View
198
Download
2
Category
Preview:
Citation preview
Page1of59
Health and Safety Executive
Developing process safety indicatorsAstep-by-stepguideforchemicalandmajorhazardindustries
This is a free-to-download, web-friendly version of HSG254 (First edition, published 2006). This version has been adapted for online use from HSE’s current printed version.
Youcanbuythebookatwww.hsebooks.co.ukandmostgoodbookshops.
ISBN 978 0 7176 6180 0Price £11.95
This guidance is aimed at senior managers and safety professionals within major hazard organisations that wish to develop performance indicators to give improved assurance that major hazard risks are under control.
It is presumed that companies using this guide already have appropriate safety management systems, so the emphasis is on checking whether their risk controls are effective and operating as intended. The guide draws on good practice in the UK chemical sector.
Too many organisations rely heavily on failure data to monitor performance, so improvements or changes are only determined after something has gone wrong.Discovering weaknesses in control systems by having a major incident is too late and too costly. Early warning of dangerous deterioration within critical systems provides an opportunity to avoid major incidents. Knowing that process risks are effectively controlled has a clear link with business efficiency, as several indicators can be used to show plant availability and optimised operating conditions.
While aimed mainly at major hazard organisations, the generic model for establishing a performance measurement system described in this guide will also apply to other enterprises requiring a high level of assurance that systems and procedures continue to operate as intended.
HSE Books
Page2of59
© Crown copyright 2006
Firstpublished2006
ISBN9780717661800
Allrightsreserved.Nopartofthispublicationmaybereproduced,storedinaretrievalsystem,ortransmittedinanyformorbyanymeans(electronic,mechanical,photocopying,recordingorotherwise)withoutthepriorwrittenpermissionofthecopyrightowner.
Applicationsforreproductionshouldbemadeinwritingto:TheOfficeofPublicSectorInformation,InformationPolicyTeam,Kew,Richmond,SurreyTW94DUore-mail:licensing@opsi.gov.uk
ThisguidanceisissuedbytheHealthandSafetyExecutive.Followingtheguidanceisnotcompulsoryandyouarefreetotakeotheraction.Butifyoudofollowtheguidanceyouwillnormallybedoingenoughtocomplywiththelaw.Healthandsafetyinspectorsseektosecurecompliancewiththelawandmayrefertothisguidanceasillustratinggoodpractice.
Health and Safety Executive
Developingprocesssafetyindicators Page3of59
Health and Safety Executive
ContentsForeword 4
Part 1: Introduction 5 Structureandcontent 6 Measuringperformance–earlywarningbeforecatastrophicfailure 6 What’sdifferentaboutthisguide? 6
Part 2: Six steps to performance measurement 10 Step 1:Establishtheorganisationalarrangementstoimplement indicators 11 Step 2:Decideonthescopeoftheindicators 13 Step 3:Identifytheriskcontrolsystemsanddecideonthe outcomes 18 Step 4:Identifycriticalelementsofeachriskcontrolsystem 22 Step 5:Establishdatacollectionandreportingsystem 25 Step 6:Review 26
Part 3: Worked example 28 Riskcontrolsystems 37
References 58
Further information 59
Developingprocesssafetyindicators Page4of59
Health and Safety Executive
ForewordThereisacollectiveneedforthechemicalandmajorhazardsectorstodemonstratethatrisksarebeingadequatelycontrolled,astheindustryisoftenjudgedbytheworstperformeroragainstthelastmajorincidenttogainpublicattention.SincethepublicationoftheBPGrangemouthMajorincidentinvestigationreport,1theHealthandSafetyExecutive(HSE)andindustryhavebeenworkingcloselytodevelopthemeansbywhichcompaniescandevelopkeyperformanceindicatorsformajorhazardsandensureprocesssafetyperformanceismonitoredandreportedagainsttheseparameters.
ThisguidehasbeenproducedjointlybyHSEandtheChemicalIndustriesAssociation(CIA),basedoninformationandideasfromindustry.Thesix-stageprocessoutlinedshouldhelpcompaniesthroughthemainstepstowardsimplementingprocesssafetyperformanceindicators.
Investigationofmajorincidentschemicalandmajorhazardinstallationshaveshownthatitisvitalthatchemicalcompaniesknowthatsystemsdesignedtocontrolrisksoperateasintended.Thiswork,builtfromclosecollaborationbetweenHSEandindustry,helpsprovidethisassurance.Itisimportantthatwecontinuetoshareunderstandingofbestpracticeinthisdevelopingarea.Reviewingperformancewillincreasinglyfeatureinourinspectionprogramme.
Kevin AllarsHeadofChemicalIndustriesDivisionHSEMeasurementleadstoconfidence.
OurResponsibeCare®2commitmentistocontinuousimprovementinallaspectsofhealth,safetyandenvironmentalmanagement.Thisimportantnewinitiativewillhelpusallgainabetterunderstandingofpotentiallyseriousincidentprecursors,andwillenableustomakefurtherimprovementstoouroverallhealth,safetyandenvironmentalmanagementsystems.
Steve ElliotDirectorGeneralChemicalIndustriesAssociation
Developingprocesssafetyindicators Page5of59
Health and Safety Executive
Part 1: IntroductionMeasurement leads to confidence
1 Thisguideisintendedforseniormanagersandsafetyprofessionalswithinorganisationsthatwishtodevelopperformanceindicatorstoprovideassurancethatmajorhazardrisksareundercontrol.Asmallnumberofcarefullychosenindicatorscanmonitorthestatusofkeysystemsandprovideanearlywarningshouldcontrolsdeterioratedangerously.
2 Althoughprimarilyaimedatmajorhazardorganisations,thegenericmodelforestablishingaperformancemeasurementsystemdescribedinthisguidecanequallybeappliedtootherenterprisesrequiringahighlevelofassurancethatsystemsandprocedurescontinuetooperateasintended.
3 Itispresumedthatcompaniesusingthisguidealreadyhaveappropriatesafetymanagementsystemsinplace;theemphasisofthisguideisthereforetocheckwhetherthecontrolsinplaceareeffectiveandoperatingasintended.
4 Toomanyorganisationsrelyheavilyonfailuredatatomonitorperformance.Theconsequenceofthisapproachisthatimprovementsorchangesareonlydeterminedaftersomethinghasgonewrong.Oftenthedifferencebetweenwhetherasystemfailureresultsinaminororacatastrophicoutcomeispurelydowntochance.Effectivemanagementofmajorhazardsrequiresaproactiveapproachtoriskmanagement,soinformationtoconfirmcriticalsystemsareoperatingasintendedisessential.Switchingtheemphasisinfavourofleadingindicatorstoconfirmthatriskcontrolscontinuetooperateisanimportantstepforwardinthemanagementofmajorhazardrisks.
5 Themainreasonformeasuringprocesssafetyperformanceistoprovideongoingassurancethatrisksarebeingadequatelycontrolled.Directorsandseniormanagersneedtomonitortheeffectivenessofinternalcontrolsagainstbusinessrisks.Formajorhazardinstallationsandchemicalmanufacturers,processsafetyriskswillbeasignificantaspectofbusinessrisk,assetintegrityandreputation.Manyorganisationsdonothavegoodinformationtoshowhowwelltheyaremanagingmajorhazardrisks.Thisisbecausetheinformationgatheredtendstobelimitedtomeasuringfailures,suchasincidentsornearmisses.Discoveringweaknessesincontrolsystemsbyhavingamajorincidentistoolateandtoocostly.Earlywarningofdangerousdeteriorationwithincriticalsystemsprovidesanopportunitytoavoidmajorincidents.Knowingthatprocessrisksareeffectivelycontrolledhasaclearlinkwithbusinessefficiency,asseveralindicatorscanbeusedtoshowplantavailabilityandoptimisedoperatingconditions.
6 Themethodofsettingindicatorsoutlinedinthisguiderequiresthoseinvolvedinmanagingprocesssafetyriskstoasksomefundamentalquestionsabouttheirsystems,suchas:
n Whatcangowrong?n Whatcontrolsareinplacetopreventmajorincidents?n Whatdoeseachcontroldeliverintermsofa‘safety outcome’?n Howdoweknowtheycontinuetooperateasintended?
7 Companieswhohaveadoptedprocesssafetyperformanceindicatorshavereportedthattheyhave:
n anincreasedassuranceonriskmanagementandprotectedreputation;
Developingprocesssafetyindicators Page6of59
Health and Safety Executive
n demonstratedthesuitabilityoftheirriskcontrolsystems;n avoideddiscoveringweaknessesthroughcostlyincidents;n stoppedcollectingandreportingperformanceinformationwhichwasnolonger
relevant–therebysavingcosts;andn madebetteruseofinformationalreadycollectedforotherpurposes,egquality
management.
Structure and content
8 Part 2,themainpartofthisguide,describesasix-stepprocessthatcanbeadoptedbyorganisationswishingtoimplementaprogrammeofperformancemeasurementforprocesssafetyrisks.Eachstageisexplainedindetailwithinaseparatechapter.Tohelpputtheprocessintocontext,afullworkedexampleforatop-tierCOMAH3siteisincludedinPart 3.
9 Althoughthismodelcanbefollowedstep-by-step,manyorganisationsalreadyhaveaperformancemeasurementsysteminplaceandmaynotwishtoembarkonradicalchange.Insuchcircumstances,thisguidemaybeusedasaframeworkagainstwhichtocompareexistingprogrammestodecideifimprovementsareneeded,asitdrawsongoodpracticewithintheUKchemicalsector.
10 Throughoutthisguide,theterm‘process safety management system’isusedtodescribethosepartsofanorganisation’smanagementsystemintendedtopreventmajorincidentsarisingoutoftheproduction,storageandhandlingofdangeroussubstances.‘Risk control system’(RCS)isusedtodescribeaconstituentpartofaprocesssafetymanagementsystemthatfocusesonaspecificriskoractivity,egplantandprocesschange,permittowork,inspectionandmaintenanceetc.
Measuring performance – early warning before catastrophic failure
11 Mostsystemsandproceduresdeteriorateovertime,andsystemfailuresdiscoveredfollowingamajorincidentfrequentlysurpriseseniormanagers,whosincerelybelievedthatthecontrolswerefunctioningasdesigned.Usedeffectively,processsafetyindicatorscanprovideanearlywarning,beforecatastrophicfailure,thatcriticalcontrolshavedeterioratedtoanunacceptablelevel.
12 Measuringperformancetoassesshoweffectivelyrisksarebeingcontrolledisanessentialpartofahealthandsafetymanagementsystem,asexplainedinSuccessful health and safety management,4and,forexample,theCIA’sResponsible Care Management Systems:5
n active monitoringprovidesfeedbackonperformancebeforeanaccidentorincident;whereas
n reactive monitoringinvolvesidentifyingandreportingonincidentstocheckthecontrolsinplaceareadequate,toidentifyweaknessesorgapsincontrolsystemsandtolearnfrommistakes.
What’s different about this guide? Dual assurance – a leading and lagging indicator for each risk control system13 Themaindifferencebetweentheapproachoutlinedinthisguideandexistingguidanceonperformancemeasurementistheintroductionoftheconceptof‘dualassurance’thatkeyriskcontrolsystemsareoperatingasintended.Leadingandlaggingindicatorsaresetinastructuredandsystematicwayforeachcriticalrisk
Developingprocesssafetyindicators Page7of59
Health and Safety Executive
controlsystemwithinthewholeprocesssafetymanagementsystem.Intandemtheyactassystemguardiansprovidingdualassurancetoconfirmthattheriskcontrolsystemisoperatingasintendedorprovidingawarningthatproblemsarestartingtodevelop.Leading indicators 14 Leadingindicatorsareaformofactivemonitoringfocusedonafewcriticalriskcontrolsystemstoensuretheircontinuedeffectiveness.Leading indicators require a routine systematic check that key actions or activities are undertaken as intended.Theycanbeconsideredasmeasuresofprocessorinputsessentialtodeliverthedesiredsafetyoutcome.Lagging indicators 15 Laggingindicatorsareaformofreactivemonitoringrequiringthereportingandinvestigationofspecificincidentsandeventstodiscoverweaknessesinthatsystem.Theseincidentsoreventsdonothavetoresultinmajordamageorinjuryorevenalossofcontainment,providingthattheyrepresentafailureofasignificantcontrolsystemwhichguardsagainstorlimitstheconsequencesofamajorincident.Lagging indicators show when a desired safety outcome has failed, or has not been achieved.
