Page 1 of 59 Health and Safety Executive Developing process safety indicators A step-by-step guide for chemical and major hazard industries This is a free-to-download, web-friendly version of HSG254 (First edition, published 2006). This version has been adapted for online use from HSE’s current printed version. You can buy the book at www.hsebooks.co.uk and most good bookshops. ISBN 978 0 7176 6180 0 Price £11.95 This guidance is aimed at senior managers and safety professionals within major hazard organisations that wish to develop performance indicators to give improved assurance that major hazard risks are under control. It is presumed that companies using this guide already have appropriate safety management systems, so the emphasis is on checking whether their risk controls are effective and operating as intended. The guide draws on good practice in the UK chemical sector. Too many organisations rely heavily on failure data to monitor performance, so improvements or changes are only determined after something has gone wrong. Discovering weaknesses in control systems by having a major incident is too late and too costly. Early warning of dangerous deterioration within critical systems provides an opportunity to avoid major incidents. Knowing that process risks are effectively controlled has a clear link with business efficiency, as several indicators can be used to show plant availability and optimised operating conditions. While aimed mainly at major hazard organisations, the generic model for establishing a performance measurement system described in this guide will also apply to other enterprises requiring a high level of assurance that systems and procedures continue to operate as intended. HSE Books
59
Embed
Developing process safety indicators - Antaris Consultingantarisconsulting.com/docs/...Developing_Process_Safety_Indicators.pdf · Developing process safety indicators Page 4 of 59
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page1of59
Health and Safety Executive
Developing process safety indicatorsAstep-by-stepguideforchemicalandmajorhazardindustries
This is a free-to-download, web-friendly version of HSG254 (First edition, published 2006). This version has been adapted for online use from HSE’s current printed version.
This guidance is aimed at senior managers and safety professionals within major hazard organisations that wish to develop performance indicators to give improved assurance that major hazard risks are under control.
It is presumed that companies using this guide already have appropriate safety management systems, so the emphasis is on checking whether their risk controls are effective and operating as intended. The guide draws on good practice in the UK chemical sector.
Too many organisations rely heavily on failure data to monitor performance, so improvements or changes are only determined after something has gone wrong.Discovering weaknesses in control systems by having a major incident is too late and too costly. Early warning of dangerous deterioration within critical systems provides an opportunity to avoid major incidents. Knowing that process risks are effectively controlled has a clear link with business efficiency, as several indicators can be used to show plant availability and optimised operating conditions.
While aimed mainly at major hazard organisations, the generic model for establishing a performance measurement system described in this guide will also apply to other enterprises requiring a high level of assurance that systems and procedures continue to operate as intended.
n anincreasedassuranceonriskmanagementandprotectedreputation;
Developingprocesssafetyindicators Page6of59
Health and Safety Executive
n demonstratedthesuitabilityoftheirriskcontrolsystems;n avoideddiscoveringweaknessesthroughcostlyincidents;n stoppedcollectingandreportingperformanceinformationwhichwasnolonger
8 Part 2,themainpartofthisguide,describesasix-stepprocessthatcanbeadoptedbyorganisationswishingtoimplementaprogrammeofperformancemeasurementforprocesssafetyrisks.Eachstageisexplainedindetailwithinaseparatechapter.Tohelpputtheprocessintocontext,afullworkedexampleforatop-tierCOMAH3siteisincludedinPart 3.
12 Measuringperformancetoassesshoweffectivelyrisksarebeingcontrolledisanessentialpartofahealthandsafetymanagementsystem,asexplainedinSuccessful health and safety management,4and,forexample,theCIA’sResponsible Care Management Systems:5
n active monitoringprovidesfeedbackonperformancebeforeanaccidentorincident;whereas
n reactive monitoringinvolvesidentifyingandreportingonincidentstocheckthecontrolsinplaceareadequate,toidentifyweaknessesorgapsincontrolsystemsandtolearnfrommistakes.
