SYMPOSIUM SERIES No.

150

# 2004 IChemE

IMPLEMENTING MAJOR ACCIDENT HAZARD MANAGEMENT SILO BUSTING IN PRACTICE

Reynold H Mohess1 and Stuart Ditchburn2 CEng BSc M Inst MC 1 MAHMS Project Manager, bp Trinidad & Tobago LLC 2 Principal Consultant, DNV Consulting

INTRODUCTION A paper presented at Hazards XVII [Reference 1] explained the theory behind the Major Accident Hazards Management System (MAHMS), being developed for bp Trinidad & Tobagos (bpTT) operations in the Caribbean. This paper follows up with a discussion of the practical experience of implementing such a system within the operation. The attributes of MAHMS as presented in Reference 1, are that it:. . . . . . . . Adopts a Pragmatic and Qualitative Approach Deals with Safety, Environmental & Business Risk Management in a Holistic way Manages all Types of Risk as a Continuum Adopts a Systematic Approach Builds on Existing Processes Identies Critical Measures as People, Processes & Plant Develops Major Accident Hazard Understanding Makes Major Accident Hazard Information Readily Available

Implementation has also begun to address the Inheritance & Continuity of MAHMS beyond the project phase. This paper considers each of the above attributes in turn and discusses the practical experience gained during MAHMS implementation. PRAGMATIC & QUALITATIVE APPROACH RISK LEVELS AND REDUCTION In most businesses, there is an imperative to determine the levels of risk exposure that the company is willing to tolerate. The risk may comprise all types of contribution, but typically will include safety risk, environmental damage risk and business risk. Business risk in this sense includes production interruption and damage to both plant and reputation. There are numerous factors that will determine the risk level deemed to be intolerable. For safety risk for example, there may be two criterion; one for those directly involved in the operation and stand to gain from that employment (workers); and those who are not involved in the operation but may in some small way be exposed to risks arising from it (public). It is usual for the former group to have a higher level of tolerance to risk, but for both risk exposures there should be a continuous effort to reduce risk. Thus major accident hazard (MAH) events, which potentially affect members of the public either offshore (eg. sherman near the facility) or onshore (eg. people located an
1

SYMPOSIUM SERIES No. 150

# 2004 IChemE

area adjacent to a land pipeline), have more signicance and higher justication for risk reduction measures. The former example has justied signicant effort to lobby the Trinidad and Tobago (TT) Government to enforce the establishment of 500 m safety exclusion zones around offshore installations, in TT waters. Having established levels of intolerable risk, another factor needs to be taken into account, namely the degree of public outrage to the consequences of incidents. This manifests in a higher outrage for events where there are (or potentially are) a larger number of fatalities. Thus this means that Company Risk Criteria are invariably specied in terms of a societal risk curve (or F N curve) as shown in Figure 1. The sloping line of tolerability indicates the societal risk representation. The line is straight since both the event frequency (F) and cumulative number of potential fatalities (N) axes are logarithmic. A secondary, but equally important feature of Company Risk Criteria is a requirement to demonstrate how continuous risk reduction will be achieved over a period of time.

SEMI-QUANTITATIVE RISK ANALYSIS MAHMS considers three types of risk, namely safety risk, environmental risk and business risk; as discussed further in this paper. So to some extent these three contributors are being considered when comparing actual risk levels against Company Risk Criterion and delivery of continuous risk reduction.

Figure 1. Company risk criteria 2

SYMPOSIUM SERIES No. 150

# 2004 IChemE

Figure 2. MAHMS risk matrix & likelihood denitions

MAHMS initially evaluates risk on a qualitative basis using the MAHMS Risk Matrix. The MAHMS Risk Matrix and associated category denitions are shown in Figures 2 & 3. MAHMS has developed a methodology for estimating quantitative levels of safety risk, from the qualitative risk ranking determined in the Major Accident Hazard Identication sessions (MAHIDs). This is referred to as a semi-quantitative risk analysis. This is sufciently accurate to estimate where the risk levels lie when expressed in societal terms in relation to corporate risk criteria, for any given facility, group of facilities or Business Unit.

