The HOP principles and where they come from

At 6:10 on a Tuesday morning, near the end of a product changeover on bun line 3 at the Gainesville plant, maintenance technician Ben Kowalski reached past a removed guard to clear a lump of dough from the divider conveyor. He had locked out what he believed was the conveyor's disconnect and pressed the local start button, and nothing had moved. A minute later the line operator, Mei Chen, reached the last item on her changeover checklist, reset the line's emergency stop, and the divider conveyor started. Ben felt the belt grab his glove and pulled back. The glove tore. He needed a bandage on one finger and nothing more.

Ben had worked at Harrowgate Foods Inc. for nineteen years. He taught the lockout course to new maintenance hires. The disconnect he had locked was the right shape, in the right place, and carried the label his procedure named. It controlled the conveyor next to the divider. The two disconnects had been removed and reinstalled three weeks earlier during a control panel upgrade, and their labels had gone back on the wrong boxes. His start test had failed not because the conveyor was isolated but because Mei had pressed the emergency stop when the changeover began, and a latched emergency stop stops everything.

The night supervisor's first report, written before he went home, read: 'Root cause: employee failed to verify zero energy before entering the guarded area. Corrective action: retrain employee on lockout; written warning.' Rachel Okoye, the vice-president of operations, read it at 8:30 and walked down to Elena Novak's office. 'Ben teaches lockout,' she said. 'If Ben can get this wrong, what does that say about the rest of us? And what does a written warning fix?'

That question started the project this course follows. Over the next two years, Harrowgate Foods Inc. tried to build its safety work on the ideas usually grouped under the name human and organizational performance, or HOP. This first lesson sets out those ideas, where they came from, and what they ask of a company like Harrowgate Foods Inc. that already has procedures, audits, lockout rules and a metrics framework of the kind built in HSE-407.

What HOP is

Human and organizational performance is not a program, a product or a single method. It is a set of beliefs about how people and work actually behave, together with practices that follow from those beliefs. The beliefs are drawn from decades of research in human factors, cognitive psychology, systems safety and resilience engineering. The practices include learning teams, operational learning, error-tolerant design, pre-job briefs that focus on critical steps, critical control management and a restorative response to failure, all of which later lessons cover.

The core move in HOP is a change in the question people ask after something goes wrong. The traditional question is 'who failed?' The HOP question is 'what made this make sense to the person at the time, and how do we make the work able to fail without hurting anyone?' The first question looks for a person to fix. The second looks for conditions to change.

Rachel had come to food manufacturing from aviation maintenance, where these ideas were already part of daily work. She put it to the leadership team this way: 'We have spent years trying to make people perfect. People will never be perfect. We can make the work tolerant of the fact that they are not.'

Five principles

The most widely used summary of HOP is a set of five principles popularized by Todd Conklin, a safety researcher who spent much of his career at the Los Alamos National Laboratory. Different authors word them slightly differently, but the content is consistent.

• Error is normal. Even skilled, careful, motivated people make mistakes, and they make them at fairly predictable rates. A safety system that relies on people never making mistakes will eventually fail.
• Blame fixes nothing. Blaming, disciplining or retraining the person closest to the event rarely changes the conditions that produced the error, and it teaches everyone else to stay quiet.
• Learning is vital. Organizations improve by learning how work really happens, from failures and from the much larger body of work that goes well.
• Context drives behavior. What people do is shaped by the tools, time, information, pressures and incentives around them. To change behavior reliably, change the context.
• How leaders respond to failure matters. The response to a mistake tells everyone whether it is safe to report problems, and it decides whether the organization learns or hides.

Applied to the line 3 event, each principle points in the same direction. Ben made an error, but a predictable one: he trusted a label and a start test, both of which normally work. Blaming him would leave the swapped labels on other panels and the latched emergency stop able to fool the next technician. Learning how changeovers really run, under the 6:30 start time, would show why the start test was done the way it was. The context, including a recent panel upgrade with no check of the labels afterwards, drove what happened. And the response, a written warning for a lockout trainer, would tell every technician in the plant that reporting a near miss is risky.

Where the ideas come from

HOP did not appear from nowhere. Its principles are a practical summary of several research traditions, each of which made a distinct contribution.

Heinrich and the older view

H. W. Heinrich's 1931 book Industrial Accident Prevention argued that most accidents were caused by unsafe acts of workers, and that minor events, injuries and serious injuries stood in a fixed ratio to one another. HSE-401 Lesson 9 explained why both claims have been challenged. Heinrich's work is on the timeline not because HOP builds on it but because HOP is in part a reaction to it. The idea that the worker's unsafe act is the cause, and that the fix is to change the worker, still shapes many investigation forms, including the one the night supervisor filled in.

Rasmussen: performance modes and drift

Jens Rasmussen, a Danish engineer who studied operators in process control rooms, described three modes in which people perform: skill-based, rule-based and knowledge-based. Lesson 2 uses his framework to explain why different kinds of error occur in different situations. Later, in a 1997 paper on risk management in a dynamic society, Rasmussen described how work drifts under pressure for efficiency and lower workload toward the boundary of safe performance, without anyone deciding to take more risk. Lesson 4 returns to that idea.

