developing process safety indicators

of59

Health and Safety Executive

Developing process safety indicatorsAstep-by-stepguideforchemicalandmajorhazardindustries

This is a free-to-download, web-friendly version of HSG254 (First edition, published 2006). This version has been adapted for online use from HSE’s current printed version.

Youcanbuythebookatwww.hsebooks.co.ukandmostgoodbookshops.

ISBN 978 0 7176 6180 0Price £11.95

This guidance is aimed at senior managers and safety professionals within major hazard organisations that wish to develop performance indicators to give improved assurance that major hazard risks are under control.

It is presumed that companies using this guide already have appropriate safety management systems, so the emphasis is on checking whether their risk controls are effective and operating as intended. The guide draws on good practice in the UK chemical sector.

Too many organisations rely heavily on failure data to monitor performance, so improvements or changes are only determined after something has gone wrong.Discovering weaknesses in control systems by having a major incident is too late and too costly. Early warning of dangerous deterioration within critical systems provides an opportunity to avoid major incidents. Knowing that process risks are effectively controlled has a clear link with business efficiency, as several indicators can be used to show plant availability and optimised operating conditions.

While aimed mainly at major hazard organisations, the generic model for establishing a performance measurement system described in this guide will also apply to other enterprises requiring a high level of assurance that systems and procedures continue to operate as intended.

HSE Books

of59

© Crown copyright 2006

Firstpublished2006

ISBN9780717661800

Allrightsreserved.Nopartofthispublicationmaybereproduced,storedinaretrievalsystem,ortransmittedinanyformorbyanymeans(electronic,mechanical,photocopying,recordingorotherwise)withoutthepriorwrittenpermissionofthecopyrightowner.

Applicationsforreproductionshouldbemadeinwritingto:TheOfficeofPublicSectorInformation,InformationPolicyTeam,Kew,Richmond,SurreyTW94DUore-mail:[email protected]

ThisguidanceisissuedbytheHealthandSafetyExecutive.Followingtheguidanceisnotcompulsoryandyouarefreetotakeotheraction.Butifyoudofollowtheguidanceyouwillnormallybedoingenoughtocomplywiththelaw.Healthandsafetyinspectorsseektosecurecompliancewiththelawandmayrefertothisguidanceasillustratinggoodpractice.


Developingprocesssafetyindicators Page3of59


ContentsForeword 4

Part 1: Introduction 5 Structureandcontent 6 Measuringperformance–earlywarningbeforecatastrophicfailure 6 What’sdifferentaboutthisguide? 6

Part 2: Six steps to performance measurement 10 Step 1:Establishtheorganisationalarrangementstoimplement indicators 11 Step 2:Decideonthescopeoftheindicators 13 Step 3:Identifytheriskcontrolsystemsanddecideonthe outcomes 18 Step 4:Identifycriticalelementsofeachriskcontrolsystem 22 Step 5:Establishdatacollectionandreportingsystem 25 Step 6:Review 26

Part 3: Worked example 28 Riskcontrolsystems 37

References 58

Further information 59



ForewordThereisacollectiveneedforthechemicalandmajorhazardsectorstodemonstratethatrisksarebeingadequatelycontrolled,astheindustryisoftenjudgedbytheworstperformeroragainstthelastmajorincidenttogainpublicattention.SincethepublicationoftheBPGrangemouthMajorincidentinvestigationreport,1theHealthandSafetyExecutive(HSE)andindustryhavebeenworkingcloselytodevelopthemeansbywhichcompaniescandevelopkeyperformanceindicatorsformajorhazardsandensureprocesssafetyperformanceismonitoredandreportedagainsttheseparameters.

ThisguidehasbeenproducedjointlybyHSEandtheChemicalIndustriesAssociation(CIA),basedoninformationandideasfromindustry.Thesix-stageprocessoutlinedshouldhelpcompaniesthroughthemainstepstowardsimplementingprocesssafetyperformanceindicators.

Investigationofmajorincidentschemicalandmajorhazardinstallationshaveshownthatitisvitalthatchemicalcompaniesknowthatsystemsdesignedtocontrolrisksoperateasintended.Thiswork,builtfromclosecollaborationbetweenHSEandindustry,helpsprovidethisassurance.Itisimportantthatwecontinuetoshareunderstandingofbestpracticeinthisdevelopingarea.Reviewingperformancewillincreasinglyfeatureinourinspectionprogramme.

Kevin AllarsHeadofChemicalIndustriesDivisionHSEMeasurementleadstoconfidence.

OurResponsibeCare®2commitmentistocontinuousimprovementinallaspectsofhealth,safetyandenvironmentalmanagement.Thisimportantnewinitiativewillhelpusallgainabetterunderstandingofpotentiallyseriousincidentprecursors,andwillenableustomakefurtherimprovementstoouroverallhealth,safetyandenvironmentalmanagementsystems.

Steve ElliotDirectorGeneralChemicalIndustriesAssociation



Part 1: IntroductionMeasurement leads to confidence

1 Thisguideisintendedforseniormanagersandsafetyprofessionalswithinorganisationsthatwishtodevelopperformanceindicatorstoprovideassurancethatmajorhazardrisksareundercontrol.Asmallnumberofcarefullychosenindicatorscanmonitorthestatusofkeysystemsandprovideanearlywarningshouldcontrolsdeterioratedangerously.

2 Althoughprimarilyaimedatmajorhazardorganisations,thegenericmodelforestablishingaperformancemeasurementsystemdescribedinthisguidecanequallybeappliedtootherenterprisesrequiringahighlevelofassurancethatsystemsandprocedurescontinuetooperateasintended.

3 Itispresumedthatcompaniesusingthisguidealreadyhaveappropriatesafetymanagementsystemsinplace;theemphasisofthisguideisthereforetocheckwhetherthecontrolsinplaceareeffectiveandoperatingasintended.

4 Toomanyorganisationsrelyheavilyonfailuredatatomonitorperformance.Theconsequenceofthisapproachisthatimprovementsorchangesareonlydeterminedaftersomethinghasgonewrong.Oftenthedifferencebetweenwhetherasystemfailureresultsinaminororacatastrophicoutcomeispurelydowntochance.Effectivemanagementofmajorhazardsrequiresaproactiveapproachtoriskmanagement,soinformationtoconfirmcriticalsystemsareoperatingasintendedisessential.Switchingtheemphasisinfavourofleadingindicatorstoconfirmthatriskcontrolscontinuetooperateisanimportantstepforwardinthemanagementofmajorhazardrisks.

5 Themainreasonformeasuringprocesssafetyperformanceistoprovideongoingassurancethatrisksarebeingadequatelycontrolled.Directorsandseniormanagersneedtomonitortheeffectivenessofinternalcontrolsagainstbusinessrisks.Formajorhazardinstallationsandchemicalmanufacturers,processsafetyriskswillbeasignificantaspectofbusinessrisk,assetintegrityandreputation.Manyorganisationsdonothavegoodinformationtoshowhowwelltheyaremanagingmajorhazardrisks.Thisisbecausetheinformationgatheredtendstobelimitedtomeasuringfailures,suchasincidentsornearmisses.Discoveringweaknessesincontrolsystemsbyhavingamajorincidentistoolateandtoocostly.Earlywarningofdangerousdeteriorationwithincriticalsystemsprovidesanopportunitytoavoidmajorincidents.Knowingthatprocessrisksareeffectivelycontrolledhasaclearlinkwithbusinessefficiency,asseveralindicatorscanbeusedtoshowplantavailabilityandoptimisedoperatingconditions.

6 Themethodofsettingindicatorsoutlinedinthisguiderequiresthoseinvolvedinmanagingprocesssafetyriskstoasksomefundamentalquestionsabouttheirsystems,suchas:

n Whatcangowrong?n Whatcontrolsareinplacetopreventmajorincidents?n Whatdoeseachcontroldeliverintermsofa‘safety outcome’?n Howdoweknowtheycontinuetooperateasintended?

7 Companieswhohaveadoptedprocesssafetyperformanceindicatorshavereportedthattheyhave:

n anincreasedassuranceonriskmanagementandprotectedreputation;



n demonstratedthesuitabilityoftheirriskcontrolsystems;n avoideddiscoveringweaknessesthroughcostlyincidents;n stoppedcollectingandreportingperformanceinformationwhichwasnolonger

relevant–therebysavingcosts;andn madebetteruseofinformationalreadycollectedforotherpurposes,egquality

management.

Structure and content

8 Part 2,themainpartofthisguide,describesasix-stepprocessthatcanbeadoptedbyorganisationswishingtoimplementaprogrammeofperformancemeasurementforprocesssafetyrisks.Eachstageisexplainedindetailwithinaseparatechapter.Tohelpputtheprocessintocontext,afullworkedexampleforatop-tierCOMAH3siteisincludedinPart 3.

9 Althoughthismodelcanbefollowedstep-by-step,manyorganisationsalreadyhaveaperformancemeasurementsysteminplaceandmaynotwishtoembarkonradicalchange.Insuchcircumstances,thisguidemaybeusedasaframeworkagainstwhichtocompareexistingprogrammestodecideifimprovementsareneeded,asitdrawsongoodpracticewithintheUKchemicalsector.

10 Throughoutthisguide,theterm‘process safety management system’isusedtodescribethosepartsofanorganisation’smanagementsystemintendedtopreventmajorincidentsarisingoutoftheproduction,storageandhandlingofdangeroussubstances.‘Risk control system’(RCS)isusedtodescribeaconstituentpartofaprocesssafetymanagementsystemthatfocusesonaspecificriskoractivity,egplantandprocesschange,permittowork,inspectionandmaintenanceetc.

Measuring performance – early warning before catastrophic failure

11 Mostsystemsandproceduresdeteriorateovertime,andsystemfailuresdiscoveredfollowingamajorincidentfrequentlysurpriseseniormanagers,whosincerelybelievedthatthecontrolswerefunctioningasdesigned.Usedeffectively,processsafetyindicatorscanprovideanearlywarning,beforecatastrophicfailure,thatcriticalcontrolshavedeterioratedtoanunacceptablelevel.

12 Measuringperformancetoassesshoweffectivelyrisksarebeingcontrolledisanessentialpartofahealthandsafetymanagementsystem,asexplainedinSuccessful health and safety management,4and,forexample,theCIA’sResponsible Care Management Systems:5

n active monitoringprovidesfeedbackonperformancebeforeanaccidentorincident;whereas

n reactive monitoringinvolvesidentifyingandreportingonincidentstocheckthecontrolsinplaceareadequate,toidentifyweaknessesorgapsincontrolsystemsandtolearnfrommistakes.

What’s different about this guide? Dual assurance – a leading and lagging indicator for each risk control system13 Themaindifferencebetweentheapproachoutlinedinthisguideandexistingguidanceonperformancemeasurementistheintroductionoftheconceptof‘dualassurance’thatkeyriskcontrolsystemsareoperatingasintended.Leadingandlaggingindicatorsaresetinastructuredandsystematicwayforeachcriticalrisk



controlsystemwithinthewholeprocesssafetymanagementsystem.Intandemtheyactassystemguardiansprovidingdualassurancetoconfirmthattheriskcontrolsystemisoperatingasintendedorprovidingawarningthatproblemsarestartingtodevelop.Leading indicators 14 Leadingindicatorsareaformofactivemonitoringfocusedonafewcriticalriskcontrolsystemstoensuretheircontinuedeffectiveness.Leading indicators require a routine systematic check that key actions or activities are undertaken as intended.Theycanbeconsideredasmeasuresofprocessorinputsessentialtodeliverthedesiredsafetyoutcome.Lagging indicators 15 Laggingindicatorsareaformofreactivemonitoringrequiringthereportingandinvestigationofspecificincidentsandeventstodiscoverweaknessesinthatsystem.Theseincidentsoreventsdonothavetoresultinmajordamageorinjuryorevenalossofcontainment,providingthattheyrepresentafailureofasignificantcontrolsystemwhichguardsagainstorlimitstheconsequencesofamajorincident.Lagging indicators show when a desired safety outcome has failed, or has not been achieved.

