IMPLEMENTING MAJOR ACCIDENT HAZARD MANAGEMENT — SILO BUSTING IN PRACTICE

SYMPOSIUM SERIES No. 150 # 2004 IChemE

IMPLEMENTING MAJOR ACCIDENT HAZARDMANAGEMENT — SILO BUSTING IN PRACTICE

Reynold H Mohess1 and Stuart Ditchburn2 CEng BSc M Inst MC1MAHMS Project Manager, bp Trinidad & Tobago LLC2Principal Consultant, DNV Consulting

INTRODUCTIONA paper presented at Hazards XVII [Reference 1] explained the theory behind the MajorAccident Hazards Management System (MAHMS), being developed for bp Trinidad &Tobago’s (bpTT) operations in the Caribbean. This paper follows up with a discussionof the practical experience of implementing such a system within the operation.

The attributes of MAHMS as presented in Reference 1, are that it:-

. Adopts a Pragmatic and Qualitative Approach

. Deals with Safety, Environmental & Business Risk Management in a Holistic way

. Manages all Types of Risk as a Continuum

. Adopts a Systematic Approach

. Builds on Existing Processes

. Identifies Critical Measures as People, Processes & Plant

. Develops Major Accident Hazard Understanding

. Makes Major Accident Hazard Information Readily Available

Implementation has also begun to address the “Inheritance & Continuity” of MAHMSbeyond the project phase. This paper considers each of the above attributes in turn anddiscusses the practical experience gained during MAHMS implementation.

PRAGMATIC & QUALITATIVE APPROACH

RISK LEVELS AND REDUCTIONIn most businesses, there is an imperative to determine the levels of risk exposure that thecompany is willing to tolerate. The risk may comprise all types of contribution, but typi-cally will include safety risk, environmental damage risk and business risk. Business riskin this sense includes production interruption and damage to both plant and reputation.

There are numerous factors that will determine the risk level deemed to be intoler-able. For safety risk for example, there may be two criterion; one for those directlyinvolved in the operation and stand to gain from that employment (workers); and thosewho are not involved in the operation but may in some small way be exposed to risksarising from it (public). It is usual for the former group to have a higher level of toleranceto risk, but for both risk exposures there should be a continuous effort to reduce risk.

Thus major accident hazard (MAH) events, which potentially affect members of thepublic either offshore (eg. fisherman near the facility) or onshore (eg. people located an

1


area adjacent to a land pipeline), have more significance and higher justification forrisk reduction measures. The former example has justified significant effort to lobby theTrinidad and Tobago (TT) Government to enforce the establishment of 500 m safetyexclusion zones around offshore installations, in TT waters.

Having established levels of intolerable risk, another factor needs to be taken intoaccount, namely the degree of public outrage to the consequences of incidents. Thismanifests in a higher outrage for events where there are (or potentially are) a largernumber of fatalities. Thus this means that Company Risk Criteria are invariably specifiedin terms of a societal risk curve (or F–N curve) as shown in Figure 1. The sloping lineof tolerability indicates the societal risk representation. The line is straight since boththe event frequency (F) and cumulative number of potential fatalities (N) axes arelogarithmic.

A secondary, but equally important feature of Company Risk Criteria is a require-ment to demonstrate how continuous risk reduction will be achieved over a period of time.

SEMI-QUANTITATIVE RISK ANALYSISMAHMS considers three types of risk, namely safety risk, environmental risk and businessrisk; as discussed further in this paper. So to some extent these three contributors are beingconsidered when comparing actual risk levels against Company Risk Criterion and deli-very of continuous risk reduction.

Figure 1. Company risk criteria

2

Figure 2. MAHMS risk matrix & likelihood definitions


MAHMS initially evaluates risk on a qualitative basis using the MAHMS RiskMatrix. The MAHMS Risk Matrix and associated category definitions are shown inFigures 2 & 3.

MAHMS has developed a methodology for estimating quantitative levels of safetyrisk, from the qualitative risk ranking determined in the Major Accident Hazard Identifi-cation sessions (MAHIDs). This is referred to as a semi-quantitative risk analysis. This issufficiently accurate to estimate where the risk levels lie when expressed in societal termsin relation to corporate risk criteria, for any given facility, group of facilities or BusinessUnit.