16 AccordingtoJamesReasoninManaging the Risks of Organizational Accidents,6(major)accidentsresultwhenaseriesoffailingswithinseveralcriticalriskcontrolsystemsmaterialiseconcurrently.Figure2illustratesan‘accidenttrajectory’modelwhereanaccidenttrajectorypassesthroughcorrespondingholesinthelayersofdefence,barriersandsafeguards.Eachriskcontrolsystemrepresentsanimportantbarrierorsafeguardwithintheprocesssafetymanagementsystem.Itshouldalsoberecognisedthatasignificantfailinginjustonecriticalbarriermaybesufficientinitselftogiverisetoamajoraccident.
17 Foreachriskcontrolsystem:
n theleadingindicatoridentifiesfailingsor‘holes’invitalaspectsoftheriskcontrolsystemdiscoveredduring routine checksontheoperationofa
Figure 1 Dualassurance-leadingandlaggingindicatorsmeasuringperformanceofeachcriticalriskcontrolsystem
Developingprocesssafetyindicators Page8of59
Health and Safety Executive
criticalactivitywithintheriskcontrolsystem;andn thelaggingindicatorrevealsfailingsor‘holes’inthatbarrierdiscovered
following an incident or adverse event.Theincidentdoesnotnecessarilyhavetoresultininjuryorenvironmentaldamageandcanbeanearmiss,precursoreventorundesiredoutcomeattributabletoafailinginthatriskcontrolsystem.
18 Ifunchecked,allsystemswilldeteriorateovertimeandmajorincidentsoccurwhendefectsacrossanumberofriskcontrolsystemsmaterialiseconcurrently.Settingleadingandlaggingindicatorsforeachriskcriticalcontrolsystemshouldrevealfailingsinthesebarriersastheyariseandbeforealltheimportantbarriersaredefeated.
Frequency of checks19 Manyorganisationsrelyonauditingtohighlightsystemdeterioration.However,auditintervalscanbetooinfrequenttodetectrapidchange,ortheauditmayfocusoncompliance(verifyingtherightsystemsareinplace),ratherthanensuringsystemsaredeliveringthedesiredsafetyoutcome.Theuseofprocesssafetyperformanceindicatorsfitsbetweentheseformal,infrequentauditsandmorefrequentworkplaceinspectionandsafetyobservationprogrammes.Itisimportant
Figure 2 Leadingandlaggingindicatorssettodetectdefectsinimportantriskcontrolsystems
(ReproducedwithpermissionofAshgatePublishingLimited,fromManaging the Risks of Organizational AccidentsJamesReason1997AshgatePublishingLimited)6
Developingprocesssafetyindicators Page9of59
Health and Safety Executive
tobearinmindthatanauditprogrammemaybedesignedtoaddressdifferentissueswhencomparedtotheinformationgainedfromperformanceindicators.Ideally,eachwillinformtheother.Deficienciesuncoveredbyanauditmayhighlighttheneedforanewperformanceindicatorandviceversa.Therefore,performanceindicatorsarenotasubstituteforanauditprogrammebutacomplimentaryactivitytogivemorefrequentordifferentinformationonsystemperformance.
Figure 3 Howperformanceindicatorsfitwithinnormalhealthandsafetymonitoringactivities
Developingprocesssafetyindicators Page10of59
Health and Safety Executive
Part 2: Six steps to performance measurement20 Thissectionoutlinesthesixmainstagesneededtoimplementaprocesssafetymeasurementsystem.Organisationsthatdonothaveaprocesssafetyperformancemeasurementsystemwouldbenefitfromconsideringeachstageinturn.Organisationswithperformancemeasurementsystemsinplacecanusethisguideasabenchmarkofgoodpracticeandconsiderimprovementsasappropriate.
Table 1 Overviewofthesixstepstosettingperformanceindicators
Step1 Establishtheorganisationalarrangementstoimplementtheindicators
Appointastewardorchampion
Setupanimplementationteam
Seniormanagementshouldbeinvolved
Step2 Decideonthescopeofthemeasurementsystem.Considerwhatcangowrongandwhere.
Selecttheorganisationallevel
Identifythescopeofthemeasurementsystem:n Identifyincidentscenarios-wnatcangowrong?n Identifytheimmediatecausesofhazardscenariosn Reviewperformanceandnon-conformances
Step3 Identifytheriskcontrolsystemsinplacetopreventmajoraccidents.Decideontheoutcomesforeachandset a lagging indicator
Whatriskcontrolsystemsareinplace?
Describetheoutcome
Setalaggingindicator
Followupdeviationsfromtheoutcome
Step4 Identifythecriticalelementsofeachriskcontrolsystem,(iethoseactionsorprocesseswhichmustfunctioncorrectlytodelivertheoutcomes)andset leading indicators
Whatarethemostimportantpartsoftheriskcontrolsystem?
Setleadingindicators
Settolerances
Followupdeviationsfromtolerances
Step5 Establishthedatacollectionandreportingsystem Collectinformation-ensureinformation/unitofmeasurementisavailableorcanbeestablished
Decideonpresentationformat
Step6 Review Reviewperformanceofprocessmanagementsystem
Reviewthescopeoftheindicators
Reviewthetolerances
Developingprocesssafetyindicators Page11of59
Health and Safety Executive
Step 1: Establish the organisational arrangements to implement indicators
n Appoint a steward or champion to take the initiative forward.
n In larger organisations, consider using a process safety steering committee.
n Senior management should be actively involved in the development of indicators.
21 Neworganisationalarrangementsmaybeneededtoimplementaperformancemeasurementsystem.Someonewillhavetomakethecaseforprocesssafetymeasurementwithinthecompanyandthendriveitforwardtoimplementation.Thebenefitsandthecostswillneedtobecarefullyconsideredandthedetailsoftheexactindicatorsdetermined.
Step 1.1: Appoint a steward or champion
22 Astewardorchampionisneededto:
n promote,driveforwardandco-ordinatetheintroductionofthenewconceptandsystem;
n makethebusinesscaseandlinkwithcompanyhealth,safety,environment,qualityandbusinessimprovementsystems;
n communicateideasandprogress;n keepintouchwithothersworkinginthisareaandgatherinformationonbest
practice;andn identifyandevaluatethebenefitsachieved.
Make the business case 23 Developingandimplementingprocesssafetyindicatorsisoftenanewareaofworkwithinmanyorganisations,andtheneedforsuchasystemwillnotbeimmediatelyobvioustomanypeople.Tobesuccessful,thissortofinitiativerequiressomeonewithintheorganisationtopromotetheidea,gaugesupportandthentodriveforwardtheinitiative.Thismayincludemakingthebusinesscaseforadoptingperformanceindicatorsandsecuringsuitableresources.
24 Monitoringandmeasuringperformancehasalwaysbeenpartofhealthandsafetymanagementsystems.However,suchsystemsfrequentlyoverlookprocesssafetyissuesbecauseitisdifficulttoknowwhattomeasureandhowtosetleadingindicators.Whereperformanceindicatorsalreadyfeatureinacompanyhealthandsafetymanagementsystem,itisimportantforsomeonetocheckthesuitabilityofthoseindicatorsforprovidingongoingassuranceonthecontrolofprocesssafetyrisks.ItcouldbethatexistingperformanceindicatorsmayonlyshowhalfthestoryandthatdualassurancederivedfromselectingaleadingandlaggingindicatorforeachcriticalRCScanaddsignificantlytosuchasystem.Clarifyinggapsandweaknessesinexistingmeasurementsystemsandidentifyingtheassociatedbusinessriskswillbeakeypartofanycaseforchange.
Developingprocesssafetyindicators Page12of59
Health and Safety Executive
Identifying the business benefits25 Identifyingassociatedbusinessbenefitsthatcanaccruefromimprovedprocesssafetymeasurement(suchasimprovedproductivity,efficiency,reductioninthecostofloss-of-containmentincidentsandimprovedassetmanagement)willhelptoselltheinitiativewithintheorganisation.
Learning from others and sharing good practice26 Thisisadevelopingareaofworkwithnewideasandexperiencesofusingprocesssafetyindicatorsemergingallthetime.Toavoidstartingwithablanksheetofpaper,itishelpfultoknowwhatotherswithintheindustryaredoingandwhatrepresentsgoodpractice.Itisimportantthereforethatsomeonekeepsuptodatewiththesedevelopments,egbyjoiningHSE’swebcommunityforum7orparticipatinginaCIAResponsible Care Cell.8
Step 1.2: Set up an implementation team
27 Considerthefollowingfactorstodecidewhetheranimplementationteamisneeded:
n theworkloadmaybetoomuchworkforoneperson;n theremaybeextrabenefitfromateamapproach–egcollectiveideas;n largeorganisationswithbusysafetycommitteesmayneedaseparateforum/
steeringcommittee;n involvingemployeesshouldfosterasharedunderstandingandownershipof
risksandcontrols.
28 Itwillusuallybeasafetyprofessionalwithinanorganisationwhowillchampiontheworkandsteeritthroughtoimplementation.However,inlargeorganisationstherewillbetoomuchforonepersontodealwithaloneanditisoftenmoreappropriatetoformateamtomanagetheintroductionofprocesssafetyindicators.Thishasthebenefitofdrawinginpeoplefromarangeofbusinessoperations,providingtheopportunityforpoolingideas,especiallyfromemployeeswhohavedirectknowledgeofhowsystemsdeteriorateorbecomeineffective.Asteeringcommitteemayalsobehelpfultooverseetheimplementationprogrammeandtochecktheindicatorsmatchcurrentbusinesspriorities.Fortop-tierCOMAHsites,theimplementationteamandsteeringgroup(whereused)shouldcompriseofpeoplefamiliarwiththesafetyreport.
Step 1.3: Senior management involvement
n Directors and senior managers are the main customers for risk assurance information.
n Senior managers should actively participate in the implementation.
n Business benefits should be agreed.
29 The active control of business risks by directors and senior managers is an essential part of corporate governance.9 Senior managers need to fully understand the business benefits of performance measurement and clearly see how managing process safety contributes to the success and sustainability of their company.Itisvitalthatseniormanagersarecommittedtoadoptingmeaningfulindicatorsastheyhaveultimateresponsibilityforthecontrolofriskandarethereforethemaincustomerfortheenhancedinformation.Itisimportantthatmanagementteams,chiefexecutivesanddirectorsagreethatthe
Developingprocesssafetyindicators Page13of59
Health and Safety Executive
indicatorschosenprovidethemwiththerightscopeandlevelofinformationtheyneedtobesatisfiedthatprocesssafetyrisksareundercontrol.
30 Seniormanagersneedtomakeappropriateresourcesandsupportavailablefortheintroductionofprocesssafetyindicators.
Step 2: Decide on the scope of the indicatorsSelect the organisational level to which indicators will apply, eg:
n the whole organisation;
n an individual site or group of sites;
n an individual installation/plant.
31 Settingthescopeisaboutselectingtherightindicatorstoprovidejustenoughinformationabouttheadequacyofprocesssafetycontrols.Performancecanbemonitoredatanumberoforganisationallevelswithinabusinessandtheinformationcanbepresentedinahierarchicalmanner.Thenatureoftheindicatorswillvarydependingupontheorganisationallevelatwhichtheyhavebeenset.Indicatorssetforthewholeorganisationalwill,bytheirnature,tendtobemoregeneric,whereasthosesetatplantorsitelevelwillbemorefocusedonkeyactivitiesorprocessesandgivemoredirectfeedbackonthefunctioningofthoseactivities.
Tailor the indicators to suit the business
32 Themanagementsystemsandactivitiesofeveryorganisationaredifferentandsothewayperformanceindicatorsmaybeusedwillalsodifferfromoneorganisationtoanother.Thereisnorightsystemtosuiteveryneedandmanyenterprisesalreadyhavekeyperformanceindicators(KPIs)coveringanumberofbusinessactivities.Itisimportantthatnewindicatorscoveringprocesssafetyareintegratedintoandcomplementexistingarrangementsformonitoringbusinessperformance.