Figure 3. MAHMS risk matrix consequence denitions 3

SYMPOSIUM SERIES No. 150

# 2004 IChemE

The methodology relies on plotting all the potential causes of each identied MAH on the MAHMS risk matrix. Each cell on the matrix is assigned a safety risk value expressed in terms of a likelihood frequency (F) and consequences in terms of number of potential fatalities (N). (Refer to Figure 4). This data can then be used to develop the cumulative frequency, fatalities (FN) curve for that particular hazard. By summing F N curves for all identied MAHs, a F N curve for a complete facility can be developed. (Refer to Figure 5). RISK REDUCTION POTENTIAL Since each potential cause of a particular MAH is used to develop the facility FN curve, a very clear understanding of the risk drivers is achieved. The closer the cause plots towards the top right hand corner of the risk matrix, the higher the cause is in terms of its contribution to overall risk on a facility. Since risk is a combination of likelihood and consequences, the risk can either be reduced by lowering its likelihood (moving vertically down the risk matrix), or lessening the potential consequences (moving horizontally left on the risk matrix); or in some cases a combination of the two (moving diagonally towards the bottom left of the matrix). Thus risk reduction (remedial) measures may achieve lowering of the likelihood, a lessening of the consequences or in some cases both. This representation has proven to be useful in justifying expenditure on remedial measures in terms of risk benet achieved. Prioritising risk reduction measures has been achieved on the basis of: Value for money High Risks Quick Wins Long lead and expensive solutions

Figure 4. Semi-quantitative risk estimation 4

SYMPOSIUM SERIES No. 150

# 2004 IChemE

Figure 5. F N curve for facility A

Detailed understanding of the potential causes, severity, consequences, escalation potential and emergency response requirements, has provided the means to judge which remedial measures will give value for money in terms of tangible risk reduction potential. The remedial measures justied so far have been included in an integrated 3 year rolling Integrity Management Programme. HOLISTIC RISK MANAGEMENT Whilst MAHMS is estimating risk and identifying risk reduction measures primarily on the basis of safety risk, both environmental and business risk issues are being considered also. This holistic view of risk has only marginally increased the cost and complexity of MAHMS, and the benets have easily outweighed this. Two clear and specic examples of the benets of this approach are:(i) Pipelines in open water do not feature highly as a safety risk and do not ordinarily justify risk reduction. However, failure of these lines would pose much more signicant environmental and business risks. This attracts some attention, and measures to reduce the environmental and business risks can be justied. These measures coincidentally reduce the safety risks still further. Security breaches have the potential to cause MAH events that pose signicant safety, environmental and business risks. The combination of these high levels of risk increases the justication to improve security measures.
5

(ii)

SYMPOSIUM SERIES No. 150

# 2004 IChemE

Other benets include: Very few hazards have environmental and/or business consequences without any safety consequences. The characteristics (causes, severity, consequences, escalation potential actions) for any given hazard, are the same for all three types of risk. However, emergency response actions will be quite different. Risk reduction is a matter of working to reduce the risk drivers, (reducing the characteristics), and hence all types of risk are reduced by the same effort whatever the justication. It is easier to justify expense if remedial measures reduce all types of risk. Business risk drivers are a direct input to business contingency planning. An understanding of the likelihood and consequences of business risk helps to dene the details of the contingencies required. The hazard evaluation (Hazard identication risk analysis) process is the same for all risk. MAHID participants therefore gain an understanding of safety, environmental and business risk drivers; and their experience contributes greatly to design of hazard management strategies, critical measures and performance standards.

MANAGING SAFETY RISK AS A CONTINUUM Safety can be viewed as the spectrum of risk from occupational, health and safety (OH&S) exposures to major accident hazard (MAH) events. Figure 6 illustrates this spectrum that

Figure 6. The safety risk continuum 6

SYMPOSIUM SERIES No. 150

# 2004 IChemE

ranges from OH&S incidents, which tend to have higher frequency but low consequences; to MAH events which tend to occur at a much lower frequency but have potentially much higher consequences. Why bother to view the safety risk spectrum in this way? There are a number of advantages of doing so; namely: Many MAH events have historically been initiated by seemingly low consequence of an OH&S event or combination of events, which have escalated to a high potential incident or MAH event. The Birds Triangle [Reference 2], shows a direct relationship between the number of low consequence incidents (rst aid cases, days away from work cases, etc) to major incidents involving fatalities. OH&S and MAH Safety Risks are usually managed by two separate management systems, and often these systems are neither integrated nor contiguous. There is a very distinct possibility that certain risk exposures are not being managed as they fall between the scopes of both systems; or become over managed, as they fall under both systems, giving rise to potential conicts of actions. Historically, a number of near misses have been caused by the same risk drivers that create OH&S risk (viz: control of work, human factors, lifting operations, etc.) A near miss can be regarded as a major accident hazard event, where the ultimate consequences were not as great as they might have been had all potential escalation occurred.