Figure 3. MAHMS risk matrix consequence definitions

3


The methodology relies on plotting all the potential ‘causes’ of each identified MAHon the MAHMS risk matrix. Each cell on the matrix is assigned a safety risk ‘value’expressed in terms of a likelihood frequency (F) and consequences in terms of numberof potential fatalities (N). (Refer to Figure 4). This data can then be used to develop thecumulative frequency, fatalities (F–N) curve for that particular hazard. By summingF–N curves for all identified MAHs, a F–N curve for a complete facility can bedeveloped. (Refer to Figure 5).

RISK REDUCTION POTENTIALSince each potential cause of a particular MAH is used to develop the facility F–N curve,a very clear understanding of the risk drivers is achieved. The closer the cause plots towardsthe top right hand corner of the risk matrix, the higher the cause is in terms of its contri-bution to overall risk on a facility. Since risk is a combination of likelihood and conse-quences, the risk can either be reduced by lowering its likelihood (moving verticallydown the risk matrix), or lessening the potential consequences (moving horizontally lefton the risk matrix); or in some cases a combination of the two (moving diagonallytowards the bottom left of the matrix).

Thus risk reduction (remedial) measures may achieve lowering of the likelihood,a lessening of the consequences or in some cases both. This representation has provento be useful in justifying expenditure on remedial measures in terms of risk benefitachieved. Prioritising risk reduction measures has been achieved on the basis of:-

– Value for money– High Risks– Quick Wins– Long lead and expensive solutions

Figure 4. Semi-quantitative risk estimation

4

Figure 5. F–N curve for facility ‘A’


Detailed understanding of the potential causes, severity, consequences, escalation poten-tial and emergency response requirements, has provided the means to judge whichremedial measures will give ‘value for money’ in terms of tangible risk reduction poten-tial. The remedial measures justified so far have been included in an integrated 3 yearrolling Integrity Management Programme.

HOLISTIC RISK MANAGEMENTWhilst MAHMS is estimating risk and identifying risk reduction measures primarily onthe basis of ‘safety’ risk, both environmental and business risk issues are being consideredalso. This holistic view of risk has only marginally increased the cost and complexity ofMAHMS, and the benefits have easily outweighed this.

Two clear and specific examples of the benefits of this approach are:-

(i) Pipelines in open water do not feature highly as a safety risk and do not ordinarilyjustify risk reduction. However, failure of these lines would pose much moresignificant environmental and business risks. This attracts some attention, andmeasures to reduce the environmental and business risks can be justified. Thesemeasures coincidentally reduce the safety risks still further.

(ii) Security breaches have the potential to cause MAH events that pose significantsafety, environmental and business risks. The combination of these high levelsof risk increases the justification to improve security measures.

5


Other benefits include:-

– Very few hazards have environmental and/or business consequences without anysafety consequences.

– The characteristics (causes, severity, consequences, escalation potential actions) forany given hazard, are the same for all three types of risk. However, emergencyresponse actions will be quite different.

– Risk reduction is a matter of working to reduce the risk drivers, (reducing the charac-teristics), and hence all types of risk are reduced by the same effort whatever thejustification.

– It is easier to justify expense if remedial measures reduce all types of risk.– Business risk drivers are a direct input to business contingency planning. An under-

standing of the likelihood and consequences of business risk helps to define thedetails of the contingencies required.

– The hazard evaluation (Hazard identificationþrisk analysis) process is the same forall risk. MAHID participants therefore gain an understanding of safety, environ-mental and business risk drivers; and their experience contributes greatly todesign of hazard management strategies, critical measures and performancestandards.

MANAGING SAFETY RISK AS A CONTINUUMSafety can be viewed as the spectrum of risk from occupational, health and safety (OH&S)exposures to major accident hazard (MAH) events. Figure 6 illustrates this spectrum that

Figure 6. The safety risk continuum

6


ranges from OH&S incidents, which tend to have higher frequency but low consequences;to MAH events which tend to occur at a much lower frequency but have potentially muchhigher consequences.

Why bother to view the safety risk spectrum in this way? There are a number ofadvantages of doing so; namely:-

– Many MAH events have historically been initiated by seemingly low consequence ofan OH&S event or combination of events, which have escalated to a high potentialincident or MAH event.

– The Bird’s Triangle [Reference 2], shows a direct relationship between the numberof low consequence incidents (first aid cases, days away from work cases, etc) tomajor incidents involving fatalities.

– OH&S and MAH Safety Risks are usually managed by two separate managementsystems, and often these systems are neither integrated nor contiguous. There is avery distinct possibility that certain risk exposures are not being managed as they‘fall between’ the scopes of both systems; or become over managed, as they fallunder both systems, giving rise to potential conflicts of actions.