What’s different about this guide? Dual assurance – a leading and lagging indicator for each risk control system13 Themaindifferencebetweentheapproachoutlinedinthisguideandexistingguidanceonperformancemeasurementistheintroductionoftheconceptof‘dualassurance’thatkeyriskcontrolsystemsareoperatingasintended.Leadingandlaggingindicatorsaresetinastructuredandsystematicwayforeachcriticalrisk
Developingprocesssafetyindicators Page7of59
Health and Safety Executive
controlsystemwithinthewholeprocesssafetymanagementsystem.Intandemtheyactassystemguardiansprovidingdualassurancetoconfirmthattheriskcontrolsystemisoperatingasintendedorprovidingawarningthatproblemsarestartingtodevelop.Leading indicators 14 Leadingindicatorsareaformofactivemonitoringfocusedonafewcriticalriskcontrolsystemstoensuretheircontinuedeffectiveness.Leading indicators require a routine systematic check that key actions or activities are undertaken as intended.Theycanbeconsideredasmeasuresofprocessorinputsessentialtodeliverthedesiredsafetyoutcome.Lagging indicators 15 Laggingindicatorsareaformofreactivemonitoringrequiringthereportingandinvestigationofspecificincidentsandeventstodiscoverweaknessesinthatsystem.Theseincidentsoreventsdonothavetoresultinmajordamageorinjuryorevenalossofcontainment,providingthattheyrepresentafailureofasignificantcontrolsystemwhichguardsagainstorlimitstheconsequencesofamajorincident.Lagging indicators show when a desired safety outcome has failed, or has not been achieved.
16 AccordingtoJamesReasoninManaging the Risks of Organizational Accidents,6(major)accidentsresultwhenaseriesoffailingswithinseveralcriticalriskcontrolsystemsmaterialiseconcurrently.Figure2illustratesan‘accidenttrajectory’modelwhereanaccidenttrajectorypassesthroughcorrespondingholesinthelayersofdefence,barriersandsafeguards.Eachriskcontrolsystemrepresentsanimportantbarrierorsafeguardwithintheprocesssafetymanagementsystem.Itshouldalsoberecognisedthatasignificantfailinginjustonecriticalbarriermaybesufficientinitselftogiverisetoamajoraccident.
17 Foreachriskcontrolsystem:
n theleadingindicatoridentifiesfailingsor‘holes’invitalaspectsoftheriskcontrolsystemdiscoveredduring routine checksontheoperationofa
following an incident or adverse event.Theincidentdoesnotnecessarilyhavetoresultininjuryorenvironmentaldamageandcanbeanearmiss,precursoreventorundesiredoutcomeattributabletoafailinginthatriskcontrolsystem.
Frequency of checks19 Manyorganisationsrelyonauditingtohighlightsystemdeterioration.However,auditintervalscanbetooinfrequenttodetectrapidchange,ortheauditmayfocusoncompliance(verifyingtherightsystemsareinplace),ratherthanensuringsystemsaredeliveringthedesiredsafetyoutcome.Theuseofprocesssafetyperformanceindicatorsfitsbetweentheseformal,infrequentauditsandmorefrequentworkplaceinspectionandsafetyobservationprogrammes.Itisimportant
Part 2: Six steps to performance measurement20 Thissectionoutlinesthesixmainstagesneededtoimplementaprocesssafetymeasurementsystem.Organisationsthatdonothaveaprocesssafetyperformancemeasurementsystemwouldbenefitfromconsideringeachstageinturn.Organisationswithperformancemeasurementsystemsinplacecanusethisguideasabenchmarkofgoodpracticeandconsiderimprovementsasappropriate.
Step3 Identifytheriskcontrolsystemsinplacetopreventmajoraccidents.Decideontheoutcomesforeachandset a lagging indicator
Whatriskcontrolsystemsareinplace?
Describetheoutcome
Setalaggingindicator
Followupdeviationsfromtheoutcome
Step4 Identifythecriticalelementsofeachriskcontrolsystem,(iethoseactionsorprocesseswhichmustfunctioncorrectlytodelivertheoutcomes)andset leading indicators
Make the business case 23 Developingandimplementingprocesssafetyindicatorsisoftenanewareaofworkwithinmanyorganisations,andtheneedforsuchasystemwillnotbeimmediatelyobvioustomanypeople.Tobesuccessful,thissortofinitiativerequiressomeonewithintheorganisationtopromotetheidea,gaugesupportandthentodriveforwardtheinitiative.Thismayincludemakingthebusinesscaseforadoptingperformanceindicatorsandsecuringsuitableresources.