How many indicators? Quality not quantity
33 Itisnotnecessarytomeasureeveryaspectorelementofaprocesssafetymanagementsystem.Focusingonafewcriticalriskcontrolsystemswillprovideasufficientoverviewofperformance.Problemshighlightedinoneriskcontrolsystemshouldtriggeramorewidespreadreview.
34 Busymanagementteamswillquicklyloseinterestinanextensiveraftofindicators,soitisessentialtoavoidKPIoverload.Datacollectionandanalysisisresourceintensive,soarrangementsformonitoringperformancehavetobecosteffective.Evenforthelargestorganisationsafewindicatorssetagainstthemainriskswillbesufficienttoprovideahighdegreeofassuranceacrossthewholebusiness.
Developingprocesssafetyindicators Page14of59
Health and Safety Executive
Step 2.1: Select the organisational level
35 Thissectionappliesmainlytolargeormulti-siteorganisations.
Decide whether to set indicators at organisation, site or installation/plant level.
36 Manylargeorganisationscascadeperformancetargetsdownwardsthroughthemanagementchainandrequireperformanceinformationagainstsuchtargetstobereportedbackupwards.Traditionally,upwardreportingcomprisedsimplyofexceptionalreportingofincidents.Toprovideassurance,informationtoconfirmthatkeysystemsareoperatingasintendedshouldberoutinelyreportedupwardstodirectorsandseniormanagers.
37 Indicatorssetatplantlevelprovidemanagerswithroutineinformationtoshowthatspecificprocessesoractivitiesareoperatingasintended,egplantdesign,plantchange,plannedinspectionandmaintenancewithinthatsphereofoperations.Indicatorsatthislevelprovideveryspecificperformanceinformationontheactivitiesselected.
38 Indicatorsatsitelevelprovideanoverviewofcriticalsystemsoperatingacrossthewholesite.Usingahierarchicalapproach,informationfromindividualinstallationsoroperationalplantscanbesummarisedacrossthewholesite,egmanagingcontractors,emergencyarrangements,staffcompetence.39 Atanorganisationallevel,ashortsummaryofhigh-levelindicatorsisneeded.Thesemaybebasedoncorporategoalsandobjectives(atop-downapproach),butimportantly,shouldalsofeatureinformationfedupfromsitelevel.
40 Forcomplexsitessuchasrefineriesandwithinmulti-siteorganisations,theperformancemeasurementsystemcanbebasedonahierarchicalapproachwithveryfocusedinstallationlevelindicatorsfeedinguptomoregenericsitelevelandorganisationlevelindicators.Lowlevelindicatorscanbeweightedtoreflecttheirimportanceataparticularsiteorinstallation,orcanbedesignatedas‘indexindicators’toshowthatthemostimpactsystemsareoperatingasintendedacrossthesiteororganisation.
Developingprocesssafetyindicators Page15of59
Health and Safety Executive
Developing process safety indicators
99
Figure 4 A hierarchical Process Safety Performance Management System for a multi-site organisation
Pla
ntch
ang
eR
CS
Insp
ecti
on
and
mai
nten
ance
RC
S
Sta
ffco
mp
eten
ceR
CS
Op
erat
ing
pro
ced
ures
RC
S
Em
erg
ency
arra
ngem
ents
RC
S
Per
mit
tow
ork
RC
S
Organisational level indicators willbe generic and reflect commonprocess safety system elements inplace in all company facilities
Installation indicators should be based on what can go wrong at the individual installation to give rise to a major accident/serious incident.Installation level indicators should be very focused on the individual RCS critical to the safe operation of that installation or plant
Individual RCS may be given differentweightings based upon the criticality of thatRCS for the installation/plant, eg staffcompetence and permit to work may be themost critical or vulnerable RCS on InstallationA, whereas inspection and maintenance maybe the most important RCS at Installation B,etc. These higher weighted RCS could then beused as ‘index’ indicators for the whole site
x 1 x 1 x 3 x 1 x 1 x 2
Installation/plant/facility A
Installation/plant/facility ASite 1
Installation/plant/facility BSite 1
Installation/plant/facility ASite 2
Installation/plant/facility BSite 2
Installation/plant orfacility levelindicators
A site level indicator could be red ifany of the subsidiary installationlevel indicators were ‘red’.Alternatively, the result could bebiased towards the ‘index’indicators chosen for eachinstallation or plant
Site levelindicators
Organisationlevelindicators
Site indicators should reflect themajor hazard scenarios relevant toeach site and show the condition ofthe RCS in place at the site toprevent the major accident hazards
Using a traffic light system ofproducing the information fromindicators the organisational levelindicator would be ‘red’ if any ofthe subsidiary sites had a ‘red’ onthe same element
Site 1 Site 2
Figure 4 AhierarchicalProcessSafetyPerformanceManagementSystemforamulti-siteorganisation
Developingprocesssafetyindicators Page16of59
Health and Safety Executive
Dual assurance
41 Figure5illustratesthemethodusedtoestablishfirstlyalaggingindicatorandthenleadingindicatorsforeachimportantriskcontrolsystem.Thestronglinkbetweenleadingandlaggingindicatorsactingintandemprovidesdualassurancethattheriskinquestionisbeingeffectivelymanaged.
Figure 5 Settingindicators-anoverview
Developingprocesssafetyindicators Page17of59
Health and Safety Executive
Step 2.2: Identify the scope of the measurement system
Identify the scope based on:
n the main process safety risks and key risk control systems;
n areas where greater assurance on business risk is needed.
2.2.1: Identify hazard scenarios – what can go wrong?42 Itisimportanttosetleadingandlaggingindicatorsfortheimportantriskcontrolsystemsinplacetocontrolormitigateagainstmajorhazards–seeFigures1and2.Thesewilldifferdependinguponwhereintheorganisationitisdecidedtosettheindicators.
Figure 6 Identifywhatcangowrong
43 ForCOMAH3top-tierinstallations,theriskcontrolsystemswillhavebeenfullydescribedinthesafetyreport.AtCOMAHlower-tierinstallationsandothersites,identifytheprocesssafetyrisksbyfirstidentifyingarangeofhazardscenariosassociatedwiththebusinessoractivitybeingconsidered,eghowmajoraccidentsandincidentscanoccurfromactivitiessuchasstorage,useandtransferofhazardoussubstances.Askwhatcangowrongwithineachmainareaofyourbusiness.
44 Describingthemainincidentscenarioshelpsyoufocusonthemostimportantactivitiesandcontrolsagainstwhichindicatorsshouldbeset.Thescenariosformausefulcross-checklateroninStep4,whenthecriticalelementsofriskcontrolsystemstobemonitoredaredetermined.
2.2.2: Identify the immediate causes of hazard scenarios45 Tohelpdecidewhatcangowrongandhow,itisusefultoconsidertheimmediatecauseofanincident.Thisistheprimaryfailuremechanismthatgivesrisetoanincidentandcanusuallybecategorisedbyconditionsorfactorsthatchallengetheintegrityofplantorequipment.Forinstance,apipelineorbulktankfailurecouldbedueto:
n wear;n corrosion;n damage;n over/underpressurisation;orn fireorexplosion.
46 Lookalsoatareaswherethereareknownproblemsorconcernsabouttheadequacyofriskcontrolsystems.Thiscouldbebasedonpastincident/near-missdataorinformationfromauditsandinspections.Itisbeneficialtoincludeworkforcerepresentativesinthisprocess,asitwilladdressissuesofmostconcerntothem.
47 Anassessmentofallthesefactorsshouldhelpestablishthescopeoftheprocessmeasurementsystemandensureyoufocusoncriticalissues.
Developingprocesssafetyindicators Page18of59
Health and Safety Executive
Step 3: Identify the risk control systems and decide on the outcomes
n List the important risk control systems.
n Describe the outcome for each risk control system.
n Set a lagging indicator to show whether the outcome is achieved.
If you don’t clearly identify the ‘desired safety outcome’ in terms of ‘success’, it will be impossible to identify indicators that show the desired outcome is being achieved.
Step 3.1: What risk control systems are in place?
48 Foreachscenarioidentifytheriskcontrolsystemsinplacetopreventormitigatetheconsequencesoftheseevents.Theremaybeseveralinterrelatedoroverlappingriskcontrolsystemsaimedatpreventionormitigation.ItmaybehelpfultodrawupariskcontrolsystemmatrixasillustratedinPart 3,Table3.
Identify the primary cause49 Todeterminewhichriskcontrolsystemsareimportanttopreventorcontrolachallengetointegrity,firstconsidertheprimarycausesofthescenariosidentifiedinStep2.2.2.Forexample,theprimarycausesofplantorequipmentwearcouldbe:
n physicalabrasion;n vibration;orn stress.
50 Aplannedplantinspectionandmaintenancesystemisakeyriskcontrolsystemexpectedtobeinplacetopreventplantfailureduetowear.
Figure 7 Considerwhatriskcontrolsystemsareinplace
planned plant inspection and maintenance RCS guards against failure due to wear
eg plant failure due to wear
plant and equipment does not fail due to wear
Developingprocesssafetyindicators Page19of59
Health and Safety Executive
Step 3.2: Describe the outcome
51 Afterdecidingonthehazardscenariosandassociatedriskcontrolsystemsresponsibleforpreventingincidentsormitigatingconsequences,decide what success looks likeforeachriskcontrolsystemasitimpactsonthehazardscenario.This should be expressed as the ‘desired safety outcome’.Forexample,adesiredsafetyoutcomeforaplantinspectionandmaintenanceriskcontrolsystemcouldbe‘nofailuresorbreakdownofsafetycriticalplantorequipmentduetocomponentswearingout’.
52 Itisoftendifficulttodescribetheoutcomeofariskcontrolsystemthatmayhavebeeninplaceforalongtime.Youmayfindthefollowingquestionshelpful:
n Whydowehavethisriskcontrolsystem?n Whatdoesitdeliverintermsofsafety?n Whatwouldbetheconsequenceifwedidn’thavethissysteminplace?
Step 3.3: Setting a lagging indicator
53 Set a lagging indicator to directly show whether or not you are achieving the outcome.Iftheoutcomehasbeenclearlydescribeditshouldbepossibletojustuseoneindicator,ienumberofincidentsoflossofcontainmentofhazardousmaterial,orfailureofsafetycriticalplantwherecorrosion,wearordamagewasfoundtobeacontributoryfactor.Forexample,alaggingindicatorforaplantinspectionandmaintenanceriskcontrolsystemcouldbe‘thenumberofexpectedfailuresorbreakdownofsafetycriticalplantorequipmentduetocomponentswearingout’(seetheworkedexampleinPart 3forfurtherinformation).
Lagging indicators show whether the outcome has actually been achieved.
Figure 8 Describethedesiredsafetyoutcome
Developingprocesssafetyindicators Page20of59
Health and Safety Executive
Figure 9 Setalaggingindicatortoshowwhetherornottheoutcomeisachieved
Developingprocesssafetyindicators Page21of59
Health and Safety Executive
Step 3.4: Follow up deviations from the outcome
54 Settingindicatorswillnotleadtoimprovedperformanceunlesseverydeviationfromtheintendedoutcomeorfailureofacriticalpartofariskcontrolsystemisfollowedup.Forlaggingindicators,everytimetheoutcomeisnotachievedthereshouldbeaninvestigationtoseewhythesystemfailed.Eachoccasionprovidesanopportunitytoconsiderwhetherimprovementsshouldbemade.Lessonsfromtheseenquiriesshouldbeappliedacrossthewholeorganisation.
Figure 10 Followupadversefindings
Developingprocesssafetyindicators Page22of59
Health and Safety Executive
Step 4: Identify critical elements of each risk control system
n Identify elements of each risk control system that are vital to deliver the outcome.
n Set leading indicators to monitor effectiveness of those elements of the risk control system.
n Set the range of tolerance for each indicator.
Step 4.1: What are the most important parts of the risk control system?
