SearchHSE, Process Safety & OT Security

Learning from Incidents

Learning from incidents software that puts past near misses beside the job being planned, and reads each closed action against the procedure in force today.

See the demo Book a demo

Follow one drum drain from the map to the procedure ↓

The problem

Near miss reports on the same drum, unread while tomorrow’s job is planned

Tomorrow’s job plan gets written from the last plan and from memory. The near miss on that same drum sits in the incident system, a PDF or a binder, and nobody opens it while a permit is waiting.

When that report’s action was closed, a step went into the procedure. A later rewrite can drop it under a note that says no change of intent, and the tracker still shows closed. The next operator meets the same plug, and the new report blames him for skipping a step that is no longer there.

Built forJob plannersProcess safety engineersHealth and safety leadsShift supervisorsInternal auditors

The Problem Today

When a job is planned, nobody reads the last near miss on that equipment, and the fix may be gone.

9,533: hours to get through the 28,600 reports at 20 minutes a report our estimate
25%: of incidents showed no organizational learning, in six firms published

Searched by hand today

Reports
Near misses
Procedures
Actions

Closed is not doneA later revision can quietly lose the step
Planning from memoryThe person who remembers moves on or retires

The Solution

Describe the jobA job, change or permit in plain words, with no search terms to learn
Incidents gather closePlaced by shared equipment, task and hazard, each told as a short story
Is the fix still there?Each closed action read against the procedure in force today
Plan and procedure changeA hold point for this job, a signed new revision for the jobs after it

Built-in controls

Never tells anyone a job is safe
Whoever writes a plan or a fix cannot sign it
Each line opens its source passage

What You Get

Planners change the job before it starts, and the lost step goes back into the procedure for the jobs after it.

Repeats seen earlyThe same hazard shown across units and years
Lessons reviewed firstA drafted lesson reaches no plan until it is signed
A log of what was usedWhich lesson reached which plan, and what changed

One drain job, one morning

Learning from incidents on one drain job: two near misses and a lost step

A planner must drain the boot of a coker blowdown drum before its level bridle valves are changed. That morning, screen by screen.

demoThe refinery, its staff, its reports and its counts on these screens are sample data.

01Planning, first thing
Two near misses on the same drum land in the inner ring
Job planner
She types the job the way she would say it to a colleague. The agents show what they took from her words as chips: the drum, draining, hydrogen sulfide, hot liquid, a plugged line cleared under pressure. She can strike any chip out. The two closest reports are both on this drum, and the later one raised no action at all, so those two come first.
02Reading the first report
The first near miss on this drum added a stop step to Rev 6
Job planner
The report reads as a short story. The drain stopped, the operator rodded through the bleed at 9 psig and 231°F, and hot sour water sprayed across the platform; his monitor peaked at 22 ppm. Each sentence carries a number that opens its source. One opens Rev 6 of the procedure with step 4.7 lit: if flow stops, close the drain and stop.
03Still reading
A template move in Rev 9 shortened the steps and the stop fell out
Job planner
The tracker says the action closed. The revision record says Rev 9 moved the procedure to a new template, shortened its steps and changed nothing in intent. Nobody requested a process safety review, because a template move was not treated as a change. For the planner this is the line that matters: the procedure she would hand out has no stop step.
04The second report
The repeat blames the operator for a step that Rev 9 no longer had
Job planner
Same drum, same plug. This time the line let go into a face shield and the monitor peaked at 31 ppm. The report says the operator did not follow the procedure, closed in nine days with a reminder at the toolbox talk, and does not mention the first near miss. The screen marks it plainly: no action raised.
05Changing the plan
A hold point after line 4, in wording taken from the revision that had it
Job planner
The plan has six lines. She adds a hold point after line 4, where the drain is opened: if flow stops, close the drain, tell the shift supervisor and stop, since a plug can hide pressure behind it. Beside the plan sit the two reports and both undone actions on this drum: the lost stop step, and a steam-out wait missing from the drain tag.
06Sent for signature
Signing stays off until he has opened three items
Shift supervisor
The planner cannot sign her own plan, and the screen tells her so. On the supervisor’s side the plan waits, the permit is blocked, and signing stays off until he has opened each report and the hold point, with three still to open. When a plan has changed, he reads why before his name goes on it.
07Signed
Both reports opened, and this version is the one on the permit
Shift supervisor
He opens the first report, then the second, then the hold point. Only then does the plan take his signature, and the sign-off now says the permit writer can use this version. Any change after this point voids the signature. Out at the drum, the hold point carries its own button to clear it at the job.
08Later that morning
373 closed actions confirmed undone, and 1,247 nobody can call yet
Process safety engineer
A hold point protects one job. The engineer looks across the estate: 33,118 of the 39,760 closed actions can be shown still in place, 373 are confirmed undone and 1,247 are flagged and still being checked. Another 5,022 cannot be traced to any record. The undone list opens with the stop step on this drum.
09The fix to the procedure
Rev 10 carries the stop again, read back from the issued text
HSE lead
The engineer wrote the new wording and sent it on; she cannot sign her own fix. The HSE lead opened the Rev 10 wording, then signed. A fix closes only when the action checker finds the step in the issued document, and here it does, as step 3.6. The other fixes on the list stay open, one of them late and escalated.
10Back on the map
The first near miss now reads still in place, and the repeat stays on it
Job planner
On the map the same report now reads still in place, with the step quoted from Rev 10, and the chip for the later repeat stays beside it. The next planner who asks about this drum starts from a procedure with the stop in it, and still reads both stories before touching the plan.

