153536nr5

8/13/2019 153536nr5

1/23

Risk indicators for major hazards in the offshore petroleum industry

(abbreviated version to be presented at ESREL 2003

Jan Erik Vinnem, HiS/Preventor,4349 Bryne

Terje Aven, HiS, 4068Stavanger

Morten Srum, Statoil,4035 Stavanger

Knut ien, SINTEF IndustrialManagement, 7465 Trondheim

1. INTRODUCTION....................................................................................................................................................1

1.1 BACKGROUND...................... ..................... ...................... ..................... ...................... .................... ..................... .................. 11.2 LEGISLATIVE REQUIREMENTS .................... ..................... ...................... ..................... ...................... ..................... ................. 11.3 OVERVIEW OF CURRENT PROJECTS................... ...................... ..................... ..................... ...................... ..................... .......... 11.4 OBJECTIVES ..................... ...................... ..................... ...................... ..................... .................... ...................... ..................... 21.5 TERMINOLOGY ..................... ..................... ...................... ..................... ...................... .................... ..................... .................. 2

2. OVERVIEW OF CURRENT PRACTICE ..................................................................... ....................................... 5

2.1 OCCUPATIONAL HAZARDS..................... ...................... ..................... ...................... ..................... ..................... ..................... 52.2

CULTURAL ASPECTS,MANAGEMENT SYSTEM..................... ..................... ...................... ..................... ...................... ............. 5

2.3 MAJOR HAZARDS.................... ...................... ..................... ...................... ..................... ..................... ..................... .............. 5

3. RISK INDICATORS, OBJECTIVES AND REQUIREMENTS ..................................................................... ....7

3.1 CONTEXT FOR USE OF INDICATORS ................... ...................... ..................... ..................... ...................... ..................... .......... 73.2 OVERALL OBJECTIVES OF USE OF RISK INDICATORS ..................... ...................... ..................... ...................... ..................... ... 73.3 REQUIREMENTS TO THE USE OF RISK INDICATORS ..................... ..................... ...................... ..................... ...................... ...... 83.4 USE OF MAJOR HAZARD INDICATORS AT DIFFERENT LEVELS.................... ..................... .................... ..................... .............. 10

4. BASIC APPROACH INDICATORS FOR MAJOR HAZARDS ............................................................ .......12

4.1 CLASSIFICATION OF INDICATORS ................... ..................... ..................... ...................... ..................... ...................... ........... 124.2 USE OF INDICATORS IN PRACTICE ..................... ...................... ..................... ..................... ...................... .................... ......... 134.3 ACCIDENTS,INCIDENTS AND NEAR-MISSES ..................... ..................... ..................... ..................... ..................... ................. 134.4 BARRIER PERFORMANCE .................... ..................... ...................... ..................... ...................... ..................... ................... ... 14

4.5 ACTIVITY LEVEL..................... ...................... ..................... ...................... ..................... .................... ..................... ............. 144.6 CAUSAL FACTORS ................... ...................... ..................... ...................... ..................... ..................... .................... ............. 144.7 MANAGEMENT SYSTEM...................... ..................... ...................... ..................... ...................... .................... .................... ... 154.8 CULTURAL ASPECTS.................... ..................... ...................... ..................... ...................... ..................... .................... ......... 15

5. LOSS RELATED INDICATORS ................................................................ ........................................................ .16

5.1 RECOMMENDED HESINDICATORS ................... ...................... ..................... ..................... ...................... ..................... ........ 165.2 RECOMMENDED INDICATORS FOR MAJOR HAZARDS ..................... ..................... ..................... ..................... ..................... ... 165.3 RECOMMENDED USE OF INDICATORS FOR MAJOR HAZARDS .................... ..................... .................... ..................... .............. 16

6. PROCESS RELATED INDICATORS.................................................................................................................17

6.1 RECOMMENDED HESINDICATORS ................... ...................... ..................... ..................... ...................... ..................... ........ 176.2 RECOMMENDED INDICATORS FOR MAJOR HAZARDS ..................... ..................... ..................... ..................... ..................... ... 176.3 RECOMMENDED USE OF INDICATORS FOR MAJOR HAZARDS .................... ..................... .................... ..................... .............. 18

7. INDICATORS RELATED TO CAUSAL FACTORS ................................................................ ........................ 18

7.1 RECOMMENDED INDICATORS FOR MAJOR HAZARDS ..................... ..................... ..................... ..................... ..................... ... 187.2 RECOMMENDED USE OF INDICATORS FOR MAJOR HAZARDS .................... ..................... .................... ..................... .............. 19

8. CONCLUSIONS AND RECOMMENDATIONS ......................................................... ...................................... 19

9. ACKNOWLEDGEMENT ........................................................ ........................................................... .................. 19

10. REFERENCES...................................................................................................................................................20

8/13/2019 153536nr5

2/23

Indikator paper rev2a.doc

(page left blank intentionally)

8/13/2019 153536nr5

3/23

Indikator paper rev2a.doc 1

1. Introduction

1.1 BackgroundRisk indicators in the offshore industry have traditionally been based on occurrence of injuries to personnel.This implies that the indicators that may be possible to present, are:

Trends in the occurrence of injuries to personnel and near-misses, classified according to severity orpotential severity

Injury causation statistics

Such indicators are suitable for performance monitoring in the context of workplace injury (consequence upto one fatality). It has been claimed that such indicators can provide information about all safety aspects ofan installation, i.e. also aspects of major hazard risk.