16 AccordingtoJamesReasoninManaging the Risks of Organizational Accidents,6(major)accidentsresultwhenaseriesoffailingswithinseveralcriticalriskcontrolsystemsmaterialiseconcurrently.Figure2illustratesan‘accidenttrajectory’modelwhereanaccidenttrajectorypassesthroughcorrespondingholesinthelayersofdefence,barriersandsafeguards.Eachriskcontrolsystemrepresentsanimportantbarrierorsafeguardwithintheprocesssafetymanagementsystem.Itshouldalsoberecognisedthatasignificantfailinginjustonecriticalbarriermaybesufficientinitselftogiverisetoamajoraccident.

17 Foreachriskcontrolsystem:

n theleadingindicatoridentifiesfailingsor‘holes’invitalaspectsoftheriskcontrolsystemdiscoveredduring routine checksontheoperationofa

Figure 1 Dualassurance-leadingandlaggingindicatorsmeasuringperformanceofeachcriticalriskcontrolsystem



criticalactivitywithintheriskcontrolsystem;andn thelaggingindicatorrevealsfailingsor‘holes’inthatbarrierdiscovered

following an incident or adverse event.Theincidentdoesnotnecessarilyhavetoresultininjuryorenvironmentaldamageandcanbeanearmiss,precursoreventorundesiredoutcomeattributabletoafailinginthatriskcontrolsystem.

18 Ifunchecked,allsystemswilldeteriorateovertimeandmajorincidentsoccurwhendefectsacrossanumberofriskcontrolsystemsmaterialiseconcurrently.Settingleadingandlaggingindicatorsforeachriskcriticalcontrolsystemshouldrevealfailingsinthesebarriersastheyariseandbeforealltheimportantbarriersaredefeated.

Frequency of checks19 Manyorganisationsrelyonauditingtohighlightsystemdeterioration.However,auditintervalscanbetooinfrequenttodetectrapidchange,ortheauditmayfocusoncompliance(verifyingtherightsystemsareinplace),ratherthanensuringsystemsaredeliveringthedesiredsafetyoutcome.Theuseofprocesssafetyperformanceindicatorsfitsbetweentheseformal,infrequentauditsandmorefrequentworkplaceinspectionandsafetyobservationprogrammes.Itisimportant

Figure 2 Leadingandlaggingindicatorssettodetectdefectsinimportantriskcontrolsystems

(ReproducedwithpermissionofAshgatePublishingLimited,fromManaging the Risks of Organizational AccidentsJamesReason1997AshgatePublishingLimited)6



tobearinmindthatanauditprogrammemaybedesignedtoaddressdifferentissueswhencomparedtotheinformationgainedfromperformanceindicators.Ideally,eachwillinformtheother.Deficienciesuncoveredbyanauditmayhighlighttheneedforanewperformanceindicatorandviceversa.Therefore,performanceindicatorsarenotasubstituteforanauditprogrammebutacomplimentaryactivitytogivemorefrequentordifferentinformationonsystemperformance.

Figure 3 Howperformanceindicatorsfitwithinnormalhealthandsafetymonitoringactivities



Part 2: Six steps to performance measurement20 Thissectionoutlinesthesixmainstagesneededtoimplementaprocesssafetymeasurementsystem.Organisationsthatdonothaveaprocesssafetyperformancemeasurementsystemwouldbenefitfromconsideringeachstageinturn.Organisationswithperformancemeasurementsystemsinplacecanusethisguideasabenchmarkofgoodpracticeandconsiderimprovementsasappropriate.

Table 1 Overviewofthesixstepstosettingperformanceindicators

Step1 Establishtheorganisationalarrangementstoimplementtheindicators

Appointastewardorchampion

Setupanimplementationteam

Seniormanagementshouldbeinvolved

Step2 Decideonthescopeofthemeasurementsystem.Considerwhatcangowrongandwhere.

Selecttheorganisationallevel

Identifythescopeofthemeasurementsystem:n Identifyincidentscenarios-wnatcangowrong?n Identifytheimmediatecausesofhazardscenariosn Reviewperformanceandnon-conformances

Step3 Identifytheriskcontrolsystemsinplacetopreventmajoraccidents.Decideontheoutcomesforeachandset a lagging indicator

Whatriskcontrolsystemsareinplace?

Describetheoutcome

Setalaggingindicator

Followupdeviationsfromtheoutcome

Step4 Identifythecriticalelementsofeachriskcontrolsystem,(iethoseactionsorprocesseswhichmustfunctioncorrectlytodelivertheoutcomes)andset leading indicators

Whatarethemostimportantpartsoftheriskcontrolsystem?

Setleadingindicators

Settolerances

Followupdeviationsfromtolerances

Step5 Establishthedatacollectionandreportingsystem Collectinformation-ensureinformation/unitofmeasurementisavailableorcanbeestablished

Decideonpresentationformat

Step6 Review Reviewperformanceofprocessmanagementsystem

Reviewthescopeoftheindicators

Reviewthetolerances



Step 1: Establish the organisational arrangements to implement indicators

n Appoint a steward or champion to take the initiative forward.

n In larger organisations, consider using a process safety steering committee.

n Senior management should be actively involved in the development of indicators.

21 Neworganisationalarrangementsmaybeneededtoimplementaperformancemeasurementsystem.Someonewillhavetomakethecaseforprocesssafetymeasurementwithinthecompanyandthendriveitforwardtoimplementation.Thebenefitsandthecostswillneedtobecarefullyconsideredandthedetailsoftheexactindicatorsdetermined.

Step 1.1: Appoint a steward or champion

22 Astewardorchampionisneededto:

n promote,driveforwardandco-ordinatetheintroductionofthenewconceptandsystem;

n makethebusinesscaseandlinkwithcompanyhealth,safety,environment,qualityandbusinessimprovementsystems;

n communicateideasandprogress;n keepintouchwithothersworkinginthisareaandgatherinformationonbest

practice;andn identifyandevaluatethebenefitsachieved.

Make the business case 23 Developingandimplementingprocesssafetyindicatorsisoftenanewareaofworkwithinmanyorganisations,andtheneedforsuchasystemwillnotbeimmediatelyobvioustomanypeople.Tobesuccessful,thissortofinitiativerequiressomeonewithintheorganisationtopromotetheidea,gaugesupportandthentodriveforwardtheinitiative.Thismayincludemakingthebusinesscaseforadoptingperformanceindicatorsandsecuringsuitableresources.

24 Monitoringandmeasuringperformancehasalwaysbeenpartofhealthandsafetymanagementsystems.However,suchsystemsfrequentlyoverlookprocesssafetyissuesbecauseitisdifficulttoknowwhattomeasureandhowtosetleadingindicators.Whereperformanceindicatorsalreadyfeatureinacompanyhealthandsafetymanagementsystem,itisimportantforsomeonetocheckthesuitabilityofthoseindicatorsforprovidingongoingassuranceonthecontrolofprocesssafetyrisks.ItcouldbethatexistingperformanceindicatorsmayonlyshowhalfthestoryandthatdualassurancederivedfromselectingaleadingandlaggingindicatorforeachcriticalRCScanaddsignificantlytosuchasystem.Clarifyinggapsandweaknessesinexistingmeasurementsystemsandidentifyingtheassociatedbusinessriskswillbeakeypartofanycaseforchange.



Identifying the business benefits25 Identifyingassociatedbusinessbenefitsthatcanaccruefromimprovedprocesssafetymeasurement(suchasimprovedproductivity,efficiency,reductioninthecostofloss-of-containmentincidentsandimprovedassetmanagement)willhelptoselltheinitiativewithintheorganisation.

Learning from others and sharing good practice26 Thisisadevelopingareaofworkwithnewideasandexperiencesofusingprocesssafetyindicatorsemergingallthetime.Toavoidstartingwithablanksheetofpaper,itishelpfultoknowwhatotherswithintheindustryaredoingandwhatrepresentsgoodpractice.Itisimportantthereforethatsomeonekeepsuptodatewiththesedevelopments,egbyjoiningHSE’swebcommunityforum7orparticipatinginaCIAResponsible Care Cell.8

Step 1.2: Set up an implementation team

27 Considerthefollowingfactorstodecidewhetheranimplementationteamisneeded:

n theworkloadmaybetoomuchworkforoneperson;n theremaybeextrabenefitfromateamapproach–egcollectiveideas;n largeorganisationswithbusysafetycommitteesmayneedaseparateforum/

steeringcommittee;n involvingemployeesshouldfosterasharedunderstandingandownershipof

risksandcontrols.

28 Itwillusuallybeasafetyprofessionalwithinanorganisationwhowillchampiontheworkandsteeritthroughtoimplementation.However,inlargeorganisationstherewillbetoomuchforonepersontodealwithaloneanditisoftenmoreappropriatetoformateamtomanagetheintroductionofprocesssafetyindicators.Thishasthebenefitofdrawinginpeoplefromarangeofbusinessoperations,providingtheopportunityforpoolingideas,especiallyfromemployeeswhohavedirectknowledgeofhowsystemsdeteriorateorbecomeineffective.Asteeringcommitteemayalsobehelpfultooverseetheimplementationprogrammeandtochecktheindicatorsmatchcurrentbusinesspriorities.Fortop-tierCOMAHsites,theimplementationteamandsteeringgroup(whereused)shouldcompriseofpeoplefamiliarwiththesafetyreport.

Step 1.3: Senior management involvement

n Directors and senior managers are the main customers for risk assurance information.

n Senior managers should actively participate in the implementation.

n Business benefits should be agreed.

29 The active control of business risks by directors and senior managers is an essential part of corporate governance.9 Senior managers need to fully understand the business benefits of performance measurement and clearly see how managing process safety contributes to the success and sustainability of their company.Itisvitalthatseniormanagersarecommittedtoadoptingmeaningfulindicatorsastheyhaveultimateresponsibilityforthecontrolofriskandarethereforethemaincustomerfortheenhancedinformation.Itisimportantthatmanagementteams,chiefexecutivesanddirectorsagreethatthe



indicatorschosenprovidethemwiththerightscopeandlevelofinformationtheyneedtobesatisfiedthatprocesssafetyrisksareundercontrol.

30 Seniormanagersneedtomakeappropriateresourcesandsupportavailablefortheintroductionofprocesssafetyindicators.

Step 2: Decide on the scope of the indicatorsSelect the organisational level to which indicators will apply, eg:

n the whole organisation;

n an individual site or group of sites;

n an individual installation/plant.

31 Settingthescopeisaboutselectingtherightindicatorstoprovidejustenoughinformationabouttheadequacyofprocesssafetycontrols.Performancecanbemonitoredatanumberoforganisationallevelswithinabusinessandtheinformationcanbepresentedinahierarchicalmanner.Thenatureoftheindicatorswillvarydependingupontheorganisationallevelatwhichtheyhavebeenset.Indicatorssetforthewholeorganisationalwill,bytheirnature,tendtobemoregeneric,whereasthosesetatplantorsitelevelwillbemorefocusedonkeyactivitiesorprocessesandgivemoredirectfeedbackonthefunctioningofthoseactivities.