55 Itisnotnecessarytomonitoreverypartofariskcontrolsystem.Considerthefollowingfactorswhendeterminingtheaspectstocover:
n Whichactivitiesoroperationsmustbeundertakencorrectlyoneachandeveryoccasion?
n Whichaspectsofthesystemareliabletodeteriorationovertime?n Whichactivitiesareundertakenmostfrequently?
56 Fromthis,identifytheelementsofeachriskcontrolsystemthatarecriticalindeliveringtheoutcome.TheworkedexampleinPart 3illustrateshowthisprocessisapplied.
Step 4.2: Set leading indicators
57 Oncethecriticalcontrolstobemonitoredaredetermined,set a leading indicator against each one to show that system is operating as intended,forexamplethepercentageofsafetycriticalplantinspectedtoschedule.
Leading indicators highlight whether the risk control systems in place to deliver the outcome are operating as designed.
Figure 11 Identifythemostimportantpartsoftheriskcontrolsystem
Developingprocesssafetyindicators Page23of59
Health and Safety Executive
Step 4.3: Setting tolerances
58 A tolerance should be set for each leading indicator.Thisrepresentsthepointatwhichdeviationinperformanceshouldbeflaggedupforattentionofseniormanagement.Forexample,foraleadingindicator,‘percentageofoverduesafetycriticalmaintenanceactions’.
Figure 13 Settingtolerances
59 Thetolerancemaybesetatzero,whichmeansthat100%ofactionsmustbecompletedonschedule.Alternatively,thecompanymayacceptadegreeofslippagebeforeitishighlightedtothemanagementteam,inwhichcasethetoleranceshouldbesetbelow100%.
60 The management team should set the tolerance, not the person responsible for the activity.Thisenablesmanagementtodecideatwhatpointtheywishtointervenebecauseperformancehasdeviatedbeyondanacceptablelevel.
Figure 12 Setleadingindicators
Developingprocesssafetyindicators Page24of59
Health and Safety Executive
Step 4.4: Follow up deviations from tolerances
61 Deviationsfromtolerancesmustbefollowedup,otherwisethereislittlepointincollectingtheinformation.Themainaimofaperformanceinformationsystemistoindicatewhereprocesscontrolmanagementsystemshavedeterioratedorarenotdeliveringtheintendedoutcome.
Figure 14 Followupdeviationsfromtolerances
Developingprocesssafetyindicators Page25of59
Health and Safety Executive
Step 5: Establish data collection and reporting system
n Ensure information/unit of measurement for the indicator is available or can be established.
n Decide on presentation format.
Collection
62 Oncetheindicatorshavebeenselectedandthetolerancesset,itisimportanttoensurethattherelevantinformationisreadilyavailablewithintheorganisation.Experiencehasshownthattheinformationanddatarequiredtosupportasuiteofprocesssafetyindicatorsisusuallyalreadyavailableandcollectedforotherpurposes,egforqualitycontrolorbusinessefficiency.However,itisvitalthedataiscollatedtoformacompletesetofinformationonprocesssafetyrisks.
63 Ideally,itisbesttoco-ordinatetheperformancedatathroughonepersonwhowillberesponsibleforcollectingalltheinformation,compilingreportsforthemanagementteamandraisingthealarmifthereareanydeviationsfromsettolerances.
Presentation
64 Keepthepresentationofperformancedataassimpleaspossible–summarisedinasinglesheet.Itisimportanttoclearlyshowanydeviationsfromsettolerancesortargetsandimportanttrends.Graphs,chartsor‘dashboards’areprobablythebestwaytoshowthis.Alternatively,varioussystemssuchastrafficlights(green–ok,yellow–slightdeviation,red–largedeviation)or‘smiley/sadfaces’(seeTable2)canbeusedtohighlightwhereyouaredoingwell/badly.
65 Theseniormanagementteamshouldregularlyreceivekeyperformanceinformation.Theyarethemaincustomersforthisinformationandwillneedtomakedecisionsoncorrectiveaction.Theremaybeahierarchyofindicatorsinplace,eachneedingtobecollatedseparately.
66 Presentthedatatoclearlyshowthelinkbetweenthelaggingindicator(includingdegreeofsuccessagainstoutcome)andtheleadingindicator(s)relatingtothesupportingriskcontrolsystems.Thiswillclearlyhighlightthecause-and-effectlinksbetweenthem.
Although the presentation of data is important, the data collected is worthless unless it is actually used to improve health and safety.
Developingprocesssafetyindicators Page26of59
Health and Safety Executive
Step 6: ReviewThe periodic review should include:
n the performance of the process safety management system;
n the scope of the indicators;
n the tolerances set.
Review performance of the process safety management system
67Performanceagainsteachriskshouldberoutinelyreviewedbyseniormanagerstoensurethatthewholeprocesssafetymanagementsystemisdeliveringtheintendedoutcomes,andtoprovideassurancethatcriticalsystemscontinuetooperateasintended.
Variation in performance between leading and lagging indicators68Ifperformanceispooragainstagroupofleadingindicatorsbuttheassociatedlaggingindicatorissatisfactory,itislikelythattheleadingindicatorsselectedaretoofarremovedfromthecriticalcontrolmeasurethatdeliversormaintainsthedesiredoutcome.Forinstance,percentageofinductiontrainingcompletedmaybemeasured,whereasmoreimportantly,trainingandcompetenceinaparticularprocessactivitymaybemorecriticaltoensuringthesafetyofthatspecificactivity.
69Ifagroupofleadingindicatorsareontargetandcloselylinkedtotheriskcontrolsystembuttheassociatedlaggingindicatorshowspoorperformance,itislikelythatriskcontrolsystemisineffectiveindeliveringthedesiredoutcome.
Table 2 Leadingandlaggingindicatorsfordifferentoutcomes
Outcome 1(seeparagraph67)
Outcome 2(seeparagraph67)
Leading indicators
Lagging indicators
Potentialreviewissue Leadingindicatortoofarremovedfromcriticalcontrol
Controlsystemineffective
Potentialcauses Measuring in the wrong place Doing the wrong thing
Developingprocesssafetyindicators Page27of59
Health and Safety Executive
Review the scope
70Indicatorsshouldnotbedecideduponandthenforgottenabout.Everyfewyears,thescopeofthefullsetofindicatorsneedstobereviewedtoensureindicatorsstillreflectthemainprocessrisks.Indicatorsmayneedtobechangedbecauseof:
n introductionofnew,high-riskprocesses;n improvementprogrammes;n alterationinplantdesign;n reductionofstaff/lossofcompetenceincertainareas.
71Ifreviewsarenotcarriedout,processsafetyindicatorsmaybecomemeaninglessandtheinformationcollectedmaynotgivethenecessaryassurancetoseniormanagersthatthemajorhazardrisksareundercontrol.
Review tolerances
72TheimportanceoffollowingupdeviationsfromtoleranceswashighlightedinStep4.4.However,itcouldbethatthetolerancehasbeensetatthewrongpoint,egsettooleniently/stringently,sotheinformationordatadoesnotadequatelyreflectreality.Insuchcases,thetoleranceshouldbereviewed.
Tolerances should be reviewed – you don’t always get it right first time!
73IfyouwouldlikemoreinformationorwishtoaccessHSE’sprocesssafetyperformancewebsitepleasecontact:http://webcommunities.hse.gov.uk/inovem/inovem.ti/chemicalindustries.pspm.
Developingprocesssafetyindicators Page28of59
Health and Safety Executive
Part 3: Worked exampleSteps 2, 3 and 4 of the step-by-step guide
74ThisworkedexampleshowshowSteps2-4ofthisstep-by-stepguidehavebeenappliedtodevelopasuiteofsite-levelprocesssafetyindicatorsforatop-tierCOMAHbulkchemicalstoragesite.
75RefertoSteps2,3and4inPart 1tohelpworkthroughthisexample.
Figure 15 Sitelayoutshowingthelocationofthetwobulktankstoragefacilitiesandtheadjacentdockfromwheredeliveriesbyshiparemade
Developingprocesssafetyindicators Page29of59
Health and Safety Executive
76Thecompanyoperatesacontractbulkstoragebusinesshandlingliquidchemicalsatatop-tierCOMAHsitecomprisingoftwoseparatetankfarms(formerlyownedandoperatedastwobusinesses),eachcontaining80bulkliquidtanks.Mostproductsareimportedbyshipanddischargedatajettyonacanalnexttoanestuary.Shore-sideoffloadingisundertakenbycompanypersonnel.Productistransferredtositeviafixedpipelinesthatrunacrossaprivatefieldandasmallpublicroad.Bothsiteshaveroadtankerloadinggantries.
77Ship-to-shoretransferisundertakenviaarticulatedgantrieswithflexiblehoseconnectionwithscrewfittingcouplings.Roadtankerfillingisfromfixedoverheadgantrieswithsomebottomloadingusingflexiblelines.Clients’contractdriversfilltheirownvehicles.Bothsitesareinoperation24hoursaday.
78Alllinesbetweentheshoreandtheinstallationsarecleanedandpiggedregularlyandbulktanksoftenhavetobeemptiedandcleanedtoallowforachangeofproduct.
79Mosttanksaremildsteelandsitonconcretebases,withearthbundsforgroupsoftanksandsomeindividualbrickbunds.Thereison-siteproductionofnitrogenandutilitiesincludeanaturalgassupply.
80Highlyflammable,toxicandcorrosivesubstancesarestoredonsite,including:
Hexane Olefin DichloromethaneHeptane Lubeoils EthylenedibromideGasoline DERV TrichloromethaneAcetone Fueloil StyrenePyridine Methanol Causticsoda Propanol Sulphuricacid(98%)
Overview of Steps 2-4
81Themainstagesinselectingprocesssafetyindicatorsare:
n Step2.2:Identifythescope:– identifythehazardscenariosthatcanleadtoamajorincident;and– identifytheimmediatecausesofhazardscenarios.
n Step3:Identifytheriskcontrolsystemsanddescribethe‘desiredsafetyoutcome’foreach–setalaggingindicator:
Figure 16 Thesiteandactivities
Developingprocesssafetyindicators Page30of59
Health and Safety Executive
– identifytheriskcontrolsystemsinplacetopreventormitigatetheeffectsoftheincidentsidentified;
– identifythe‘desiredsafetyoutcomes’ofeachriskcontrolsystem;and– setalaggingindicatorforeachriskcontrolsystem.
n Step4:Identifycriticalelementsofeachriskcontrolsystemandsetaleadingindicator:– identifythemostcriticalelementsoftheriskcontrolsystemandsetleading
indicatorsforeachelement;– setatoleranceforeachleadingindicator;and– selectthemostrelevantindicatorsforthesiteoractivitiesunderconsideration.
Step 2.2: Identify the scope
Figure 17 Identifywhatcangowrong
Step 2.2.1: Identify the hazard scenarios which can lead to a major incident82Describingthemainincidentscenarioshelpsmaintainafocusonthemostimportantactivitiesandcontrolsagainstwhichindicatorsshouldbeset.Thescenariosformausefulcross-checklateroninStep4,whenthecriticalelementsofriskcontrolsystemstobemeasuredaredetermined.
83Forthissite,themainprocesssafetyincidentscenariosare:
n Storagetanks:– lossofliquidintobunds;– lossofliquidoutsideofthebund;– fireandexplosion:– fire/explosioninatank;– fireinbund;– fireoutsidebund.
n Docklinesandproducttransfertobulkstoragetanks:– lossofliquidfromdocklines;– lossofliquidfromfixedpipelines(includingcouplings,valves,pumps,and
flanges);– fireatthedocksideandfromleaksinproducttransferpipelines.
n Roadtankerfilling:– lossofliquidfromtransferlines;– lossofliquidfromaroadtanker;– fireorexplosioninaroadtanker;– fireintankerfillingarea.
84Theseeventsmayleadto:
n atoxicgascloudortoxicplume;n amajorfireonthesite;
Developingprocesssafetyindicators Page31of59
Health and Safety Executive
n amajorfireatthedockside;n amajorfireelsewhereoffsite,egnexttopipelines;orn environmentaldamage.
