petrotechnics white paper - process safety management whats missing

Process Safety Management:What’s Missing?

A white paper by Petrotechnics, leading providers of Enterprise Operations Excellence Management.

Petrotechnics Limited, Pavilion 5, Craigshaw Business Park, Craigshaw Road, Tullos, Aberdeen, AB12 3QH, UK

Confidential Copyright ® 2015 Petrotechnics Ltd. Page 1 of 12

ABSTRACT This paper will explore best practices for operators to make risk mitigation arising from process safety management (PSM) systems an integral part of efficient and effective operations.

Operational Risk arises from a complicated set of interrelated parameters and is viewed and managed in differing ways depending on the role and level in the organisation. The challenge is to simplify this complexity enabling all levels of the organisation to collectively focus on the major elements of risk that are important.

Conceptual models like James T. Reason’s Swiss Cheese barrier model or Bow-Tie models have been developed in an attempt to describe the inter-related nature of operational risk, but the industry has yet to develop operational systems that enable routine management of operational risk.

Regulators are requiring companies with hazardous installations to implement process safety management systems. This has led to functionally focused management and process safety systems primarily aimed at compliance.

Across the globe there are a number of process safety management models, from the Occupational Safety and Health Association (OHSA), California’s Division of Occupational Safety and Health (Cal-OHSA), Safety and Environmental Management Systems (SEMS), UK Health and Safety Executive (HSE), the Energy Institute, and even the Tier 1-4 leading and lagging indicators from the American Petroleum Institute (API). Furthermore, each company has established their individual process safety management or control systems to comply with or operationalise these models. Common to most systems is the concept of barriers, lines of defence, or layers of protection as a means of understanding how to protect operations from major accident hazards (MAHs).

The challenge every organisation faces is how to relate the performance of their process safety systems in a meaningful way to the operational reality of the plant. Too often process safety leading indicators end up being focused on programme health and do not provide a forward looking view of how all the operational risk comes together where it matters most; frontline operations.

To be successful in creating a sustainable business in hazardous industries, organisations need to collectively manage risk across their operations in a routine and efficient way. This requires a change in the dynamic between safety and productivity, where safety is not set against production and risk mitigation becomes an integral part of efficient and effective operations. Organisations need a holistic and common means of balancing risk against production at all levels of the operation.

This paper will review existing PSM models, the challenge in relating PSM performance to the operational reality of the plant and how a new breakthrough provides a simple, elegant means of relating the collective performance of a company’s process safety systems to the real cumulative risk impact on plant operations at any given point in time.

This breakthrough is not a new process safety model nor an addition to existing process safety models. It provides the means to connect deviations from process safety performance standards to the operational reality of the plant through a common language of risk so that operational risk mitigation can become an integral way of achieving efficient and effective operations. By doing so it allows operators to understand their levels of MAH risk in a prominent and real time manner. MAH pathways through the fundamental barriers can be identified by combining the residual risk arising from deviations in any process safety systems. This provides a key indicator of MAH risk.

This new breakthrough will allow people at all levels in an organisation to better understand the cumulative operational risk they are carrying at any given time which can be used to improve operational decision


making. The benefits it delivers range from serving as an early warning system for potential MAH related incidents (allowing organisations to make proactive interventions), better prioritisation of maintenance to more informed decision making around risk and activity at the daily operations level. Simultaneous Operations (SIMOPs) with a lot of work on multiple work sites

Significant environmental risks

Some of the activities will never have been done before, therefore, will require innovation which therefore introduces new and novel risks.

Breaking into areas that have not been opened up before or for a considerable time

Isolating from export / import pipelines

Dangerous materials (LSA, sludge, chemicals etc.)

Environmental impact

Heavy Lifting

High number of transient workers

INTRODUCION Operational risk arises from a complicated set of interrelated parameters and is viewed and managed in differing ways depending on one’s role and level in the organisation. Conceptual models such as James T. Reason’s Swiss Cheese barrier model or Bow-Tie models have been developed in an attempt to describe the inter-related nature of operational risk. In addition, the Industry has established systems to monitor the performance of the various PSM elements. The challenge comes in relating this to operational risk. Previous attempts to resolve this have fallen into the trap of complexity and lagging indicators.

