OTC 23051

Essential Process Safety Management for Managing Multiple Assets

John Hopkins, WoodgroupPSN

Copyright 2012, Offshore Technology Conference

This paper was prepared for presentation at the Offshore Technology Conference held in Houston, Texas, USA, 30 April3 May 2012.
This paper was selected for presentation by an OTC program committee following review of information contained in an abstract submitted by the author(s). Contents of the paper have not been
reviewed by the Offshore Technology Conference and are subject to correction by the author(s). The material does not necessarily reflect any position of the Offshore Technology Conference, its
officers, or members. Electronic reproduction, distribution, or storage of any part of this paper without the written consent of the Offshore Technology Conference is prohibited. Permission to
reproduce in print is restricted to an abstract of not more than 300 words; illustrations may not be copied. The abstract must contain conspicuous acknowledgment of OTC copyright.

Abstract
The paper describes the use of a tool and process that shows management where to make interventions that
reduce the risk of having a major accident.
The tool indicates those areas that need immediate attention and those that need to be addressed in the future. It
allows these interventions to be tracked and is designed to be used by all levels of management.
The process is based on the simple concept that prior to a major event there are numerous small events which if
identified and then eliminated by management interventions will prevent a major accident.
It describes how an oil and gas contractor found itself in the position of being legally responsible for the operation
of a number of substantial oil and gas facilities over a very short time frame.
It already had in place a mature and robust Management System with the key elements of Process Safety
Management in place across the assets concerned. However there was not a reliable and simple way of
comparing each asset in terms of vulnerability of having a major accident.
There was no method in place to quantify the vulnerability and the existing reports from the management system
were in arrears which meant that any management intervention actions were inevitability too late to be effective.
This gap was identified as a critical business need. The potential liabilities both legal and financial resulting from
major accidents are punitive. Senior management required to have visibility and be assured that their operations
were being managed correctly.
.
The tool and process has now been in place for over 4 years. It is a practical demonstration of Process Safety
Management in the international Oil and Gas industry. It is a global process for the company concerned and is an
essential part of its Process Safety Management System.

OTC 23051

Major accidents are a reality: they occur on a regular basis. See Figure 1

Figure 1 Timeline of Significant Major Accidents

The reverse is also true: the majority of Oil and Gas installations and Petrochemical plants operate successfully
without major accidents for prolonged periods because there are effective barriers in place to prevent them. If
these barriers are breached, it is likely that a major accident could occur.
Behavior of people is a barrier. It is arguably the most significant since competent individuals doing the right thing
at the appropriate time can be the key factor which prevents a major accident. However, the wrong behavior can
easily undermine any other barriers irrespective of how robust these barriers appear to be.
Behavior is governed by personal beliefs and shaped by the culture of an organization

OTC 23051

Another barrier would be the technology employed in the design of the plant and how well it was constructed. The
way the plant is operated and maintained to ensure it is within the design operating envelope is also another
barrier.
There are other barriers such as competence of the personnel (at all project stages) and management systems
which define what and how things will be carried out and to what standard. These are defined in policies,
procedures and guidelines and they usually state how these systems are checked and tested using in most cases
audits and reports.
The Asset Integrity tool and Vulnerability Index which Wood Group PSN developed use these barriers and is
explained in paper SPE 146240 The practical application of process safety principles to determine and monitor
asset integrity of oil and gas facilities.
Legislation and Regulators are increasingly placing emphasis on owners and operators to embed Process Safety
Management practice into their operations. This is usually addressed through a site management system.
Management Systems are based on a simple concept

Plan
Do
Check
Act

This is illustrated by an extract from HSG (65) Successful Health Safety Management. See Figure 2
The structure of a Management System (Plan, Do, Check, Act) is the framework of how things are done. It needs
to include legislation requirements which are the things you must do or you must comply with. It should also
incorporate advice which means best practice, guidance, and performance standards based on an individual
companys experience.
Management systems can be very sophisticated and complex, particularly in the more industrially developed
economies. However, even with these major accidents still happen. Longford, Buncefield, Grangemouth, and
Texas City were all operated by major corporations with comprehensive management systems in place designed
to prevent major accidents.
There are also examples where the management systems in place are not effective. This can be due to a variety
of reasons:

Mergers with ownership of sites being transferred to different operators that result in ambiguity for a
period until the new management system requirements are formulated and embedded.
Emerging industrial countries with no legal HSE requirements so there is no legislative drive for a
company to install an effective management system.
Mature sites which are at the very end of their useful life and the primary aim is to keep the operation
viable. This means the performance standards described in a management system are under constant
challenge. They may be ignored or diluted particularly if they result in production shut downs or
increased maintenance costs. Auditing programs can also be decreased significantly.