Tailor the indicators to suit the business

32 Themanagementsystemsandactivitiesofeveryorganisationaredifferentandsothewayperformanceindicatorsmaybeusedwillalsodifferfromoneorganisationtoanother.Thereisnorightsystemtosuiteveryneedandmanyenterprisesalreadyhavekeyperformanceindicators(KPIs)coveringanumberofbusinessactivities.Itisimportantthatnewindicatorscoveringprocesssafetyareintegratedintoandcomplementexistingarrangementsformonitoringbusinessperformance.

How many indicators? Quality not quantity

33 Itisnotnecessarytomeasureeveryaspectorelementofaprocesssafetymanagementsystem.Focusingonafewcriticalriskcontrolsystemswillprovideasufficientoverviewofperformance.Problemshighlightedinoneriskcontrolsystemshouldtriggeramorewidespreadreview.

34 Busymanagementteamswillquicklyloseinterestinanextensiveraftofindicators,soitisessentialtoavoidKPIoverload.Datacollectionandanalysisisresourceintensive,soarrangementsformonitoringperformancehavetobecosteffective.Evenforthelargestorganisationsafewindicatorssetagainstthemainriskswillbesufficienttoprovideahighdegreeofassuranceacrossthewholebusiness.



Step 2.1: Select the organisational level

35 Thissectionappliesmainlytolargeormulti-siteorganisations.

Decide whether to set indicators at organisation, site or installation/plant level.

36 Manylargeorganisationscascadeperformancetargetsdownwardsthroughthemanagementchainandrequireperformanceinformationagainstsuchtargetstobereportedbackupwards.Traditionally,upwardreportingcomprisedsimplyofexceptionalreportingofincidents.Toprovideassurance,informationtoconfirmthatkeysystemsareoperatingasintendedshouldberoutinelyreportedupwardstodirectorsandseniormanagers.

37 Indicatorssetatplantlevelprovidemanagerswithroutineinformationtoshowthatspecificprocessesoractivitiesareoperatingasintended,egplantdesign,plantchange,plannedinspectionandmaintenancewithinthatsphereofoperations.Indicatorsatthislevelprovideveryspecificperformanceinformationontheactivitiesselected.

38 Indicatorsatsitelevelprovideanoverviewofcriticalsystemsoperatingacrossthewholesite.Usingahierarchicalapproach,informationfromindividualinstallationsoroperationalplantscanbesummarisedacrossthewholesite,egmanagingcontractors,emergencyarrangements,staffcompetence.39 Atanorganisationallevel,ashortsummaryofhigh-levelindicatorsisneeded.Thesemaybebasedoncorporategoalsandobjectives(atop-downapproach),butimportantly,shouldalsofeatureinformationfedupfromsitelevel.

40 Forcomplexsitessuchasrefineriesandwithinmulti-siteorganisations,theperformancemeasurementsystemcanbebasedonahierarchicalapproachwithveryfocusedinstallationlevelindicatorsfeedinguptomoregenericsitelevelandorganisationlevelindicators.Lowlevelindicatorscanbeweightedtoreflecttheirimportanceataparticularsiteorinstallation,orcanbedesignatedas‘indexindicators’toshowthatthemostimpactsystemsareoperatingasintendedacrossthesiteororganisation.



Developing process safety indicators

99

Figure 4 A hierarchical Process Safety Performance Management System for a multi-site organisation

Pla

ntch

ang

eR

CS

Insp

ecti

on

and

mai

nten

ance

RC

S

Sta

ffco

mp

eten

ceR

CS

Op

erat

ing

pro

ced

ures

RC

S

Em

erg

ency

arra

ngem

ents

RC

S

Per

mit

tow

ork

RC

S

Organisational level indicators willbe generic and reflect commonprocess safety system elements inplace in all company facilities

Installation indicators should be based on what can go wrong at the individual installation to give rise to a major accident/serious incident.Installation level indicators should be very focused on the individual RCS critical to the safe operation of that installation or plant

Individual RCS may be given differentweightings based upon the criticality of thatRCS for the installation/plant, eg staffcompetence and permit to work may be themost critical or vulnerable RCS on InstallationA, whereas inspection and maintenance maybe the most important RCS at Installation B,etc. These higher weighted RCS could then beused as ‘index’ indicators for the whole site

x 1 x 1 x 3 x 1 x 1 x 2

Installation/plant/facility A

Installation/plant/facility ASite 1

Installation/plant/facility BSite 1

Installation/plant/facility ASite 2

Installation/plant/facility BSite 2

Installation/plant orfacility levelindicators

A site level indicator could be red ifany of the subsidiary installationlevel indicators were ‘red’.Alternatively, the result could bebiased towards the ‘index’indicators chosen for eachinstallation or plant

Site levelindicators

Organisationlevelindicators

Site indicators should reflect themajor hazard scenarios relevant toeach site and show the condition ofthe RCS in place at the site toprevent the major accident hazards

Using a traffic light system ofproducing the information fromindicators the organisational levelindicator would be ‘red’ if any ofthe subsidiary sites had a ‘red’ onthe same element

Site 1 Site 2

Figure 4 AhierarchicalProcessSafetyPerformanceManagementSystemforamulti-siteorganisation



Dual assurance

41 Figure5illustratesthemethodusedtoestablishfirstlyalaggingindicatorandthenleadingindicatorsforeachimportantriskcontrolsystem.Thestronglinkbetweenleadingandlaggingindicatorsactingintandemprovidesdualassurancethattheriskinquestionisbeingeffectivelymanaged.

Figure 5 Settingindicators-anoverview



Step 2.2: Identify the scope of the measurement system

Identify the scope based on:

n the main process safety risks and key risk control systems;

n areas where greater assurance on business risk is needed.

2.2.1: Identify hazard scenarios – what can go wrong?42 Itisimportanttosetleadingandlaggingindicatorsfortheimportantriskcontrolsystemsinplacetocontrolormitigateagainstmajorhazards–seeFigures1and2.Thesewilldifferdependinguponwhereintheorganisationitisdecidedtosettheindicators.

Figure 6 Identifywhatcangowrong

43 ForCOMAH3top-tierinstallations,theriskcontrolsystemswillhavebeenfullydescribedinthesafetyreport.AtCOMAHlower-tierinstallationsandothersites,identifytheprocesssafetyrisksbyfirstidentifyingarangeofhazardscenariosassociatedwiththebusinessoractivitybeingconsidered,eghowmajoraccidentsandincidentscanoccurfromactivitiessuchasstorage,useandtransferofhazardoussubstances.Askwhatcangowrongwithineachmainareaofyourbusiness.

44 Describingthemainincidentscenarioshelpsyoufocusonthemostimportantactivitiesandcontrolsagainstwhichindicatorsshouldbeset.Thescenariosformausefulcross-checklateroninStep4,whenthecriticalelementsofriskcontrolsystemstobemonitoredaredetermined.

2.2.2: Identify the immediate causes of hazard scenarios45 Tohelpdecidewhatcangowrongandhow,itisusefultoconsidertheimmediatecauseofanincident.Thisistheprimaryfailuremechanismthatgivesrisetoanincidentandcanusuallybecategorisedbyconditionsorfactorsthatchallengetheintegrityofplantorequipment.Forinstance,apipelineorbulktankfailurecouldbedueto:

n wear;n corrosion;n damage;n over/underpressurisation;orn fireorexplosion.

46 Lookalsoatareaswherethereareknownproblemsorconcernsabouttheadequacyofriskcontrolsystems.Thiscouldbebasedonpastincident/near-missdataorinformationfromauditsandinspections.Itisbeneficialtoincludeworkforcerepresentativesinthisprocess,asitwilladdressissuesofmostconcerntothem.

47 Anassessmentofallthesefactorsshouldhelpestablishthescopeoftheprocessmeasurementsystemandensureyoufocusoncriticalissues.



Step 3: Identify the risk control systems and decide on the outcomes

n List the important risk control systems.

n Describe the outcome for each risk control system.

n Set a lagging indicator to show whether the outcome is achieved.

If you don’t clearly identify the ‘desired safety outcome’ in terms of ‘success’, it will be impossible to identify indicators that show the desired outcome is being achieved.

Step 3.1: What risk control systems are in place?

48 Foreachscenarioidentifytheriskcontrolsystemsinplacetopreventormitigatetheconsequencesoftheseevents.Theremaybeseveralinterrelatedoroverlappingriskcontrolsystemsaimedatpreventionormitigation.ItmaybehelpfultodrawupariskcontrolsystemmatrixasillustratedinPart 3,Table3.

Identify the primary cause49 Todeterminewhichriskcontrolsystemsareimportanttopreventorcontrolachallengetointegrity,firstconsidertheprimarycausesofthescenariosidentifiedinStep2.2.2.Forexample,theprimarycausesofplantorequipmentwearcouldbe:

n physicalabrasion;n vibration;orn stress.

50 Aplannedplantinspectionandmaintenancesystemisakeyriskcontrolsystemexpectedtobeinplacetopreventplantfailureduetowear.

Figure 7 Considerwhatriskcontrolsystemsareinplace

planned plant inspection and maintenance RCS guards against failure due to wear

eg plant failure due to wear

plant and equipment does not fail due to wear



Step 3.2: Describe the outcome

51 Afterdecidingonthehazardscenariosandassociatedriskcontrolsystemsresponsibleforpreventingincidentsormitigatingconsequences,decide what success looks likeforeachriskcontrolsystemasitimpactsonthehazardscenario.This should be expressed as the ‘desired safety outcome’.Forexample,adesiredsafetyoutcomeforaplantinspectionandmaintenanceriskcontrolsystemcouldbe‘nofailuresorbreakdownofsafetycriticalplantorequipmentduetocomponentswearingout’.

52 Itisoftendifficulttodescribetheoutcomeofariskcontrolsystemthatmayhavebeeninplaceforalongtime.Youmayfindthefollowingquestionshelpful:

n Whydowehavethisriskcontrolsystem?n Whatdoesitdeliverintermsofsafety?n Whatwouldbetheconsequenceifwedidn’thavethissysteminplace?

Step 3.3: Setting a lagging indicator

53 Set a lagging indicator to directly show whether or not you are achieving the outcome.Iftheoutcomehasbeenclearlydescribeditshouldbepossibletojustuseoneindicator,ienumberofincidentsoflossofcontainmentofhazardousmaterial,orfailureofsafetycriticalplantwherecorrosion,wearordamagewasfoundtobeacontributoryfactor.Forexample,alaggingindicatorforaplantinspectionandmaintenanceriskcontrolsystemcouldbe‘thenumberofexpectedfailuresorbreakdownofsafetycriticalplantorequipmentduetocomponentswearingout’(seetheworkedexampleinPart 3forfurtherinformation).

Lagging indicators show whether the outcome has actually been achieved.

Figure 8 Describethedesiredsafetyoutcome



Figure 9 Setalaggingindicatortoshowwhetherornottheoutcomeisachieved



Step 3.4: Follow up deviations from the outcome

54 Settingindicatorswillnotleadtoimprovedperformanceunlesseverydeviationfromtheintendedoutcomeorfailureofacriticalpartofariskcontrolsystemisfollowedup.Forlaggingindicators,everytimetheoutcomeisnotachievedthereshouldbeaninvestigationtoseewhythesystemfailed.Eachoccasionprovidesanopportunitytoconsiderwhetherimprovementsshouldbemade.Lessonsfromtheseenquiriesshouldbeappliedacrossthewholeorganisation.