The efforts the industry has made have been in the right direction. Regulators and industry bodies have been driving Process Safety Management (PSM) models and frameworks to systematise best practices for managing major accident hazards.

Across the globe there are a number of process safety management models, from the Occupational Safety and Health Association (OHSA), California’s Division of Occupational Safety and Health (Cal-OHSA), Safety and Environmental Management Systems (SEMS), UK Health and Safety Executive (HSE), the Energy Institute, and even the Tier 1-4 leading and lagging indicators from the American Petroleum Institute (API). Furthermore, each company has established their individual process safety management or control systems to comply with or operationalise these models. Common to most systems is the concept of barriers, lines of defence, or layers of protection as a means of understanding how to protect operations from major accident hazards (MAHs).

However, the adoption and practical management of these systems has not yet delivered the desired results of reducing incidents and near misses. One of the principal challenges most organisations face is how to relate the performance of their process safety systems in a meaningful way to the operational reality of the plant. The industry has yet to develop operational systems to systematise operational risk management.

In trying to understand where these systems have fallen short one has to take a broader look at not just at how they have evolved but at what we are trying to achieve and where incidents and accidents actually happen; frontline operations. Traditionally the industry has taken an “audit” based approach to managing operational risk. A programme or process is developed to manage an aspect of PSM (e.g. PHA, MoC, Mechanical Integrity, etc…) and then using a standard Plan-Do-Act-Check process where our “checking” involves an “audit” process we see how well we are doing from a programmatic perspective. This audit cycle provides each function responsible for each PSM element a status report of the “health” of our performance for each PSM element.

What is missing is the perspective of the operational reality of the plant. Frontline operations is where everything comes together. It’s where people intervene in the plant to operate, maintain and fix equipment on the plant.


It’s where process systems operate, where people get hurt, equipment is damaged, where the plant ages, where the impact of deferred maintenance is felt, where the consequences of ageing assets manifest themselves, where operating procedures are used and importantly where incidents and accidents occur. Plant operations are dynamic and conditions change over time as does the operational risk we carry.

The breakthrough presented in this paper is not a new PSM model or even a build on existing models but the means to connect the performance of PSM systems to their impact on the operational reality of the plant. Understanding the operational impact of performance against our PSM systems is critical as it can better inform operational decision making from the frontline to the boardroom.

This new breakthrough has evolved from an investigation of the gap between PSM performance and frontline operations. In terms of the operational reality of the plant, PSM and frontline operations are very much intertwined yet in our functional organisations we separate the understanding and management of these systems very differently. As a result we struggle to relate the two to each other in a simple, elegant and practical manner that can enhance the decisions we make every day throughout the organisation.

In use, this breakthrough will empower Oil & Gas organisations to better understand the cumulative operational risk they are carrying at any given time which can be used to improve operational decision making. It allows all levels of the organisation to better understand the level of risk being carried at any given time. The benefits it delivers range from serving as an early warning systems for potential MAH related incidents (allowing organisations to make proactive interventions), better prioritisation of maintenance to more informed decision making around risk and activity at the daily operations level.

PSM - THE CURRENT APPROACH

Process Safety Management principles emphasise the importance of designing, building, maintaining and operating our plants to avoid major accidents. This simple approach builds multiple layers of protection, such that if one should fail another will hold and a potential incident could be avoided or prevented from escalating. Unfortunately, these barriers are never 100% reliable and as the plant is operated and ages over time, the reliability of the barriers degrades. History also tells us most major incidents occur when there is concurrent failure of several barriers leading to a catastrophic event.

The metaphor most commonly used to illustrate the individual barrier systems or layers of protection is James Reason's (1990) Swiss Cheese model. Each slice of cheese represents a barrier; the holes in the cheese represent impairments to that barrier. When the holes in each slice of cheese line up, this represents multiple failures of the layers of protection and an undesired event could occur or escalate as shown in Fig. 1.

