In the search of oil and gas incident causal factors: The Gaussian Fuzzy Analytic Hierarchy Process approach

Learning from events is a crucial measure to reduce the number of catastrophic incidents on board the oil and gas industry. It is critical to have a better understanding of the root causes behind the incidents. A better understanding of the incident causal factors can be accomplished by investigating thoroughly previous incident reports and determine the most notable factors in contributing to the incidents. This paper mainly elaborates and analyzes incident reports produced by the International Oil and Gas Producer Association’s (IOGP’s) reports from 2010 until 2018 located in the worldwide operation. The most contributing factors lead to the oil and gas incidents are examined in this paper utilizing Gaussian fuzzy analytic hierarchy process, an improved methodology of fuzzy analytic hierarchy process (FAHP) by embedding Gaussian fuzzy number within the evaluation process. Gaussian fuzzy number is obtained by random simulation corresponding to the Gaussian probability density function. The result of this paper reveals the more accurate and realistic representation of incident causal factors determination. This point of view helps in better explaining oil and gas incidents causal factors, where precaution measures should be directed and efficiently managed.


Introduction
The oil and gas industry is one of the highest-risk operation process industries. The risks involved in the operation shall originate from the complex operation, large manpower employment, and severe incident consequences [1]. The oil and gas industry is one of the sectors with a high incident rate, involving the probability from one incident to escalate to a catastrophic or disastrous event [2]. During 2010 -2018, there are 987 High potential event incidents (HIPO-incidents), which could escalate to the higher level of consequences, or possess higher probability to result one or more fatalities [3]. These incidents are produced from a number of causal factors, underlying from the Organizational system factor, Process factor leading to unsafe working condition, and Human-behavioral factor.
A number of researches have been performed to identify the underlying causal factors which significantly contribute to the incidents. An example of the study was conducted by Abdelhamid TS & Everett [4] to reveal the root causes of the construction industry accidents. The study concludes that the incidents are likely to occur as a cause of both unsafe conditions and unsafe acts. Zhou & Lei [5] investigate China railway incidents by using the Human Factors Analysis and Classification System and found that higher organizational levels in the railway system result in errors in accidents/ incidents. Managerial position of the organization bears the ultimate responsibility to generate organizational safety culture that significantly prevents incidents occurrence [6]. Organizational system factors involving corporate safety culture, applicable procedure, and adequate competency are considered as the underlying cause of incidents, through potentially influencing the human-behavioral factor and generating unsafe working condition [7] .
In regard to the identified factors, the research question is raised: how significant causal factor could contribute to the incidents, and how is the quantified degree of importance to an incident cause. The conclusion to the questioned would generate not only reveal the specific weighting values to the causal IOP Publishing doi: 10.1088/1757-899X/1072/1/012012 2 factors but also to elaborates the most effective incidents prevention schemes. The author's contribution to the body of research in the oil and gas safety should a holistic, quantitative model, based on robust methodology, and capable of approximating HIPO-incidents frequency [8].
Analytic hierarchy process (AHP) is firstly introduced by Saaty [9] as the breakthrough of Multicriteria decision-making methodology. AHP has been implemented in various applications, including business selection problems, energy sector evaluation, and optimization of location selection. The remarkable implementation of AHP is addressed as a structured scientific solution to the Israeli-Palestinian conflict [10]. To overcome this limitation, fuzzy AHP is introduced by integrating fuzzy numbers in the evaluation process [11]. Fuzzy AHP has been rapidly used in the field of Multi-criteria decision analysis [12]. In many study cases, Fuzzy AHPs are utilized based on triangular fuzzy number to represent linguistic variable and approximate reasoning [13]. Yang et al. [14] implement triangular fuzzy number in AHP to evaluate the prioritization of environmental issues in offshore oil and gas operations. Montazar et al. [15] utilized triangular fuzzy number in AHP evaluation to assess the performance of irrigation projects.
In recent studies, Fuzzy AHP is improved by executing Gaussian fuzzy numbers to eliminate the case of zero weights and lack of consistency for the decision matrices [16]. The adoption of Gaussian fuzzy number is also demonstrated by Wicaksono et al. [17] to represent more realistic fuzzy environment in the evaluation of benefit, cost, and risk analysis in the oil and gas processing area. The main capability of Gaussian fuzzy number compared to triangular fuzzy number is the capability to evaluate first fuzzy number which is wrongly weighted as 0 in the TFN [16] [18].
Current paper examines 987 High potential event incidents (HIPO-incidents) occurring from 2010 until 2018 investigated by the International Oil and Gas Producers Association (IOGP). This study aims to develop a quantified degree of importance model for oil and gas incident causal factors by utilizing Gaussian fuzzy analytic hierarchy process. Sensitivity analysis is performed to measure the proposed methodology's accuracy and consistency. The novelty of this study covers the adoption Gaussian fuzzy number in the Fuzzy AHP evaluation which is generated based on random numbers following the Normal distribution density function. This methodology is capable of approximating the randomness and uncertainty that may arise from the decision-making process.