Identifying the business benefits25 Identifyingassociatedbusinessbenefitsthatcanaccruefromimprovedprocesssafetymeasurement(suchasimprovedproductivity,efficiency,reductioninthecostofloss-of-containmentincidentsandimprovedassetmanagement)willhelptoselltheinitiativewithintheorganisation.
Learning from others and sharing good practice26 Thisisadevelopingareaofworkwithnewideasandexperiencesofusingprocesssafetyindicatorsemergingallthetime.Toavoidstartingwithablanksheetofpaper,itishelpfultoknowwhatotherswithintheindustryaredoingandwhatrepresentsgoodpractice.Itisimportantthereforethatsomeonekeepsuptodatewiththesedevelopments,egbyjoiningHSE’swebcommunityforum7orparticipatinginaCIAResponsible Care Cell.8
n theworkloadmaybetoomuchworkforoneperson;n theremaybeextrabenefitfromateamapproach–egcollectiveideas;n largeorganisationswithbusysafetycommitteesmayneedaseparateforum/
n Directors and senior managers are the main customers for risk assurance information.
n Senior managers should actively participate in the implementation.
n Business benefits should be agreed.
29 The active control of business risks by directors and senior managers is an essential part of corporate governance.9 Senior managers need to fully understand the business benefits of performance measurement and clearly see how managing process safety contributes to the success and sustainability of their company.Itisvitalthatseniormanagersarecommittedtoadoptingmeaningfulindicatorsastheyhaveultimateresponsibilityforthecontrolofriskandarethereforethemaincustomerfortheenhancedinformation.Itisimportantthatmanagementteams,chiefexecutivesanddirectorsagreethatthe
Figure 4 A hierarchical Process Safety Performance Management System for a multi-site organisation
Pla
ntch
ang
eR
CS
Insp
ecti
on
and
mai
nten
ance
RC
S
Sta
ffco
mp
eten
ceR
CS
Op
erat
ing
pro
ced
ures
RC
S
Em
erg
ency
arra
ngem
ents
RC
S
Per
mit
tow
ork
RC
S
Organisational level indicators willbe generic and reflect commonprocess safety system elements inplace in all company facilities
Installation indicators should be based on what can go wrong at the individual installation to give rise to a major accident/serious incident.Installation level indicators should be very focused on the individual RCS critical to the safe operation of that installation or plant
Individual RCS may be given differentweightings based upon the criticality of thatRCS for the installation/plant, eg staffcompetence and permit to work may be themost critical or vulnerable RCS on InstallationA, whereas inspection and maintenance maybe the most important RCS at Installation B,etc. These higher weighted RCS could then beused as ‘index’ indicators for the whole site
x 1 x 1 x 3 x 1 x 1 x 2
Installation/plant/facility A
Installation/plant/facility ASite 1
Installation/plant/facility BSite 1
Installation/plant/facility ASite 2
Installation/plant/facility BSite 2
Installation/plant orfacility levelindicators
A site level indicator could be red ifany of the subsidiary installationlevel indicators were ‘red’.Alternatively, the result could bebiased towards the ‘index’indicators chosen for eachinstallation or plant
Site levelindicators
Organisationlevelindicators
Site indicators should reflect themajor hazard scenarios relevant toeach site and show the condition ofthe RCS in place at the site toprevent the major accident hazards
Using a traffic light system ofproducing the information fromindicators the organisational levelindicator would be ‘red’ if any ofthe subsidiary sites had a ‘red’ onthe same element
Step 2.2: Identify the scope of the measurement system
Identify the scope based on:
n the main process safety risks and key risk control systems;
n areas where greater assurance on business risk is needed.
2.2.1: Identify hazard scenarios – what can go wrong?42 Itisimportanttosetleadingandlaggingindicatorsfortheimportantriskcontrolsystemsinplacetocontrolormitigateagainstmajorhazards–seeFigures1and2.Thesewilldifferdependinguponwhereintheorganisationitisdecidedtosettheindicators.