It may be argued that there will be considerable similarity between occupational and major accidents, when

it comes to root causes of organisational nature. Otherwise, the similarity would be expected to be verylimited. Therefore, indicators for personal injuries have very limited applicability for monitoring of majorhazard risk.

This may be further emphasized as follows: A traditional focus on near misses and motivation is noguarantee for the functioning of normally dormant safety barriers. The indicators based on events and HESculture therefore need to be supplemented with indicators reflecting the status of safety barriers, in order toillustrate the total picture.

In the recent NPD management regulations (NPD, 2001a) there is a clear requirement to monitor risk andpresent trends in indicators, which shall illustrate the relevant aspects of major hazard risk.

1.2 Legislative RequirementsThe recent regulations relating to management in the petroleum activities (NPD, 2001a, the managementregulations) require the following in terms of monitoring of major hazard risk:

Section 7 Monitoring parameters and indicators.The operator or the party responsible for the operation of a facility shall establish indicators to monitorchanges and trends in the risk relating to major accidents.

UK legislation for offshore installations and operations have similar requirements, in the Prevention of fire

and explosion and emergency response on offshore installations (PFEER) Regulations (HSE, 1995), whereRegulation 5 requires establishment of performance standards and suitable measurement and recording.

1.3 Overview of Current ProjectsThe structure of major hazard barriers that is currently used widely in the offshore petroleum industry isbriefly described in Section 1.5.2. There are currently a number of projects that address modelling orevaluation of barriers, which may be briefly explained as follows:

NFR/HESPetroleum:

R&D project financed by Norwegian authorities in order to develop decisionsupport tools for the offshore petroleum industry in Norway

CORD: Coordinated operation and maintenance offshore (Langli, 2001), Part Project 5

OLF ORA: OLF project on Operational Risk Assessment

RNNS: Risk Level on the Norwegian Continental Shelf. NPD project. Se section 1.5.4

8/13/2019 153536nr5

4/23


SINTEF/NPD: SINTEF project financed by NPD on modelling of barriers

Multi national: PRIMA_EU (a Program for RIsk MAnagement in Europe), see Momal (2002)

There are also various initiatives and internal projects being conducted within the industry, in order todevelop schemes for barrier performance monitoring.

1.4 ObjectivesThe Norwegian Government has initiated a research program to improve the safety level offshore. Theprogram is led by the Norwegian Research Council and a network of Norwegian institutions has beenestablished in order to realise the program. The ambition is to obtain more adequate tools for risk assessmentand support for decision-making, in general and for the operational phases in particular. The present work isa part of this program.

The purpose of the paper is to propose a structured approach to definition of suitable risk indicators formajor hazards, based on a brief review of current usage, development plans and experience from existingprojects.

1.5 Terminology

1.5.1 Risk DimensionsThere are three main dimensions of risk according to Norwegian regulatory requirements, which has thefollowing main elements:

Risk to personnelo Occupational accidentso Major accidentso Occupational diseases

Risk to environmento Accidental spillo Continuous release

Risk to assets and production/transportation capacityo Accidental disruption

Unplanned and planned maintenance are also contributions to disruption of production and transport. Thesecontributions are normally considered within regularity analysis. Regularity analysis may be considered aspart of risk assessment, if a wide interpretation of the term is used, but may be more efficiently considered aseparate analysis.

The main focus in the paper is risk to personnel, in particular major hazard risk.

1.5.2 Proposed Terminology for BarriersThe new Norwegian regulations for offshore installations and operations make extensive references to theterm barriers. This term is not defined, but comments given in the regulations (NPD, 2001a) imply thatbarriers are actions that are intended to reduce the probability that faults or hazards develop into accidents orto limit or reduce injury, damage and other unwanted effects.

ISO Standard 17776 defines barrier as follows:

measure which reduces the probability of realising a hazards potential for harm and of reducing its

consequence. Barriers may be physical, (materials, protective devices, shields, segregation, etc.) ornon-physical (procedures, inspection, training, drills)

8/13/2019 153536nr5

5/23


This implies that NPD has adopted the ISO definition. This definition is wide and general, and includes awide range of actions which may be considered a barrier. More precise or limited definitions have beensearched for by several specialists.