– Historically, a number of near misses have been caused by the same risk drivers thatcreate OH&S risk (viz: control of work, human factors, lifting operations, etc.) Anear miss can be regarded as a major accident hazard event, where the ultimateconsequences were not as great as they might have been had all potential escalationoccurred.

Figure 7. Bird’s triangle relationship between low and high consequence incidents

7


MAHMS has developed a common set of tools for the management of OH&S risk,environmental risk and MAH risk. These common tools offer the following features:-

– Calibrated risk matrices, which have common scales allowing a direct comparison tothe Company Risk Criterion to be made.

– Harmonisation of risk management methodology and terminology (matrices,likelihood and consequence definitions), which facilitates extending work placerisk management into the realms of MAH management.

– Provides a direct alignment of the risk assessment methodology with the require-ments for incident reporting and follow-up, allowing incident reporting independentof the seriousness of the consequences (actual and potential).

– The means to establish the total risk exposure for any operation (OH&S risk plusMAH risk).

Figure 8 shows how the risk assessment matrices for OH&S risk and MAH risk arecalibrated to the Company Risk Standard and the incident reporting tool.

ADOPTS A SYSTEMATIC APPROACHThe virtue of adopting a systematic approach to MAH management is that it achieves con-sistency of results and risk estimation. This is essential where comparisons of riskexposure for each facility are to be made separately and then summated to create anoverall risk profile for the Performance Units and Business Unit.

There is a clear progression from hazard identification, through hazard understand-ing to managing the hazards. So there are two types of processes employed by MAHMS,

Figure 8. Calibration of risk matrices to company risk standard

8


namely those that develop Hazard Understanding and those that manage the Hazards.These processes are listed in the following table.

The purpose of self-verification is to provide assurance that critical measures areeffective. The scheme takes credit for the maintenance, calibration, function testing andperformance testing of critical measures already carried out. Critical measures includepeople (with a specific role in MAH management), processes (management systems) aswell as more conventional items of plant. Self-verification uses performance standardsas the benchmark for judging if critical measures are performing as they should, and ifnot to what extent rectification work is required. This self-verification includes assuranceof the MAHMS process itself.

Periodically a management system review is performed to examine the MAHMSprocess and to potentially identify any areas that can be improved. This may meanraising performance standards for some aspects of the management system or criticalmeasures. This supports the aim of achieving continuous improvement in terms ofcontinuous MAH risk reduction. Figure 9 illustrates this in the form of the MAHMS model.

Table 1. Hazard understanding and management processes

Hazard Understanding Processes Delivers

MAHID List of hazards, causes, likelihood, consequences,

critical measures and qualitative risk ranking.

Hazard Summaries Hazard characteristics (causes, severity,

consequences, escalation potential, emergency

response requirements), hazard management

strategy.

Hazard Registers Hazard characteristics, critical measures, current

status of critical measures and effectiveness.

Semi-Quantitative Risk Analysis List of hazards, causes, likelihood and

consequences of events, number of fatalities, F-N

exceedance curves (risk profiles).

Hazard Management Processes Delivers

Remedial Measures Justifications Nature of risk, likelihood, consequences, risk

drivers, potential risk reduction cost and

programme for implementation.

Risk Reduction Plans Remedial measures, programme for

implementation and risk reduction to be gained

Self-verification Scheme Assurance of critical measures, performance

standards, verification scheme.

Management System Review Review protocol, opportunities for improvement to

existing management system.

9

Figure 9. Overview of the MAHMS process model


BUILDS ON EXISTING PROCESSESOne attribute to MAHMS is that it should build on existing processes as far as possible.The objective of MAHMS was to not to overburden the organisation, nor create additionallayers of management systems. This means MAHMS has had to identify and interface withkey business processes to deliver MAH management and risk reduction.

Figure 10 shows how MAHMS is integrating with policy and strategy and to someextent influencing these. It is also embedded into a range of activities, new projects (toachieve an inherently safer design), turnarounds (ensuring that major maintenance workis conducted safely), standard operating procedures (to define the safe operating envelope)and engineering projects (to influence the layout and design of new equipment; e.g. spherelaunchers/receivers and specification of temporary accommodation units).

