OTC 23051

Essential Process Safety Management for Managing Multiple Assets John Hopkins, WoodgroupPSN

Copyright 2012, Offshore Technology Conference This paper was prepared for presentation at the Offshore Technology Conference held in Houston, Texas, USA, 30 April3 May 2012. This paper was selected for presentation by an OTC program committee following review of information contained in an abstract submitted by the author(s). Contents of the paper have not been reviewed by the Offshore Technology Conference and are subject to correction by the author(s). The material does not necessarily reflect any position of the Offshore Technology Conference, its officers, or members. Electronic reproduction, distribution, or storage of any part of this paper without the written consent of the Offshore Technology Conference is prohibited. Permission to reproduce in print is restricted to an abstract of not more than 300 words; illustrations may not be copied. The abstract must contain conspicuous acknowledgment of OTC copyright.

Abstract The paper describes the use of a tool and process that shows management where to make interventions that reduce the risk of having a major accident. The tool indicates those areas that need immediate attention and those that need to be addressed in the future. It allows these interventions to be tracked and is designed to be used by all levels of management. The process is based on the simple concept that prior to a major event there are numerous small events which if identified and then eliminated by management interventions will prevent a major accident. It describes how an oil and gas contractor found itself in the position of being legally responsible for the operation of a number of substantial oil and gas facilities over a very short time frame. It already had in place a mature and robust Management System with the key elements of Process Safety Management in place across the assets concerned. However there was not a reliable and simple way of comparing each asset in terms of vulnerability of having a major accident. There was no method in place to quantify the vulnerability and the existing reports from the management system were in arrears which meant that any management intervention actions were inevitability too late to be effective. This gap was identified as a critical business need. The potential liabilities both legal and financial resulting from major accidents are punitive. Senior management required to have visibility and be assured that their operations were being managed correctly. . The tool and process has now been in place for over 4 years. It is a practical demonstration of Process Safety Management in the international Oil and Gas industry. It is a global process for the company concerned and is an essential part of its Process Safety Management System.

2 OTC 23051

Major accidents are a reality: they occur on a regular basis. See Figure 1

Figure 1 Timeline of Significant Major Accidents

The reverse is also true: the majority of Oil and Gas installations and Petrochemical plants operate successfully without major accidents for prolonged periods because there are effective barriers in place to prevent them. If these barriers are breached, it is likely that a major accident could occur. Behavior of people is a barrier. It is arguably the most significant since competent individuals doing the right thing at the appropriate time can be the key factor which prevents a major accident. However, the wrong behavior can easily undermine any other barriers irrespective of how robust these barriers appear to be. Behavior is governed by personal beliefs and shaped by the culture of an organization

OTC 23051 3

Another barrier would be the technology employed in the design of the plant and how well it was constructed. The way the plant is operated and maintained to ensure it is within the design operating envelope is also another barrier. There are other barriers such as competence of the personnel (at all project stages) and management systems which define what and how things will be carried out and to what standard. These are defined in policies, procedures and guidelines and they usually state how these systems are checked and tested using in most cases audits and reports. The Asset Integrity tool and Vulnerability Index which Wood Group PSN developed use these barriers and is explained in paper SPE 146240 The practical application of process safety principles to determine and monitor asset integrity of oil and gas facilities. Legislation and Regulators are increasingly placing emphasis on owners and operators to embed Process Safety Management practice into their operations. This is usually addressed through a site management system. Management Systems are based on a simple concept-

Plan Do Check Act

This is illustrated by an extract from HSG (65) Successful Health Safety Management. See Figure 2 The structure of a Management System (Plan, Do, Check, Act) is the framework of how things are done. It needs to include legislation requirements which are the things you must do or you must comply with. It should also incorporate advice which means best practice, guidance, and performance standards based on an individual companys experience.

Management systems can be very sophisticated and complex, particularly in the more industrially developed economies. However, even with these major accidents still happen. Longford, Buncefield, Grangemouth, and Texas City were all operated by major corporations with comprehensive management systems in place designed to prevent major accidents.

There are also examples where the management systems in place are not effective. This can be due to a variety of reasons:-

Mergers with ownership of sites being transferred to different operators that result in ambiguity for a

period until the new management system requirements are formulated and embedded. Emerging industrial countries with no legal HSE requirements so there is no legislative drive for a

company to install an effective management system. Mature sites which are at the very end of their useful life and the primary aim is to keep the operation

viable. This means the performance standards described in a management system are under constant challenge. They may be ignored or diluted particularly if they result in production shut downs or increased maintenance costs. Auditing programs can also be decreased significantly.