Step 2.2.2: Identify the immediate causes of hazard scenarios85Theimmediatecauseisthefinalfailuremechanismthatgivesrisetoalossofcontainment.Thiscanusuallybeconsideredasafactorthatchallengestheintegrityofplantorequipment.
86Hazardscenariosmaybecausedby:
n failureofflexihose,coupling,pump,valve,fixedpipeworkorbulktank,dueto:– wear;– corrosion;– damage;– over/underpressurisation;or– fireorexplosion;
n overfillingof:– bulktank;or– roadtanker;
n accidentalrelease:– valvesleftopen,connectionsnotmadecorrectly.
87Remembertoreviewareaswherethereareknownproblemsandpastincident/near-missdatatohelpidentifytheprimarycauses.Thisstepisimportantasitisaprerequisitetodecidingwhichriskcontrolsystemsareimportanttopreventorcontrolthechallengetointegrity.
Primary causes include:
Wear:n physicalabrasion;n vibration/stress.
Corrosion:n reactionofmildsteeltanksetcfromexposuretotheatmosphere;orn incorrectproducttransfer/storageorineffectivetank/pipecleaning,resultinginachemicalreactionfromanincompatibleproductinatank/pipeorreactionwithresidues.
Damage:n collision/impact,egbyvehicle,plant/equipment;n damageduringuse;n ship/tankerdriveaway(stillattached);n workactivity,suchaswelding/grinding;orn internalignitionwithintanksorexternalfireaffectingstructuralintegrityofthetank.
Over/underpressurisation:n incorrectproducttransfer/storageresultinginlock-inpressureinpipework,pipe/ventblockage;
n incorrectnitrogenblanketingoftanks;n ineffectivetankcleaningleadingtoanexothermicorendothermicreactionwhennewproductisadded.
Developingprocesssafetyindicators Page32of59
Health and Safety Executive
Fireandexplosion:n failuretocontrolignitionsourcesinflammableatmospheres:
– failureofearthbonding;– failuretoensureflowrateisrestrictedtopreventstaticaccumulation;– incorrectequipmentselected;– failureofnitrogenblanketingoftanks;– ignitionfromdamagedorincorrectlyselectedhazardareaelectricalequipment;– failuretocontrolhotwork;– failuretostopproductmovementduringelectricstorms;– failureofemergencyfire-fightingprovision.
Overfilling:n incorrectproducttransferorincorrectflowrateresultingfrom:
– poorcommunication;– instrumentationfailure;– incorrectproductrouting;or– failureintankgauging.
Accidentalrelease:n leavingvalvesopen;n incorrectcoupling;orn omissionofblankingplatesetc.
Step 3.1: Identify the associated risk control systems
88DrawupariskcontrolmatrixasillustratedinTable3,tohelpdecidewhichriskcontrolsystemsarethemostimportantincontrollingthechallengestointegrityidentifiedwithintheincidentscenarios.
Figure 18 Identifywhatriskcontrolsystemsareinplace
Developingprocesssafetyindicators Page33of59
Health and Safety Executive
Challenges to plant integrity
Inspection and maintenance of:
Flexihoses,couplings,pumps,valves,flanges,fixedpipes,bulktanks ✓ ✓ ✓ ✓
Instrumentation ✓ ✓
Earthbonding ✓
Tankvents ✓
Firedetectionandfightingequipment ✓
Staff competence, covering:
Selectionofcompatibletank ✓ ✓ ✓
Selectionofrouteandtankwithadequatecapacity ✓
Drivererror ✓ ✓
Correctcoupling,opening/closingvalves,startingpumpsetc ✓ ✓
Suitableskillsandexperiencetoundertakeinspectionandmaintenancetasks
✓ ✓ ✓ ✓ ✓ ✓ ✓
Emergencyarrangements ✓
Operating procedures, covering:
Selectionofcompatibletank ✓ ✓
Selectionofrouteandtankwithadequatecapacity ✓ ✓
Correctcoupling,opening/closingvalves,startingpumpsetc ✓ ✓ ✓
Tankerloading ✓
Ship-to-shorepre-andpost-transferchecks ✓ ✓ ✓
Emergencyarrangements ✓
Instrumentation and alarms ✓ ✓
Plant change
Selectionofcorrectspecificationmaterial/equipment ✓ ✓ ✓ ✓
Correctinstallation/implementationofchange ✓ ✓ ✓ ✓
Communication
Completionofpre-andpost-transferchecks ✓ ✓ ✓ ✓
Instigationofemergencyaction ✓ ✓ ✓
Permit to work
Controlofhotwork ✓
Preventionofphysicaldamage/liftingoperations ✓
Safeisolations ✓
Plant design ✓ ✓ ✓ ✓ ✓ ✓ ✓
Emergency arrangements ✓ ✓
Table 3 Riskcontrolmatrix
Ove
r/un
der
pre
ssur
isat
ion
Fir
e an
d
exp
losi
on
Wea
r
Co
rro
sio
n
Dam
age
Ove
rfill
ing
Oth
er
acci
den
tal
rele
ase
Developingprocesssafetyindicators Page34of59
Health and Safety Executive
Wear89ThemainriskcontrolsystemsformanagingthemainhazardscenariosaregiveninTable4.
Collated list of risk control systems for the installation90Thefollowingisasummaryoftheriskcontrolsystemsrelevanttothecontrolandmitigationofthemostsignificantmajorhazardscenariosassociatedwiththeactivitiesonsite:
n plannedinspectionandmaintenance;n staffcompetence;n operatingprocedures;n instrumentation/alarms;n plantchange;n plantdesign;n communication;n permittowork;n earthbondingsystem;andn emergencyarrangements
Table 4 Mainriskcontrolsystems
Hazard scenario Risk control systems
Wear InspectionandmaintenanceStaffcompetencePlantmodification/change,includingtemporarymodificationsPlantdesign
Corrosion InspectionandmaintenanceStaffcompetenceOperatingproceduresCommunicationPlantchangePlantdesign
Damage Staffcompetence(includingcontractors)OperatingproceduresPermittoworkWorkplacetransportInspectionandmaintenancePlantdesign
Over/underpressurisation StaffcompetenceOperatingproceduresInstrumentationandalarmsCommunicationInspectionandmaintenance
Fireandexplosion PermittoworkPlantinspectionandmaintenance–especiallyelectricalequipmentStaffcompetenceOperatingproceduresPlantchangePlantdesignEarthbondingsystem
Overfilling StaffcompetenceOperatingproceduresInstrumentation/alarmsCommunication
Developingprocesssafetyindicators Page35of59
Health and Safety Executive
Step 3: Identify the outcome and set a lagging indicator
Figure 19 Identifytheoutcomeandsetalaggingindicator
91Itisvitaltodiscussandagreethereasonwhyeachriskcontrolsystemisinplaceandwhatitachievesintermsofthescenariosidentified.Withoutthisagreement,itwillbeimpossibletomeasuresuccessindeliveringthisoutcome.
92Itisbesttophrase‘success’intermsofapositiveoutcome–supportiveofthesafetyandbusinesspriorities.Theindicatorcanthenbesetasapositiveornegativemetrictoflagupwhenthisisachievedorwhennot.Assuccessshouldbethenormaloutcome,choosinganegativemetricwillguardagainstbeingswampedbydata(reportingbyexception).
93Thefollowingquestionsmaybehelpful:
n Whydowehavethisriskcontrolsysteminplace?n Whatdoesitdeliverintermsofsafety?n Whatwouldbetheconsequenceifwedidn’thavethissysteminplace?
94Theindicatorsetshouldbedirectlylinkedtotheagreedriskcontrolsystemoutcomeandshouldbeabletomeasurethesuccess/failureatmeetingtheoutcome.
Step 4: Identify the critical elements of each risk control system and set leading indicators
95Therearetoomanyelementstoariskcontrolsystemforeachtobemeasured.Itisnotnecessarytomonitoreverypartofariskcontrolsystem.Considerthefollowingfactorswhendecidingwhichaspectstoinclude:
Hazard scenario Risk control systems
Accidentalrelease StaffcompetenceOperatingproceduresPermittoworkCommunication
Emergencyarrangements Foranyofthescenarioslistedabove,itisimportanttomitigatetheconsequencesofanincidentorlossofcontainment.Thisriskcontrolsystemisthereforeincludedintheoveralllistofsystemsinplaceatthisestablishment
Developingprocesssafetyindicators Page36of59
Health and Safety Executive
n Whichactivitiesoroperationsmustbeundertakencorrectlyoneachandeveryoccasion?
n Whichaspectsofthesystemareliabletodeteriorateovertime?n Whichactivitiesareundertakenmostfrequently?
96Fromthis,thecriticalelementsofeachriskcontrolsystemimportanttodeliveringtheoutcomecanbeidentified.
Figure 20 Identifycriticalelementsandsetleadingindicators
Examples of indicators for each risk control system
97ThefollowingsectionillustrateshowSteps3and4areusedtoidentifyindicatorsforeachimportantriskcontrolsystemintheprocesssafetymanagementsysteminplaceattheinstallation.Initially,anumberofoutcomesandsubsequentcandidatelaggingandleadingindicatorsaregenerated.Thesearethenprioritisedtoselectjustonelaggingindicatorandamaximumoftwoleadingindicatorsforeachriskcontrolsystem.ThefinalselectionforalltheriskcontrolsystemsisgiveninTable3.
Developingprocesssafetyindicators Page37of59
Health and Safety Executive
Risk control systemsRCS: Inspection and maintenance
n Nounexpectedlossofcontainmentduetofailureofflexihoses,couplings,pumps,valves,flanges,fixedpipes,bulktanksorinstrumentation.
n Nounexpectedlossofcontainmentduetoblockagesintankvents.n Nofiresorexplosionsduetostaticelectricignition.n Nofiresorexplosionscausedbyasourceofignitionfromfaultyordamaged
hazardousareaelectricalequipment.n Firedetectionandfire-fightingequipmentisavailableandingoodcondition.
Potential lagging indicatorsn Numberofunexpectedloss-of-containmentincidentsduetofailureof
flexihoses,couplings,pumps,valves,flanges,fixedpipes,bulktanksorinstrumentation.
n Numberofloss-of-containmentsduetoblockagesintankvents.n Numberoffiresorexplosionsthatresultfromastaticelectricignition.n Numberoffiresorexplosionscausedbyasourceofignitionfromfaultyor
damagedhazardousareaelectricalequipment.n Numberofincidentsoffire/explosionwherefiredetectionorfire-fighting
equipmentfailedtofunctionasdesigned.
Critical elementsn Thespecificationofscopeandfrequencyoftheinspectionandmaintenance
system.Thisshouldbebasedonhowsafetycriticaltheitemis,andonthedegreeofchallengepresentedtothesystemintegrity,ortocomplywiththemanufacturer’sorsupplier’sinstructions.
n Safetycriticalplantandequipment(ieflexihoses,couplings,pumpsvalves,flanges,fixedpipes,bulktanks)areinspectedforwearanddamageormalfunctionwithinthespecifiedperiod.
n Faultsarefixedwithinspecifiedtimescalesandrepairsandimprovementsmeetplantdesignstandards.
n Alogoffindingskept–enablingtrending.
Potential leading indicatorsn Percentageofsafetycriticalplant/equipmentthatperformswithinspecification
wheninspected.n Percentageofsafetycriticalplantandequipmentinspectionscompletedto
schedule.n Percentageofmaintenanceactionsidentifiedthatarecompletedtothe
specifiedtimescale.n Percentageoffaulttrendingcarriedouttoschedule.
Note:Whatconstitutesa‘safetycritical’itemshouldhavebeenidentifiedwhileconsideringmajoraccidentscenarios.