At best, the effectiveness of the conventional approach as found in many Management Systems as a means of
prevention of major accidents is variable.
After the major accident at Texas City in 2005 there was an international drive by the energy industries and
legislators to embed Process Safety Management principles in the way owners managed their operations. The
outcomes of which gave confidence to the company management and legislators that major accident prevention
was under control and managed
The major accident caused by drilling the Macondo Well in the Gulf of Mexico in 2010 has built on this initiative and
there is now even more focus in most energy companies and governments on what is the most effective way of
preventing major accidents.

OTC 23051

Figure 2 Management System Concepts

OTC 23051

In 2008 Wood Group was facing a considerable challenge. It had been contracted by the owners of a large number
of very different oil and gas installations to be the duty holder. This meant the company was responsible as far as
the regulator was concerned for all operational matters on the installations and sites concerned and was the
responsible party for prosecution in the event of a major accident.
The diversity and scale as well as the size and number of installations concerned meant the company became
effectively one of the largest operators in the region.
There was already in place a conventional management system based on the ISO 9000 series of international
quality standards and in the each of assets concerned there were many of the process safety management
elements described in API 75 and SEMS. See Figure 3

SEMS-Safety and Environmental Management Systems

Process Safety Management

Figure 3 API 75 Process Safety Elements

Even with these safeguards in place the company felt vulnerable and exposed to having a major accident. An
additional process was required to give management at all levels in the company visibility and allow them to
instigate management interventions in a timely fashion to prevent major accidents
Major accidents in Oil and Gas operations were identified as a major risk for the company
In 2008 Wood Group developed the Vulnerability Index and I View tool. In 2011 Woodgroup bought PSN which
meant a considerable increase in global oil and gas operations with the associated increase in vulnerability to
having a major accident somewhere. The Vulnerability Index and I View tool is currently being implemented on
an international basis.
The idea behind the process is based on reliability and maintenance engineering principles. Failures in plant and
equipment can be prevented by an opportune maintenance intervention that is a restorative task that prevents the
failures happening.

OTC 23051

This is illustrated in Figure 4

Failures

Figure 4 Optimized Maintenance Interventions

Maintenance strategies based on RCM, RBI, and SiL or reliability studies define preventative maintenance
tasks, when they should occur, and at what frequency. There is an optimized zone when the task should be
carried out. If the task is carried outwith the optimized zone it worthless because it adds nothing to the
equipment performance or it fails to restore performance and prevent a failure.

Figure 5 How Failures of Plant and Equipment Develop

OTC 23051

Figure 5 shows how failures on plant and equipment develop and illustrates that not all failures are obvious.
In Figure 5 the first condition curve (from the left) shows that the equipment has started to degrade very suddenly.
It has not been detected because the drop in performance is instant. It is a breakdown with little or no warning.
The second curve (from the left) shows another failure type which is more progressive and gradual. The functional
performance is decreasing, and again it is not detected until the item fails. These failures are the most common;
typically they account for 75% of all equipment failures.
Maintenance Options see Figure 6 is the menu of techniques available in order to prevent these failures. The
combination of how these techniques are used is called Maintenance Strategy.
We need to be able to find the degradation in performance in order for a management intervention to take place in
the P and F interval. Then the equipment performance is restored and a failure is avoided.

Figure 6 Maintenance Options

In Figure 6 the maintenance option which is best suited to this is shown to be Condition Based Maintenance.
Different types of CBM are inspection where you go and look for the failures, function testing where you test for
failure and degradation, and condition monitoring where you trend parameters over time and look for changes or
anomalies. These indicate degradation such as changes in mechanical vibration or increases in temperature.
Corrective actions can be instigated on the basis of these observations.
Similarities exist between this approach using CM and using accident ratios to manage Health and Safety similar to
Figure 7
The concept is based on the idea that if non injury accidents are managed and controlled through elimination of
their causes then more serious injuries will be avoided

Figure 7 Accident Ratios (Triangles)

Figure 8 shows this concept extended to include Asset Integrity and Process Safety Management

Figure 8 Personal Safety Ratios and Process Safety Ratios

The company Vulnerability Index Tool works mainly in the area shown below the dotted line in Figure 8.