Figure 10 Followupadversefindings



Step 4: Identify critical elements of each risk control system

n Identify elements of each risk control system that are vital to deliver the outcome.

n Set leading indicators to monitor effectiveness of those elements of the risk control system.

n Set the range of tolerance for each indicator.

Step 4.1: What are the most important parts of the risk control system?

55 Itisnotnecessarytomonitoreverypartofariskcontrolsystem.Considerthefollowingfactorswhendeterminingtheaspectstocover:

n Whichactivitiesoroperationsmustbeundertakencorrectlyoneachandeveryoccasion?

n Whichaspectsofthesystemareliabletodeteriorationovertime?n Whichactivitiesareundertakenmostfrequently?

56 Fromthis,identifytheelementsofeachriskcontrolsystemthatarecriticalindeliveringtheoutcome.TheworkedexampleinPart 3illustrateshowthisprocessisapplied.

Step 4.2: Set leading indicators

57 Oncethecriticalcontrolstobemonitoredaredetermined,set a leading indicator against each one to show that system is operating as intended,forexamplethepercentageofsafetycriticalplantinspectedtoschedule.

Leading indicators highlight whether the risk control systems in place to deliver the outcome are operating as designed.

Figure 11 Identifythemostimportantpartsoftheriskcontrolsystem



Step 4.3: Setting tolerances

58 A tolerance should be set for each leading indicator.Thisrepresentsthepointatwhichdeviationinperformanceshouldbeflaggedupforattentionofseniormanagement.Forexample,foraleadingindicator,‘percentageofoverduesafetycriticalmaintenanceactions’.

Figure 13 Settingtolerances

59 Thetolerancemaybesetatzero,whichmeansthat100%ofactionsmustbecompletedonschedule.Alternatively,thecompanymayacceptadegreeofslippagebeforeitishighlightedtothemanagementteam,inwhichcasethetoleranceshouldbesetbelow100%.

60 The management team should set the tolerance, not the person responsible for the activity.Thisenablesmanagementtodecideatwhatpointtheywishtointervenebecauseperformancehasdeviatedbeyondanacceptablelevel.

Figure 12 Setleadingindicators



Step 4.4: Follow up deviations from tolerances

61 Deviationsfromtolerancesmustbefollowedup,otherwisethereislittlepointincollectingtheinformation.Themainaimofaperformanceinformationsystemistoindicatewhereprocesscontrolmanagementsystemshavedeterioratedorarenotdeliveringtheintendedoutcome.

Figure 14 Followupdeviationsfromtolerances



Step 5: Establish data collection and reporting system

n Ensure information/unit of measurement for the indicator is available or can be established.

n Decide on presentation format.

Collection

62 Oncetheindicatorshavebeenselectedandthetolerancesset,itisimportanttoensurethattherelevantinformationisreadilyavailablewithintheorganisation.Experiencehasshownthattheinformationanddatarequiredtosupportasuiteofprocesssafetyindicatorsisusuallyalreadyavailableandcollectedforotherpurposes,egforqualitycontrolorbusinessefficiency.However,itisvitalthedataiscollatedtoformacompletesetofinformationonprocesssafetyrisks.

63 Ideally,itisbesttoco-ordinatetheperformancedatathroughonepersonwhowillberesponsibleforcollectingalltheinformation,compilingreportsforthemanagementteamandraisingthealarmifthereareanydeviationsfromsettolerances.

Presentation

64 Keepthepresentationofperformancedataassimpleaspossible–summarisedinasinglesheet.Itisimportanttoclearlyshowanydeviationsfromsettolerancesortargetsandimportanttrends.Graphs,chartsor‘dashboards’areprobablythebestwaytoshowthis.Alternatively,varioussystemssuchastrafficlights(green–ok,yellow–slightdeviation,red–largedeviation)or‘smiley/sadfaces’(seeTable2)canbeusedtohighlightwhereyouaredoingwell/badly.

65 Theseniormanagementteamshouldregularlyreceivekeyperformanceinformation.Theyarethemaincustomersforthisinformationandwillneedtomakedecisionsoncorrectiveaction.Theremaybeahierarchyofindicatorsinplace,eachneedingtobecollatedseparately.

66 Presentthedatatoclearlyshowthelinkbetweenthelaggingindicator(includingdegreeofsuccessagainstoutcome)andtheleadingindicator(s)relatingtothesupportingriskcontrolsystems.Thiswillclearlyhighlightthecause-and-effectlinksbetweenthem.

Although the presentation of data is important, the data collected is worthless unless it is actually used to improve health and safety.



Step 6: ReviewThe periodic review should include:

n the performance of the process safety management system;

n the scope of the indicators;

n the tolerances set.

Review performance of the process safety management system

67Performanceagainsteachriskshouldberoutinelyreviewedbyseniormanagerstoensurethatthewholeprocesssafetymanagementsystemisdeliveringtheintendedoutcomes,andtoprovideassurancethatcriticalsystemscontinuetooperateasintended.

Variation in performance between leading and lagging indicators68Ifperformanceispooragainstagroupofleadingindicatorsbuttheassociatedlaggingindicatorissatisfactory,itislikelythattheleadingindicatorsselectedaretoofarremovedfromthecriticalcontrolmeasurethatdeliversormaintainsthedesiredoutcome.Forinstance,percentageofinductiontrainingcompletedmaybemeasured,whereasmoreimportantly,trainingandcompetenceinaparticularprocessactivitymaybemorecriticaltoensuringthesafetyofthatspecificactivity.

69Ifagroupofleadingindicatorsareontargetandcloselylinkedtotheriskcontrolsystembuttheassociatedlaggingindicatorshowspoorperformance,itislikelythatriskcontrolsystemisineffectiveindeliveringthedesiredoutcome.

Table 2 Leadingandlaggingindicatorsfordifferentoutcomes

Outcome 1(seeparagraph67)

Outcome 2(seeparagraph67)

Leading indicators

Lagging indicators

Potentialreviewissue Leadingindicatortoofarremovedfromcriticalcontrol

Controlsystemineffective

Potentialcauses Measuring in the wrong place Doing the wrong thing



Review the scope

70Indicatorsshouldnotbedecideduponandthenforgottenabout.Everyfewyears,thescopeofthefullsetofindicatorsneedstobereviewedtoensureindicatorsstillreflectthemainprocessrisks.Indicatorsmayneedtobechangedbecauseof:

n introductionofnew,high-riskprocesses;n improvementprogrammes;n alterationinplantdesign;n reductionofstaff/lossofcompetenceincertainareas.

71Ifreviewsarenotcarriedout,processsafetyindicatorsmaybecomemeaninglessandtheinformationcollectedmaynotgivethenecessaryassurancetoseniormanagersthatthemajorhazardrisksareundercontrol.

Review tolerances

72TheimportanceoffollowingupdeviationsfromtoleranceswashighlightedinStep4.4.However,itcouldbethatthetolerancehasbeensetatthewrongpoint,egsettooleniently/stringently,sotheinformationordatadoesnotadequatelyreflectreality.Insuchcases,thetoleranceshouldbereviewed.

Tolerances should be reviewed – you don’t always get it right first time!

73IfyouwouldlikemoreinformationorwishtoaccessHSE’sprocesssafetyperformancewebsitepleasecontact:http://webcommunities.hse.gov.uk/inovem/inovem.ti/chemicalindustries.pspm.



Part 3: Worked exampleSteps 2, 3 and 4 of the step-by-step guide

74ThisworkedexampleshowshowSteps2-4ofthisstep-by-stepguidehavebeenappliedtodevelopasuiteofsite-levelprocesssafetyindicatorsforatop-tierCOMAHbulkchemicalstoragesite.

75RefertoSteps2,3and4inPart 1tohelpworkthroughthisexample.

Figure 15 Sitelayoutshowingthelocationofthetwobulktankstoragefacilitiesandtheadjacentdockfromwheredeliveriesbyshiparemade



76Thecompanyoperatesacontractbulkstoragebusinesshandlingliquidchemicalsatatop-tierCOMAHsitecomprisingoftwoseparatetankfarms(formerlyownedandoperatedastwobusinesses),eachcontaining80bulkliquidtanks.Mostproductsareimportedbyshipanddischargedatajettyonacanalnexttoanestuary.Shore-sideoffloadingisundertakenbycompanypersonnel.Productistransferredtositeviafixedpipelinesthatrunacrossaprivatefieldandasmallpublicroad.Bothsiteshaveroadtankerloadinggantries.

77Ship-to-shoretransferisundertakenviaarticulatedgantrieswithflexiblehoseconnectionwithscrewfittingcouplings.Roadtankerfillingisfromfixedoverheadgantrieswithsomebottomloadingusingflexiblelines.Clients’contractdriversfilltheirownvehicles.Bothsitesareinoperation24hoursaday.

78Alllinesbetweentheshoreandtheinstallationsarecleanedandpiggedregularlyandbulktanksoftenhavetobeemptiedandcleanedtoallowforachangeofproduct.

79Mosttanksaremildsteelandsitonconcretebases,withearthbundsforgroupsoftanksandsomeindividualbrickbunds.Thereison-siteproductionofnitrogenandutilitiesincludeanaturalgassupply.

80Highlyflammable,toxicandcorrosivesubstancesarestoredonsite,including:

Hexane Olefin DichloromethaneHeptane Lubeoils EthylenedibromideGasoline DERV TrichloromethaneAcetone Fueloil StyrenePyridine Methanol Causticsoda Propanol Sulphuricacid(98%)

Overview of Steps 2-4

81Themainstagesinselectingprocesssafetyindicatorsare:

n Step2.2:Identifythescope:– identifythehazardscenariosthatcanleadtoamajorincident;and– identifytheimmediatecausesofhazardscenarios.

n Step3:Identifytheriskcontrolsystemsanddescribethe‘desiredsafetyoutcome’foreach–setalaggingindicator:

Figure 16 Thesiteandactivities



– identifytheriskcontrolsystemsinplacetopreventormitigatetheeffectsoftheincidentsidentified;

– identifythe‘desiredsafetyoutcomes’ofeachriskcontrolsystem;and– setalaggingindicatorforeachriskcontrolsystem.

n Step4:Identifycriticalelementsofeachriskcontrolsystemandsetaleadingindicator:– identifythemostcriticalelementsoftheriskcontrolsystemandsetleading

indicatorsforeachelement;– setatoleranceforeachleadingindicator;and– selectthemostrelevantindicatorsforthesiteoractivitiesunderconsideration.

Step 2.2: Identify the scope

Figure 17 Identifywhatcangowrong

Step 2.2.1: Identify the hazard scenarios which can lead to a major incident82Describingthemainincidentscenarioshelpsmaintainafocusonthemostimportantactivitiesandcontrolsagainstwhichindicatorsshouldbeset.Thescenariosformausefulcross-checklateroninStep4,whenthecriticalelementsofriskcontrolsystemstobemeasuredaredetermined.

83Forthissite,themainprocesssafetyincidentscenariosare:

n Storagetanks:– lossofliquidintobunds;– lossofliquidoutsideofthebund;– fireandexplosion:– fire/explosioninatank;– fireinbund;– fireoutsidebund.

n Docklinesandproducttransfertobulkstoragetanks:– lossofliquidfromdocklines;– lossofliquidfromfixedpipelines(includingcouplings,valves,pumps,and

flanges);– fireatthedocksideandfromleaksinproducttransferpipelines.

n Roadtankerfilling:– lossofliquidfromtransferlines;– lossofliquidfromaroadtanker;– fireorexplosioninaroadtanker;– fireintankerfillingarea.