2.2.2: Identify the immediate causes of hazard scenarios45 Tohelpdecidewhatcangowrongandhow,itisusefultoconsidertheimmediatecauseofanincident.Thisistheprimaryfailuremechanismthatgivesrisetoanincidentandcanusuallybecategorisedbyconditionsorfactorsthatchallengetheintegrityofplantorequipment.Forinstance,apipelineorbulktankfailurecouldbedueto:
n wear;n corrosion;n damage;n over/underpressurisation;orn fireorexplosion.
Step 3: Identify the risk control systems and decide on the outcomes
n List the important risk control systems.
n Describe the outcome for each risk control system.
n Set a lagging indicator to show whether the outcome is achieved.
If you don’t clearly identify the ‘desired safety outcome’ in terms of ‘success’, it will be impossible to identify indicators that show the desired outcome is being achieved.
Identify the primary cause49 Todeterminewhichriskcontrolsystemsareimportanttopreventorcontrolachallengetointegrity,firstconsidertheprimarycausesofthescenariosidentifiedinStep2.2.2.Forexample,theprimarycausesofplantorequipmentwearcouldbe:
planned plant inspection and maintenance RCS guards against failure due to wear
eg plant failure due to wear
plant and equipment does not fail due to wear
Developingprocesssafetyindicators Page19of59
Health and Safety Executive
Step 3.2: Describe the outcome
51 Afterdecidingonthehazardscenariosandassociatedriskcontrolsystemsresponsibleforpreventingincidentsormitigatingconsequences,decide what success looks likeforeachriskcontrolsystemasitimpactsonthehazardscenario.This should be expressed as the ‘desired safety outcome’.Forexample,adesiredsafetyoutcomeforaplantinspectionandmaintenanceriskcontrolsystemcouldbe‘nofailuresorbreakdownofsafetycriticalplantorequipmentduetocomponentswearingout’.
n Whydowehavethisriskcontrolsystem?n Whatdoesitdeliverintermsofsafety?n Whatwouldbetheconsequenceifwedidn’thavethissysteminplace?
Step 3.3: Setting a lagging indicator
53 Set a lagging indicator to directly show whether or not you are achieving the outcome.Iftheoutcomehasbeenclearlydescribeditshouldbepossibletojustuseoneindicator,ienumberofincidentsoflossofcontainmentofhazardousmaterial,orfailureofsafetycriticalplantwherecorrosion,wearordamagewasfoundtobeacontributoryfactor.Forexample,alaggingindicatorforaplantinspectionandmaintenanceriskcontrolsystemcouldbe‘thenumberofexpectedfailuresorbreakdownofsafetycriticalplantorequipmentduetocomponentswearingout’(seetheworkedexampleinPart 3forfurtherinformation).
Lagging indicators show whether the outcome has actually been achieved.
57 Oncethecriticalcontrolstobemonitoredaredetermined,set a leading indicator against each one to show that system is operating as intended,forexamplethepercentageofsafetycriticalplantinspectedtoschedule.
Leading indicators highlight whether the risk control systems in place to deliver the outcome are operating as designed.
58 A tolerance should be set for each leading indicator.Thisrepresentsthepointatwhichdeviationinperformanceshouldbeflaggedupforattentionofseniormanagement.Forexample,foraleadingindicator,‘percentageofoverduesafetycriticalmaintenanceactions’.
60 The management team should set the tolerance, not the person responsible for the activity.Thisenablesmanagementtodecideatwhatpointtheywishtointervenebecauseperformancehasdeviatedbeyondanacceptablelevel.
Variation in performance between leading and lagging indicators68Ifperformanceispooragainstagroupofleadingindicatorsbuttheassociatedlaggingindicatorissatisfactory,itislikelythattheleadingindicatorsselectedaretoofarremovedfromthecriticalcontrolmeasurethatdeliversormaintainsthedesiredoutcome.Forinstance,percentageofinductiontrainingcompletedmaybemeasured,whereasmoreimportantly,trainingandcompetenceinaparticularprocessactivitymaybemorecriticaltoensuringthesafetyofthatspecificactivity.