(Source: Petrotechnics, 2014)

Real life, however, is not as simple as the model. Impairments in barriers are not as obvious to recognise as the holes in Swiss cheese. Identifying when the "holes" in several slices line up to a point where a catastrophic event


is highly probable, is far from straightforward. Often the practical implication of barrier models within organisations are based on applying numbers of non-compliances against a barrier on a manual basis (e.g. monthly) and when the count reaches a specific number the barrier changes color. Additional information on the status of our barrier systems and specific impairments is often hidden away in "silos" or different systems around the organisation, which drives a reliance on key performance indicators (KPIs) to inform us on the health of our systems. This brings with it a host of challenges.

What Are Our Current Key Performance Indicators Focused On?

The health and effectiveness of process safety barriers are critical to our ability to assess accurately in order to make appropriate operational decisions at all levels.

The American Petroleum Institute’s (API) (2010) recommendation for process safety indicators, RP 754, is based on a 4-tier system/pyramid as shown in Fig. 2. The top two layers are based on loss of primary containment events; Tier 1 being of greater consequence than Tier 2. Tier 3 represents events involving challenges to safety systems, such as safe operating limit excursions, inspections of primary containment outside acceptable limits, etc. Tier 4 categorises operating discipline and management system performance. The top two layers are based on incident reports and are identified as lagging indicators. Tier 3 is based on part incident, part inspection data, and Tier 4 is mostly composed of data from audit-driven reports.

Fig. 2 - The American Petroleum Institute (API)’s Recommended Practice on Process Safety Indicators

(Source: API, 2010)

In the UK, the Health and Safety Executive's (2006) guide on developing Process Safety Indicators, HSG 254, recommends focusing on the health of Risk Control Systems (RCS), examples of which include; Inspection and Maintenance, Competence, Operating Procedures, Plant Change, Permit to Work, Plant Design, etc. The UK HSE recommends specifying critical elements of each RCS, and developing indicators, both leading and lagging, to identified impairments. The advantage of this approach is it focusses on the systems that may be the source of highest risk; however, it does not provide specific location or equipment references where risk is present, nor does it show how combinations of risk sources act together. Similar to API, the time dimension is a challenge, as much of this information will be dated by the time it is published, and it may not reflect the current status of the plant.


The Energy Institute's (EI) (2010) PSM framework, developed by the oil and gas industry further builds on these approaches. It looks to address two core questions – how will we assure the integrity of the operation and how will we know we are doing it? There are four 'focus areas' defining the key high level components of the Framework; Process Safety Leadership, Risk Identification & Assessment, Risk Management and Review & Improvement. Within each of these areas are a number of 'elements', 20 in total, which set out the key aspects of the operation that organisations need to get right. Each of these elements contains a number of 'expectations' which set out a more detailed definition of what they need to do in order to assure the integrity of the operation. Each element has an associated guideline which captures and presents industry practices and guidance to meet expectations set out in each element of the PSM framework.

Further advice and guidance on Process Safety KPIs include the Center for Chemical Process Safety’s (CCPS) (2011) Leading and Lagging Metrics. Many of these concepts fed into the subsequent API recommended practices. The International Association of Oil and Gas Producers (OGP) (2011) also published Process Safety - Recommended Practices on Key Performance Indicators. This builds on API RP 754 and takes ideas from HSG 254 for Tier 3 and Tier 4 indicators.

The industry uses these recommendations as the baseline in the development of their own specific KPIs to measure health and effectiveness of their process safety barriers.

Are Our Plants Getting Any Safer?

While the industry, regulators and stakeholders are more focused than they have ever been on safety we have yet to see a real impact in the numbers of incidents. Fig. 3 below, from the 22nd edition of Marsh & McLennan's (2012) publication, 100 Largest Losses (in the Hydrocarbon Industry) 1972 – 2011, displays the 100 largest loss events since 1972. Each referenced event is based on property damage, debris removal, and clean-up costs, normalised to 2013.

Fig. 3 - 100 Largest Losses (in the Hydrocarbon Industry) 1972 - 2011

(Source: Marsh & McLennan Companies, 2012)

This is a combined picture from all sectors. The upstream segment showed a high contribution to the top 100 losses over the past seven years. The report suggests the ages of the operating assets and the associated asset integrity issues are a contributing factor for loss.