84Theseeventsmayleadto:

n atoxicgascloudortoxicplume;n amajorfireonthesite;



n amajorfireatthedockside;n amajorfireelsewhereoffsite,egnexttopipelines;orn environmentaldamage.

Step 2.2.2: Identify the immediate causes of hazard scenarios85Theimmediatecauseisthefinalfailuremechanismthatgivesrisetoalossofcontainment.Thiscanusuallybeconsideredasafactorthatchallengestheintegrityofplantorequipment.

86Hazardscenariosmaybecausedby:

n failureofflexihose,coupling,pump,valve,fixedpipeworkorbulktank,dueto:– wear;– corrosion;– damage;– over/underpressurisation;or– fireorexplosion;

n overfillingof:– bulktank;or– roadtanker;

n accidentalrelease:– valvesleftopen,connectionsnotmadecorrectly.

87Remembertoreviewareaswherethereareknownproblemsandpastincident/near-missdatatohelpidentifytheprimarycauses.Thisstepisimportantasitisaprerequisitetodecidingwhichriskcontrolsystemsareimportanttopreventorcontrolthechallengetointegrity.

Primary causes include:

Wear:n physicalabrasion;n vibration/stress.

Corrosion:n reactionofmildsteeltanksetcfromexposuretotheatmosphere;orn incorrectproducttransfer/storageorineffectivetank/pipecleaning,resultinginachemicalreactionfromanincompatibleproductinatank/pipeorreactionwithresidues.

Damage:n collision/impact,egbyvehicle,plant/equipment;n damageduringuse;n ship/tankerdriveaway(stillattached);n workactivity,suchaswelding/grinding;orn internalignitionwithintanksorexternalfireaffectingstructuralintegrityofthetank.

Over/underpressurisation:n incorrectproducttransfer/storageresultinginlock-inpressureinpipework,pipe/ventblockage;

n incorrectnitrogenblanketingoftanks;n ineffectivetankcleaningleadingtoanexothermicorendothermicreactionwhennewproductisadded.



Fireandexplosion:n failuretocontrolignitionsourcesinflammableatmospheres:

– failureofearthbonding;– failuretoensureflowrateisrestrictedtopreventstaticaccumulation;– incorrectequipmentselected;– failureofnitrogenblanketingoftanks;– ignitionfromdamagedorincorrectlyselectedhazardareaelectricalequipment;– failuretocontrolhotwork;– failuretostopproductmovementduringelectricstorms;– failureofemergencyfire-fightingprovision.

Overfilling:n incorrectproducttransferorincorrectflowrateresultingfrom:

– poorcommunication;– instrumentationfailure;– incorrectproductrouting;or– failureintankgauging.

Accidentalrelease:n leavingvalvesopen;n incorrectcoupling;orn omissionofblankingplatesetc.

Step 3.1: Identify the associated risk control systems

88DrawupariskcontrolmatrixasillustratedinTable3,tohelpdecidewhichriskcontrolsystemsarethemostimportantincontrollingthechallengestointegrityidentifiedwithintheincidentscenarios.

Figure 18 Identifywhatriskcontrolsystemsareinplace



Challenges to plant integrity

Inspection and maintenance of:

Flexihoses,couplings,pumps,valves,flanges,fixedpipes,bulktanks ✓ ✓ ✓ ✓

Instrumentation ✓ ✓

Earthbonding ✓

Tankvents ✓

Firedetectionandfightingequipment ✓

Staff competence, covering:

Selectionofcompatibletank ✓ ✓ ✓

Selectionofrouteandtankwithadequatecapacity ✓

Drivererror ✓ ✓

Correctcoupling,opening/closingvalves,startingpumpsetc ✓ ✓

Suitableskillsandexperiencetoundertakeinspectionandmaintenancetasks

✓ ✓ ✓ ✓ ✓ ✓ ✓

Emergencyarrangements ✓

Operating procedures, covering:

Selectionofcompatibletank ✓ ✓

Selectionofrouteandtankwithadequatecapacity ✓ ✓

Correctcoupling,opening/closingvalves,startingpumpsetc ✓ ✓ ✓

Tankerloading ✓

Ship-to-shorepre-andpost-transferchecks ✓ ✓ ✓

Emergencyarrangements ✓

Instrumentation and alarms ✓ ✓

Plant change

Selectionofcorrectspecificationmaterial/equipment ✓ ✓ ✓ ✓

Correctinstallation/implementationofchange ✓ ✓ ✓ ✓

Communication

Completionofpre-andpost-transferchecks ✓ ✓ ✓ ✓

Instigationofemergencyaction ✓ ✓ ✓

Permit to work

Controlofhotwork ✓

Preventionofphysicaldamage/liftingoperations ✓

Safeisolations ✓

Plant design ✓ ✓ ✓ ✓ ✓ ✓ ✓

Emergency arrangements ✓ ✓

Table 3 Riskcontrolmatrix

Ove

r/un

der

pre

ssur

isat

ion

Fir

e an

d

exp

losi

on

Wea

r

Co

rro

sio

n

Dam

age

Ove

rfill

ing

Oth

er

acci

den

tal

rele

ase



Wear89ThemainriskcontrolsystemsformanagingthemainhazardscenariosaregiveninTable4.

Collated list of risk control systems for the installation90Thefollowingisasummaryoftheriskcontrolsystemsrelevanttothecontrolandmitigationofthemostsignificantmajorhazardscenariosassociatedwiththeactivitiesonsite:

n plannedinspectionandmaintenance;n staffcompetence;n operatingprocedures;n instrumentation/alarms;n plantchange;n plantdesign;n communication;n permittowork;n earthbondingsystem;andn emergencyarrangements

Table 4 Mainriskcontrolsystems

Hazard scenario Risk control systems

Wear InspectionandmaintenanceStaffcompetencePlantmodification/change,includingtemporarymodificationsPlantdesign

Corrosion InspectionandmaintenanceStaffcompetenceOperatingproceduresCommunicationPlantchangePlantdesign

Damage Staffcompetence(includingcontractors)OperatingproceduresPermittoworkWorkplacetransportInspectionandmaintenancePlantdesign

Over/underpressurisation StaffcompetenceOperatingproceduresInstrumentationandalarmsCommunicationInspectionandmaintenance

Fireandexplosion PermittoworkPlantinspectionandmaintenance–especiallyelectricalequipmentStaffcompetenceOperatingproceduresPlantchangePlantdesignEarthbondingsystem

Overfilling StaffcompetenceOperatingproceduresInstrumentation/alarmsCommunication



Step 3: Identify the outcome and set a lagging indicator

Figure 19 Identifytheoutcomeandsetalaggingindicator

91Itisvitaltodiscussandagreethereasonwhyeachriskcontrolsystemisinplaceandwhatitachievesintermsofthescenariosidentified.Withoutthisagreement,itwillbeimpossibletomeasuresuccessindeliveringthisoutcome.

92Itisbesttophrase‘success’intermsofapositiveoutcome–supportiveofthesafetyandbusinesspriorities.Theindicatorcanthenbesetasapositiveornegativemetrictoflagupwhenthisisachievedorwhennot.Assuccessshouldbethenormaloutcome,choosinganegativemetricwillguardagainstbeingswampedbydata(reportingbyexception).

93Thefollowingquestionsmaybehelpful:

n Whydowehavethisriskcontrolsysteminplace?n Whatdoesitdeliverintermsofsafety?n Whatwouldbetheconsequenceifwedidn’thavethissysteminplace?

94Theindicatorsetshouldbedirectlylinkedtotheagreedriskcontrolsystemoutcomeandshouldbeabletomeasurethesuccess/failureatmeetingtheoutcome.

Step 4: Identify the critical elements of each risk control system and set leading indicators

95Therearetoomanyelementstoariskcontrolsystemforeachtobemeasured.Itisnotnecessarytomonitoreverypartofariskcontrolsystem.Considerthefollowingfactorswhendecidingwhichaspectstoinclude:

Hazard scenario Risk control systems

Accidentalrelease StaffcompetenceOperatingproceduresPermittoworkCommunication

Emergencyarrangements Foranyofthescenarioslistedabove,itisimportanttomitigatetheconsequencesofanincidentorlossofcontainment.Thisriskcontrolsystemisthereforeincludedintheoveralllistofsystemsinplaceatthisestablishment



n Whichactivitiesoroperationsmustbeundertakencorrectlyoneachandeveryoccasion?

n Whichaspectsofthesystemareliabletodeteriorateovertime?n Whichactivitiesareundertakenmostfrequently?

96Fromthis,thecriticalelementsofeachriskcontrolsystemimportanttodeliveringtheoutcomecanbeidentified.

Figure 20 Identifycriticalelementsandsetleadingindicators

Examples of indicators for each risk control system

97ThefollowingsectionillustrateshowSteps3and4areusedtoidentifyindicatorsforeachimportantriskcontrolsystemintheprocesssafetymanagementsysteminplaceattheinstallation.Initially,anumberofoutcomesandsubsequentcandidatelaggingandleadingindicatorsaregenerated.Thesearethenprioritisedtoselectjustonelaggingindicatorandamaximumoftwoleadingindicatorsforeachriskcontrolsystem.ThefinalselectionforalltheriskcontrolsystemsisgiveninTable3.



Risk control systemsRCS: Inspection and maintenance

n Nounexpectedlossofcontainmentduetofailureofflexihoses,couplings,pumps,valves,flanges,fixedpipes,bulktanksorinstrumentation.

n Nounexpectedlossofcontainmentduetoblockagesintankvents.n Nofiresorexplosionsduetostaticelectricignition.n Nofiresorexplosionscausedbyasourceofignitionfromfaultyordamaged

hazardousareaelectricalequipment.n Firedetectionandfire-fightingequipmentisavailableandingoodcondition.

Potential lagging indicatorsn Numberofunexpectedloss-of-containmentincidentsduetofailureof

flexihoses,couplings,pumps,valves,flanges,fixedpipes,bulktanksorinstrumentation.

n Numberofloss-of-containmentsduetoblockagesintankvents.n Numberoffiresorexplosionsthatresultfromastaticelectricignition.n Numberoffiresorexplosionscausedbyasourceofignitionfromfaultyor

damagedhazardousareaelectricalequipment.n Numberofincidentsoffire/explosionwherefiredetectionorfire-fighting

equipmentfailedtofunctionasdesigned.

Critical elementsn Thespecificationofscopeandfrequencyoftheinspectionandmaintenance

system.Thisshouldbebasedonhowsafetycriticaltheitemis,andonthedegreeofchallengepresentedtothesystemintegrity,ortocomplywiththemanufacturer’sorsupplier’sinstructions.

n Safetycriticalplantandequipment(ieflexihoses,couplings,pumpsvalves,flanges,fixedpipes,bulktanks)areinspectedforwearanddamageormalfunctionwithinthespecifiedperiod.

n Faultsarefixedwithinspecifiedtimescalesandrepairsandimprovementsmeetplantdesignstandards.

n Alogoffindingskept–enablingtrending.

Potential leading indicatorsn Percentageofsafetycriticalplant/equipmentthatperformswithinspecification

wheninspected.n Percentageofsafetycriticalplantandequipmentinspectionscompletedto

schedule.n Percentageofmaintenanceactionsidentifiedthatarecompletedtothe

specifiedtimescale.n Percentageoffaulttrendingcarriedouttoschedule.

Note:Whatconstitutesa‘safetycritical’itemshouldhavebeenidentifiedwhileconsideringmajoraccidentscenarios.