Literature Review
The incident causes analysis is merely based on the studies of which performed to identify the root causes of incidents. Abdelhamid & Everett [4] define that the incidents are merely caused by two factors, i.e., Human factor models, and Non-human factor or unsafe conditions. Halim et al. [1] perform the study literature based on the Bureau of Safety and Environmental Enforcement and confirm that incidents are caused by 1. Equipment failure, 2. Human error, and 3. Other significant findings such as, lacked proper isolation, and procedure deviation. Theophilus et al. [19] investigate the Human factors analysis and classification system for the oil and gas industry. They identify that the incidents are dominant to be caused by Human and Organizational factors in the oil and gas industry. The study performed implies that oil and gas incidents is caused by 1. Unsafe acts, 2. Preconditions for unsafe acts, 3. Unsafe supervision, and 4. Organizational influences. Tang et al. [20] perform a study to review offshore oil and gas safety indices. They conclude that Organizational factor is the key success to build the safety culture within the organization. Skogdalen & Vinnem [21] conclude the precursor incidents in oil and gas industry are caused by 1. Human factor, 2. Organizational factor, and 3. Technical factor. The precursor incidents are, therefore generate consequences and harmful effects. Ferjencik [22] defines that the incidents would have occurred due to these factors: 1. Implementation (1 st level) causes, 2. Organizational (2 nd level) causes, 3. Management attitude (3 rd level) causes, and 4. Societal (4 th level) causes. Motarjemi & Wallace [6] investigates several incidents in the field of food safety management and conclude that the identified root cause are: 1. Human error or equipment failure, 2. Workplace condition, and 3. Organizational culture and management decision. Bea [23] investigates the human and organizational factor in reliability assessment and management of offshore structures. He implies that the incidents are mainly linked to the factor of Human and Organizational.  Figure 1 illustrates the main variables used to identify the possibility of High potential incident causes. Based on those studies, the author formulates several factors as the main variables of this research, i.e. (1) Human-behavioral factor; (2) Job factor leading to unsafe working condition; and (3) Organizational system factor.

High Potential Event Incidents (HIPO-Incidents)
Investigating incidents is essential, as effective root-cause and the recommendation of improvements, to make every effort to avoid future incidents. The international Oil and Gas Producer (IOGP) highly recommends carrying out an incident investigation for which is expected to cause fatality or major injuries. High potential event incidents (HIPO-incidents) are defined as any incident or near-miss event which potentially or would have realistically caused in catastrophic events, such as fatalities, major pollution, and/or loss of production facility. HIPO-incidents are also defined as any incident which is expected, in other circumstances, result in catastrophic and disastrous consequences regardless of the actual severity. In other words, HIPO-incidents are probable to escalate from lower consequences incident tor the higher level. Skogdalen & Vinnem [21] identify that HIPO-incidents are precursor incidents which have the potential to lead to or develop into a catastrophic accident and they should be thoroughly investigated in order to prevent them from reoccurring.
The type of HIPO-incidents can be summarized as [2]: (1) Fire or explosion (2) Flash fire in a hazardous are; (3) Significant and Major Hydrocarbon leakage; (4) Emergency shutdown caused by the detection of gas leak or fire; (5) Incidents involving personnel caught in, under or between; (6) Falls from height or person slips and trips (7) Falling objects capable of causing a fatality; and (8) Incident involving confined space working.

