Procedures people can use

When the observation work described in Lesson 4 found gaps between procedure and practice in 23 of 30 tasks, Marcus's first reaction was that the plant needed better procedure compliance. Elena asked him to read the line 3 changeover procedure himself, at the line, during a changeover, and to try to follow it. He lasted eleven steps. Step 12 told him to 'confirm the divider section is in a safe state per SOP-ME-0447'. He did not know what that meant, could not find SOP-ME-0447 on the line, and by the time he had asked Luis, the crew had done the next nine steps.

This lesson is about procedures: why so many fail the people who use them, how Harrowgate Foods Inc. rewrote its critical procedures with the crews, and how it handled the moments when a procedure did not fit the work.

What procedures are for

Procedures do several jobs at once, and the jobs can pull against each other. They capture knowledge about how to do a task safely and well. They guide people who are new to a task or do it rarely. They support memory for steps that are easy to miss. They show regulators, customers and auditors that the company has thought about its risks. And, too often, they are written to protect the company after an incident, with every possible caution included so that nobody can say the procedure was silent.

A procedure written mainly for the last purpose tends to be long, general and hard to use at the task. A procedure written for the person doing the job is shorter, specific and organized around the work. HOP treats procedures, in Dekker's phrase, as resources for action: tools that help skilled people do the work, not substitutes for their judgment and not a script that guarantees safety if followed.

Why procedures fail

Elena's team reviewed the procedure library at the main plant. It held 1,140 documents. About 38 % had not been reviewed in three years, 112 referred to equipment that no longer existed, and many of the rest were long documents written by engineers or consultants, often adapted from a template used at another site. The common failings were the same ones found across industry.

• Written by people who do not do the work, so steps are missing, out of order or impossible with the real equipment.
• Too long and too general, mixing background, policy and instructions, so the critical steps are buried.
• Not available at the task, kept in a binder in an office or a system that needs a computer.
• Out of date, not revised after equipment or process changes.
• Vague, using phrases like 'ensure safe condition' or 'as required' that leave the reader to work out what is meant.
• Not tested, never walked through on the real equipment before release.
• No way to report problems, so known errors stay in the document for years.

Each of these failings pushes people toward working from memory and habit, which is how the gap between work as prescribed and work as done opens. When an incident follows, the investigation finds that the procedure was not followed, and the cycle repeats.

A procedure life cycle

The project set out a simple life cycle for procedures covering critical tasks, so that each one would be written, tested, used, improved and eventually retired in a controlled way.

Write with users

Each critical procedure was drafted by a small group of people who did the task, with a technical writer or supervisor to help with structure and an engineer to check the technical content. The users decided the order of steps, the level of detail and where photographs would help. This took longer than having an engineer write the procedure alone, but it produced documents that the crew recognized as describing their work.

Test in the field

Before release, every procedure was walked through on the real equipment by someone who had not helped write it. The tester did the task, or talked through each step at the equipment where doing it was not practical, and noted anything unclear, missing or impossible. The line 3 lockout procedure went through three rounds of field testing before it was released.

Use at the task

The DOE handbook describes levels of procedure use, and Harrowgate Foods Inc. adopted a version of them so that each procedure stated how it was meant to be used.

• In-hand use. The procedure is at the task and followed step by step, with each step marked as done. Used for critical, complex or infrequent tasks where an error could cause serious harm, such as a first-time lockout of new equipment.
• Reference use. The procedure is at the task and referred to as needed, especially at critical steps, but skilled workers do not read every line. Used for tasks done often with a few critical points.
• Skill of the craft. No document is needed at the task, because the work is within the normal skill of a trained worker. Training and competence assessment carry the knowledge.

The point of stating the level was to remove the pretense that every procedure was read line by line every time. Once the level was honest, the company could make sure that in-hand procedures really were in hand, with printed copies or tablets at the equipment and a way to mark steps.

Collect feedback

Every procedure carried a short note at the end: 'If any step is wrong, unclear or impossible, tell your supervisor or scan the code to report it.' The code opened a two-question form on a phone. Reports went to the procedure owner, who had to respond within two weeks. In the first year the main plant received 214 procedure feedback reports, and 160 led to a change.