At best, the effectiveness of the conventional approach as found in many Management Systems as a means of prevention of major accidents is variable.

After the major accident at Texas City in 2005 there was an international drive by the energy industries and legislators to embed Process Safety Management principles in the way owners managed their operations. The outcomes of which gave confidence to the company management and legislators that major accident prevention was under control and managed The major accident caused by drilling the Macondo Well in the Gulf of Mexico in 2010 has built on this initiative and there is now even more focus in most energy companies and governments on what is the most effective way of preventing major accidents.

4 OTC 23051

Figure 2 Management System Concepts

OTC 23051 5

In 2008 Wood Group was facing a considerable challenge. It had been contracted by the owners of a large number of very different oil and gas installations to be the duty holder. This meant the company was responsible as far as the regulator was concerned for all operational matters on the installations and sites concerned and was the responsible party for prosecution in the event of a major accident.

The diversity and scale as well as the size and number of installations concerned meant the company became effectively one of the largest operators in the region.

There was already in place a conventional management system based on the ISO 9000 series of international quality standards and in the each of assets concerned there were many of the process safety management elements described in API 75 and SEMS. See Figure 3

Figure 3 API 75 Process Safety Elements

Even with these safeguards in place the company felt vulnerable and exposed to having a major accident. An additional process was required to give management at all levels in the company visibility and allow them to instigate management interventions in a timely fashion to prevent major accidents

Major accidents in Oil and Gas operations were identified as a major risk for the company

In 2008 Wood Group developed the Vulnerability Index and I View tool. In 2011 Woodgroup bought PSN which meant a considerable increase in global oil and gas operations with the associated increase in vulnerability to having a major accident somewhere. The Vulnerability Index and I View tool is currently being implemented on an international basis.

The idea behind the process is based on reliability and maintenance engineering principles. Failures in plant and equipment can be prevented by an opportune maintenance intervention that is a restorative task that prevents the failures happening.

SEMS-Safety and Environmental Management Systems

Process Safety Management

6 OTC 23051

This is illustrated in Figure 4

Failures

Figure 4 Optimized Maintenance Interventions Maintenance strategies based on RCM, RBI, and SiL or reliability studies define preventative maintenance tasks, when they should occur, and at what frequency. There is an optimized zone when the task should be carried out. If the task is carried outwith the optimized zone it worthless because it adds nothing to the equipment performance or it fails to restore performance and prevent a failure.

Figure 5 How Failures of Plant and Equipment Develop

OTC 23051 7

Figure 5 shows how failures on plant and equipment develop and illustrates that not all failures are obvious.

In Figure 5 the first condition curve (from the left) shows that the equipment has started to degrade very suddenly. It has not been detected because the drop in performance is instant. It is a breakdown with little or no warning.

The second curve (from the left) shows another failure type which is more progressive and gradual. The functional performance is decreasing, and again it is not detected until the item fails. These failures are the most common; typically they account for 75% of all equipment failures.

Maintenance Options see Figure 6 is the menu of techniques available in order to prevent these failures. The combination of how these techniques are used is called Maintenance Strategy.

We need to be able to find the degradation in performance in order for a management intervention to take place in the P and F interval. Then the equipment performance is restored and a failure is avoided.

Figure 6 Maintenance Options In Figure 6 the maintenance option which is best suited to this is shown to be Condition Based Maintenance. Different types of CBM are inspection where you go and look for the failures, function testing where you test for failure and degradation, and condition monitoring where you trend parameters over time and look for changes or anomalies. These indicate degradation such as changes in mechanical vibration or increases in temperature. Corrective actions can be instigated on the basis of these observations. Similarities exist between this approach using CM and using accident ratios to manage Health and Safety similar to Figure 7 The concept is based on the idea that if non injury accidents are managed and controlled through elimination of their causes then more serious injuries will be avoided

8 OTC 23051

Figure 7 Accident Ratios (Triangles) Figure 8 shows this concept extended to include Asset Integrity and Process Safety Management

Figure 8 Personal Safety Ratios and Process Safety Ratios The company Vulnerability Index Tool works mainly in the area shown below the dotted line in Figure 8.