10

Figure 10. MAHMS interface with key business processes


As already mentioned MAH management and the management of OH&S risk havebeen harmonised. Embedding MAHMS into existing operations has also been possiblefor new functional standards. For example a new Group Standard on Integrity Manage-ment [Reference 3], will rely heavily on MAHMS for conformance with the HazardEvaluations (Element 1) and MAH Potential (Element 2) of the standard. However,MAHMS will have an influence over and/or provide conformance other elements ofthe standard, namely:-

Element
3 Management of Change –
11

Considers MAH risk potential

4
Engineering Authorities – Defines Accountability, Responsibility
5
Plant Integrity – Defines Operating envelope
6
Protective Systems – Uses Performance Standards as benchmarks
7
Competent Personnel – Recognises People as critical measures
8
Incident Investigation – Identifies Failure of critical measures
9
Emergency Response – Based on Reasonably foreseeable MAH
event scenarios

10
Performance Management – Self-verification and Management Review


Some other notable processes that MAHMS influences and interfaces with, are:-

– HSSE Management Systems: For each of the expectations of Element 2 of “BP’sgetting HSE right Risk Assessment & Management” [Reference 4], MAHMS ident-ifies key processes and documents for planning, implementation and operation. Formonitoring and corrective action, leading indicators are identified for continuousmonitoring.

– Supply Chain Management: MAHMS identifies equipment and materials that areof a safety, environmental or business critical nature. Ramification – no substitutes –and urgency required. MAHMS also identifies the competence requirements of con-tract personnel who have roles and responsibilities in MAH management.

– Competency Assurance: MAHMS identifies the competence requirements forpersons who have roles and responsibilities in MAH management. (Competence isdefined as appropriate combination of, qualifications, understanding, experience,skills and other qualities) (QUESO, refer to Figure 11).

– Emergency Response: ER Plans should be based on reasonably foreseeable MAHevents and be designed to achieve safety of personnel. Major emergency manage-ment (MEM) training, should also be based on reasonably foreseeable MAH events.

– Management of Change: Needs to consider the impact of change on (1) likelihoodof MAH events; and (2) the consequences of MAH events. MAHMS identifies thevalues of benchmark parameters against which the impact of change may bejudged. (Refer to Figure 12).

CRITICAL MEASURES (PEOPLE, PROCESSES & PLANT)People and processes are a natural extension to items of plant, which are traditionallyviewed as ‘safety’ critical. In MAHMS critical measures include those that managesafety, environmental and business risk. Hazard registers list the critical measures relied

Figure 11. QUESCO ingredients of competence

12

Figure 12. Management of change — benchmark parameters


upon to eliminate, prevent, detect and control, mitigate or provide emergency response toMAH events.

People can be critical in key situations, e.g. emergencies; or while discharging their day-to-day roles and responsibilities for MAH management.Processes which contribute to actively manage MAH risks are also critical, e.g. corrosionmanagement is a process, the failure or ineffectiveness of which could directly lead to lossof containment of hydrocarbons.Plant is the more readily identified critical measure. It has two attributes in that; (1) it mayeliminate a hazard or prevent, detect, control, mitigate or provide emergency response toMAH events; and (2) the failure of the item of plant may initiate an MAH event itself.

Hazard registers also provide a means to manage the ongoing status of critical measures(see hazard understanding documentation). Each critical measure has a performance stan-dard against which self-verification is carried out.

Performance standards for people, process and plant critical measures have beendeveloped using the templates shown in Figure 13. The figure illustrates how eachperformance standard is developed to state what the critical measure is designed to do(functionality), what level of performance it is to deliver (performance specification)and under what conditions it can reasonably be expected to operate (survivability).

13

Figure 13. Performance standards template


DEVELOPS MAJOR ACCIDENT HAZARD UNDERSTANDINGUnderstanding MAHs is key to The MAHMS process. It is also aligned with most individ-ual’s desire for a safe, environmentally responsible and prosperous place of work.

Participation in Major Accident Hazard Identification (MAHID) workshops, is thefirst step towards development of MAH understanding. Other documentation providesthe means to further develop the MAH understanding required by people operating atdifferent levels in the organization. Achieving this understanding amongst the higherlevels of the organisation is proving to be a challenge.

So what exactly is ‘understanding’ and how does it differ from knowledge. Tomisquote Confucius, “tell me and I may forget” (knowledge), “let me do it and I willunderstand” (understanding). Figure 14 illustrates the four essential elements of effectivecommunication that have increasing importance in developing understanding.

MAHMS provides the information required to develop the understanding atdifferent levels of the organization. There is a close inter-relationship between hazardunderstanding and hazard management documentation.

Worthy of separate mention is the series of Key Issue Notes (KINs), which havebeen developed as aids to understanding of areas of particular concern. Each KIN dis-cusses the issue in some detail and outlines the elimination, prevention, detection andcontrol, mitigation and emergency response measures required to manage the threat. Italso recommends some specific actions to resolve the issue across the whole operation.