Desired safety outcomes
Developingprocesssafetyindicators Page38of59
Health and Safety Executive
Final selection of indicatorsItisoftendifficulttochooseonlyalimitednumberofindicatorsfromtherangeofpotentialcandidatesgeneratedwithinSteps3.3(laggingindicators)andSteps4.2(leadingindicators).Toprioritise,consider:
n Istheoutcomemeasurable,iecanasuccessfuloradverseoutcomeeasilybedetected?Ask‘wouldyouknowwhenthishadhappened?’
n Isacriticalcontroloractivitymeasurable,iecanthecorrectoperationofacriticalcontroleasilybedetected?
n Howoftencaneachbemeasured?n Forlaggingindicators:howmuchinformationisitlikelytogenerate?Aimfor
reportingbyexception.n Forleadingindicators:howsusceptiblearecriticalelementsofthesystemto
rapiddeterioration?n Willtheindicatorhighlightabnormalconditionsbeforeaseriouseventoccurs?n Recheckthattheindicators:
– supporttheoutcomesset;and– thatleadingindicatorslinktothelaggingindicator.
n Whatistheoverallimportance,intermsofsafetyandbusinesspriorities,oftheinformationprovidedbytheindicator?
n Cantheinformationbereadilycollected,ieisitalreadyrecordedsomewhereintheorganisation,egnotedinqualitylogs/recordsorprocesscontrolrecords?
Developingprocesssafetyindicators Page39of59
Health and Safety Executive
Desired safety outcomes
Nounexpectedlossofcontainmentduetofailureofflexihoses,
couplings,pumps,valves,flanges,fixedpipes,bulktanksor
instrumentation
LAGGING INDICATOR
Numberofunexpectedlossofcontainmentincidentsduetofailureofflexihoses,couplings,pumps,valves,flanges,
fixedpipes,bulktanksorinstrumentation
LEADING INDICATORS
Percentageofsafetycriticalplant/equipmentthatperformstospecificationwheninspectedortested
Percentageofmaintenanceactionsidentifiedwhicharecompletedtospecifictimescale
Justification
Thisindicatorcoversthewidestrangeofequipmentwheremostproblemsarelikelytooccur.Thisindicatorcouldbenarroweddownfurthertofocusonspecificitemsofplantconsideredtopresentthehighestrisk,egflexiblehoses
Justification
Performance of safety critical equipmentThisindicatorshowsthereliabilityofplantandequipmentbutalsoprovidesthemeanstoexplorewhyequipment
maynothaveperformedasintended,Also,toarriveatthisinformation,thescheduledinspectionactionswillneedto
havebeencompleted
Completion of maintenance actionsItisimportanttogetacompletepictureofanybacklogoffaultsassociatedwithsafetycriticalplant.Again,theinspectionandmaintenanceschedulewillhavetohave
beenundertakentoobtainthisinformation
Process controls
Inspectionandmaintenancesystems
RISK
Plantorequipmentinunsafecondition
OUTPUTS INPUTS
Lagging indicators discounted n Tankventblockages:theseeventscanbe
capturedintheindicatorcoveringthefailureofbulktanks.
n Staticignition:itcanbedifficulttobecertainwhetherafire/explosionoccurredasaresultofastaticelectricignition.Sucheventsshouldbequiterareandiftheydooccurtheycanbepickedupaspartofincidentinvestigation.
n Numberoffiresorexplosionscausedbyasourceofignitionfromfaultyordamagedhazardousareaelectricalequipment:theseshouldbeveryrareeventsandsooflittlebenefitduetothelowfrequency.
n Firedetectionandfire-fightingequipment:sucheventsarelikelytoberare.Identificationoffailingsindetectionandfire-fightingequipmentisbettercoveredunderRCS:Emergencyarrangements.
Leading indicators discounted n Progresswithinspectionschedule:thisisa
frequentlyusedindicator.However,theindicatoronperformanceofsafetycriticalequipmentismuchclosertothedesiredoutcome.
n Faulttrending:althoughfaulttrendingisimportant,measuringthepercentageofthetrendingactionscompletedmaynotprovidegoodassurancethatproblemswithreliabilityarebeingrectified.
Figure 21 Inspectionandmaintenanceindicators
Developingprocesssafetyindicators Page40of59
Health and Safety Executive
RCS: Staff competence
n Operatorsandcontractorshavetherequiredknowledgeandskillstoenableeffectiveproducttransferfromship,tobulktank,toroadtanker.
n Operatorsandcontractorshavetherequiredknowledgeandskillstoadequatelycleanbulktanks/pipelinesbefore/afteraproducttransfer.
n Operatorsandcontractorshavetherequiredknowledgeandskillstotakeemergencyactionfollowingaproducttransferthatresultsinafire/explosion.
Potential lagging indicatorsn Numberoftimesproducttransferdoesnotproceedasplannedduetoerrors
madebystaffwithoutthenecessaryunderstanding,knowledgeorexperiencetotakecorrectactions.
n Numberoftimesabulktankisover/underpressurisedduetoinadequatecleaningbystaffwithoutthenecessaryunderstanding,knowledgeorexperience.
n Numberoftimesineffectiveactionistakenfollowingaproducttransferresultinginfire/explosion,duetolackofunderstanding,knowledgeorexperiencetotakecorrectemergencyaction.
Critical elementsInformationandtrainingcovering:
n hazardouspropertiesofproducts;n ship-to-shorecommunicationsystems;n pre-transferchecks;n producttransfercontrolsandmonitoring;n post-transferchecks;n emergencyactions.
Job-specificknowledgeandrelevantexperienceof:
n substances;n workprocesses;n hazards;andn emergencyactions.
Potential leading indicatorsn Percentageofstaffinvolvedinproducttransferswhohavetherequiredlevelof
competencenecessaryforthesuccessfultransferandstorageofproducts.
Note:Thecompanywilldeterminethetypeoftrainingandexperiencenecessarytoachievecompetence.
Outcomes
Developingprocesssafetyindicators Page41of59
Health and Safety Executive
LAGGING INDICATOR
Numberoftimesproducttransferdoesnotproceedasplannedduetoerrorsmadebystaffwithoutthe
necessaryunderstanding,knowledgeorexperiencetotakethecorrectactions
LEADING INDICATOR
Percentageofstaffinvolvedinproducttransferwhohavetherequiredlevelofcompetencenecessaryforthe
successfultransferandstorageofproducts
Justification
Thisindicatorchosenlinkscloselytotheoutcomeandcapturesthemostcommonandimportantaspectofwhy
thecontrolsystemisinplace
Justification
Thiswastheonlypotentialleadingindicatorchosen
RISK
Criticaltasksundertakendangerously
OUTPUTS INPUTS
Lagging indicators discountedn Tankover/underpressurisation:ensuring
competencefortankcleaningisunlikelytobeacomplexordemandingissuethatmayfrequentlygiverisetoincidentscausedbylackofcompetence.Itisthereforemoreappropriatetomeasureotheraspectsofcompetence.
n Emergencyaction:thisisbettercoveredunderRCS:EmergencyArrangements.
Figure 22 Staffcompetenceindicators
Process controls
Staffcompetencesystems:selection,information,trainingandassessment
Desired safety outcomes
Operatorsandcontractorshavetherequiredknowledgeandskillsto
enableeffectiveproducttransferfromship,tobulktanker,toroadtransfer
Developingprocesssafetyindicators Page42of59
Health and Safety Executive
RCS: Operating procedures
n Correcttankselectionandoperationofequipmentduringproducttransferfromship,tobulktank,toroadtanker.
n Correctcleaning,isolationandequipmentshutdownafterproducttransfer.
Potential lagging indicatorsn Numberoftimesproducttransferdoesnotoccurasplannedduetoincorrect/
unclearoperationalprocedures.n Numberoftimesabulktankisover/underpressurisedduetoinadequate
cleaningbystaffworkingwithunclear/incorrectoperationalprocedures.n Numberoftimesineffectiveactionistakenfollowingaproducttransferresulting
infire/explosionduetoincorrect/unclearoperationalprocedures.
Critical elementsn Procedurescontaincorrectscope(keyactionsandtasksincludingemergency
action)and/orsufficientdetail.n Proceduresareclearlywritten/easilyunderstood.n Proceduresarekeptuptodate.
Potential leading indicatorsn Percentageofsafetycriticaltasksforwhichawrittenoperationalprocedure
coversthecorrectscope(keyactionsandtasksincludingemergencyaction)and/orsufficientdetail.
n Percentageofproceduresthatareclearlywrittenandeasytounderstand.n Percentageofproceduresthatarereviewedandrevisedwithinthedesignated
period.
Desired safety outcomes
Developingprocesssafetyindicators Page43of59
Health and Safety Executive
LAGGING INDICATOR
Numberoftimesproducttransferdoesnotoccurasplannedduetoincorrect/unclearoperationalprocedures
LEADING INDICATORS
Percentageofprocedureswhicharereviewedandrevisedwithinthedesignatedperiod
Justification
Thisindicatorwilldetecthumanerrorlinkedtothequalityofoperationalproceduresforawiderangeofactivities
associatedwiththeoutcome
Justification
Thisistheonlyindicatorthatmeasuresthequalityofaprocedureonceithasbeenagreedandimplemented
RISK
Criticaltasksundertakendangerously
OUTPUTS INPUTS
Lagging indicators discountedn Tankover/underpressurisation:itisbetterto
focusonawidersetofactivitiesreliantongoodoperatingproceduresascoveredbytheindicatorchosen,becausethiswillprovideamorecomprehensivepictureofthesuitabilityofwrittenprocedures.
n Emergencyaction:thisisbettercoveredunderRCS:EmergencyArrangements.
Leading indicators discountedn Scopeandclarityofprocedures:thisshouldbe
ensuredbyaone-offcheckcarriedoutbeforetheprocedureisfirstintroducedandcannotbeusefullymonitoredonanongoingbasis.
Figure 23 Operatingprocedureindicators
Process controls
Operationalprocedures:writteninstructions,workpractices
Correcttankselectionandoperationofequipmentduringproducttransfer
fromship,tobulktank,toroadtransfer
Developingprocesssafetyindicators Page44of59
Health and Safety Executive
RCS: Instrumentation and alarms
n Safetycriticalinstrumentationandalarmscorrectlyindicatewhenprocessconditionsexceedsafeoperatinglimits.
Potential lagging indicatorsn Numberofsafetycriticalinstruments/alarmsthatfailtooperateasdesigned,
eitherinuseorduringtesting.n Numberoftimesabulktankoraroadtankerisoverfilledduetofailureinthe
levelindicatororalarms.n Numberoftimesabulktankoraroadtankerisover/underpressuriseddueto
failureinalevelindicatororalarms.n Numberoftimesproductistransferredatthewrongflowrateorpressuredue
tofailureinaflowmeter/pressuregaugeoralarms.
Critical elementsn Instrumentscorrectlyindicateprocessconditions.n Alarmsactivateatdesiredsetpoints.n Instrumentsandalarmsaretestedandcalibratedtodesignstandard.n Repairstofaultyinstrumentsandalarmsarecarriedoutwithinspecifiedtime
period.
Potential leading indicatorsn Percentageofsafetycriticalinstrumentsandalarmsthatcorrectlyindicatethe
processconditions.n Percentageofsafetycriticalinstrumentsandalarmsthatactivateatthedesired
setpoint.n Percentageoffunctionaltestsofsafetycriticalinstrumentsandalarms
completedtoschedule.n Percentageofmaintenanceactionstorectifyfaultstosafetycriticalinstruments
andalarmscompletedtoschedule.
Desired safety outcomes
Developingprocesssafetyindicators Page45of59
Health and Safety Executive
LAGGING INDICATOR
Numberofsafetycriticalinstruments/alarmsthatfailtooperateasdesigned,eitherinuseorduringtesting
LEADING INDICATORS
Percentageoffunctionaltestsofsafetycriticalinstrumentsandalarmscompletedtoschedule
Percentageofmaintenanceactionstorectifyfaultstosafetycriticalinstrumentsandalarmscompletedto
scheduleJustification
Thisindicatorwilldetectallfailuresintheinstrumentsandalarmsystems,regardlessofwhetherthisleadstoaloss
ofcontainment
Justification
Thesearethemaininputstoensurethatinstrumentsandalarmscontinuetofunctionasdesigned
RISK
Plantorprocessoutsidesafeoperatingconditions
OUTPUTS INPUTS
Lagging indicators discountedn Numberoftimesabulktankoraroadtankeris
overfilledduetofailureinalevelindicatororalarm.n Numberoftimesabulktankoraroadtankeris
over/underpressurisedduetofailureinalevelindicatororalarm.
n Numberoftimesproductistransferredatthewrongflowrateorpressureduetofailureinaflowmeter,pressuregaugeoralarm.