From the evidence presented within the Marsh & McLennan (2012) report, it can be concluded we have not eliminated major accidents, and the last few years of data shows no reason to be optimistic about this trend improving.

Is the Current PSM Approach Enough or Is There Something Missing?

When relating Marsh & McLennan’s loss data to today’s PSM approach, we find functional approaches to PSM provides a valuable health check on the fundamental PSM elements. However, data indicates they do not have the desired impact on reducing incidents. Why is this? There are likely a number of reasons such as the indicators we use are lagging, the information is dated or a snapshot in time, they do not reflect the current status of the plant; and therefore, the cumulative impact on operational risk is not understood and we have built in too much complexity.

While Regulators require companies with hazardous installations to implement process safety management systems, this has often led to functionally-focused safety systems primarily aimed at compliance. The challenge comes when relating the performance of these systems to the operational reality of the plant, and this is where Oil and Gas organisations struggle to find a common means of balancing risk against production at all levels of the operation.

As previously mentioned, most PSM models recommend the creation of leading and lagging indicators. When we refer to "leading indicators," these typically represent a snapshot in time. Many indicators reported as leading indicators are actually days or weeks old as they often rely on audit processes to determine performance against expected performance standards. These indicators provide value in their ability to show relative improvements over time across a site, an organisation, or the industry as a whole. However, they don’t provide enough insight to all levels of the organisation to enhance operational decision-making around critical questions such as;

1. Is it safe for the plant to operate today?2. Can I safely execute the program of work scheduled for today? Tomorrow? Next week?3. Where do we need to focus our future interventions?4. Is the operational risk we are carrying on our plants increasing or decreasing?

To put things in perspective, one Executive commented that PSM data like this leaves him questioning what this really means to operational risk. Knowing the percentage of safety critical devices correctly maintained is useful, but it is a lagging indicator, and as an isolated statistic, it tells us little about the resultant level of operational risk. For example, if 95% of safety critical maintenance is up to date and 5% is deferred what does this mean? While 95% appear to be a very good statistic what is the operational impact of that 5% of deferred safety critical maintenance? What does it mean to the overall risk being carried on the plant? How does it impact our frontline operations and how is that communicated to them? Increasingly organisations are recognising good performance, as indicated by the PSM system, is not matched by audit findings and potential incidents.

Complexity remains another key challenge. This issue was highlighted by Nancy Leveson, Professor of Aeronautics and Astronautics at MIT, who previously served on the NASA Aerospace Safety Advisory Panel and the Baker Panel investigating safety culture in the Texas City Oil Refinery explosion and as an expert advisor to the Presidential Oil Spill Commission (Deepwater Horizon). She states;

“In some organizations, the desire to predict the future leads to collecting a large amount of information based on the hope that something will be obtained that is useful. The NASA Space Shuttle program was collecting 600 metrics a month, for example, right before the loss of the Columbia, none of which turned out to be helpful in predicting the loss or identifying the clear migration of the program to states of increasing risk.” (Leveson, 2007, p. 9).

The challenge is to be able to connect the performance of the various elements of PSM to operational risk. To do this we need to be able to simplify the complexity of operational risk management, enabling more routine and


efficient management of operational risk throughout the organisation. This requires new leading indicators of operational risk that reflect the operational reality of the plant.

A NEW, ELEGANT APPROACH TO OPERATIONAL RISK MANAGEMENT

The breakthrough is a simple, elegant means of relating the collective performance of a company’s process safety systems to the real cumulative risk in the operation at any one point in time. It is a modern and new approach to operational risk management that has evolved from more than twenty five years of experience, investigation and implementation of technology and business process change in Oil & Gas operations.

This new approach to operational risk management recognises a gap between PSM performance and the operational reality of the plant. It provides the means to connect deviations or non-compliances from process safety performance standards into a common language of risk and how operational risk mitigation can become an integral way of achieving efficient and effective operations.

One of the principal challenges most organisations face is how to relate the performance of their process safety systems in a meaningful way to the operational reality of the plant. In trying to understand where these systems have fallen short one needs to look more closely at where incidents and accidents actually occur; frontline operations. Traditionally the industry has taken an “audit” based approach to managing operational risk. A programme or process is developed to manage an aspect of PSM (e.g. PHA, MoC, Mechanical Integrity, etc…) and then using a standard Plan-Do-Act-Check process where our “checking” involves an “audit” process we see how well we are doing from a programmatic perspective. This audit cycle provides each function responsible for each PSM element a status report of the “health” of our performance for each PSM element.