Figure 7. Birds triangle relationship between low and high consequence incidents 7

SYMPOSIUM SERIES No. 150

# 2004 IChemE

MAHMS has developed a common set of tools for the management of OH&S risk, environmental risk and MAH risk. These common tools offer the following features: Calibrated risk matrices, which have common scales allowing a direct comparison to the Company Risk Criterion to be made. Harmonisation of risk management methodology and terminology (matrices, likelihood and consequence denitions), which facilitates extending work place risk management into the realms of MAH management. Provides a direct alignment of the risk assessment methodology with the requirements for incident reporting and follow-up, allowing incident reporting independent of the seriousness of the consequences (actual and potential). The means to establish the total risk exposure for any operation (OH&S risk plus MAH risk).

Figure 8 shows how the risk assessment matrices for OH&S risk and MAH risk are calibrated to the Company Risk Standard and the incident reporting tool.

ADOPTS A SYSTEMATIC APPROACH The virtue of adopting a systematic approach to MAH management is that it achieves consistency of results and risk estimation. This is essential where comparisons of risk exposure for each facility are to be made separately and then summated to create an overall risk prole for the Performance Units and Business Unit. There is a clear progression from hazard identication, through hazard understanding to managing the hazards. So there are two types of processes employed by MAHMS,

Figure 8. Calibration of risk matrices to company risk standard 8

SYMPOSIUM SERIES No. 150

# 2004 IChemE

namely those that develop Hazard Understanding and those that manage the Hazards. These processes are listed in the following table. The purpose of self-verication is to provide assurance that critical measures are effective. The scheme takes credit for the maintenance, calibration, function testing and performance testing of critical measures already carried out. Critical measures include people (with a specic role in MAH management), processes (management systems) as well as more conventional items of plant. Self-verication uses performance standards as the benchmark for judging if critical measures are performing as they should, and if not to what extent rectication work is required. This self-verication includes assurance of the MAHMS process itself. Periodically a management system review is performed to examine the MAHMS process and to potentially identify any areas that can be improved. This may mean raising performance standards for some aspects of the management system or critical measures. This supports the aim of achieving continuous improvement in terms of continuous MAH risk reduction. Figure 9 illustrates this in the form of the MAHMS model.

Table 1. Hazard understanding and management processes Hazard Understanding Processes MAHID Hazard Summaries Delivers List of hazards, causes, likelihood, consequences, critical measures and qualitative risk ranking. Hazard characteristics (causes, severity, consequences, escalation potential, emergency response requirements), hazard management strategy. Hazard characteristics, critical measures, current status of critical measures and effectiveness. List of hazards, causes, likelihood and consequences of events, number of fatalities, F-N exceedance curves (risk proles). Delivers Nature of risk, likelihood, consequences, risk drivers, potential risk reduction cost and programme for implementation. Remedial measures, programme for implementation and risk reduction to be gained Assurance of critical measures, performance standards, verication scheme. Review protocol, opportunities for improvement to existing management system. 9

Hazard Registers Semi-Quantitative Risk Analysis

Hazard Management Processes Remedial Measures Justications

Risk Reduction Plans Self-verication Scheme Management System Review

SYMPOSIUM SERIES No. 150

# 2004 IChemE

Figure 9. Overview of the MAHMS process model

BUILDS ON EXISTING PROCESSES One attribute to MAHMS is that it should build on existing processes as far as possible. The objective of MAHMS was to not to overburden the organisation, nor create additional layers of management systems. This means MAHMS has had to identify and interface with key business processes to deliver MAH management and risk reduction. Figure 10 shows how MAHMS is integrating with policy and strategy and to some extent inuencing these. It is also embedded into a range of activities, new projects (to achieve an inherently safer design), turnarounds (ensuring that major maintenance work is conducted safely), standard operating procedures (to dene the safe operating envelope) and engineering projects (to inuence the layout and design of new equipment; e.g. sphere launchers/receivers and specication of temporary accommodation units).
10