Alloftheseindicatorsareasubsetofthepreferredindicatorselected.
Leading indicators discountedn Percentageofsafetycriticalinstrumentsand
alarmsthatcorrectlyindicatetheprocessconditions.
n Percentageofsafetycriticalinstrumentsandalarmsthatactivateatthedesiredsetpoint.
Thesetwoindicatorswillbecoveredwithinthefunctionaltestingandmaintenancesystem.
Note:Instrumentationandalarmsystemfunctioningcanbeconsideredasanimportantpartofawiderinspectionandmaintenancesystemandtheindicatorssetinthissectioncouldbereadilyincorporatedintothebroaderinspection/maintenanceschemeandmeasuredaspartofthatsystem.
Figure 24 Instrumentationandalarmindicators
Process controls
Operationalprocedures:instrumentalandalarmsystems
Desired safety outcomes
Safetycriticalinstrumentationandalarmscorrectlyindicatewhenprocessconditionsexceedsafe
operatinglimits
Developingprocesssafetyindicators Page46of59
Health and Safety Executive
RCS: Plant change
n Followingachangeofspecificationofflexihoses,couplings,pumps,fixedpipes,bulktanks,theycontinuetooperateinanoptimisedstate.
Potential lagging indicatorsn Numberofincidentsinvolvinglossofcontainmentofhazardousmaterialorfire/
explosionduetofailureofflexihoses,couplings,valves,pumps,fixedpipes,bulktanks,whereplantchangewasfoundtobeacontributoryfactor.
n Numberoftimesequipmentorplantisbelowthedesiredstandardduetodeficienciesinplantchange.
Critical elementsn Scopeanddefinitionareproperlysetout(temporary/permanentchanges).n Riskassessmentsareundertakenbeforeplantchange.n Changes/outcomesaredocumented.n Changesareauthorisedbeforebeingimplemented.n Post-changechecksarecarriedout(plantfoundtobeperformingasdesigned).
Potential leading indicatorsn Thescopeanddefinitionoftheplantchangesystemisproperlyspecified.n Percentageofplantchangeactionsundertakenwhereanadequaterisk
assessmentwascarriedoutbeforechange.n Percentageofplantchangeactionsundertakenwherechanges/outcomeswere
documented.n Percentageofplantchangeactionsundertakenwhereauthorisationwasgiven
beforeimplementation.n Percentageofplantchangeactionsundertakenwherepost-changechecks
werecarriedout.
Desired safety outcomes
Developingprocesssafetyindicators Page47of59
Health and Safety Executive
LAGGING INDICATOR
Numberoftimesequipmentorplantisbelowthedesiredstandardduetodeficienciesinplantchange
LEADING INDICATORS
Percentageofhazardandoperability(HAZOP)actionsassociatedwithplantchangecompleted
Percentageofplantchangeactionsundertakenwhereauthorisationwasgivenbeforeimplementation
Justification
Thisindicatorwillalsoincludelossofcontainmentincidentswheretheseareduetodeficientplantor
equipmentfollowingaplantchange
RISK
OUTPUTS INPUTS
Lagging indicators discountedn Numberofincidentsinvolvinglossofcontainment
ofhazardousmaterialorfire/explosionduetofailureofflexihoses,couplings,valves,pumps,fixedpipes,bulktankswheredeficiencyinplantchangewasfoundtobeacontributoryfactor.
Thefirstindicatorwillcapturethesesortsofeventsautomaticallyifthecauseisattributedtoafaultfollowingaplantchange.
Leading indicators discountedn Documentationofchanges.n Post-changechecks.
Bothoftheseindicatorsareimportantanditisrelativelyeasytocollectinformationagainstthem.However,theywerenotselectedsimplytokeeptheoverallnumberofindicatorstoareasonablelevel.
Figure 25 Plantchangeindicators
Process controls
Plantchangesystem
Desired safety outcomes
Justification
Completion of risk assessmentsThisisacriticalaspectofplantchangeuponwhichtheoutcomeisdependent.Itislikelytobeeasytomeasure
andcapturetherelevantinformation
Retrospective authorisationsThisindicatorwillshowwherepotentiallydangerouscircumstancesmaybecreatedduetoaneedto
implementchangesquickly
Developingprocesssafetyindicators Page48of59
Health and Safety Executive
RCS:Communication
RCS: Plant design
n Plantoperationoptimisedwithequipmentrunningefficientlyandreliablywithnounexpectedbreakdownduetodeficienciesintheplantdesignandspecification.
Potential lagging indicatorn Numberofplantbreakdownsorincidentsinvolvinglossofcontainmentof
hazardousmaterialorfailureofsafetycriticalplant/equipmentwheredeficiencyinplantdesignwasfoundtobeacontributoryfactor.
Critical elementsWhenselectingsuitableequipment,consider:
n standardsandcodes;n compatibilityofmaterialswithproducts;n anticipateddutyanddegradationmethods;n pressuresystems;n lifeexpectancy;n electricalintegrityandequipmentbonding;andn easeofinspectionandmaintenance.
Potential leading indicatorsn Percentageofequipmentandplantassociatedwithproducttransferthatmeets
currentstandardsandcodes.n Oncommissioning:percentageofsafetycriticalitemsofplantorequipment
whichcomplywithspecifieddesignstandards.n Onaperiodicbasis:percentageofsafetycriticalitemsofplantorequipment
whichcomplywithcurrentdesignstandardsorcodes.
Desired safety outcome
Developingprocesssafetyindicators Page49of59
Health and Safety Executive
LAGGING INDICATOR
Numberofincidentsinvolvingplantbreakdown,lossofcontainmentofhazardousmaterialorfailureofsafety
criticalplant/equipmentwheredeficiencyinplantdesignwasfoundtobeacontributoryfactor
LEADING INDICATOR
Percentageofsafetycriticalitemsofplantorequipmentwhichcomplywithcurrentdesignstandardsorcodes
Note:Thisshouldbedoneonasampleorperiodicbasis
Justification
Thiswillfocusonthesatisfactoryoperationofplantorequipment
RISK
Plantinunsafecondition
OUTPUTS INPUTS
Leading indicators discountedn Oncommissioning:thepercentageofsafetycritical
itemsofplantorequipmentwhichcomplywithspecifieddesignstandards.
n Onaperiodicbasis:percentageofcriticalitemsofplantorequipmentwhichcomplywithcurrentdesignstandardsorcodes.
Theseareone-offchecksthatdonotbenefitfrombeingmeasuredthroughouttheyear.
Figure 26 Plantdesignindicators
Process controls
Plantdesignsystem
Desired safety outcomes
Plantoperationoptimisedwithequipmentrunningefficientlyand
reliablywithnounexpectedbreakdownduetodeficienciesinthe
plantdesignandspecification
Justification
TheplantchangeRCSshouldensureitemsofplantreplacedstillcomplywithcurrentdesignstandards.However,thisindicatorwillpickupitemsofplant
equipmentthatnolongercomplywithcurrentdesignstandards/codesbecauseoftheirage,orrecentchanges
instandards/codes
Developingprocesssafetyindicators Page50of59
Health and Safety Executive
RCS: Communication
n Effectivemanagementofproducttransfer*andstorageandeffectivewarningofproblemsintimetotakeremedialaction.
n Effectiveremedialactionistakenintheeventofoverfill,fire/explosionoraccidentalrelease.
* Product transfer includes all aspects and actions associated with the successful transfer of hazardous material from ship to shore into bulk storage or between bulk tanks and the filling or discharge of road tankers.
Potential lagging indicatorsn Numberoftimesproducttransferdoesnotproceedasplanneddueto
breakdownincommunicationsystems.Thisoutcomecouldbesubdividedintotwofurtherindicators,ie:– numberoftimesoverfillingoccursduetoabreakdownincommunication
systems;– numberoftimesaccidentalreleasesoccurduetobreakdownin
communicationsystems.n Percentageofmitigatingsystemswhichfailedtooperatefollowinganoverfill,
fire/explosionoraccidentalreleaseduetofailuretoadequatelycommunicateinformationrelatingtotheemergency.
Critical elementsCriticalcommunicationsundertaken:
n Confirmationofpre-transferchecks–type,properties,quantityofmaterialtobetransferred.
n Confirmationofrouteintegrity,connectionsmade,valvesopen.n Authorisationtostarttransfer.n Confirmationofstart/rateoftransfer.n Confirmationofcontainmentintegritycheckscarriedoutduringtransfers.n Post-transfer–confirmationofpumpsstopped,valvesclosed.
Potential leading indicatorsn Percentageofproducttransferswhereconfirmationofthecompletionofpre-
transfercheckswasadequatelycommunicated.n Percentageofproducttransferswhereconfirmationofrouteintegrity,
connectionsmade,valvesopenetcwasadequatelycommunicated.n Percentageofproducttransferswhereauthorisationtostarttransferwas
successfullycompletedbeforetransfercommenced.n Percentageofproducttransferswhereconfirmationofstartandrateoftransfer
weresuccessfullycompletedbeforetransfercommenced.n Percentageofproducttransferswhereconfirmationofstartandrateoftransfer
weresuccessfullycompletedbeforetransfercommenced.n Percentageofcontainmentintegritycheckscarriedoutduringtransfers.n Percentageofpost-transferchecksundertakentoconfirmthatpumpshave
stoppedandvalvesareisolatedorclosed.
Desired safety outcomes
Developingprocesssafetyindicators Page51of59
Health and Safety Executive
LAGGING INDICATOR
Numberoftimesproducttransferdoesnotproceedasplannedduetoabreakdownincommunicationsystems
LEADING INDICATORS
Percentageofproducttransferswhereauthorisationtostarttransferwassuccessfullycompletedbeforethe
transfercommenced
Percentageofpost-transferchecksundertakentoconfirmthatpumpsstopped,valvesareisolatedorclosed
Justification
Themoregenericindicatorhasbeenchosen,asoverfillingoranaccidentalreleasecouldnotbeconsideredas‘aplanned,successfulproducttransfer’.Therefore,both
theseeventswouldbecapturedwithinthefirstindicator.Alsothisbroadercategoryofferstheopportunityto
captureawiderseriesofevents,someofwhichmaynothavebeenfullyconsideredwhenformulatingtheindicators
RISK
Activitiesnotproperlyco-ordinated
OUTPUTS INPUTS
Leading indicators discountedn Percentageofproducttransferswhere
confirmationofcompletionofpre-transfercheckswasadequatelycommunicated.
n Percentageofproducttransferswhereconfirmationofrouteintegrity,connectionsmade,valvesopenetcwasadequatelycommunicated.
n Percentageofproducttransferswhereconfirmationofstartandrateoftransferweresuccessfullycompletedbeforeproducttransfercommenced.
n Percentageofproducttransferswheretheconfirmationofstartandrateoftransferweresuccessfullycompletedbeforeproducttransfercommenced.
Again,ensurethatthefinalauthorisationisissuedautomaticallyandincludesthecheckslistedabove.Figure 27 Communicationindicators
Process controlsDesired safety outcomes
Effectivemanagementofproducttransferandstorageandeffectivewarningofproblemsintimetotake
remedialaction
Justification
Thisfirstindicatorautomaticallycapturesalltheotherchecksthatshouldbecompletedbeforeauthorisationisissued.Thesecondensuresthattheplantissecuredina
safeconditionaftertheactivity
Lagging indicators discountedn Failureofmitigation:incidentswiththistypeof
causearelikelytobeveryrare.ThisisbettercoveredunderRCS:Emergencyarrangements.
Developingprocesssafetyindicators Page52of59
Health and Safety Executive
RCS: Permit to work
n High-riskmaintenanceactivitiesareundertakeninawaythatwillnotcausedamage/injury.
Potential lagging indicatorn Numberofincidentswhereplant/equipmentcouldbedamagedduetofailure
tocontrolhigh-riskmaintenanceactivity.
