The Fog of War in Process Safety
On friction, contact and the PSM binder
In 1806 the Prussian army was still the army Frederick the Great had built. He had been dead twenty years and it still drilled his way, marched his way and measured itself against his standard. By every measure it used on itself, it was ready. On October 14 it met Napoleon at Jena and Auerstedt and lost both battles in a single day. Within weeks most of what was left of it had surrendered.
A twenty-six-year-old officer named Carl von Clausewitz, serving as aide to a Prussian prince, was taken prisoner in the retreat. He spent the rest of his life working out how an army could look that finished and come apart that fast. The book he left unfinished when he died, On War, is still taught in war colleges two centuries later.
He came back with two ideas. The first he called friction. "Everything is very simple in war," he wrote, "but the simplest thing is difficult." Orders get misread. The road is worse than the map said. A unit arrives late because a bridge is out. None of it is dramatic and none of it shows up in the plan, but it adds up until the plan and the battle are two different things. Friction, he wrote, is the one concept that separates real war from war on paper.
The second was uncertainty. "War is the province of uncertainty," and three-fourths of what a commander has to act on is "hidden more or less in the clouds of great uncertainty." The phrase that stuck, the fog of war, came later from other writers. The idea is his.
"Process safety doesn't usually borrow from Prussian officers. It should borrow from this one, because he was working on the problem every PSM program has: running something dangerous off a written picture of it, kept by people who can't be there every time it changes. PSM became law in 1992, about one working career ago. The problem underneath it is much older. Armies have been running dangerous work off written pictures of the ground for as long as there have been written orders, and most of what they know they learned the expensive way, in public."
"If you've ever handed a service tech a procedure that didn't match the package in front of him, you've met friction. The last piece was about exactly that: a pumpout procedure that said stop, isolate and blow down, written broad enough to fit every plant. The procedure was simple. The job wasn't."
Part of the map comes finished
"Generals had to map their own ground. PSM hands you part of the map already drawn. 1910.119's fourteen elements point at each other in the text: management of change sends you to process safety information, operating procedures and training, and the same lines run through every covered plant in the country."
What the regulation can't tell you is the state of anything on the map. Whether the P&ID matches the pipe, whether the procedure matches the job, whether the training covers the procedure the way it's actually run. That part is your plant, and it's in the fog.
Where the reports come from
"Look at what's in a PSM program: P&IDs, the PSI, operating procedures, training records, the last PHA. A commander would read all of it as reports, and he'd want to know two things about each one: when it was made and where it came from. The program answers the first. Everything carries a revision date, an annual certification or a PHA date."
The second question is harder, and it isn't about anyone doing their job badly. Somebody has to keep the program, and whoever keeps it can't be on every job, every shift. So the documents get written, reviewed and signed on the schedule the regulation sets, by people who see the floor in visits. The annual certification asks the signer to vouch that a procedure is current and accurate, and the people best placed to say are the ones who ran it this year. The PHA gets revalidated every five years with at least one person on the team who knows the process. That's the program's deepest look at its own hazards, and what the floor knows gets into it through whoever is in the room that week and whatever they remember.
Clausewitz did not trust reports. "Great part of the information obtained in war is contradictory," he wrote, "a still greater part is false, and by far the greatest part is of a doubtful character." The armies that took him seriously learned to judge a report by where it came from. NATO intelligence doctrine grades every report twice, once on the reliability of the source and once on the credibility of the information. Judged that way, the best source on whether a procedure works is the operator who ran it last night.
Where a report comes from matters most at the bottom of the hierarchy of controls. An interlock trips whether or not anyone has looked at the drawing lately. A procedure, a permit or a training module works only as well as what's written in it, because administrative controls are made of paper. The rung that depends most on the paper being right is also the one people test against the plant every day.
Fog clears on contact
A staff officer studying the map can find where it contradicts itself. That's real work, and armies can't run without it. But he can't find out the bridge is gone. Only contact tells you that: the patrol, the scout, the unit that just ran into something.