SYMPOSIUM SERIES No. 150

# 2004 IChemE

Figure 10. MAHMS interface with key business processes

As already mentioned MAH management and the management of OH&S risk have been harmonised. Embedding MAHMS into existing operations has also been possible for new functional standards. For example a new Group Standard on Integrity Management [Reference 3], will rely heavily on MAHMS for conformance with the Hazard Evaluations (Element 1) and MAH Potential (Element 2) of the standard. However, MAHMS will have an inuence over and/or provide conformance other elements of the standard, namely:Element 3 4 5 6 7 8 9 Management of Change Engineering Authorities Plant Integrity Protective Systems Competent Personnel Incident Investigation Emergency Response Considers MAH risk potential Denes Accountability, Responsibility Denes Operating envelope Uses Performance Standards as benchmarks Recognises People as critical measures Identies Failure of critical measures Based on Reasonably foreseeable MAH event scenarios Self-verication and Management Review 11

10 Performance Management

SYMPOSIUM SERIES No. 150

# 2004 IChemE

Some other notable processes that MAHMS inuences and interfaces with, are: HSSE Management Systems: For each of the expectations of Element 2 of BPs getting HSE right Risk Assessment & Management [Reference 4], MAHMS identies key processes and documents for planning, implementation and operation. For monitoring and corrective action, leading indicators are identied for continuous monitoring. Supply Chain Management: MAHMS identies equipment and materials that are of a safety, environmental or business critical nature. Ramication no substitutes and urgency required. MAHMS also identies the competence requirements of contract personnel who have roles and responsibilities in MAH management. Competency Assurance: MAHMS identies the competence requirements for persons who have roles and responsibilities in MAH management. (Competence is dened as appropriate combination of, qualications, understanding, experience, skills and other qualities) (QUESO, refer to Figure 11). Emergency Response: ER Plans should be based on reasonably foreseeable MAH events and be designed to achieve safety of personnel. Major emergency management (MEM) training, should also be based on reasonably foreseeable MAH events. Management of Change: Needs to consider the impact of change on (1) likelihood of MAH events; and (2) the consequences of MAH events. MAHMS identies the values of benchmark parameters against which the impact of change may be judged. (Refer to Figure 12).

CRITICAL MEASURES (PEOPLE, PROCESSES & PLANT) People and processes are a natural extension to items of plant, which are traditionally viewed as safety critical. In MAHMS critical measures include those that manage safety, environmental and business risk. Hazard registers list the critical measures relied

Figure 11. QUESCO ingredients of competence 12

SYMPOSIUM SERIES No. 150

# 2004 IChemE

Figure 12. Management of change benchmark parameters

upon to eliminate, prevent, detect and control, mitigate or provide emergency response to MAH events. People can be critical in key situations, e.g. emergencies; or while discharging their dayto-day roles and responsibilities for MAH management. Processes which contribute to actively manage MAH risks are also critical, e.g. corrosion management is a process, the failure or ineffectiveness of which could directly lead to loss of containment of hydrocarbons. Plant is the more readily identied critical measure. It has two attributes in that; (1) it may eliminate a hazard or prevent, detect, control, mitigate or provide emergency response to MAH events; and (2) the failure of the item of plant may initiate an MAH event itself. Hazard registers also provide a means to manage the ongoing status of critical measures (see hazard understanding documentation). Each critical measure has a performance standard against which self-verication is carried out. Performance standards for people, process and plant critical measures have been developed using the templates shown in Figure 13. The gure illustrates how each performance standard is developed to state what the critical measure is designed to do (functionality), what level of performance it is to deliver (performance specication) and under what conditions it can reasonably be expected to operate (survivability).
13

SYMPOSIUM SERIES No. 150

# 2004 IChemE

Figure 13. Performance standards template

DEVELOPS MAJOR ACCIDENT HAZARD UNDERSTANDING Understanding MAHs is key to The MAHMS process. It is also aligned with most individuals desire for a safe, environmentally responsible and prosperous place of work. Participation in Major Accident Hazard Identication (MAHID) workshops, is the rst step towards development of MAH understanding. Other documentation provides the means to further develop the MAH understanding required by people operating at different levels in the organization. Achieving this understanding amongst the higher levels of the organisation is proving to be a challenge. So what exactly is understanding and how does it differ from knowledge. To misquote Confucius, tell me and I may forget (knowledge), let me do it and I will understand (understanding). Figure 14 illustrates the four essential elements of effective communication that have increasing importance in developing understanding. MAHMS provides the information required to develop the understanding at different levels of the organization. There is a close inter-relationship between hazard understanding and hazard management documentation. Worthy of separate mention is the series of Key Issue Notes (KINs), which have been developed as aids to understanding of areas of particular concern. Each KIN discusses the issue in some detail and outlines the elimination, prevention, detection and control, mitigation and emergency response measures required to manage the threat. It also recommends some specic actions to resolve the issue across the whole operation. MAHMS has recognized that understanding needs vary according to an individuals operating level and specic job function within the organization. MAHMS has found that describing roles & responsibilities in terms of Accountability Responsibility,
14