Another application of the barrier concept is in relation to MTO analysis of accidents and incidents in theoffshore petroleum sector (Bento, 1999). The term barrier is in this application given a wide definition, inline with the ISO definition.

The following definitions are proposed as more precise definitions of barrier related expressions, within thegeneral definition adopted from ISO 17776. These definitions are proposed in the context of the presentpaper, for use in relation to barriers for major hazards and indicators in relation to such risk elements. Theterm major hazard barrier has been proposed in order to give a more precise definition of the wide termbarrier:

Major hazard barrier Line of defence relating to overall functions, as explained below.Barrier element Part of barrier, but not sufficient alone in order to achieve the required

overall function, as explained below.[Barrier performance] Influen-

cing factor

Factors that influence the performance of barriers.

The NPD management regulations (NPD, 2001a) makes a distinction between physical barrier [elements]and non-physical barrier [elements]. The former are the hardware systems, whereas the latter areorganisational, procedural or human elements.

The influencing factors are particularly important for non-physical barriers.

Barriers may be regarded as lines of defence, as illustrated in Figure 1 below.

Figure 1 Illustration of lines of defence principle

Each of these levels will consist of several barrier elements, for instance (but not limited to) the followingfor the ignition prevention barrier:

Automatic gas detection

Manual gas detection

8/13/2019 153536nr5

6/23


Shutdown logic

Procedures intended to limit open flame exposure

Area classification rules affecting protection of electrical equipment

[Barrier performance] Influencing factors are factors that influence the performance of barriers. These areparticularly important for non-physical barrier elements.

Consider as an example the manual gas detection performed by personnel performing manual inspection inthe process areas. Factors that will influence the ability of such personnel to detect possible gas leaks are asfollows:

Procedures for manual inspections

Organisation of work, work patterns

Training of process operators

Experience of process operators

Motivation of process operators

etc.

Indicators may be defined for each of these factors, see discussion in Section 7.1.

Please note that what we here consider as influencing factors will often be considered as barriers accordingto the ISO or NPD definition as stated above.

1.5.3 Terminology for IndicatorsThis section proposes a structured terminology for indicators.

Risk indicator: A measurable quantity which provides information about risk

Risk indicator related to activity: A measurable quantity related to execution of defined operationalactivities, which provides information about risk

Risk indicator based on barrierperformance:

A measurable quantity related to barrier performance, which providesinformation about risk

Risk indicator related to incidents: A measurable quantity related to occurrences of accidents, incidentsand near-misses, which provides information about risk

Risk indicator related to causalfactors:

A measurable quantity related to causal factors for barrier perfor-mance, which provides information about risk

Risk indicator related to safetyculture:

A measurable quantity related to safety climate/culture and itsinfluence on the performance of barriers, which provides informationabout risk

Proactive (leading) risk indicator: A measurable quantity which provides information about risk,explicitly addressing an aspect of future performance (example;

anticipated number of hot work hours next year)Reactive (lagging) risk indicator: A measurable quantity based on outcomes of accidents and incidents

It may be discussed whether causal factors and influencing factors are synonymous expressions, and tosome extent they are. It may be argued that influencing factors is a wider term than causal factors, butlittle emphasis is placed on this.

Sometimes the term safety indicator is used in stead of or in addition to the term risk indicator. We usethese terms as synonymous terms in this paper, meaning that safety indicator is a measurable quantity whichprovides information about safety. Both the terms safety and risk are used in a wide sense and for thepurpose of this paper we have not distinguished between them. The term risk indicator is used throughout

the paper.

1.5.4 AbbreviationsThe following abbreviations are used in the paper:

8/13/2019 153536nr5

7/23


HSE Health and Safety ExecutiveHES Health, Environment and SafetyISRS International Safety Rating SystemKPI Key Performance IndicatorLTI Lost Time InjuryNPD Norwegian Petroleum DirectoratePFEER Prevention of Fire and Explosion, and Emergency Response

QRA Quantified Risk AssessmentRNNS Risk level on the Norwegian Continental Shelf (Risikoniv norsk sokkel)TTS Technical condition of safety systems (Teknisk Tilstand Sikkerhet)

2. Overview of Current Practice

2.1 Occupational HazardsThe traditional approach to monitoring in the offshore petroleum industry has been based on different

indicators based on occurrence of injury to personnel, see Kjelln (2000). The following are the mostcommonly used indicators:

H-value: Number of injuries with absence per 1 million exposure hours

H2-value: Number of injuries per 1 million exposure hours (excluding first aid cases)

Huseb et.al (2002) presents trends in H2-values for the entire Norwegian Continental Shelf, in the period1990-2001.

There may also be other measures as described by Kjelln (2000), but the H and H2 values are by far themost commonly used indicators.