OTC 23051

OTC 23051

The events in this area need to measured and monitored. KPI are used for this purpose. It is vital to focus on the
correct KPI which indicate the potential for a major accident.
Figure 9 illustrates this point.

Figure 9 Process Safety Major Accident Key Performance Indicators

KPI can categorize into different types. See Figure 10. The most useful KPI or Process Safety Performance
Indicators (PSPI) are Operational Control indicators or Generic RCS (Risk Control System). Program Indications
are of little value for the prevention of major accidents other than to demonstrate activity. In Figure 10 the difficulty
and cost of collecting the data increases considerably as you move from right to left across the diagram.

10

OTC 23051

Figure 10 Different Categories of Process Safety Performance Indicators

For the Nigg Oil Terminal in Scotland a series of Operational Control Indicators were selected from 120 potential
candidates to 11 PSPI based on the COMAH (Control of Major Accidents and Hazards) case.
These were categorized into

Level Indicators
Pressure Indicators
Integrity Report Indicators
H2S Indicators
PSV Indicators
Miscellaneous

As shown in Figure 11

OTC 23051

11

Figure 11 Process Safety Control Indicators for Nigg Oil Terminal

Figure 10 uses the terms leading and lagging indicators.

Leading indicators are before an event or indicative of an event.

Lagging indicators are the event itself or the consequences after the event has occurred.

This introduces the concept of timing. A major accident will impact a number of different lagging indicators and be
recorded as such. Therefore the focus of management should be on the leading indicators as they are the trigger
to set off management interventions to prevent a major accident.
This is impossible if the report from the management system is always after the event. They are typically 4 weeks
behind real events (monthly reports). For the prevention of major accidents the reports need to be as near to real
time as possible.
The world of operations management is complex and busy. The KPI selected need to be as direct as possible.
They should be meaningful, and explained in such as way that when the small events which are the precursor to
major accidents occur they are noted, and acted upon as soon as possible by all levels of operations management.
Figures 12, 13, and 14 are examples of management interventions

Assurance Example Preventative Maintenance Routine

Backlog Reduction
90
Reported Backlog

80
70
60
50
40
30
20
10
0
Jan- 10

Feb-10

Mar -10

Apr -10

May- 10

Jun- 10

Jul-10

Aug- 10

Sep- 10

Oct - 10

Nov-10

Dec-10

Jan-11

Feb-11

Figure 12 Maintenance Backlog Reduction on Safety Critical Equipment

Figure 12 shows how preventative maintenance tasks (PMR) on safety critical equipment were not carried out
within the optimized time resulting in a backlog of 85 tasks in Feb 2010.
As a result of a series of management interventions, extra staff, campaign maintenance approach, data clean up,
and most importantly more management focus. Preventative Maintenance Backlog was permanantly eliminated
over a 12 month period.

12

OTC 23051

Figure 13 shows how non conformances (NCR) against the Safety Case verification scheme for an FPSO as
identified by an Independent Auditor were rationalized and in many cases eliminated.
The verification scheme describes the barriers in place and the expected performance standard for them to prevent
a major accident on an asset; such as the wet deluge system in terms of flow and pressure or similarly the
temporary safe refuge in terms of gas ingress performance.
Anomalies are comments or questions as a result of the audit. NCR are not meeting the approved scheme
requirements and are serious violations.
Audit outcomes such as NCR are a typical leading Process Safety Indicator.

Verification Example Independent and Competent

Person Audit Results
45
Non-Conformances

40

Anomalies

35
30
25
20
15
10
5
0
Nov-09

Dec-09

Jan-10

Feb-10

M ar-10

Apr-10

M ay-10

-5

Figure 13 Verification Scheme Audit Trends

Figure 14 show an operational example where the high pressure and high level alarms are monitored and trended
as a PSPI over time.
Normally the number of alarms on the plant is relatively consistent. There is however a period in the middle of the
year when the there is a rapid increase. This was due to 2 significant plant upsets which showed the associated
high level alarms going into overdrive. The site management needed to make urgent interventions in both cases to
safeguard the operation and prevent a major accident.
Usually indicators like this provide minimal information and it is easy to dismiss them as being of little value.
However as a trend and a performance standard is established, (in this case the performance standard is 42
alarms per week), It is possible to identify patterns and allow comparisons with other sites to see if any installations
are operating at undue strain and in turn instigate management interventions on them to bring about
improvements.