OTC 23051 9

The events in this area need to measured and monitored. KPI are used for this purpose. It is vital to focus on the correct KPI which indicate the potential for a major accident. Figure 9 illustrates this point.

Figure 9 Process Safety Major Accident Key Performance Indicators KPI can categorize into different types. See Figure 10. The most useful KPI or Process Safety Performance Indicators (PSPI) are Operational Control indicators or Generic RCS (Risk Control System). Program Indications are of little value for the prevention of major accidents other than to demonstrate activity. In Figure 10 the difficulty and cost of collecting the data increases considerably as you move from right to left across the diagram.

10 OTC 23051

Figure 10 Different Categories of Process Safety Performance Indicators For the Nigg Oil Terminal in Scotland a series of Operational Control Indicators were selected from 120 potential candidates to 11 PSPI based on the COMAH (Control of Major Accidents and Hazards) case. These were categorized into

Level Indicators Pressure Indicators Integrity Report Indicators H2S Indicators PSV Indicators Miscellaneous

As shown in Figure 11

OTC 23051 11

Figure 11 Process Safety Control Indicators for Nigg Oil Terminal Figure 10 uses the terms leading and lagging indicators.

Leading indicators are before an event or indicative of an event. Lagging indicators are the event itself or the consequences after the event has occurred.

This introduces the concept of timing. A major accident will impact a number of different lagging indicators and be recorded as such. Therefore the focus of management should be on the leading indicators as they are the trigger to set off management interventions to prevent a major accident. This is impossible if the report from the management system is always after the event. They are typically 4 weeks behind real events (monthly reports). For the prevention of major accidents the reports need to be as near to real time as possible. The world of operations management is complex and busy. The KPI selected need to be as direct as possible. They should be meaningful, and explained in such as way that when the small events which are the precursor to major accidents occur they are noted, and acted upon as soon as possible by all levels of operations management. Figures 12, 13, and 14 are examples of management interventions Figure 12 Maintenance Backlog Reduction on Safety Critical Equipment Figure 12 shows how preventative maintenance tasks (PMR) on safety critical equipment were not carried out within the optimized time resulting in a backlog of 85 tasks in Feb 2010. As a result of a series of management interventions, extra staff, campaign maintenance approach, data clean up, and most importantly more management focus. Preventative Maintenance Backlog was permanantly eliminated over a 12 month period.

Assurance Example Preventative Maintenance Routine Backlog Reduction

0

10

20

30

40

50

60

70

80

90

Jan-10 Feb-10 Mar-10 Apr-10 May-10 Jun-10 Jul-10 Aug-10 Sep-10 Oct -10 Nov-10 Dec-10 Jan-11 Feb-11

Reported Backlog

12 OTC 23051

Figure 13 shows how non conformances (NCR) against the Safety Case verification scheme for an FPSO as identified by an Independent Auditor were rationalized and in many cases eliminated. The verification scheme describes the barriers in place and the expected performance standard for them to prevent a major accident on an asset; such as the wet deluge system in terms of flow and pressure or similarly the temporary safe refuge in terms of gas ingress performance. Anomalies are comments or questions as a result of the audit. NCR are not meeting the approved scheme requirements and are serious violations. Audit outcomes such as NCR are a typical leading Process Safety Indicator. Figure 13 Verification Scheme Audit Trends Figure 14 show an operational example where the high pressure and high level alarms are monitored and trended as a PSPI over time. Normally the number of alarms on the plant is relatively consistent. There is however a period in the middle of the year when the there is a rapid increase. This was due to 2 significant plant upsets which showed the associated high level alarms going into overdrive. The site management needed to make urgent interventions in both cases to safeguard the operation and prevent a major accident. Usually indicators like this provide minimal information and it is easy to dismiss them as being of little value. However as a trend and a performance standard is established, (in this case the performance standard is 42 alarms per week), It is possible to identify patterns and allow comparisons with other sites to see if any installations are operating at undue strain and in turn instigate management interventions on them to bring about improvements.