Learning from incidents in oil and gas: three gaps on one drum nobody joined

Each sat in a different record, and each looked finished where it was filed.

A template move that dropped a safety step

The revision note said no change of intent, and nobody asked for a process safety review.

A repeat closed with no action

The later near miss closed in nine days with a toolbox reminder and never named the first.

A wait line lost from a drain tag

A steam-out wait written on the tag went missing when the tag was replaced, and it shows beside the plan.

Of 39,760 closed actions, 33,118 can be shown still in place

The agents follow each closed action to the procedure, drawing, work order or form it should have changed.

Still in place, shown in the record now	33,118
Confirmed undone, in the two finished lots	373
Flagged undone, still being checkedTwelve of the fourteen lots are not finished	1,247
Cannot be traced to any record	5,022
Closed actions	39,760

demoSample data, from the working solution. 34,738 reached a record today. Another 1,420 actions are still open, of 41,180 raised.

Around the job

The rest of the learning from incidents work: lots, lessons and the log

Six more screens from the same refinery, each opening larger.

Repeat incidents timeline for one hazard: nine reports of plugged lines cleared under pressure across units, each with its action and status today — **One hazard across units and years**Nine reports where a plug let go toward a person, each treated as local. Four asked for a stop on lost flow; one was undone, one cannot be traced.

Reopen lots by unit: two lots ready for the engineer, twelve still being checked, and a sample of 12 from 211 coker actions to open — **Reopen lots, unit by unit**Two of fourteen lots are ready. The engineer opens a sample of 12 from 211 on the coker before proposing, and the HSE lead countersigns. Nothing is reopened yet.

Process safety lessons learned draft built from seven near miss reports, marked not reviewed, with the procedure revision where it must land — **A drafted lesson, before review**Built from seven reports and drafted for the engineer to edit. It reaches no plan until the HSE lead signs, and stays open until the document it changes says so.

Use log of asks this quarter: plans altered, read with no change, nothing close found, each row with work order, report and what came of it — **Which lesson changed which plan**1,284 asks this quarter: 187 plans or changes altered, 864 read with nothing to change, 233 with nothing close. Each row names the work order and the report.

Report sources totaling 28,600: incident system, document management and scanned paper binders, unreadable scans held, the permit feed paused — **Where the 28,600 reports come from**19,240 from the incident system, 6,918 from document management and 2,442 from scanned binders. 186 unreadable scans are held outside the count, and the paused permit feed is shown.