OTC 23051

13

Figure 14 Trend of High Level Alarms over 12 months at an Oil Terminal

There is a considerable amount of data and information contained in Process Safety Management reports
particularly when they becomes normalized into ratios as is common in Health and Safety reporting.
This form of reporting does not encourage engagement and means a code or language needs to be learned to
understand the real message hidden in the information
Instead what is needed is a very simple way of knowing the status of an installation in terms of Asst Integrity or
Process Safety to allow management to focus on the assets that need their time and attention.
Figure 15 show the Barrier model form SPE 146240 The practical application of process safety principles to
determine and monitor asset integrity of oil and gas facilities.
Figure 16 is an extract from a management report used to illustrate the principle. The barrier titles from Figure 15
are shown in the white boxes in Figure 16 under the title Barriers.

Fixed - 1
Oil Terminal

These two sites are not at Asset Integrity status this is shown by the red boxes. The other assets in showing green
are at Asset Integrity status.
The traffic lights are only red or green there is no amber. Hence Asset Integrity is a state: you either have it or you
do not. When you are at Asset Integrity status all the barriers which prevent a major accident are intact.
The red boxes in Figure 15 mean that the Engineering, Production and Maintenance, and Process, Systems and
Competence Barriers have been breached; ie they have holes in them.
For Fixed Platform 1 all the technical barriers which prevent a major accident are holed.

14

OTC 23051

For the Oil Terminal the situation is different. In this case the behavior barrier has been breached but the technical
barriers are intact. It also does not have AI status.
Using this simple method it is easy to see at a glance the status of multiple sites. It is updated weekly. Senior
Management always study the sites which are not at AI status.
Asset Integrity Management is all about managing the barriers so that the cracks in them do not become holes.

Figure 15 Barrier Model

Figure 16 Asset Integrity Status

OTC 23051

15

Conclusions

Conventional Management Systems based on the Quality Management System model are to be found
wanting in their execution when used to prevent major accidents.

Major Accidents are prevented by timely interventions by Operations personnel and all levels of
Management.

KPI need to be selected that are meaningful to the individuals who are responsible for carrying out the
interventions.

Reports need to be produced in a timely fashion in order for any interventions to be effective

Everyone concerned with operating a site needs to understand the hazards involved and the current status
of the site in terms vulnerability to a major accident.

A simple easily understood indicator of Process Safety or Asset Integrity needs to be developed to help
engagement.

Complex ratios, and normalized results as commonly found in HSE reports do not create engagement or
promote effective management interventions.

Abbreviations
AI
AIM
API
CBM
CM
COMAH
FPSO
HSE
ICB
I-VIEW
ICP
NCR
PMR
PSM
PSPI
RAM
RBI
RCM
RCS
SiL

Asset Integrity
Asset Integrity Management
American Petroleum Institute
Condition Based Maintenance
Condition Monitoring
Control of Major Accident Hazards Regulations
Floating Production, Storage & Offload facility
Health and Safety Executive
Independent Competent Body
Wood Group PSN web based Asset Integrity Tool
Independent and Competent Person
Non Conformance Result
Preventative Maintenance Routine
Process Safety Management
Process Safety Performance Indicator
Risk Assessment Matrix
Risk Based Inspection
Reliability Centered Maintenance
Risk Control System
Safety Integrity Levels

16

OTC 23051

References

API 75 Recommended Practice for Development of a Safety and Environmental Management Program for
Offshore operations and Facilities

API 754 Process Safety Performance Indicators for the Refining and Petrochemical Industries

Baker, James A, Report of the BP U.S. Refineries Independent Safety Review Panel

Conference: Dawson, P, HSE Process Safety Specialist Inspector, December 2008, Grangemouth
Refinery, Effective Process Safety Leadership workshop, Process Safety Performance Indicators for
Major Hazard sites presentation.

Johnson Ian, Smith Alasdair Nigg Oil Terminal Process Safety Indicator PSPI Design Wood Group internal
document

Hopkins A Failure to Learn- The BP Texas City Disaster

Hopkins A Lessons from Longford

Hopkins J SPE 146240 The practical application of process safety principles to determine and monitor
asset integrity of oil and gas facilities

HSE HSG 254 Developing Process Safety Indicators

HSE BP Grangemouth Major Accident Investigation Report June 2000

Occupational Safety Health Administration OSHA Process Safety Management regulations

UK Government Report The Buncefield Incident December 2005 Major Incident Investigation Board Report