IOGP's Incident Investigation Report
IOGP has displayed information regarding investigated HIPO-incidents in the reports every year on their website. The report contains detailed information on the incidents, including the immediate cause and the underlying cause of HIPO-incidents. As per 31 December 2019, the report shows a total of 987 HIPO-incidents, which are assigned to the causal factors. IOGP classified the HIPO-incidents report based on the working functions involved in the incidents. The working functions are the entities or concerned disciplines holding the responsibility of HIPO-incidents. As in most of upstream oil and gas company, the working functions are classified as in Figure 1. Figure 1 illustrates the number of HIPO-incidents in accordance with the working functions. It is evident that Production concern discipline contributes the highest number of HIPO-incidents among others. Production entity possesses 452 cases from total of 957 cases (47.2%) in the worldwide operation. Based on this graphical statistic, Production, as the main operation entity, involves the highest risks in the oil and gas industry. In the second place, there are 274 HIPO-incident cases in the drilling and well services working function. This number shows that this concerned disciplines involves high risk and is also considered as the main operating business in oil and gas companies. Construction working functions places at the third rank, following 134 HIPO-incident cases. As the nature of these disciplines is to build offshore platforms and facilities, construction shall possess inherent risks due to the massive manpower involved. Logistics and Explorations working functions lie at the fourth and fifth places with 89 and 38 HIPO-incident cases respectively. Logistics may contribute to the HIPO-incident case through their supporting activities involving land, air, and sea/marine transportation. The number of HIPO-incidents in this concerned discipline are mainly contributed by the lifting activity and material/personal transportation. Exploration may involve lesser risk among other working functions due to its fewer working man-hours.

Encycolopedia of food safety
Food industry . Human error or equipment failure 2. Workplace condition 3. Organizational culture and management decision Bea [23] Risk analysis Oil and gas . Human factor 2. Organizational factor Madigan et al. [24] Accident analysis and prevention Transportation . Organizational incluences 2. Precondition for unsafe acts 3. Unsafe acts  All HIPO-incidents listed in the IOGP's report are categorized based on their event category. The event category describes the activities associated with HIPO-incidents and the nature of incidents. In the IOGP's report, event categories are defined as: water-related incident and drowning; struck by, slips and trips at the same height; pressure release or hydrocarbon leaks; overexertion or strain; falls from height, exposure noise, chemical, biological, vibration; exposure electrical; explosion or burns; dropped objects; cut, puncture, scrape; confined space; caught in, under or between; aviation incident; assault or violent act; and other type of incidents. Figure 2 illustrates the event categories of HIPO-incidents provided by the IOGP's database. The investigation report lists each HIPO-incident case as a single event category despite multiple event categories may also occur within the same HIPO incident cases.
According to graphical statistics in Figure 2, event category "struck by" contributes the most numerous HIPO-incident occurrence (34.4%). This event category explains the conditions where an injury is resulted from being hit by moving equipment and machinery, or by flying or falling objects. This event category also includes vehicular incidents where the vehicle is struck or collided against another object. In the second place, event category "pressure release" lists 141 HIPO-incident cases (14.7%). This type of incident is described as the release of gas, liquid, or object under pressure from pressurized system. Hydrocarbon gas leakage and oil spill are two of the most often case in the operations. Event category "caught in, under or between" is recorded in the third place following 103 (10.8%) HIPO-incident cases occurrence. This event category elaborates an incident where an injured person is crushed between moving parts equipment or machinery. This also includes an incident where injured person caught between rolling tubular or objects being moved, crushed between a boat and a bollard, and also includes vehicle incidents involving rollover. There are 95 HIPO-incidents (9.9%) are categorized as "other" type of incident. This event category explains an incident where it cannot be logically classified under any other category. This event category includes natural incidents and the incidents which cannot be identified nor investigated due to lack of factual record.