Audit trail for one job plan: the search, the hold point, each report the supervisor opened, his signature and the procedure read back — **The trail of one plan**The search, the hold point, each report the supervisor opened, his signature and the agent reading Rev 10, in order, with no line open to editing.

demoSample data, from the working solution.

Who signs the plan, the reopen lot and the new revision

Whoever writes a plan, a lot or a fix hands it to someone else to sign.

Job planner

Sees: Past reports around the job, each with whether its action held
Signs: Nothing; she writes the plan and its hold points for someone else to sign

Shift supervisor

Sees: Each report and hold point that changed the plan, opened one by one
Signs: The changed plan, before the permit can use it

Process safety engineer

Sees: Closed actions read against today’s records, reopen lots and drafted lessons
Signs: Proposes lots, lessons and fixes, and cannot countersign her own

HSE lead

Sees: The sample in each lot and the new wording of each fix, opened first
Signs: Countersigns reopen lots, lessons, fixes and changes to settings

Internal auditor

Sees: Each line back to its source page, and the full trail
Signs: Nothing; reads and downloads

The agents

Six agents read the incident history, and none says a job is safe

What each one reads, and the line it stops at.

Job reader

Pulls the equipment, task and hazards from plain words and shows them as chips a planner can strike out.

Never adds a hazard it cannot trace
Never says a job is safe

Incident finder

Scores each report on equipment, task, hazard and shared words, and gives the reason it is close.

Never hides an old report
Never claims a search it did not run

Action checker

Follows each closed action to the current procedure, drawing, work order or form.

Never closes or reopens an action

Repeat watcher

Groups reports by hazard and flags a hazard that comes back after a closed action.

Never decides a cause

Alert reader

Reads public incident reports from other sites and asks what each means for this plant’s equipment.

Never rules whether an alert applies
Never says whether equipment is fit for service

Lesson drafter

Drafts a cited lesson for a process safety engineer to edit.

Never writes how to do safety-critical work
Never sends a draft to a plan

Questions on learning from incidents, from planners and safety teams

What is learning from incidents?

Learning from incidents is the work of turning past near misses and investigations into changes that last. Here it starts from the job being planned: past reports gather around it by shared equipment, task and hazard, and each closed action is read against the procedure in force today.

How does this sit beside our incident management system?

The incident system stays the record. It holds the reports and tracks each action to closed. The agents read it, along with document management and scanned binders, and start from the job at planning time instead of from the report at filing time.

What do lessons learned in the oil and gas industry look like here?

A lesson is drafted from the reports it cites, edited by a process safety engineer and signed by the HSE lead before it reaches any plan. It stays open until the document it changes says so, and the use log shows which plans it altered.

Can the agents tell a planner a job is safe?

No. They show what happened before and whether the fix held. When nothing close turns up, the answer says so and adds that this does not mean safe. The plan, the hold points and the signature stay with the planner and the shift supervisor.

What happens to old paper reports?

Scanned binders are read with the rest, and each report shows how sure the reading is. A scan that cannot be read at all is held outside the count and sent to the records team, so nothing is claimed as searched that was not.

Does it read incident reports from other sites?

Yes. An agent reads published reports and asks what each one means for this plant’s equipment, then lists the matches. A process safety engineer rules on each match with a reason, and the HSE lead countersigns.

HSE, Process Safety & OT Security

Bring one job and
its near miss history.

We gather your own reports around a job you are planning, and read its closed actions against the procedures you run today.

Book a demo Browse solutions

Learning from Incidents

Near miss reports on the same drum, unread while tomorrow’s job is planned

The Problem Today

The Solution

What You Get

Learning from incidents on one drain job: two near misses and a lost step

Two near misses on the same drum land in the inner ring

The first near miss on this drum added a stop step to Rev 6

A template move in Rev 9 shortened the steps and the stop fell out

The repeat blames the operator for a step that Rev 9 no longer had

A hold point after line 4, in wording taken from the revision that had it

Signing stays off until he has opened three items

Both reports opened, and this version is the one on the permit

373 closed actions confirmed undone, and 1,247 nobody can call yet

Rev 10 carries the stop again, read back from the issued text

The first near miss now reads still in place, and the repeat stays on it