Verification Example Independent and Competent Person Audit Results

-5

0

5

10

15

20

25

30

35

40

45

Nov-09 Dec-09 Jan-10 Feb-10 M ar-10 Apr-10 M ay-10

Non-Conformances

Anomalies

OTC 23051 13

Figure 14 Trend of High Level Alarms over 12 months at an Oil Terminal There is a considerable amount of data and information contained in Process Safety Management reports particularly when they becomes normalized into ratios as is common in Health and Safety reporting. This form of reporting does not encourage engagement and means a code or language needs to be learned to understand the real message hidden in the information Instead what is needed is a very simple way of knowing the status of an installation in terms of Asst Integrity or Process Safety to allow management to focus on the assets that need their time and attention. Figure 15 show the Barrier model form SPE 146240 The practical application of process safety principles to determine and monitor asset integrity of oil and gas facilities. Figure 16 is an extract from a management report used to illustrate the principle. The barrier titles from Figure 15 are shown in the white boxes in Figure 16 under the title Barriers.

Fixed - 1 Oil Terminal

These two sites are not at Asset Integrity status this is shown by the red boxes. The other assets in showing green are at Asset Integrity status. The traffic lights are only red or green there is no amber. Hence Asset Integrity is a state: you either have it or you do not. When you are at Asset Integrity status all the barriers which prevent a major accident are intact. The red boxes in Figure 15 mean that the Engineering, Production and Maintenance, and Process, Systems and Competence Barriers have been breached; ie they have holes in them. For Fixed Platform 1 all the technical barriers which prevent a major accident are holed.

14 OTC 23051

For the Oil Terminal the situation is different. In this case the behavior barrier has been breached but the technical barriers are intact. It also does not have AI status. Using this simple method it is easy to see at a glance the status of multiple sites. It is updated weekly. Senior Management always study the sites which are not at AI status. Asset Integrity Management is all about managing the barriers so that the cracks in them do not become holes. Figure 15 Barrier Model

Figure 16 Asset Integrity Status

OTC 23051 15

Conclusions

Conventional Management Systems based on the Quality Management System model are to be found wanting in their execution when used to prevent major accidents.

Major Accidents are prevented by timely interventions by Operations personnel and all levels of

Management.

KPI need to be selected that are meaningful to the individuals who are responsible for carrying out the interventions.

Reports need to be produced in a timely fashion in order for any interventions to be effective

Everyone concerned with operating a site needs to understand the hazards involved and the current status

of the site in terms vulnerability to a major accident.

A simple easily understood indicator of Process Safety or Asset Integrity needs to be developed to help engagement.

Complex ratios, and normalized results as commonly found in HSE reports do not create engagement or

promote effective management interventions. Abbreviations AI Asset Integrity AIM Asset Integrity Management API American Petroleum Institute CBM Condition Based Maintenance CM Condition Monitoring COMAH Control of Major Accident Hazards Regulations FPSO Floating Production, Storage & Offload facility HSE Health and Safety Executive ICB Independent Competent Body I-VIEW Wood Group PSN web based Asset Integrity Tool ICP Independent and Competent Person NCR Non Conformance Result PMR Preventative Maintenance Routine PSM Process Safety Management PSPI Process Safety Performance Indicator RAM Risk Assessment Matrix RBI Risk Based Inspection RCM Reliability Centered Maintenance RCS Risk Control System SiL Safety Integrity Levels

16 OTC 23051

References

API 75 Recommended Practice for Development of a Safety and Environmental Management Program for Offshore operations and Facilities

API 754 Process Safety Performance Indicators for the Refining and Petrochemical Industries

Baker, James A, Report of the BP U.S. Refineries Independent Safety Review Panel

Conference: Dawson, P, HSE Process Safety Specialist Inspector, December 2008, Grangemouth

Refinery, Effective Process Safety Leadership workshop, Process Safety Performance Indicators for Major Hazard sites presentation.

Johnson Ian, Smith Alasdair Nigg Oil Terminal Process Safety Indicator PSPI Design Wood Group internal

document

Hopkins A Failure to Learn- The BP Texas City Disaster

Hopkins A Lessons from Longford Hopkins J SPE 146240 The practical application of process safety principles to determine and monitor

asset integrity of oil and gas facilities

HSE HSG 254 Developing Process Safety Indicators

HSE BP Grangemouth Major Accident Investigation Report June 2000

Occupational Safety Health Administration OSHA Process Safety Management regulations

UK Government Report The Buncefield Incident December 2005 Major Incident Investigation Board Report

MAIN MENUTable of ContentsSearchPrint