What is missing is the perspective of the operational reality of the plant. Frontline operations is where everything comes together. It’s where people intervene in the plant to operate, maintain and fix equipment on the plant. It’s where process systems operate, where people get hurt, equipment is damaged, where the plant ages, where the impact of deferred maintenance is felt, where the consequences of ageing assets manifest themselves, where operating procedures are used and importantly where incidents and accidents occur. Plant operations are dynamic and conditions change over time, as does the operational risk we carry.

For operational risk mitigation to become an integral way of achieving efficient and effective operations, it must be understood in terms of its impact on the operational reality of the plant. The industry has yet to develop operational systems to systematise operational risk management but this breakthrough will allow organisations to understand the levels of MAH risk they are carrying at any point in time. The approach uses the key indicator of Major Accident Hazard (MAH) risk.

The MAH risk indicator of is the combination of:

Major accident hazards Fundamental barriers The MAH pathways through the fundamental barriers.

This is achieved by combining the residual risk arising from deviations in any process safety management systems, any major deviation in each element of the process safety management system can be evaluated by a multi-discipline team using the following approach:

1. Identify the deviation in the Risk Control System2. Identify the Major Risk Category affected (ex. major hazardous risk, fire, explosion, etc.)3. Identify the Fundamental Barriers that are compromised (ex. maintain, contain, control, detect, etc.)4. Identify the areas of the business impacted5. Identify the mitigation measures required and their duration6. Evaluate the residual operational risk (ex. the size of the impact on the barrier)7. Obtain the appropriate authorisation


8. Manage and control mitigation measure9. Rectify deviation10. Adjust residual risk

This approach provides the means to evaluate each major deviation from the expected performance standards for each PSM element in the same manner. We are also doing so in the context of each deviations’ impact on the operational reality of the plant. This provides us with a “common currency of operational risk” that can then be combined to provide a holistic understanding of the risk arising from identified shortfalls in the various elements of the PSM system.

Susan McKenzie, Director Hazardous Installations Directorate, made a direct plea to industry (2014) in an interview with the UK’s Energy Voice, for such indicators,

“I want to see the industry agreeing some common, comparable major hazard performance measures.” (Energy Voice, 2014)

When combined with the risk associated with the planned and live daily operations activity we have a holistic and common means of viewing all operational risk across an organisation. This allows organisations to meet the challenge to better manage major hazard risk that many regulatory bodies have been driving over the past few years. The Norwegian Petroleum Safety Authority (2013) stated,

“…relevant personnel must have an understanding of how decisions can directly or indirectly influence the risk picture or barrier performance. To deal with the risk over time, moreover, the condition of the barriers must be monitored. That calls in part for a conscious attitude towards the presumptions and conditions (the context) on which the risk assessment has been based, and that changes are handled in a controlled manner”.

This new approach demonstrates how deviations from process safety performance standards are translated into a common currency of risk and, when linked with other sources of operational risk, can provide common, leading MAH indicators the industry and Regulators are looking to understand.

WHAT DOES THIS MEAN IN PRACTICE?

With a common and holistic picture of risk, organisations have the ability to balance risk against production throughout the organisation.

For example, at the facility level, the combined risk can be displayed in:

• Space• Time• The components of the combined risk

As shown below, Fig. 4 illustrates how cumulative risk factors can be displayed in relation to a specific location and time.

Fig. 4 - Cumulative Risk Factors in Relation to Fundamental Process Safety Management Barriers



Fig. 5 is an example of a display that shows the location of all the operational risks in a particular facility, and how the combined operational risk in that facility varies by shift.

Fig. 5 – Geographic Perspective of Risk Levels



Fig. 6 is an example of how the PSM status of the facility, combined with the ongoing and planned activity, impacts the combined operational risk over time.