A plant is in contact every day. An operator on rounds sees the plant as it is that morning. A service tech running a pumpout learns in ten minutes whether the procedure matches the package. A mechanic swapping a valve knows whether its tag matches the drawing. A contractor crew that filled out a job hazard analysis that morning finds out by lunch whether the hazards on it were the hazards they met.
"Some of that contact already has a home. Mechanical integrity is built on it: rounds logged against set readings, IIAR 6 inspections on a schedule, test results recorded and trended. It works because every look comes with a form that asks the right questions. What the form doesn't ask, it doesn't keep. The round sheet has a line for every reading. Some have a comments line at the bottom, and it's usually blank. Procedures don't get even that. They get certified on a calendar, and the people running them in between rarely have anywhere to write."
This is where Clausewitz's two ideas meet. Fog is what the program can't see from where it sits. Friction is what the crew feels when the job runs into it, the gap between the job on paper and the job on the floor. Every bit of that friction is a scouting report on the actual plant. The work order closes as complete, the permit gets filed and whatever the job learned goes home with whoever did it, or becomes something the night shift knows and no document shows.
"The U.S. Army eventually built a habit around this. After exercises and operations, units run an after-action review: what was supposed to happen, what actually happened, why they differed and what changes next time. Rank comes off for the conversation, because the private who found the bridge out knows more about that bridge than the colonel does. The review works because people learn that what they say gets used."
Most plants already run the first part of one. Nearly every contractor job starts with a JHA, the crew's own answer to what's supposed to happen and what could hurt them. It's usually done in good faith. Then it gets filed. Plenty of JHAs even have a line for hazards found on the job, and it tends to stay empty, because nothing ever happens to what gets written there. So the second question, what actually happened, goes unanswered, and the hazard nobody listed and the step that went differently than planned never get written down anywhere.
"When something does go wrong, the usual answer is more paper: another procedure, another form, another training module. Without the reports from contact, it gets written from what the program already knew, which is the same picture that just turned out to be wrong. That doesn't clear the fog. It paints over it, and the map looks more finished than it did before."
Where this goes
"Clausewitz never thought the fog could be cleared for good, and he never told commanders to wait until it was. The realistic goal for a PSM program is the same: clear it a little at a time, with work that's already happening."
"That starts with a place to write that someone reads. Every procedure, every JHA and every PHA gets somewhere for the people using it to leave a note: this step doesn't match the valves, this hazard wasn't the one we hit, this goes better the other way. Each one is friction, written down where the program can see it. The comments line on the round sheet gets read. The JHA gets its second question asked when the job closes: what did you actually run into?"
"The regulation already points here. Employee participation requires consulting employees on the development of the other elements, and most programs meet it at set points: the written plan, the PHA team, the safety meeting. Notes on the documents people use every day are what that consultation looks like when it never stops."
Then every note gets an answer. Whoever owns the document reads it and decides. The procedure gets changed through MOC, or it stays and the note gets a reply saying why. A comment box nobody answers teaches people to stop writing in it. Notes that get answered keep coming, and they give whoever keeps the program a view of the floor between visits. The annual certification gets signed with a year of notes from the people who ran the procedure. The PHA team walks in with five years of what the floor saw instead of one operator's memory of it. The people doing the work become the program's best sources instead of its least heard.
Volume is where paper breaks. A plant where people write things down can produce thousands of notes a year. No coordinator can sort a year of them before signing, and no PHA team can read five years' worth. On paper, more participation makes the pile worse, and the three notes that matter are in there somewhere nobody can find them. Software gets better with more input. It can read every note, merge the duplicates, tie each one to the document it's about and have them sorted when certification or revalidation comes around. The decisions stay with people. The software makes sure the floor is in the room when they're made.
Everything people expect from the next decade of process safety, changes that flag every document they reach and patterns that only show up across many plants, depends on that daily intelligence getting captured. Clearing the fog comes first.
This week, pick one procedure and ask the last three people who ran it what it gets wrong. Then find the place in your program where those answers would go. If there isn't one, or there is and nobody reads it, you've found where your fog comes from.