Revise and retire

Each procedure had a named owner and a review date. Any change to equipment or process went through management of change, which now asked which procedures were affected. Procedures for equipment that no longer existed were withdrawn, and old copies were removed from the line. By the end of the first year the library had fallen from 1,140 documents to about 700.

Writing steps people can follow

The project adopted a short style guide for critical procedures, drawn from practice in nuclear power, aviation and plain-language writing.

• One action per step, starting with a verb: 'Turn the divider disconnect to OFF', not 'The divider disconnect should be turned off and checked'.
• Conditions before actions: 'If the beacon is flashing, stop and find the latched stop', not 'Stop if the beacon is flashing'.
• Hazard notes before the step they apply to, short and specific, saying what could happen and how to avoid it.
• Exact names, numbers and locations, matching the labels on the equipment.
• Photographs of isolation points, valves and controls, taken from where the worker stands.
• No cross-references at critical steps; if a step depends on another document, the needed information is copied in.
• Critical steps marked, with a symbol and a short reason, so that readers know where to slow down.

Luis compared the old and new versions of the divider isolation steps using a rough measure: average words per step and the share of steps containing vague phrases.

# Comparing old and new procedure steps
old = [
    "The technician shall ensure that the divider section is placed in a safe state per SOP-ME-0447 prior to any intervention.",
    "Isolation of all energy sources should be carried out and verified as required.",
    "A start test is to be performed from the main control screen or the local start station.",
    "Product build-up may be removed once the line has been confirmed isolated.",
]
new = [
    "Turn disconnect D3-DIV (photo 4) to OFF.",
    "Fit your personal lock and tag to D3-DIV.",
    "Check the beacon. If it is flashing, stop and find the latched emergency stop.",
    "Press TEST at the divider. Confirm the screen shows NO MOTION - ISOLATED.",
    "Use the frame scraper to clear dough. Reach in only if the scraper cannot reach.",
]
vague = ["ensure", "as required", "safe state", "per sop", "may be", "should be", "is to be", "shall"]

def stats(steps):
    words = sum(len(s.split()) for s in steps) / len(steps)
    flagged = sum(any(v in s.lower() for v in vague) for s in steps)
    return words, flagged

for name, steps in (("old", old), ("new", new)):
    w, f = stats(steps)
    print(f"{name}: {len(steps)} steps, {w:.1f} words per step, {f} of {len(steps)} with vague phrases")

old: 4 steps, 15.5 words per step, 4 of 4 with vague phrases
new: 5 steps, 11.4 words per step, 0 of 5 with vague phrases

The new steps were less than half as long on average and contained no vague phrases. More importantly, each one told the technician exactly what to do with which piece of equipment, and the step that had failed in the event, the start test, now included a check that would catch a latched emergency stop.

Lockout procedures

Lockout procedures deserve special attention, because energy isolation is one of the most common critical steps in food manufacturing. Harrowgate Foods Inc. works under OSHA's lockout standard, 29 CFR 1910.147, which requires the host and outside employers to tell each other about their lockout procedures. The project replaced the plant's general lockout procedure, which described the principles but left technicians to work out the isolation points for each machine, with machine-specific lockout placards. Each placard was mounted on the machine and showed every energy source, the location and photograph of each isolation point, the method of isolating it, and the method of verifying zero energy.

Writing the placards was a large job: 118 machines at the main plant, each needing a field survey. Luis and two technicians did it over five months, with each placard field tested by a different technician. The survey found 14 machines with an energy source that the old general procedure had not mentioned, including three with stored pneumatic energy and two with gravity hazards from raised parts.

When the procedure does not fit

No procedure can anticipate every situation. A HOP approach accepts this and asks what people should do when they meet a situation the procedure does not cover, or when following it would be unsafe or impossible. The answer at Harrowgate Foods Inc. was a simple rule, repeated in training and on every critical procedure: if the procedure does not fit, stop, make the work safe, and call. Nobody would be criticized for stopping. And every such stop was treated as feedback that the procedure needed attention.

This was a change from the old position, in which departures from procedure were violations by definition. Under the new approach, an adaptation made openly, with the work made safe and a supervisor informed, was legitimate. What was not legitimate was quietly working around a critical step. The difference was visibility: an open adaptation could be learned from, while a hidden one could drift.