SYMPOSIUM SERIES No. 150

# 2004 IChemE

Figure 14. Essential elements of effective communication

Facilitators and Implementers to be particularly useful. An ARFI chart for the Integrity Management Function has been drawn up to illustrate this in Figure 15. Various communication tools have been identied to enable the ongoing development of MAH understanding and the communication of risk. These tools form part of a documented communication strategy, as shown in Figure 16.

MAKING HAZARD INFORMATION READILY AVAILABLE The formal safety assessments required by the UK Safety Case Regulations [Reference 5], have traditionally been written for the UK Safety Regulator as the customer and safety professionals as the target audience. Hence they are usually written in terms that are not easily understood by the layman. Information useful for day-to-day management of MAHs is often difcult to nd and can require some interpretation before use. MAHMS has set out to improve on this situation by using non-technical language wherever possible and lodging all relevant MAH information on a MAHMS Website. This has proven invaluable to those who have a role to play in MAH management and
15

SYMPOSIUM SERIES No. 150

# 2004 IChemE

Figure 15. ARFI chart for integrity management function

Figure 16. Hazard understanding communication tools 16

SYMPOSIUM SERIES No. 150

# 2004 IChemE

an interesting source of information for others not directly involved. The main features of the website are: It is a readily accessible, up-to-date source of information and the preferred medium for most users. It is highly graphical, intuitive operation, provides easy cross-referencing and links to other relevant websites/or documentation. It enables MAHMS hazard understanding and management documentation to be kept dynamic. Updates do not require exhaustive document management arrangements and re-issue of hard copies.

The home page of the MAHMS Website is the portal (Figure 17) from which all information can be retrieved. It is simple and intuitive in use. Access to facility specic information is via the interactive map. The hazard understanding and management information is then accessible via the facility risk picture, which shows all the MAHs and their contribution to the overall MAH risk for that facility. More detailed information is accessible by clicking on the relevant segment of the risk picture allowing the user to drill down to their level of interest. Although the Website requires continuous effort to keep dynamic it has proven very popular with users.

Figure 17. MAHMS website portal home page 17

SYMPOSIUM SERIES No. 150

# 2004 IChemE

Figure 18. MAHMS project mission statement

INHERITANCE & SUSTAINANCE OF MAHMS The development (Phase II) and Inheritance (Phase III) of MAHMS has been a project responsibility. However, it was always envisaged that MAHMS would be a continuous process, which it will need to be to deliver MAH management over the lifetime of the facilities. BP have an evaluation process for judging the viability and added value of projects. This is called the Capital Value Process (CVP) [Reference 6]. The various stages of the MAHMS project have been fully aligned to the 5 stages of the CVP process. It is the philosophy of MAHMS project that the operation should inherit the process, to be owned and operated by the organisation. To this end, the project team is dening the organisation required to maintain and sustain the process beyond the project phases. This means determining the number of personnel required to operate MAHMS, and for each post developing a job specication. Individuals will be appointed/recruited against these job specications. This is being done well ahead of the end of the project phase, representing the transition from Execute to Operate so that formal and on-the-job training can be completed for the sustenance team. It is not only the MAHMS sustenance team that is being considered however, but the whole workforce who will need to inherit the MAHMS process. They will be responsible for embedding it into the key business processes and adopting behaviours that will ensue MAHMS will become a natural way of working. This will be necessary to achieve the MAHMS mission statement shown in Figure 18.

REFERENCES
1. Dalzell, Ditchburn & Mohess; Understanding Major Accident Hazards The Cutting Edge of Common Sense IChemE NW Branch Hazards XVII Symposium, Manchester: 25 27th March 2003. 18

SYMPOSIUM SERIES No. 150

# 2004 IChemE

2. Bird, F E; Damage Control Insurance Company of North America, Philedelphia 1966. 3. BP Group Functional Standard Integrity Management, Draft 2004. 4. BP Group Getting HSE Right HSE Management System Framework dated March 1999. 5. UK Safety Case Regulations, Statutory Instrument SI 1992/915. 6. BP Capital Value Process (CVP), Updated 19 October 1999.

19