Desired safety outcomes



Final selection of indicatorsItisoftendifficulttochooseonlyalimitednumberofindicatorsfromtherangeofpotentialcandidatesgeneratedwithinSteps3.3(laggingindicators)andSteps4.2(leadingindicators).Toprioritise,consider:

n Istheoutcomemeasurable,iecanasuccessfuloradverseoutcomeeasilybedetected?Ask‘wouldyouknowwhenthishadhappened?’

n Isacriticalcontroloractivitymeasurable,iecanthecorrectoperationofacriticalcontroleasilybedetected?

n Howoftencaneachbemeasured?n Forlaggingindicators:howmuchinformationisitlikelytogenerate?Aimfor

reportingbyexception.n Forleadingindicators:howsusceptiblearecriticalelementsofthesystemto

rapiddeterioration?n Willtheindicatorhighlightabnormalconditionsbeforeaseriouseventoccurs?n Recheckthattheindicators:

– supporttheoutcomesset;and– thatleadingindicatorslinktothelaggingindicator.

n Whatistheoverallimportance,intermsofsafetyandbusinesspriorities,oftheinformationprovidedbytheindicator?

n Cantheinformationbereadilycollected,ieisitalreadyrecordedsomewhereintheorganisation,egnotedinqualitylogs/recordsorprocesscontrolrecords?




Nounexpectedlossofcontainmentduetofailureofflexihoses,

couplings,pumps,valves,flanges,fixedpipes,bulktanksor

instrumentation

LAGGING INDICATOR

Numberofunexpectedlossofcontainmentincidentsduetofailureofflexihoses,couplings,pumps,valves,flanges,

fixedpipes,bulktanksorinstrumentation

LEADING INDICATORS

Percentageofsafetycriticalplant/equipmentthatperformstospecificationwheninspectedortested

Percentageofmaintenanceactionsidentifiedwhicharecompletedtospecifictimescale

Justification

Thisindicatorcoversthewidestrangeofequipmentwheremostproblemsarelikelytooccur.Thisindicatorcouldbenarroweddownfurthertofocusonspecificitemsofplantconsideredtopresentthehighestrisk,egflexiblehoses

Justification

Performance of safety critical equipmentThisindicatorshowsthereliabilityofplantandequipmentbutalsoprovidesthemeanstoexplorewhyequipment

maynothaveperformedasintended,Also,toarriveatthisinformation,thescheduledinspectionactionswillneedto

havebeencompleted

Completion of maintenance actionsItisimportanttogetacompletepictureofanybacklogoffaultsassociatedwithsafetycriticalplant.Again,theinspectionandmaintenanceschedulewillhavetohave

beenundertakentoobtainthisinformation

Process controls

Inspectionandmaintenancesystems

RISK

Plantorequipmentinunsafecondition

OUTPUTS INPUTS

Lagging indicators discounted n Tankventblockages:theseeventscanbe

capturedintheindicatorcoveringthefailureofbulktanks.

n Staticignition:itcanbedifficulttobecertainwhetherafire/explosionoccurredasaresultofastaticelectricignition.Sucheventsshouldbequiterareandiftheydooccurtheycanbepickedupaspartofincidentinvestigation.

n Numberoffiresorexplosionscausedbyasourceofignitionfromfaultyordamagedhazardousareaelectricalequipment:theseshouldbeveryrareeventsandsooflittlebenefitduetothelowfrequency.

n Firedetectionandfire-fightingequipment:sucheventsarelikelytoberare.Identificationoffailingsindetectionandfire-fightingequipmentisbettercoveredunderRCS:Emergencyarrangements.

Leading indicators discounted n Progresswithinspectionschedule:thisisa

frequentlyusedindicator.However,theindicatoronperformanceofsafetycriticalequipmentismuchclosertothedesiredoutcome.

n Faulttrending:althoughfaulttrendingisimportant,measuringthepercentageofthetrendingactionscompletedmaynotprovidegoodassurancethatproblemswithreliabilityarebeingrectified.

Figure 21 Inspectionandmaintenanceindicators



RCS: Staff competence

n Operatorsandcontractorshavetherequiredknowledgeandskillstoenableeffectiveproducttransferfromship,tobulktank,toroadtanker.

n Operatorsandcontractorshavetherequiredknowledgeandskillstoadequatelycleanbulktanks/pipelinesbefore/afteraproducttransfer.

n Operatorsandcontractorshavetherequiredknowledgeandskillstotakeemergencyactionfollowingaproducttransferthatresultsinafire/explosion.

Potential lagging indicatorsn Numberoftimesproducttransferdoesnotproceedasplannedduetoerrors

madebystaffwithoutthenecessaryunderstanding,knowledgeorexperiencetotakecorrectactions.

n Numberoftimesabulktankisover/underpressurisedduetoinadequatecleaningbystaffwithoutthenecessaryunderstanding,knowledgeorexperience.

n Numberoftimesineffectiveactionistakenfollowingaproducttransferresultinginfire/explosion,duetolackofunderstanding,knowledgeorexperiencetotakecorrectemergencyaction.

Critical elementsInformationandtrainingcovering:

n hazardouspropertiesofproducts;n ship-to-shorecommunicationsystems;n pre-transferchecks;n producttransfercontrolsandmonitoring;n post-transferchecks;n emergencyactions.

Job-specificknowledgeandrelevantexperienceof:

n substances;n workprocesses;n hazards;andn emergencyactions.

Potential leading indicatorsn Percentageofstaffinvolvedinproducttransferswhohavetherequiredlevelof

competencenecessaryforthesuccessfultransferandstorageofproducts.

Note:Thecompanywilldeterminethetypeoftrainingandexperiencenecessarytoachievecompetence.

Outcomes



LAGGING INDICATOR

Numberoftimesproducttransferdoesnotproceedasplannedduetoerrorsmadebystaffwithoutthe

necessaryunderstanding,knowledgeorexperiencetotakethecorrectactions

LEADING INDICATOR

Percentageofstaffinvolvedinproducttransferwhohavetherequiredlevelofcompetencenecessaryforthe

successfultransferandstorageofproducts

Justification

Thisindicatorchosenlinkscloselytotheoutcomeandcapturesthemostcommonandimportantaspectofwhy

thecontrolsystemisinplace

Justification

Thiswastheonlypotentialleadingindicatorchosen

RISK

Criticaltasksundertakendangerously

OUTPUTS INPUTS

Lagging indicators discountedn Tankover/underpressurisation:ensuring

competencefortankcleaningisunlikelytobeacomplexordemandingissuethatmayfrequentlygiverisetoincidentscausedbylackofcompetence.Itisthereforemoreappropriatetomeasureotheraspectsofcompetence.

n Emergencyaction:thisisbettercoveredunderRCS:EmergencyArrangements.

Figure 22 Staffcompetenceindicators

Process controls

Staffcompetencesystems:selection,information,trainingandassessment


Operatorsandcontractorshavetherequiredknowledgeandskillsto

enableeffectiveproducttransferfromship,tobulktanker,toroadtransfer



RCS: Operating procedures

n Correcttankselectionandoperationofequipmentduringproducttransferfromship,tobulktank,toroadtanker.

n Correctcleaning,isolationandequipmentshutdownafterproducttransfer.

Potential lagging indicatorsn Numberoftimesproducttransferdoesnotoccurasplannedduetoincorrect/

unclearoperationalprocedures.n Numberoftimesabulktankisover/underpressurisedduetoinadequate

cleaningbystaffworkingwithunclear/incorrectoperationalprocedures.n Numberoftimesineffectiveactionistakenfollowingaproducttransferresulting

infire/explosionduetoincorrect/unclearoperationalprocedures.

Critical elementsn Procedurescontaincorrectscope(keyactionsandtasksincludingemergency

action)and/orsufficientdetail.n Proceduresareclearlywritten/easilyunderstood.n Proceduresarekeptuptodate.

Potential leading indicatorsn Percentageofsafetycriticaltasksforwhichawrittenoperationalprocedure

coversthecorrectscope(keyactionsandtasksincludingemergencyaction)and/orsufficientdetail.

n Percentageofproceduresthatareclearlywrittenandeasytounderstand.n Percentageofproceduresthatarereviewedandrevisedwithinthedesignated

period.




LAGGING INDICATOR

Numberoftimesproducttransferdoesnotoccurasplannedduetoincorrect/unclearoperationalprocedures

LEADING INDICATORS

Percentageofprocedureswhicharereviewedandrevisedwithinthedesignatedperiod

Justification

Thisindicatorwilldetecthumanerrorlinkedtothequalityofoperationalproceduresforawiderangeofactivities

associatedwiththeoutcome

Justification

Thisistheonlyindicatorthatmeasuresthequalityofaprocedureonceithasbeenagreedandimplemented

RISK

Criticaltasksundertakendangerously

OUTPUTS INPUTS

Lagging indicators discountedn Tankover/underpressurisation:itisbetterto

focusonawidersetofactivitiesreliantongoodoperatingproceduresascoveredbytheindicatorchosen,becausethiswillprovideamorecomprehensivepictureofthesuitabilityofwrittenprocedures.

n Emergencyaction:thisisbettercoveredunderRCS:EmergencyArrangements.

Leading indicators discountedn Scopeandclarityofprocedures:thisshouldbe

ensuredbyaone-offcheckcarriedoutbeforetheprocedureisfirstintroducedandcannotbeusefullymonitoredonanongoingbasis.

Figure 23 Operatingprocedureindicators

Process controls

Operationalprocedures:writteninstructions,workpractices

Correcttankselectionandoperationofequipmentduringproducttransfer

fromship,tobulktank,toroadtransfer



RCS: Instrumentation and alarms

n Safetycriticalinstrumentationandalarmscorrectlyindicatewhenprocessconditionsexceedsafeoperatinglimits.

Potential lagging indicatorsn Numberofsafetycriticalinstruments/alarmsthatfailtooperateasdesigned,

eitherinuseorduringtesting.n Numberoftimesabulktankoraroadtankerisoverfilledduetofailureinthe

levelindicatororalarms.n Numberoftimesabulktankoraroadtankerisover/underpressuriseddueto

failureinalevelindicatororalarms.n Numberoftimesproductistransferredatthewrongflowrateorpressuredue

tofailureinaflowmeter/pressuregaugeoralarms.

Critical elementsn Instrumentscorrectlyindicateprocessconditions.n Alarmsactivateatdesiredsetpoints.n Instrumentsandalarmsaretestedandcalibratedtodesignstandard.n Repairstofaultyinstrumentsandalarmsarecarriedoutwithinspecifiedtime

period.

Potential leading indicatorsn Percentageofsafetycriticalinstrumentsandalarmsthatcorrectlyindicatethe

processconditions.n Percentageofsafetycriticalinstrumentsandalarmsthatactivateatthedesired

setpoint.n Percentageoffunctionaltestsofsafetycriticalinstrumentsandalarms

completedtoschedule.n Percentageofmaintenanceactionstorectifyfaultstosafetycriticalinstruments

andalarmscompletedtoschedule.




LAGGING INDICATOR

Numberofsafetycriticalinstruments/alarmsthatfailtooperateasdesigned,eitherinuseorduringtesting

LEADING INDICATORS

Percentageoffunctionaltestsofsafetycriticalinstrumentsandalarmscompletedtoschedule

Percentageofmaintenanceactionstorectifyfaultstosafetycriticalinstrumentsandalarmscompletedto

scheduleJustification

Thisindicatorwilldetectallfailuresintheinstrumentsandalarmsystems,regardlessofwhetherthisleadstoaloss

ofcontainment

Justification

Thesearethemaininputstoensurethatinstrumentsandalarmscontinuetofunctionasdesigned

RISK

Plantorprocessoutsidesafeoperatingconditions

OUTPUTS INPUTS

Lagging indicators discountedn Numberoftimesabulktankoraroadtankeris

overfilledduetofailureinalevelindicatororalarm.n Numberoftimesabulktankoraroadtankeris

over/underpressurisedduetofailureinalevelindicatororalarm.

n Numberoftimesproductistransferredatthewrongflowrateorpressureduetofailureinaflowmeter,pressuregaugeoralarm.