Step 2.2.1: Identify the hazard scenarios which can lead to a major incident82Describingthemainincidentscenarioshelpsmaintainafocusonthemostimportantactivitiesandcontrolsagainstwhichindicatorsshouldbeset.Thescenariosformausefulcross-checklateroninStep4,whenthecriticalelementsofriskcontrolsystemstobemeasuredaredetermined.
n Roadtankerfilling:– lossofliquidfromtransferlines;– lossofliquidfromaroadtanker;– fireorexplosioninaroadtanker;– fireintankerfillingarea.
84Theseeventsmayleadto:
n atoxicgascloudortoxicplume;n amajorfireonthesite;
Developingprocesssafetyindicators Page31of59
Health and Safety Executive
n amajorfireatthedockside;n amajorfireelsewhereoffsite,egnexttopipelines;orn environmentaldamage.
Step 2.2.2: Identify the immediate causes of hazard scenarios85Theimmediatecauseisthefinalfailuremechanismthatgivesrisetoalossofcontainment.Thiscanusuallybeconsideredasafactorthatchallengestheintegrityofplantorequipment.
86Hazardscenariosmaybecausedby:
n failureofflexihose,coupling,pump,valve,fixedpipeworkorbulktank,dueto:– wear;– corrosion;– damage;– over/underpressurisation;or– fireorexplosion;
n overfillingof:– bulktank;or– roadtanker;
n accidentalrelease:– valvesleftopen,connectionsnotmadecorrectly.
Collated list of risk control systems for the installation90Thefollowingisasummaryoftheriskcontrolsystemsrelevanttothecontrolandmitigationofthemostsignificantmajorhazardscenariosassociatedwiththeactivitiesonsite:
Risk control systemsRCS: Inspection and maintenance
n Nounexpectedlossofcontainmentduetofailureofflexihoses,couplings,pumps,valves,flanges,fixedpipes,bulktanksorinstrumentation.
n Nounexpectedlossofcontainmentduetoblockagesintankvents.n Nofiresorexplosionsduetostaticelectricignition.n Nofiresorexplosionscausedbyasourceofignitionfromfaultyordamaged
n Numberofloss-of-containmentsduetoblockagesintankvents.n Numberoffiresorexplosionsthatresultfromastaticelectricignition.n Numberoffiresorexplosionscausedbyasourceofignitionfromfaultyor
n Safetycriticalplantandequipment(ieflexihoses,couplings,pumpsvalves,flanges,fixedpipes,bulktanks)areinspectedforwearanddamageormalfunctionwithinthespecifiedperiod.
n Faultsarefixedwithinspecifiedtimescalesandrepairsandimprovementsmeetplantdesignstandards.
n Alogoffindingskept–enablingtrending.
Potential leading indicatorsn Percentageofsafetycriticalplant/equipmentthatperformswithinspecification
Final selection of indicatorsItisoftendifficulttochooseonlyalimitednumberofindicatorsfromtherangeofpotentialcandidatesgeneratedwithinSteps3.3(laggingindicators)andSteps4.2(leadingindicators).Toprioritise,consider:
n Istheoutcomemeasurable,iecanasuccessfuloradverseoutcomeeasilybedetected?Ask‘wouldyouknowwhenthishadhappened?’
n Isacriticalcontroloractivitymeasurable,iecanthecorrectoperationofacriticalcontroleasilybedetected?
n Howoftencaneachbemeasured?n Forlaggingindicators:howmuchinformationisitlikelytogenerate?Aimfor
Completion of maintenance actionsItisimportanttogetacompletepictureofanybacklogoffaultsassociatedwithsafetycriticalplant.Again,theinspectionandmaintenanceschedulewillhavetohave
beenundertakentoobtainthisinformation
Process controls
Inspectionandmaintenancesystems
RISK
Plantorequipmentinunsafecondition
OUTPUTS INPUTS
Lagging indicators discounted n Tankventblockages:theseeventscanbe
n Staticignition:itcanbedifficulttobecertainwhetherafire/explosionoccurredasaresultofastaticelectricignition.Sucheventsshouldbequiterareandiftheydooccurtheycanbepickedupaspartofincidentinvestigation.
n Numberoffiresorexplosionscausedbyasourceofignitionfromfaultyordamagedhazardousareaelectricalequipment:theseshouldbeveryrareeventsandsooflittlebenefitduetothelowfrequency.
n Firedetectionandfire-fightingequipment:sucheventsarelikelytoberare.Identificationoffailingsindetectionandfire-fightingequipmentisbettercoveredunderRCS:Emergencyarrangements.