HIPO-Incident Causal Factors
IOGP reported 987 HIPO-incidents based on root cause analysis methods and revealed 36 root causes which are investigated as the causal factors of the incidents. IOGP provides the definition for each causal factor which are identified along with their explanations. All of causal factors are mentioned as three main categories, i.e., Organizational system factor; Process factor leading to unsafe working condition; and Human-behavioral factor. Figure    Organizational system factor is identified as the group of root causes associated with the failure of management decision or management system dysfunction. This causal factor is linked to the failure of an organization to provide safe working conditions and adequate health and safety culture. Oftentimes, organizational system failures within incidents are required more in-depth investigation as they may not be revealed directly by the management. Several examples of Organizational system factors are written as follows: inadequate work standards/procedures; inadequate to provide training/competence; inadequate supervision; inadequate communication; poor leadership/organizational culture; and failure to report/learn from events.
Process factor leading to unsafe working condition is a causal factor of incidents which is marked with the existence of physical hazards or high-risk situation. Process condition factor may lead to unsafe working condition due to insufficient control measures. In other circumstances, unsafe working condition may also be resulted from inadequate safety system or poor engineering design. There are four classification categories of process condition factor leading to unsafe working condition. Those are: inadequate protective equipment; failure of preventive maintenance or inspection; insufficient engineering design; and workplace hazards.
The last of incidents causal factor classified is Human-behaviour factor. This causal factor involves either the violating human behaviour or a person actions which incorrectly performed as required. Several examples of this causal factor are: violation intentional or unintentional by individual or group; work or motion at improper parameter; improper use of equipment; failure to warn of hazard; personal Protective Equipment not used or used improperly; acts of violence; use of drugs or alcohol; and fatigue.
Of the 987 HIPO-incidents that IOGP investigated, there are a total of 5124 causal factors appear as the root cause of the incidents. From these numbers, it is confirming that a HIPO case should have resulted from multiple causal factors. Figure 3 demonstrates the names of specific causal factors according to the classifications. Inadequate hazard identification or risk assessment, inadequate work standards/procedures, and improper decision making has been identified as the top of causes and appeared to be influenced by other causal factors. This section thus identifies the essential contributing factors which emerge in conjunction with organizational system factor, process factor, and humanbehavioral factor.
In Organizational system factor classification, Figure 3 illustrates 523 (10.2%) causal factors is identified as inadequate hazard identification or risk assessment. This finding becomes critical because failure to manage and control risks shall create a higher-severity incident. As often in many cases, HIPOincidents involving fire and gas leak could rapidly escalate and produce catastrophic consequences. At the second point, inadequate work standards and procedures contribute 418 (8.2%) of the total causal factors. This finding includes maintaining obsolete procedures/documents, misplaced work instructions, and incompatible organization standards. It is essential finding that inadequate procedure shall impact to the failure of operation management and equipment defect. It is concluded that an improper or insufficient way of conducting a task had initiated an equipment failure that eventually led to the fire [1]. Therefore, providing correct and updated working procedures and organizational documents plays critical roles in creating safer working conditions.
In terms of Human-behaviour factor, it is investigated that 326 causal factors are improper decision making or lack of safety judgment. This terminology is observed where the risky situations were wrongly judged, and the error decision were made, or the personnel involved in the inappropriate activities. This finding includes taking shortcuts, horse-playing, and bypassing safety standards. Another essential factor within Human-behaviour factor is the violation of safety rules unintentionally by the personnel (228 cases). This happens because of the lack of safety knowledge and poor competence of assigned tasks. Personnel may violate safety standards and endanger themselves unintentionally due to insufficient safety awareness, which is resulted from organizational failure to promote safety culture. This finding is also correlated with providing inadequate training/competence in the Organizational system factor classification. The high-risk situation in the process factor, which leads to unsafe working conditions, is mainly caused by inadequate preventive maintenance and inspection (5.9%). Most of the equipment defect and malfunction are attributed to the failure of maintenance program, or it was not performed correctly. Due to this fact, it is obvious that inadequate maintenance and inspection contributes significant factor to the HIPO-incidents occurrence. Another important factor identified is the inadequate design/specification or management of change. There are 290 (5.7%) findings attributed to this causal factor. Such a design flaw may result in equipment degradation due to operational vibrations, heats, and pressures. This causal factor includes improper installations, incompatible materials and products, and operating beyond equipment specification. From these investigations, it is expected that the organization could understand the causes of incidents and provide adequate measures to control the operational risks.