Alloftheseindicatorsareasubsetofthepreferredindicatorselected.

Leading indicators discountedn Percentageofsafetycriticalinstrumentsand

alarmsthatcorrectlyindicatetheprocessconditions.

n Percentageofsafetycriticalinstrumentsandalarmsthatactivateatthedesiredsetpoint.

Thesetwoindicatorswillbecoveredwithinthefunctionaltestingandmaintenancesystem.

Note:Instrumentationandalarmsystemfunctioningcanbeconsideredasanimportantpartofawiderinspectionandmaintenancesystemandtheindicatorssetinthissectioncouldbereadilyincorporatedintothebroaderinspection/maintenanceschemeandmeasuredaspartofthatsystem.

Figure 24 Instrumentationandalarmindicators

Process controls

Operationalprocedures:instrumentalandalarmsystems


Safetycriticalinstrumentationandalarmscorrectlyindicatewhenprocessconditionsexceedsafe

operatinglimits



RCS: Plant change

n Followingachangeofspecificationofflexihoses,couplings,pumps,fixedpipes,bulktanks,theycontinuetooperateinanoptimisedstate.

Potential lagging indicatorsn Numberofincidentsinvolvinglossofcontainmentofhazardousmaterialorfire/

explosionduetofailureofflexihoses,couplings,valves,pumps,fixedpipes,bulktanks,whereplantchangewasfoundtobeacontributoryfactor.

n Numberoftimesequipmentorplantisbelowthedesiredstandardduetodeficienciesinplantchange.

Critical elementsn Scopeanddefinitionareproperlysetout(temporary/permanentchanges).n Riskassessmentsareundertakenbeforeplantchange.n Changes/outcomesaredocumented.n Changesareauthorisedbeforebeingimplemented.n Post-changechecksarecarriedout(plantfoundtobeperformingasdesigned).

Potential leading indicatorsn Thescopeanddefinitionoftheplantchangesystemisproperlyspecified.n Percentageofplantchangeactionsundertakenwhereanadequaterisk

assessmentwascarriedoutbeforechange.n Percentageofplantchangeactionsundertakenwherechanges/outcomeswere

documented.n Percentageofplantchangeactionsundertakenwhereauthorisationwasgiven

beforeimplementation.n Percentageofplantchangeactionsundertakenwherepost-changechecks

werecarriedout.




LAGGING INDICATOR

Numberoftimesequipmentorplantisbelowthedesiredstandardduetodeficienciesinplantchange

LEADING INDICATORS

Percentageofhazardandoperability(HAZOP)actionsassociatedwithplantchangecompleted

Percentageofplantchangeactionsundertakenwhereauthorisationwasgivenbeforeimplementation

Justification

Thisindicatorwillalsoincludelossofcontainmentincidentswheretheseareduetodeficientplantor

equipmentfollowingaplantchange

RISK

OUTPUTS INPUTS

Lagging indicators discountedn Numberofincidentsinvolvinglossofcontainment

ofhazardousmaterialorfire/explosionduetofailureofflexihoses,couplings,valves,pumps,fixedpipes,bulktankswheredeficiencyinplantchangewasfoundtobeacontributoryfactor.

Thefirstindicatorwillcapturethesesortsofeventsautomaticallyifthecauseisattributedtoafaultfollowingaplantchange.

Leading indicators discountedn Documentationofchanges.n Post-changechecks.

Bothoftheseindicatorsareimportantanditisrelativelyeasytocollectinformationagainstthem.However,theywerenotselectedsimplytokeeptheoverallnumberofindicatorstoareasonablelevel.

Figure 25 Plantchangeindicators

Process controls

Plantchangesystem


Justification

Completion of risk assessmentsThisisacriticalaspectofplantchangeuponwhichtheoutcomeisdependent.Itislikelytobeeasytomeasure

andcapturetherelevantinformation

Retrospective authorisationsThisindicatorwillshowwherepotentiallydangerouscircumstancesmaybecreatedduetoaneedto

implementchangesquickly



RCS:Communication

RCS: Plant design

n Plantoperationoptimisedwithequipmentrunningefficientlyandreliablywithnounexpectedbreakdownduetodeficienciesintheplantdesignandspecification.

Potential lagging indicatorn Numberofplantbreakdownsorincidentsinvolvinglossofcontainmentof

hazardousmaterialorfailureofsafetycriticalplant/equipmentwheredeficiencyinplantdesignwasfoundtobeacontributoryfactor.

Critical elementsWhenselectingsuitableequipment,consider:

n standardsandcodes;n compatibilityofmaterialswithproducts;n anticipateddutyanddegradationmethods;n pressuresystems;n lifeexpectancy;n electricalintegrityandequipmentbonding;andn easeofinspectionandmaintenance.

Potential leading indicatorsn Percentageofequipmentandplantassociatedwithproducttransferthatmeets

currentstandardsandcodes.n Oncommissioning:percentageofsafetycriticalitemsofplantorequipment

whichcomplywithspecifieddesignstandards.n Onaperiodicbasis:percentageofsafetycriticalitemsofplantorequipment

whichcomplywithcurrentdesignstandardsorcodes.

Desired safety outcome



LAGGING INDICATOR

Numberofincidentsinvolvingplantbreakdown,lossofcontainmentofhazardousmaterialorfailureofsafety

criticalplant/equipmentwheredeficiencyinplantdesignwasfoundtobeacontributoryfactor

LEADING INDICATOR

Percentageofsafetycriticalitemsofplantorequipmentwhichcomplywithcurrentdesignstandardsorcodes

Note:Thisshouldbedoneonasampleorperiodicbasis

Justification

Thiswillfocusonthesatisfactoryoperationofplantorequipment

RISK

Plantinunsafecondition

OUTPUTS INPUTS

Leading indicators discountedn Oncommissioning:thepercentageofsafetycritical

itemsofplantorequipmentwhichcomplywithspecifieddesignstandards.

n Onaperiodicbasis:percentageofcriticalitemsofplantorequipmentwhichcomplywithcurrentdesignstandardsorcodes.

Theseareone-offchecksthatdonotbenefitfrombeingmeasuredthroughouttheyear.

Figure 26 Plantdesignindicators

Process controls

Plantdesignsystem


Plantoperationoptimisedwithequipmentrunningefficientlyand

reliablywithnounexpectedbreakdownduetodeficienciesinthe

plantdesignandspecification

Justification

TheplantchangeRCSshouldensureitemsofplantreplacedstillcomplywithcurrentdesignstandards.However,thisindicatorwillpickupitemsofplant

equipmentthatnolongercomplywithcurrentdesignstandards/codesbecauseoftheirage,orrecentchanges

instandards/codes



RCS: Communication

n Effectivemanagementofproducttransfer*andstorageandeffectivewarningofproblemsintimetotakeremedialaction.

n Effectiveremedialactionistakenintheeventofoverfill,fire/explosionoraccidentalrelease.

* Product transfer includes all aspects and actions associated with the successful transfer of hazardous material from ship to shore into bulk storage or between bulk tanks and the filling or discharge of road tankers.

Potential lagging indicatorsn Numberoftimesproducttransferdoesnotproceedasplanneddueto

breakdownincommunicationsystems.Thisoutcomecouldbesubdividedintotwofurtherindicators,ie:– numberoftimesoverfillingoccursduetoabreakdownincommunication

systems;– numberoftimesaccidentalreleasesoccurduetobreakdownin

communicationsystems.n Percentageofmitigatingsystemswhichfailedtooperatefollowinganoverfill,

fire/explosionoraccidentalreleaseduetofailuretoadequatelycommunicateinformationrelatingtotheemergency.

Critical elementsCriticalcommunicationsundertaken:

n Confirmationofpre-transferchecks–type,properties,quantityofmaterialtobetransferred.

n Confirmationofrouteintegrity,connectionsmade,valvesopen.n Authorisationtostarttransfer.n Confirmationofstart/rateoftransfer.n Confirmationofcontainmentintegritycheckscarriedoutduringtransfers.n Post-transfer–confirmationofpumpsstopped,valvesclosed.

Potential leading indicatorsn Percentageofproducttransferswhereconfirmationofthecompletionofpre-

transfercheckswasadequatelycommunicated.n Percentageofproducttransferswhereconfirmationofrouteintegrity,

connectionsmade,valvesopenetcwasadequatelycommunicated.n Percentageofproducttransferswhereauthorisationtostarttransferwas

successfullycompletedbeforetransfercommenced.n Percentageofproducttransferswhereconfirmationofstartandrateoftransfer

weresuccessfullycompletedbeforetransfercommenced.n Percentageofproducttransferswhereconfirmationofstartandrateoftransfer

weresuccessfullycompletedbeforetransfercommenced.n Percentageofcontainmentintegritycheckscarriedoutduringtransfers.n Percentageofpost-transferchecksundertakentoconfirmthatpumpshave

stoppedandvalvesareisolatedorclosed.




LAGGING INDICATOR

Numberoftimesproducttransferdoesnotproceedasplannedduetoabreakdownincommunicationsystems

LEADING INDICATORS

Percentageofproducttransferswhereauthorisationtostarttransferwassuccessfullycompletedbeforethe

transfercommenced

Percentageofpost-transferchecksundertakentoconfirmthatpumpsstopped,valvesareisolatedorclosed

Justification

Themoregenericindicatorhasbeenchosen,asoverfillingoranaccidentalreleasecouldnotbeconsideredas‘aplanned,successfulproducttransfer’.Therefore,both

theseeventswouldbecapturedwithinthefirstindicator.Alsothisbroadercategoryofferstheopportunityto

captureawiderseriesofevents,someofwhichmaynothavebeenfullyconsideredwhenformulatingtheindicators

RISK

Activitiesnotproperlyco-ordinated

OUTPUTS INPUTS

Leading indicators discountedn Percentageofproducttransferswhere

confirmationofcompletionofpre-transfercheckswasadequatelycommunicated.

n Percentageofproducttransferswhereconfirmationofrouteintegrity,connectionsmade,valvesopenetcwasadequatelycommunicated.

n Percentageofproducttransferswhereconfirmationofstartandrateoftransferweresuccessfullycompletedbeforeproducttransfercommenced.

n Percentageofproducttransferswheretheconfirmationofstartandrateoftransferweresuccessfullycompletedbeforeproducttransfercommenced.

Again,ensurethatthefinalauthorisationisissuedautomaticallyandincludesthecheckslistedabove.Figure 27 Communicationindicators

Process controlsDesired safety outcomes

Effectivemanagementofproducttransferandstorageandeffectivewarningofproblemsintimetotake

remedialaction

Justification

Thisfirstindicatorautomaticallycapturesalltheotherchecksthatshouldbecompletedbeforeauthorisationisissued.Thesecondensuresthattheplantissecuredina

safeconditionaftertheactivity

Lagging indicators discountedn Failureofmitigation:incidentswiththistypeof

causearelikelytobeveryrare.ThisisbettercoveredunderRCS:Emergencyarrangements.



RCS: Permit to work

n High-riskmaintenanceactivitiesareundertakeninawaythatwillnotcausedamage/injury.

Potential lagging indicatorn Numberofincidentswhereplant/equipmentcouldbedamagedduetofailure

tocontrolhigh-riskmaintenanceactivity.