Critical elementsn Scopeofactivitiescoveredbythepermit-to-worksystemisclearlyidentified.n Permitsspecifythehazards,risksandcontrolmeasures,includingisolations.n Permitsareonlyissuedfollowingsuitableauthorisationprocedures.n Permit/taskistimelimited.n Workisconductedasperpermitconditions,includingdemonstrationof
satisfactorycompletionofwork.
Potential leading indicatorsn Thescopeanddefinitionofthepermit-to-worksystemhasbeenproperly
specified.n Percentageofpermitstoworkissuedwherethehazards,risksandcontrol
measureswereadequatelyspecified.n Percentageofpermitsissuedwherethetimeperiodforcompletingthetaskis
specified.n Percentageofworkconductedinaccordancewithpermitconditionsand
wherecompletionofworkhasbeendemonstrated.
Desired safety outcome
Developingprocesssafetyindicators Page53of59
Health and Safety Executive
LAGGING INDICATOR
Numberofincidentswheretheplant/equipmentcouldbedamagedduetofailuretocontrolhigh-riskmaintenance
activity
Justification
Focusingonplantdamageratherthanpersonalinjurymaintainsafocusonprocesssafetyissues
RISK
Maintenanceworkundertakenunsafely
OUTPUTS INPUTS
Leading indicators discountedn Thescopeanddefinitionofthepermit-to-work
systemhasbeenproperlyspecified:thisisaone-offactivityandunlikelytodeteriorateovertime.
n Timeperiodspecified:althoughthisisimportant,itnotconsideredascriticalasauthorisationbeforeworkstarts.
Figure 28 Permit-to-workindicators
Process controls
Permit-to-worksystem
Desired safety outcomes
High-riskmaintenanceactivitiesareundertakeninawaythatwillnot
causedamage/injury
Justification
Settingoutthehazardsandcontrolsisakeypartofapermitandaprerequisiteforsafeworking.Themain
purposeforapermitistosetoutasafemethodofworkinadvance(ifthereisone).
Knowingthatworkisconductedinaccordancewiththepermitconditionsisthereforethemostimportantaspect
LEADING INDICATORS
Percentageofpermitstoworkissuedwherethehazards,risksandcontrolmeasureswereadequatelyspecified
Percentageofworkconductedinaccordancewithpermitconditions
Note:Thesearelikelytobemeasuredonasamplebasis
Developingprocesssafetyindicators Page54of59
Health and Safety Executive
RCS: Emergency arrangements
n Theimpactofamajorincidentduringproducttransferorstorageisminimisedasfaraspossible.
Potential lagging indicatorn Numberofelementsoftheemergencyprocedurethatfailtofunctiontothe
designedperformancestandard.
System critical elementsn Emergencyplancoversallrelevantoperations.n Testingofemergencyplan.n Raisingalarm.n Shutdown/isolationprocedures.n Firefighting–startingfirepumps.n Communicationwithship/installationcontrolrooms,andimmediatesite
neighbours.n Evacuation–ship/dock/site.n Communicationwiththedockoperatingcompany.n Communicationwithemergencyservices.
Potential leading indicatorsn Percentageofshutdown/isolationsystemsthatfunctionedtothedesired
performancestandardwhentested.n Percentageoftimesthefire-fightingpumpsstartedautomaticallyand
pressurisedthefiremainwhenthealarmwastested.n Percentageofstaff/contractorswhotakethecorrectactionintheeventofan
emergency.n Percentageofstaff/contractorstrainedinemergencyarrangements.n Percentageofemergencyexercisescompletedtoschedule.
Desired safety outcome
Developingprocesssafetyindicators Page55of59
Health and Safety Executive
LAGGING INDICATOR
Numberofelementsoftheemergencyprocedurethatfailtofunctiontothedesignedperformancestandard
Justification
Majorincidentsareveryrareonanyparticularsite.Itisdifficulttomeasurewhethertheadverseoutcomesofan
incidentareworsethanexpected
RISK
Damageandinjuriesintheeventofamajoraccidentaregreaterthan
reasonablyexpected
OUTPUTS INPUTS
Leading indicators discountedn Percentageoftimesthefire-fightingpumpsstarted
automaticallyandpressurisedthefiremainwhenthealarmwastested:thisisafairlynarrowsetofcircumstanceswhichwouldalreadybecapturedbythefirstindicator.
n Percentageofstaff/contractorstrainedinemergencyarrangements:thisindicatordoesn’tprovideinformationonthefunctionofthesystemandsoisfurtherawayfromtheoutcome.
n Percentageofemergencyexercisescompletedtoschedule:thisindicatordoesn’tprovideinformationonthefunctionofthesystemandsoisfurtherawayfromtheoutcome.
Figure 29 Emergencyarrangementindicators
Process controls
Emergencyarrangements
Desired safety outcomes
Theimpactofamajorincidentduringproducttransferorstorageisminimisedasfaraspossible
Justification
Bothoftheseindicatorsshowtheextenttowhichelementsoftheemergencysystemsperformedas
expected
LEADING INDICATORS
Percentageofshutdown/isolationsystemswhichfunctionedtothedesiredperformancestandardwhen
tested.
Percentageofstaff/contractorswhotakethecorrectactionintheeventofanemergency
Developingprocesssafetyindicators Page56of59
Health and Safety Executive
RCS: Earth bonding
n Staticelectriccharge,causedbyproductmovement/flow,isdissipatedwithoutgivingrisetoignition.
Potential lagging indicatorn Numberofincidentsinvolvingfireandexplosioncausedbystaticignition.
Critical elementsn Allimportantelementsarecorrectlybondedtogetherandconnectedtothe
earth.n Impedanceissufficientlylowtoalloweffectivedischargeofcurrent.n Continuityofearthbondingisroutinelychecked.
Potential leading indicatorsn Percentageofat-riskplantwheretheearthbondingisinplace.n Percentageofsafetycriticalplantwhereimpedanceoftheearthbonding
systemistospecification.
Indicators selectedn Noneoftheseindicatorswerechosenbecausetheintegrityofearthbonding
shouldbecheckedwithintheinspectionandmaintenancesystemsandcanbemeasuredaspartofthatwiderscheme.
Desired safety outcome
Developingprocesssafetyindicators Page57of59
Health and Safety Executive
Table 5 Finalsuiteofprocesssafetyperformanceindicatorsforthewholeinstallation
Control Lagging indicator Leading indicator
Inspection/maintenance
Numberofunexpectedloss-of-containmentincidentsduetofailureofflexihoses,couplings,pumps,valves,flanges,fixedpipes,bulktanksorinstrumentation.
Percentageofsafetycriticalplant/equipmentthatperformstospecificationwheninspectedortested.
Percentageofmaintenanceactionsidentifiedwhicharecompletedtospecifiedtimescale.
Staffcompetence
Numberoftimesproducttransferdoesnotproceedasplannedduetoerrorsmadebystaffwithoutthenecessaryunderstanding,knowledgeorexperiencetotakecorrectactions.
Percentageofstaffinvolvedinproducttransferwhohavetherequiredlevelofcompetencenecessaryforthesuccessfultransferandstorageofproducts.
Note:thecompanywilldeterminethetypeoftrainingandexperiencenecessarytoachievecompetence.
Operationalprocedures
Numberoftimesproducttransferdoesnotoccurasplannedduetoincorrect/unclearoperationalprocedures.
Percentageofprocedureswhicharereviewed/revisedwithinthedesignatedperiod.
Instrumentationand alarms
Numberofsafetycriticalinstrumentation/alarmsthatfailtooperateasdesignedeitherinuseorduringtesting.
Percentageoffunctionaltestsofsafetycriticalinstrumentsandalarmscompletedtoschedule.
Percentageofmaintenanceactionstorectifyfaultstosafetycriticalinstrumentsandalarmscompletedtoschedule.
Plant change Numberoftimesequipmentorplantisbelowthedesiredstandardduetodeficienciesinplantchange.
Percentageofplantchangeactionsundertakenwhereanadequateriskassessmentwascarriedoutbeforechange.
Percentageofplantchangeactionsundertakenwhereauthorisationwasgivenbeforeimplementation.
Communication Numberoftimesproducttransferdoesnotproceedasplannedduetoabreakdownincommunicationsystems.
Percentageofproducttransferswhereauthorisationtostarttransferwassuccessfullycompletedbeforethetransfercommenced.
Percentageofpost-transferchecksundertakentoconfirmthatpumpshavestopped,andvalvesareisolatedorclosed.
Permit to work Numberofincidentswhereplant/equipmentcouldbedamagedduetofailuretocontrolhigh-riskmaintenanceactivity.
Percentageofpermitstoworkissuedwherethehazards,risksandcontrolmeasureswereadequatelyspecified.
Percentageofworkconductedinaccordancewithpermitconditions.
Note:Thesearelikelytobemeasuredonasamplebasis.
Plant design Numberofincidentsinvolvingbreakdown,lossofcontainmentofhazardousmaterialorfailureofsafetycriticalplant/equipment,wheredeficiencyinplantdesignwasfoundtobeacontributoryfactor.
Percentageofsafetycriticalitemsofplantorequipmentwhichcomplywithcurrentdesignstandardsorcodes.
Note:Thisshouldbedoneonasampleorperiodicbasis.
Developingprocesssafetyindicators Page58of59
Health and Safety Executive
References1 Major incident investigation report, BP Grangemouth Scotland, 29 May – 10 June 2000 COMAHCompetentAuthorityReportAugust2003www.hse.gov.uk/comah/bparrange/index.htm
2 Responsible Care. An IntroductionRC107ChemicalIndustriesAssociationLondon1999
3 Control of Major Accident Hazards Regulations 1999 SI 1999/743 The Stationery Office 1999 ISBN 0 11 082192 0 (COMAH), as amended by the Control of Major Accident Hazards (Amendment) Regulations 2005SI2005/1088TheStationeryOffice2005ISBN0110727665,whichimplementstheSevesoIIDirective(96/82/EC)inGreatBritain
4 Successful health and safety managementHSG65(Secondedition)HSEBooks1997ISBN0717612767
5 Responsible Care Management Systems Guidance(Fourthedition)RC127ChemicalIndustriesAssociationsLondon2003
6 James Reason Managing the Risks of Organizational AccidentsAshgatePublishingLimited1997ISBN1840141042
7 http://webcommunities.hse.gov.uk/ui/inovem.ti/group/chemicalindustries.pspm/grouphome
8 www.cia.org.uk/newsite/responsible_care/cells.htm
9 Leadership for the major hazard industriesLeafletINDG277(rev1)HSEBooks2004(singlecopyfreeorpricedpacksof15ISBN0717629058)
Whileeveryefforthasbeenmadetoensuretheaccuracyofthereferenceslistedinthispublication,theirfutureavailabilitycannotbeguaranteed.
Control Lagging indicator Leading indicator
Emergencyarrangements
Numberofelementsoftheemergencyprocedurethatfailtofunctiontothedesignedperformancestandard.
Percentageofshutdown/isolationsystemswhichfunctionedtothedesiredperformancestandardwhentested.
Percentageofstaff/contractorswhotakethecorrectactionintheeventofanemergency.
Table 5 continued
Further information
HSEpricedandfreepublicationscanbeviewedonlineororderedfromwww.hse.gov.ukorcontactHSEBooks,POBox1999,Sudbury,SuffolkCO102WATel:01787881165Fax:01787313995.HSEpricedpublicationsarealsoavailablefrombookshops.
ForinformationabouthealthandsafetyringHSE’sInfolineTel:08453450055Fax:08454089566Textphone:08454089577e-mail:hse.infoline@natbrit.comorwritetoHSEInformationServices,CaerphillyBusinessPark,CaerphillyCF833GG.
TheStationeryOfficepublicationsareavailablefromTheStationeryOffice,POBox29,NorwichNR31GNTel:08706005522Fax:08706005533e-mail:customer.services@tso.co.ukWebsite:www.tso.co.uk(Theyarealsoavailablefrombookshops.)StatutoryInstrumentscanbeviewedfreeofchargeatwww.opsi.gov.uk.
PublishedbyHSE03/10 Page59of59
Health and Safety Executive
Recommended