Development of Gaussian Fuzzy Analytic Hierarchy Process
This paper proposes the Gaussian fuzzy analytic hierarchy process (Gaussian FAHP), a multi-criteria decision analysis methodology that can realistically compensate uncertainty and ambiguity during preference selection. This methodology is advantageous due to its capability to approximate uncertainty and risk of incomplete information due to scattered data. The Gaussian membership function in this paper is generated based on Normal distribution function by simulating Monte-Carlo random variables. The final evaluation value is formed as a single crisp number by calculating centre of gravity defuzzification method. The detailed computation process of Gaussian FAHP in this paper is explained as follows. Gaussian (x: 5, rand (σi)) Strongly important 7 Triangular (x,5,7,9) Gaussian (x: 7, rand (σi)) Extremely important 9 Triangular (x,1,1,1) Gaussian (x: 9, rand (σi)) Step-1, transform a triangular fuzzy number into Gaussian fuzzy number, based on the linguistic preference scale of the Saaty scale based on Table 2 Step-2, calculate Gaussian fuzzy pairwise comparison matrices for all criteria and alternatives judgments. Construct Gaussian fuzzy judgment matrix ‫ܣ‬ ሚ based on the value of (li ,mi, ui) which one of criteria is more important to another.
Where ‫ܣ‬ ഢണ ෪ is the fuzzy pairwise comparison value i compare to j. The value of (݈ , ݉ , ‫ݑ‬ ) are the value of lower, middle, and upper properties of the fuzzy pair wise comparison matrices ‫ܣ‬ ഢണ ෪ , Step-3, Determine the fuzzy weight value by implementing geometric mean for each criterion and alternative judgment. The fuzzy weight of each criterion is calculated as follows [25]. Step-4, identify the rank for all alternatives by applying defuzzification process of Gaussian fuzzy numbers (݈ , ݉ , ‫ݑ‬ ). Defuzzification process is important because it defines the crisp value from the fuzzy number to determine the most optimum alternative. The defuzzification method of (݈ , ݉ , ‫ݑ‬ ) is applied by center of gravity of the Normal (Gaussian) distribution probability density function. Where ߤ and ߪ are the mean value and standard deviation of Normal (Gaussian) probability distribution function after performed by Geometric mean operation. It is explained that: Step-5, Perform consistency analysis. After having defuzzified value, it is important to check the consistency of the pairwise comparison matrices. The crisp value is then formed into a comparison matrix similar with conventional AHP. The values of defuzzification U are developed into crisp value comparison matrix.
As stated by Zheng et al. [26] "When the conventional comparison matrix ܷ is consistent, it means that fuzzy comparison matrix ܷ ෩ is also consistent". Consistency analysis is the performed by implementing consistency ratio method similar with those in AHP method.
Step-6, determine the weight of fuzzy value by normalizing each criterion.
where ܷ ෩ is the fuzzy weight value of the i-th criterion, and therefore, obtain fuzzy final value by calculating hierarchical layer sequencing.
where ܷ పఫ ෪ is the fuzzy weight value of the j-th criteria to the i-the alternatives.

Results and Discussion
This section analyses the methods implemented in the research. As defining the most contributing causal factor of HIPO-incidents is the ultimate objective, the methods should comply with systematic research framework. For an improved fuzzy AHP research to be precise, its criteria, sub-criteria, and alternatives should be developed based on applicable research methodology. The criteria involved in the proposed NMCFAHP method is determined based on work functions. Whereas the alternatives lie upon the identified root causes, i.e., Organizational system factor; Process factor leading to unsafe working condition; and Human-behaviour factor.