Critical elementsn Scopeofactivitiescoveredbythepermit-to-worksystemisclearlyidentified.n Permitsspecifythehazards,risksandcontrolmeasures,includingisolations.n Permitsareonlyissuedfollowingsuitableauthorisationprocedures.n Permit/taskistimelimited.n Workisconductedasperpermitconditions,includingdemonstrationof

satisfactorycompletionofwork.

Potential leading indicatorsn Thescopeanddefinitionofthepermit-to-worksystemhasbeenproperly

specified.n Percentageofpermitstoworkissuedwherethehazards,risksandcontrol

measureswereadequatelyspecified.n Percentageofpermitsissuedwherethetimeperiodforcompletingthetaskis

specified.n Percentageofworkconductedinaccordancewithpermitconditionsand

wherecompletionofworkhasbeendemonstrated.




LAGGING INDICATOR

Numberofincidentswheretheplant/equipmentcouldbedamagedduetofailuretocontrolhigh-riskmaintenance

activity

Justification

Focusingonplantdamageratherthanpersonalinjurymaintainsafocusonprocesssafetyissues

RISK

Maintenanceworkundertakenunsafely

OUTPUTS INPUTS

Leading indicators discountedn Thescopeanddefinitionofthepermit-to-work

systemhasbeenproperlyspecified:thisisaone-offactivityandunlikelytodeteriorateovertime.

n Timeperiodspecified:althoughthisisimportant,itnotconsideredascriticalasauthorisationbeforeworkstarts.

Figure 28 Permit-to-workindicators

Process controls

Permit-to-worksystem


High-riskmaintenanceactivitiesareundertakeninawaythatwillnot

causedamage/injury

Justification

Settingoutthehazardsandcontrolsisakeypartofapermitandaprerequisiteforsafeworking.Themain

purposeforapermitistosetoutasafemethodofworkinadvance(ifthereisone).

Knowingthatworkisconductedinaccordancewiththepermitconditionsisthereforethemostimportantaspect

LEADING INDICATORS

Percentageofpermitstoworkissuedwherethehazards,risksandcontrolmeasureswereadequatelyspecified

Percentageofworkconductedinaccordancewithpermitconditions

Note:Thesearelikelytobemeasuredonasamplebasis



RCS: Emergency arrangements

n Theimpactofamajorincidentduringproducttransferorstorageisminimisedasfaraspossible.

Potential lagging indicatorn Numberofelementsoftheemergencyprocedurethatfailtofunctiontothe

designedperformancestandard.

System critical elementsn Emergencyplancoversallrelevantoperations.n Testingofemergencyplan.n Raisingalarm.n Shutdown/isolationprocedures.n Firefighting–startingfirepumps.n Communicationwithship/installationcontrolrooms,andimmediatesite

neighbours.n Evacuation–ship/dock/site.n Communicationwiththedockoperatingcompany.n Communicationwithemergencyservices.

Potential leading indicatorsn Percentageofshutdown/isolationsystemsthatfunctionedtothedesired

performancestandardwhentested.n Percentageoftimesthefire-fightingpumpsstartedautomaticallyand

pressurisedthefiremainwhenthealarmwastested.n Percentageofstaff/contractorswhotakethecorrectactionintheeventofan

emergency.n Percentageofstaff/contractorstrainedinemergencyarrangements.n Percentageofemergencyexercisescompletedtoschedule.




LAGGING INDICATOR

Numberofelementsoftheemergencyprocedurethatfailtofunctiontothedesignedperformancestandard

Justification

Majorincidentsareveryrareonanyparticularsite.Itisdifficulttomeasurewhethertheadverseoutcomesofan

incidentareworsethanexpected

RISK

Damageandinjuriesintheeventofamajoraccidentaregreaterthan

reasonablyexpected

OUTPUTS INPUTS

Leading indicators discountedn Percentageoftimesthefire-fightingpumpsstarted

automaticallyandpressurisedthefiremainwhenthealarmwastested:thisisafairlynarrowsetofcircumstanceswhichwouldalreadybecapturedbythefirstindicator.

n Percentageofstaff/contractorstrainedinemergencyarrangements:thisindicatordoesn’tprovideinformationonthefunctionofthesystemandsoisfurtherawayfromtheoutcome.

n Percentageofemergencyexercisescompletedtoschedule:thisindicatordoesn’tprovideinformationonthefunctionofthesystemandsoisfurtherawayfromtheoutcome.

Figure 29 Emergencyarrangementindicators

Process controls

Emergencyarrangements


Theimpactofamajorincidentduringproducttransferorstorageisminimisedasfaraspossible

Justification

Bothoftheseindicatorsshowtheextenttowhichelementsoftheemergencysystemsperformedas

expected

LEADING INDICATORS

Percentageofshutdown/isolationsystemswhichfunctionedtothedesiredperformancestandardwhen

tested.

Percentageofstaff/contractorswhotakethecorrectactionintheeventofanemergency



RCS: Earth bonding

n Staticelectriccharge,causedbyproductmovement/flow,isdissipatedwithoutgivingrisetoignition.

Potential lagging indicatorn Numberofincidentsinvolvingfireandexplosioncausedbystaticignition.

Critical elementsn Allimportantelementsarecorrectlybondedtogetherandconnectedtothe

earth.n Impedanceissufficientlylowtoalloweffectivedischargeofcurrent.n Continuityofearthbondingisroutinelychecked.

Potential leading indicatorsn Percentageofat-riskplantwheretheearthbondingisinplace.n Percentageofsafetycriticalplantwhereimpedanceoftheearthbonding

systemistospecification.

Indicators selectedn Noneoftheseindicatorswerechosenbecausetheintegrityofearthbonding

shouldbecheckedwithintheinspectionandmaintenancesystemsandcanbemeasuredaspartofthatwiderscheme.




Table 5 Finalsuiteofprocesssafetyperformanceindicatorsforthewholeinstallation

Control Lagging indicator Leading indicator

Inspection/maintenance

Numberofunexpectedloss-of-containmentincidentsduetofailureofflexihoses,couplings,pumps,valves,flanges,fixedpipes,bulktanksorinstrumentation.

Percentageofsafetycriticalplant/equipmentthatperformstospecificationwheninspectedortested.

Percentageofmaintenanceactionsidentifiedwhicharecompletedtospecifiedtimescale.

Staffcompetence

Numberoftimesproducttransferdoesnotproceedasplannedduetoerrorsmadebystaffwithoutthenecessaryunderstanding,knowledgeorexperiencetotakecorrectactions.

Percentageofstaffinvolvedinproducttransferwhohavetherequiredlevelofcompetencenecessaryforthesuccessfultransferandstorageofproducts.

Note:thecompanywilldeterminethetypeoftrainingandexperiencenecessarytoachievecompetence.

Operationalprocedures

Numberoftimesproducttransferdoesnotoccurasplannedduetoincorrect/unclearoperationalprocedures.

Percentageofprocedureswhicharereviewed/revisedwithinthedesignatedperiod.

Instrumentationand alarms

Numberofsafetycriticalinstrumentation/alarmsthatfailtooperateasdesignedeitherinuseorduringtesting.

Percentageoffunctionaltestsofsafetycriticalinstrumentsandalarmscompletedtoschedule.

Percentageofmaintenanceactionstorectifyfaultstosafetycriticalinstrumentsandalarmscompletedtoschedule.

Plant change Numberoftimesequipmentorplantisbelowthedesiredstandardduetodeficienciesinplantchange.

Percentageofplantchangeactionsundertakenwhereanadequateriskassessmentwascarriedoutbeforechange.

Percentageofplantchangeactionsundertakenwhereauthorisationwasgivenbeforeimplementation.

Communication Numberoftimesproducttransferdoesnotproceedasplannedduetoabreakdownincommunicationsystems.

Percentageofproducttransferswhereauthorisationtostarttransferwassuccessfullycompletedbeforethetransfercommenced.

Percentageofpost-transferchecksundertakentoconfirmthatpumpshavestopped,andvalvesareisolatedorclosed.

Permit to work Numberofincidentswhereplant/equipmentcouldbedamagedduetofailuretocontrolhigh-riskmaintenanceactivity.

Percentageofpermitstoworkissuedwherethehazards,risksandcontrolmeasureswereadequatelyspecified.

Percentageofworkconductedinaccordancewithpermitconditions.

Note:Thesearelikelytobemeasuredonasamplebasis.

Plant design Numberofincidentsinvolvingbreakdown,lossofcontainmentofhazardousmaterialorfailureofsafetycriticalplant/equipment,wheredeficiencyinplantdesignwasfoundtobeacontributoryfactor.

Percentageofsafetycriticalitemsofplantorequipmentwhichcomplywithcurrentdesignstandardsorcodes.

Note:Thisshouldbedoneonasampleorperiodicbasis.



References1 Major incident investigation report, BP Grangemouth Scotland, 29 May – 10 June 2000 COMAHCompetentAuthorityReportAugust2003www.hse.gov.uk/comah/bparrange/index.htm

2 Responsible Care. An IntroductionRC107ChemicalIndustriesAssociationLondon1999

3 Control of Major Accident Hazards Regulations 1999 SI 1999/743 The Stationery Office 1999 ISBN 0 11 082192 0 (COMAH), as amended by the Control of Major Accident Hazards (Amendment) Regulations 2005SI2005/1088TheStationeryOffice2005ISBN0110727665,whichimplementstheSevesoIIDirective(96/82/EC)inGreatBritain

4 Successful health and safety managementHSG65(Secondedition)HSEBooks1997ISBN0717612767

5 Responsible Care Management Systems Guidance(Fourthedition)RC127ChemicalIndustriesAssociationsLondon2003

6 James Reason Managing the Risks of Organizational AccidentsAshgatePublishingLimited1997ISBN1840141042

7 http://webcommunities.hse.gov.uk/ui/inovem.ti/group/chemicalindustries.pspm/grouphome

8 www.cia.org.uk/newsite/responsible_care/cells.htm

9 Leadership for the major hazard industriesLeafletINDG277(rev1)HSEBooks2004(singlecopyfreeorpricedpacksof15ISBN0717629058)

Whileeveryefforthasbeenmadetoensuretheaccuracyofthereferenceslistedinthispublication,theirfutureavailabilitycannotbeguaranteed.

Control Lagging indicator Leading indicator

Emergencyarrangements

Numberofelementsoftheemergencyprocedurethatfailtofunctiontothedesignedperformancestandard.

Percentageofshutdown/isolationsystemswhichfunctionedtothedesiredperformancestandardwhentested.

Percentageofstaff/contractorswhotakethecorrectactionintheeventofanemergency.

Table 5 continued

Further information

HSEpricedandfreepublicationscanbeviewedonlineororderedfromwww.hse.gov.ukorcontactHSEBooks,POBox1999,Sudbury,SuffolkCO102WATel:01787881165Fax:01787313995.HSEpricedpublicationsarealsoavailablefrombookshops.

ForinformationabouthealthandsafetyringHSE’sInfolineTel:08453450055Fax:08454089566Textphone:08454089577e-mail:[email protected],CaerphillyBusinessPark,CaerphillyCF833GG.

TheStationeryOfficepublicationsareavailablefromTheStationeryOffice,POBox29,NorwichNR31GNTel:08706005522Fax:08706005533e-mail:[email protected]:www.tso.co.uk(Theyarealsoavailablefrombookshops.)StatutoryInstrumentscanbeviewedfreeofchargeatwww.opsi.gov.uk.

PublishedbyHSE03/10 Page59of59


developing process safety indicators

Documents