Reason: error types and latent conditions

James Reason, a British psychologist, classified errors into slips, lapses and mistakes, and separated them from violations. HSE-403 Lesson 7 introduced his classification for investigators. Reason also argued that most accidents involve latent conditions, such as poor design, gaps in supervision or unworkable procedures, that lie dormant until combined with a frontline error. His Swiss cheese model, in which holes in successive defenses line up, gave managers a picture of why the person at the sharp end is usually the last link in a longer chain.

The Department of Energy handbook

In 2009, the United States Department of Energy published a two-volume Human Performance Improvement Handbook, drawing on practice in nuclear power. It turned research on error into tools for daily work: error precursors, error traps, self-checking, peer checking, pre-job briefings and post-job reviews. Lessons 3 and 8 use material that traces back to this handbook. Many HOP practitioners first met these ideas in the electric utility and nuclear industries.

Dekker: the new view of human error

Sidney Dekker, a safety researcher with a background in aviation, contrasted an 'old view' in which human error is the cause of failure with a 'new view' in which human error is a symptom of trouble deeper in the system. In his Field Guide to Understanding Human Error, he urged investigators to reconstruct the situation as the person saw it at the time, rather than judging their actions with hindsight. He also wrote extensively on just culture and, later, restorative just culture, which Lesson 11 covers.

Hollnagel: Safety-I and Safety-II

Erik Hollnagel, one of the founders of resilience engineering, distinguished Safety-I, which defines safety as the absence of things going wrong, from Safety-II, which defines safety as the ability to succeed under varying conditions. HSE-401 Lesson 8 introduced Safety-II and work as imagined versus work as done. Hollnagel's point that the same everyday adjustments explain both success and failure is central to HOP, and Lesson 10 uses his account of the abilities a resilient operation needs.

Conklin and the practitioner movement

Todd Conklin brought these strands together in a form that operations leaders could use, in books such as Pre-Accident Investigations and The 5 Principles of Human Performance, and in a long-running podcast. Practitioners in utilities, manufacturing, construction and energy developed learning teams and other practices in parallel. The result is less a single theory than a community of practice that shares principles and borrows tools from each other.

What HOP is not

Elena expected resistance, and some of the early objections at Harrowgate Foods Inc. came from misunderstandings that are worth naming.

• HOP is not 'no accountability'. It changes what accountability means, from paying for the past to taking part in fixing the future. Lesson 11 shows how Harrowgate Foods Inc. handled reckless conduct, which remained a disciplinary matter.
• HOP does not do away with rules or procedures. It asks that procedures fit the work, that people help write them, and that the most important steps be protected by design rather than by reminders. Lesson 6 covers this.
• HOP is not a soft option. Designing a disconnect that cannot be mislabeled, or an interlock that will not allow a start test while the emergency stop is latched, is harder engineering than writing a warning letter.
• HOP is not behavior-based safety with a new name. Behavior-based safety programs observe and correct worker behavior. HOP starts from the conditions that shape behavior and treats worker behavior as information about those conditions.
• HOP is not only for after events. Most of its value comes from learning about normal work before anything goes wrong.

Marcus Bell, the main plant manager, raised a sharper question at the first leadership meeting. 'If error is normal, are we telling people it is fine to make mistakes?' Rachel's answer became one of the lines the project repeated: 'We are telling people that mistakes are going to happen, so we had better make sure a mistake cannot kill anyone, and that we hear about the small ones while they are still small.'

The principles and the law

HOP sits comfortably inside the legal framework Harrowgate Foods Inc. already works under, but it does not remove any duty. In Georgia, the company works within OSHA's Recommended Practices for Safety and Health Programs, which put worker participation and hazard finding at the core of a program. Employers must still provide safe equipment, safe systems of work, training and supervision. A HOP approach helps the company meet those duties more reliably, because it looks for weaknesses in equipment and systems rather than stopping at the worker.

At the same time, HOP does not allow a company to ignore a person who deliberately puts others at risk. Lesson 11 explains how Harrowgate Foods Inc. separated honest errors and at-risk choices shaped by the work from the rare cases of reckless conduct, using the just culture approach from HSE-401 Lesson 6 and then going further with restorative practice.

A first look at the line 3 event through HOP eyes

Elena asked the supervisor to hold the written warning while a small team looked at the event again. The team was Elena, Luis Ortega from maintenance, Tanya Morris as worker co-chair of the safety committee, and Ben himself, once he said he wanted to take part. It asked a different set of questions from the first report.

The labels on the second panel had been wrong for three weeks. Nobody had been hurt because nobody had yet needed to isolate those conveyors. That finding, more than any argument, persuaded Marcus that the HOP approach was worth the effort.

HOP and the systems Harrowgate Foods Inc. already has

Rachel was clear that HOP would not be a separate initiative with its own posters. It had to change the way the existing safety management system worked. The table shows how the main elements of that system looked before and after the shift the project aimed for.

Course map

The rest of this course follows the line 3 event and the project it started. Lessons 2 to 4 explain why error is normal, how precursors set traps, and how context and drift shape what people do. Lessons 5 and 6 cover designing equipment and procedures that tolerate error. Lessons 7 and 8 cover learning teams, pre-job briefs and other tools for learning from normal work. Lesson 9 links HOP to critical controls and the prevention of serious injuries and fatalities, deepening HSE-401 Lesson 9. Lesson 10 covers resilience and capacity, and Lesson 11 the response to failure, including care for the people involved. Lesson 12 brings together leadership, measurement and implementation across all three sites, and closes with a capstone event at the McDonough distribution center.