Evaluation of Gaussian FAHP Criteria Variables
The development of criteria variables evaluation begins with the process of listing all HIPO-incidents from IOGP's report into the table of working function series. This table contains all HIPO in accordance with their specific working function and is used for developing the evaluative criteria. Table 3 defines the series of working functions from 2010 until 2018.
To evaluate the criteria variables, we develop pairwise comparison tables according to the working function in Table 3. All working function is compared from one to another and displayed in a yearseries. For instance, in 2010, there are 14 HIPO-incident cases occurred in construction, whereas in drilling there are 32 cases. Therefore, in relative comparison drilling is more important than construction  Table 4. The reciprocal approach is implemented for reflecting the dominance of second criteria compared with the first. Afterward, from Table 4, we develop the pairwise comparison matrices. The analysis for criteria variables is calculated based fuzzy pairwise comparison matrix. The fuzzy judgment matrix A ̃ is developed based on Gaussian fuzzy number (Gaussian (x: µi, σi)). The value of mean (µ) and standard deviation (σ) is obtained from the average and standard deviation value listed in the years' arrear, as specified in Table 4. We then generate a random Gaussian fuzzy number by applying the Monte-Carlo simulation following the values of µ and σ for each criteria evaluation. This paper employs 1,000 random normal variables. The Monte-Carlo simulation is obtained by entering a spreadsheet formula, i.e. "= ‫,)(ܦܰܣܴ(ܸܰܫܯܴܱܰ‬ ܺ ത , ‫.")ݏ‬ From the Monte-Carlo simulation, we obtain the result of Monte-Carlo Normal distribution mean (µi) and standard deviation (σi). Based on the random number generation for the criteria pairwise comparison, we determine the value of l, m, and u as the most probable, lower value, and upper value of the fuzzy pairwise comparison matrices A . The value of l, m, and u for all criteria evaluation is determined by solving Equation 1 until 4. After having the value of l, m, and u, the pairwise comparison is modified and written in Table 5.   Figure 4 it can be seen that the researcher uses five criteria and three alternatives. The result of criteria evaluation is plotted as Gaussian probability distribution function. In corresponding to the value of ߤ and ߪ in Equation 10 and 11. For obtaining the final criteria weight values, we perform defuzzification method based on Equation 4. The result of Gaussian distribution plot of criteria is demonstrated in Figure 5, and the result of defuzzification process is written in Table 7.  Figure 5. Gaussian probability density function plot in accordance to all working functions (criteria).

Evaluation of Gaussian FAHP Alternatives Variables
In this research, a similar approach with the criteria evaluation is implemented for evaluating alternatives. The alternatives are assessed by the respective criterion. Therefore, there will be five pairwise comparisons to score the alternatives based on criteria evaluated. Firstly, based on the IOGP's report, the list of causal factors according to the working function is displayed in series arrear. To shorten the writing style, the alternative variables are determined as follows, ‫1ܣ‬ = ‫݈ܽ݊݅ݐܽݖ݅݊ܽ݃ݎܱ‬ ‫݉݁ݐݏݕݏ‬ ‫ݎݐ݂ܿܽ‬ ‫2ܣ‬ = ‫ݏݏ݁ܿݎܲ‬ ‫ݎݐ݂ܿܽ‬ ݈݁ܽ݀݅݊݃ ‫ݐ‬ ‫݂݁ܽݏ݊ݑ‬ ‫݃݊݅݇ݎݓ‬ ‫݊݅ݐ݅݀݊ܿ‬ ‫3ܣ‬ = ‫݊ܽ݉ݑܪ‬ − ‫݈ܽݎ݅ݒܽ‪ܾ݁ℎ‬‬ ‫ݎݐ݂ܿܽ‬ Afterward, the pairwise comparison tables are developed for alternatives based on each criterion. For instance, in 2010 there are 27 cases of Organizational system factor, 5 cases of process factor, and 22 cases of Human-behavioral factor within Construction working function. Therefore, pairwise comparison tables and matrices can be obtained based on this ratio. Table 8. until table 13. define the pairwise comparison for the alternatives. Due to space limitation, we only display the causal factor cases in correspond with Construction working function. Similar approaches are applied for the other working function or criteria.
In order to have the alternatives final fuzzy values, multiplication values between criteria and alternatives should be performed. To accommodate this problems, we used the fuzzy hierarchical layer sequencing method. By implementing Equation 16, the fuzzy final value is obtained.  where ‫ݓ‬ , ‫ݓ‬ ெ , and ‫ݓ‬ are the lower value, most probable value, and upper value of the calculated fuzzy pairwise comparison matrices; ߪ is the fuzzy standard deviation; and ߤ is the mean of fuzzy calculated values. Random variables for all alternatives are generated in accordance with the values of ߤ and ߪ . The result of final fuzzy values is illustrated in Figure 6. As seen in Figure 6 There are overlapping figure from one alternatives to others. To clarify the alternatives' rank, final crisp value should be obtained. The final crisp values are then calculated by applying a defuzzification using the centre of gravity method (COG).
By solving complex integration in Eq. 20, the fuzzy final values for alternative-1 are: The rest of calculations are implemented for A2, A3, and A4 respectively. The final alternatives' rank and score is then displayed in Table 15.    Table 8. Causal factors in correspond to construction criteria.      From the result of this research, it is exposed that Organizational system factor (A1) is the most significant contributing factor to the HIPO-incidents occurrence. Besides that, Organizational system factor possesses the narrowest Gaussian probability density function among other causal factors. The calculation of standard deviations for Organizational system factor is less than 0.5% of their means. Based on this figure, it is implied that the incidents statistics are complete and consistent in deciding the fuzzy weights of judgment.

