by explosions and the deaths of 167 people.
It is tempting to describe incidents like this as the result of individual carelessness. That explanation is too simple. The people involved did not arrive at work intending to harm anyone or perform badly. They were trying to operate the plant and complete their work.
The failure was systemic. Important information was not communicated clearly enough between shifts. The permit system did not give the incoming team a reliable, usable picture of what work had been authorised, what equipment had been isolated and what hazards remained.
The Cullen Inquiry that followed issued 106 specific recommendations that fundamentally overhauled offshore safety management. Rather than introducing more rigid checkboxes, the report shifted the industry from rigid “prescriptive” rules to a dynamic safety management system built on a number of critical safety pillars. Blaming individuals does little to prevent the next incident. Improving the safety system can.
Two ways of thinking
Scott referred to Daniel Kahneman’s well-known book Thinking, Fast and Slow, which describes two modes of human thought.
System 1 is fast, automatic and based on pattern recognition. It allows an experienced operator to enter a plant and immediately sense that something is wrong. People often describe this as instinct or experience. In reality, the brain is rapidly comparing what it sees and hears with patterns built up over time.
System 1 is extremely useful. It enables people to process large amounts of information quickly. Without it, routine operations would be slow and mentally exhausting.
It also makes assumptions. When information is missing, the brain fills in the gaps. Usually that works well enough. In a hazardous operating environment, it can create a dangerous false sense that everything is normal.
System 2 is slower and more deliberate. It is the form of thinking needed for unfamiliar, complex or high-hazard work. It involves checking information, considering alternatives and working through the consequences of a decision.
The problem is that System 2 is limited. It requires concentration and mental effort. Fatigue, time pressure, noise and stress all make it harder to engage.
This creates a serious challenge for high-hazard industries. The situations that require the most careful reasoning are often the same situations that make careful reasoning difficult.
A major maintenance turnaround, a plant start-up or an unplanned equipment failure can place people under intense pressure. They may need System 2 thinking, but the conditions are pushing them towards System 1.
We do not experience the world directly
Scott also discussed a less obvious feature of human perception: we do not simply observe reality and then respond to it.
Our brains use existing knowledge and expectations to predict what we are about to experience. Our senses then check those predictions and correct them where necessary.
This is happening all the time. The brain is constantly making judgements about what we can see, hear and feel, often before we are consciously aware of the information.
That process is efficient, but it can also mislead us. If the situation appears to match our expectations, we may fail to notice information that does not fit the pattern. We see what we expect to see and treat the unexpected detail as unimportant, or perhaps do not register it at all.
In a plant environment, this could mean assuming that equipment is in its normal condition because it usually is. It could mean treating an incomplete handover as a routine omission rather than a warning. It could mean relying on memory when the written record is unclear.
These are not character flaws. They are features of ordinary human cognition.
Building systems that support people
The practical lesson is straightforward: safety systems need to be designed around real human performance, not an idealised version of it.
People will sometimes be tired. They will work under pressure. They will misunderstand information, make assumptions and overlook details. Competence and good intentions do not remove these risks.
The purpose of a permit-to-work system is therefore wider than issuing approvals. It must help people maintain a shared understanding of the work:
- What work is taking place?
- Which equipment is affected?
- What isolations are in place?
- Which hazards remain?
- Who is authorised to perform and approve the work?
- What has changed since the previous shift?
This information needs to be clear, current and available to the people who need it. It cannot remain buried in a paper permit that is difficult to read, stored in the wrong place or understood only by the person who created it.
An electronic system can provide a common operational record. It can make permit status visible, preserve the history of changes and improve the quality of shift handovers. It can also enforce rules around authorisation, competence and approval, rather than relying entirely on memory or informal practice.
That does not eliminate human judgement. It gives human judgement better information to work with.
The real role of technology
There is a risk in treating digitalisation as a technology project alone. Replacing paper with software does not automatically make work safer. Poorly designed software can simply make the same weaknesses harder to see.
The value comes from recognising where people are most likely to struggle and designing the system to provide support at those points.
If System 2 thinking is needed, the system should make important information easier to find and understand. If shift handover is a known weakness, the system should make changes, outstanding work and equipment status visible. If authorisation is important, the system should prevent people without the right authority or competence from signing off critical stages.
Good safety technology does not assume that people will always perform perfectly. It helps them perform safely when conditions are far from perfect.
That is the central message from Scott’s presentation. Human error is often the visible outcome of a deeper system problem. The answer is not to add technology, remove human beings from the process or blame them when something goes wrong. It is to build work control systems that recognise how people think, communicate and make decisions under pressure.
Technology that accounts for the way people really think will earn its place in industrial safety applications. Technology that ignores human cognitive factors might in contrast just be adding another level of hidden risk.
To learn about how IntelliPERMIT is designed around human cognitive processes and how it supports a comprehensive safe system of work, please contact the team at Adapt IT.