Leading indicators discounted n Progresswithinspectionschedule:thisisa
n Faulttrending:althoughfaulttrendingisimportant,measuringthepercentageofthetrendingactionscompletedmaynotprovidegoodassurancethatproblemswithreliabilityarebeingrectified.
Figure 21 Inspectionandmaintenanceindicators
Developingprocesssafetyindicators Page40of59
Health and Safety Executive
RCS: Staff competence
n Operatorsandcontractorshavetherequiredknowledgeandskillstoenableeffectiveproducttransferfromship,tobulktank,toroadtanker.
n Operatorsandcontractorshavetherequiredknowledgeandskillstoadequatelycleanbulktanks/pipelinesbefore/afteraproducttransfer.
n Operatorsandcontractorshavetherequiredknowledgeandskillstotakeemergencyactionfollowingaproducttransferthatresultsinafire/explosion.
n Numberoftimesabulktankisover/underpressurisedduetoinadequatecleaningbystaffwithoutthenecessaryunderstanding,knowledgeorexperience.
n Numberoftimesineffectiveactionistakenfollowingaproducttransferresultinginfire/explosion,duetolackofunderstanding,knowledgeorexperiencetotakecorrectemergencyaction.
Critical elementsInformationandtrainingcovering:
n hazardouspropertiesofproducts;n ship-to-shorecommunicationsystems;n pre-transferchecks;n producttransfercontrolsandmonitoring;n post-transferchecks;n emergencyactions.
Job-specificknowledgeandrelevantexperienceof:
n substances;n workprocesses;n hazards;andn emergencyactions.
Potential leading indicatorsn Percentageofstaffinvolvedinproducttransferswhohavetherequiredlevelof
Potential leading indicatorsn Thescopeanddefinitionoftheplantchangesystemisproperlyspecified.n Percentageofplantchangeactionsundertakenwhereanadequaterisk
n Effectivemanagementofproducttransfer*andstorageandeffectivewarningofproblemsintimetotakeremedialaction.
n Effectiveremedialactionistakenintheeventofoverfill,fire/explosionoraccidentalrelease.
* Product transfer includes all aspects and actions associated with the successful transfer of hazardous material from ship to shore into bulk storage or between bulk tanks and the filling or discharge of road tankers.
n Percentageofstaff/contractorstrainedinemergencyarrangements:thisindicatordoesn’tprovideinformationonthefunctionofthesystemandsoisfurtherawayfromtheoutcome.
n Percentageofemergencyexercisescompletedtoschedule:thisindicatordoesn’tprovideinformationonthefunctionofthesystemandsoisfurtherawayfromtheoutcome.
References1 Major incident investigation report, BP Grangemouth Scotland, 29 May – 10 June 2000 COMAHCompetentAuthorityReportAugust2003www.hse.gov.uk/comah/bparrange/index.htm
2 Responsible Care. An IntroductionRC107ChemicalIndustriesAssociationLondon1999
3 Control of Major Accident Hazards Regulations 1999 SI 1999/743 The Stationery Office 1999 ISBN 0 11 082192 0 (COMAH), as amended by the Control of Major Accident Hazards (Amendment) Regulations 2005SI2005/1088TheStationeryOffice2005ISBN0110727665,whichimplementstheSevesoIIDirective(96/82/EC)inGreatBritain
4 Successful health and safety managementHSG65(Secondedition)HSEBooks1997ISBN0717612767
5 Responsible Care Management Systems Guidance(Fourthedition)RC127ChemicalIndustriesAssociationsLondon2003
6 James Reason Managing the Risks of Organizational AccidentsAshgatePublishingLimited1997ISBN1840141042