Fig. 6 – Display of Cumulative Risk and Conflict Detection


Fig. 7 is an example of how components of risk combine to provide an overall risk level for each part of the facility by indicating how impairments in the fundamental barriers create a potential MAH pathway.

Fig. 7 - Cumulative Risk Impact Aligned to Process Safety Barriers – Across Facility



Having simplified the complexity of operational risk management in this way, management of all operational risk at the facility level can become a routine and efficient process. Managing and monitoring risks in this way provides the potential for new leading indicators as organisations now have access to understand and proactively manage escalating operational risk.

This approach also has the potential to impact operational risk management at the enterprise level. With each facility using common currencies of operational risk to routinely manage their operations, executives have real insight into where the real operational risks may lie and what direction are they trending, enabling timely intervention. Armed with long-term operational risk trends, and the associated sources, executives can more accurately and systematically target investments balancing risk management and production.

Conclusion

This paper outlines a new approach that provides a simple, elegant means of relating the collective performance of a company’s process safety systems to the real cumulative risk impact to operations at any given point in time. It provides the means to help the industry to connect PSM performance to real operational risk and develop common comparable leading indicators of major accident risk.

It allows the industry to better understand the cumulative operational risk they are carrying at any given time which can be used to improve operational decision making at all levels of the organisation. With a better understanding of the level and nature of risk being carried at any given point in time risk mitigation can become an integral way of achieving efficient and effective operations. The benefits to the industry can range from an early warning systems for potential MAH related incidents (allowing organisations to make proactive interventions) to better prioritisation of maintenance to more informed decision making around risk and activity at the daily operations level.

With an ability to better understand and mange operational risk the industry can improve its operational effectiveness and ultimately unlock higher levels of asset productivity.


References

ASSOCIATION OF OIL AND GAS PRODUCERS, (2011). Process Safety – Recommended Practice on Key Performance Indicators. [online] London: OGP.

Available from: http://www.ogp.org.uk/pubs/456.pdf [Accessed on 2 June 2015].

AMERICAN PETROLEUM INSTITUTE, (2010). Recommended Practice (RP) 754, Process Safety Performance Indicators for the Refining and Petrochemical Industries. [online] Washington: API. Available from: http://www.api.org/~/media/files/ehs/process-safety/rp-54-fact-sheet.pdf?la=en

[Accessed on 7 June 2015].

ENERGY INSTITUTE, (2010). High Level Framework for Process Safety Management. [online] London: EI. Available from:

http://publishing.energyinst.org/publication/ei-technical-publications/process-safety/management-systems/high-level-framework-for-process-safety-

management?SQ_ACTION=login?SQ_ACTION=login [Accessed on 3 June 2015].

LEVESON, N.G., (2007). A Systems Approach to Risk Management Through Leading Safety Indicators [online] Cambridge. Available from:

http://sunnyday.mit.edu/papers/leading-indicators-final.pdf [Accessed 7 June 2015].

MARSH AND MCLENNAN, (2012). The 100 Largest Losses 1972 – 2011: Large Property Damage Losses in the Hydrocarbon Industry [online] London.

Available from: https://uk.marsh.com/Portals/18/Documents/100%20Largest%20Losses_low%20res.pdf [Accessed 11 June 2015].

NORWEIGAN PETROLEUM SAFETY AUTHORITY, (2013). Principles for Barrier Management in the Petroleum Industry [online] Stavanger. Available

from: http://www.psa.no/getfile.php/PDF/Barrierenotatet%202013%20engelsk%20april.pdf [Accessed 12 June 2015].

REASON, J., (1990). Human Error. Cambridge University Press, United States of America.

THE CENTER FOR CHEMICAL PROCESS SAFETY, (2011). Process Safety Leading and Lagging Metrics - You Don’t Improve What You Don’t Measure

[online] New York: CCPS. Available from: http://www.aiche.org/sites/default/files/docs/pages/CCPS_ProcessSafety_Lagging_2011_2-24.pdf [Accessed

5 June 2015].

UK HEALTH AND SAFETY EXECUTIVE, (2006). Developing Process Safety Indicators [online] London: HSE. Available from:

http://www.hse.gov.uk/pubns/priced/hsg254.pdf [Accessed on 27 May 2015].