MAHMS has recognized that understanding needs vary according to an individual’soperating level and specific job function within the organization. MAHMS has foundthat describing roles & responsibilities in terms of ‘Accountability’ ‘Responsibility’,

14

Figure 14. Essential elements of effective communication


‘Facilitators’ and ‘Implementers’ to be particularly useful. An ARFI chart for the IntegrityManagement Function has been drawn up to illustrate this in Figure 15.

Various communication tools have been identified to enable the ongoing develop-ment of MAH understanding and the communication of risk. These tools form part of adocumented communication strategy, as shown in Figure 16.

MAKING HAZARD INFORMATION READILY AVAILABLEThe formal safety assessments required by the UK Safety Case Regulations [Reference 5],have traditionally been written for the UK Safety Regulator as the customer and safetyprofessionals as the target audience. Hence they are usually written in terms that are noteasily understood by the layman. Information useful for day-to-day management ofMAHs is often difficult to find and can require some interpretation before use.

MAHMS has set out to improve on this situation by using non-technical languagewherever possible and lodging all relevant MAH information on a MAHMS Website.This has proven invaluable to those who have a role to play in MAH management and

15

Figure 15. ARFI chart for integrity management function

Figure 16. Hazard understanding communication tools


16


an interesting source of information for others not directly involved. The main features ofthe website are:-

– It is a readily accessible, up-to-date source of information and the preferred mediumfor most users.

– It is highly graphical, intuitive operation, provides easy cross-referencing and linksto other relevant websites/or documentation.

– It enables MAHMS hazard understanding and management documentation to be keptdynamic. Updates do not require exhaustive document management arrangementsand re-issue of hard copies.

The home page of the MAHMS Website is the ‘portal’ (Figure 17) from which allinformation can be retrieved. It is simple and intuitive in use. Access to facility specificinformation is via the interactive map. The hazard understanding and management infor-mation is then accessible via the facility risk picture, which shows all the MAHs and theircontribution to the overall MAH risk for that facility. More detailed information is acces-sible by clicking on the relevant segment of the risk picture – allowing the user to “drilldown” to their level of interest.

Although the Website requires continuous effort to keep dynamic – it has provenvery popular with users.

Figure 17. MAHMS website portal home page

17

Figure 18. MAHMS project mission statement


INHERITANCE & SUSTAINANCE OF MAHMSThe development (Phase II) and Inheritance (Phase III) of MAHMS has been a projectresponsibility. However, it was always envisaged that MAHMS would be a continuousprocess, which it will need to be to deliver MAH management over the lifetime of thefacilities.

BP have an evaluation process for judging the viability and added value of projects.This is called the Capital Value Process (CVP) [Reference 6]. The various stages of theMAHMS project have been fully aligned to the 5 stages of the CVP process.

It is the philosophy of MAHMS project that the operation should inherit the process,to be owned and operated by the organisation. To this end, the project team is defining theorganisation required to maintain and sustain the process beyond the project phases. Thismeans determining the number of personnel required to operate MAHMS, and for eachpost developing a job specification. Individuals will be appointed/recruited againstthese job specifications. This is being done well ahead of the end of the project phase,representing the transition from ‘Execute’ to ‘Operate’ so that formal and on-the-job train-ing can be completed for the sustenance team.

It is not only the MAHMS sustenance team that is being considered however, but thewhole workforce who will need to inherit the MAHMS process. They will be responsiblefor embedding it into the key business processes and adopting behaviours that will ensueMAHMS will become a ‘natural way of working’. This will be necessary to achieve theMAHMS mission statement shown in Figure 18.

REFERENCES1. Dalzell, Ditchburn & Mohess; “Understanding Major Accident Hazards — The Cutting

Edge of Common Sense” IChemE NW Branch Hazards XVII Symposium, Manchester:

25–27th March 2003.

18


2. Bird, F E; “Damage Control” Insurance Company of North America, Philedelphia 1966.

3. BP Group Functional Standard — Integrity Management, Draft 2004.

4. BP Group “Getting HSE Right — HSE Management System Framework” dated March

1999.

5. UK Safety Case Regulations, Statutory Instrument SI 1992/915.

6. BP Capital Value Process (CVP), Updated 19 October 1999.

19

IMPLEMENTING MAJOR ACCIDENT HAZARD MANAGEMENT — SILO BUSTING IN PRACTICE

Documents

major accident hazard

quantitative risk analysis

provide emergency response

emergency response requirements

company risk criteria

integrity management function

company risk criterion

continuous risk reduction