Construction
In the second and third rank lies the causal factor of Human behaviour factor (A3) and Process factor leading unsafe working condition (A2). In contrast with A1, A2 and A3 display a wide range of standard deviation (>0.5% of mean). Especially in A3, the value of standard deviation is even more than its mean. This phenomenon shows that in the Human-behaviour causal factor, there is a wide range of fluctuation in the yearly series arrear. Based on this analysis, Human-behaviour factor comes as the most unstable causal factor, which identifies the fragility of personnel/workers involved. This circumstance also indicates that Human-behaviour factor should be consistently taken into account in incident prevention programs.

Sensitivity Analysis
The sensitivity analysis is performed to measure the proposed evaluation model's performance. It is necessary to evaluate how input change could lead to output difference. This means that if the input system is changed by adding or lowering the criteria values, how far the expected alternatives scores will change. The sensitivity analysis is performed by replacing the degree of importance of working function criteria. In such manner, we change the least important criteria, e.g., Exploration and Logistics to become the most important criteria. This analysis previses if there is a change in incident statistics or different data approach as the baseline of the research. The result of the sensitivity analysis shall be displayed in descriptive graphics and charts.
According to the evaluation of criteria in section 4.1., the most significant criteria is Production, followed by Drilling. Whereas the lease significant contributing criteria are Exploration and Logistics. The sensitivity analysis is performed by lowering 50% weight of Production and Drilling criteria and adding 50% weight to the least significant criteria, Exploration and Logistics. The result of this change is demonstrated in Figure 7.
In Figure 7, it is observed that there is no ranking change of all alternatives. The result is still consistent, figuring that Organizational system factor (A1) as the most significant causal factor for the HIPO-incidents occurrence. In addition, it is obviously displayed that Human-behaviour factor (A3) and Process factor leading to unsafe working condition (A2) come as the second and third significant factor. Therefore, the evaluation is consistent and robust.

Conclusion
This paper has presented the development of Gaussian fuzzy analytic hierarchy process based on the random values generated by Monte-Carlo simulation. The proposed methodology evaluates the most significant causal factor corresponding to the HIPO-incidents occurrence. Based on the analysis, it is concluded that Organizational system factor (A1) is the most contributing causal factor to the HIPOincidents. In current condition, oil and gas company records the HIPO-incidents' occurrence and defines its frequencies as the notable factor. The detail of root causal factors is almost never adhered to. Oil and gas company has not prioritized its resource to enhance the safety aspect of the organizational system factor. On the other hand, the Human-behaviour causal factor (A3), perches as the second place of significant causal factor and displays a wide range of standard deviation. As observed, the standard deviation is even more than the mean value. This concludes that Human-behaviour factor indicates unstable causal factor and identifies the fragility of personnel/workers involved.
Based on the sensitivity analysis, the observed result demonstrates consistent and accurate analysis. There is no change in terms of alternatives' final ranking and significance. The analysis figures that Organizational system factor (A1) still as the most significant causal factor among the other alternatives. Therefore, it is inferred that the propose methodology is robust and acceptable as the reference for oil and gas companies in determining their incident preventive programs.