2.2 Cultural Aspects, Management SystemThere are a number of alternative indicators that have been proposed and used for monitoring ofmanagement systems and cultural aspects of safety (cf. Kjelln, 2000):

International Safety Rating System, ISRS

Tripod Delta

Sustainability index (the Learning lab, 2002)

There are in addition a number of questionnaire surveys, interview schemes, etc that have been employed in

order to assess management systems and cultural factors, see Kjelln (2000).

2.3 Major HazardsThere have been a few projects in the industry and research projects that have addressed major hazardindicators for the offshore petroleum industry:

TotalFinaElfs major hazard indicator, 1997-present, (Vinnem, 2000)

Statoil TTS-project on technical barrier status, 2000-present (Thomassen and Srum, 2002)

Indicator project, research project, 1994-2000 (ien and Sklet, 2001a)

Norsk Hydro's KPI project, 2001-present (ien, 2002)

TotalFinaElfs major hazard indicator for the Frigg field production complex has been in operation since1997, and includes 12 individual indicators for technical safety systems and organisational factors foremergency preparedness. There is in addition an overall indicator which summarises weighted contributionsfrom the individual indicators.

8/13/2019 153536nr5

8/23


The Statoil TTS-project has assessed status for technical barriers on offshore installations and onshorefacilities, based on 19 performance indicators per installation. Integrity, effectiveness and robustness areconsidered and an overall evaluation of the individual performance indicators is provided.

The [research project] Indicator project, performed by SINTEF on behalf of NPD covered technical aswell as organisational indicators. The first phase of this project focused on technical (QRA-based) risk

indicators. A set of nine individual indicators was proposed for one specific installation (ien et al., 1995),and a second set of nine individual indicators (some being different from the first set) was proposed foranother installation (ien and Sklet, 1999).

The second phase of the indicator project focused on organisational risk indicators as a supplement to theQRA-based indicators (in those instances where the latter indicators are judged inappropriate due to, e.g.,few events). Organisational risk indicators covering five organisational factors important to the containmentbarrier were proposed for one specific installation (ien and Sklet, 2001b).

The objective of Hydros KPI project is to develop a technical safety indicator and provide a system todocument and follow up the development of the process safety condition during the lifetime of plants, and

provides a management tool to ensure continuous focus. The technical safety indicator, denoted T value,will be a key performance indicator for technical safety corresponding to the H value for occupationalhazards. This overall indicator consists of four types of indicators; barrier test indicators, inspectionindicators, activity indicators and event indicators. At present 13 individual indicators are proposed used fora pilot plant (ien, 2002).

8/13/2019 153536nr5

9/23


3. Risk indicators, Objectives and Requirements

3.1 Context for Use of IndicatorsManagement of Health, Environment and Safety (HES) has the following elements (cf. Kjelln, 2000):

Establishing policies, goals and requirements

Planning and implementation

Organisation and responsibilities

Control and verification

Corrective actions

Experience transfer

The management of HES is often described as a control loop (see illustration in Figure 2), with the elementsas mentioned above. Use of indicators has an important role in the control loop, in order to provide basis forcontrol and verification, identify the need for corrective actions and basis for experience transfer.

Figure 2 HES management control loop

Use of risk indicators is one element of the monitoring of effect box in Figure 2. It should be noted thoughthat separate elements are devoted to requirements, analyses, etc. implying that the scope of use of riskindicators is limited to monitoring.

3.2 Overall Objectives of Use of Risk IndicatorsThe main purpose of using risk indicators is to enable an effective and proactive HES management of thesystems and operations being considered. Measurement of safety performance is necessary for many reasons(based on Tarrants, 1980):

As a basis for causal factor detection

To identify problem areas

Objectives,requirements,

criteria

Risk & Emergencypreparedness

analysis

Identification ofmeasures and their

effect

Implementation ofmeasures

Monitoring of

effect

8/13/2019 153536nr5

10/23


As a basis for trend analysis

As a basis for evaluation of risk of injury and other losses

To describe the safety status of an organization

As a basis for predicting future accident exposure

As a basis for evaluating accident prevention program effectiveness

As a basis for making decisions regarding the allocation of accident prevention resources

To establish long-term risk management strategies To fulfil authority requirements

These objectives are general, and apply to all types of risk indicators. This paper has however, its mainfocus on major hazard risk, and the following additional aspects may be considered in this context.

One aspect is special about management of major hazard aspects, namely the need to maintain a continuoushigh attention level, often in spite of many years of operation without accidents or near-misses. It is quitecommon that motivation and attention may be somewhat degraded over the years, when an installation hasbeen operated without serious events for a long time.

3.3 Requirements to the Use of Risk Indicators3.3.1 HES related RequirementsThe overall objectives may be broken down into specific requirements. The following may be stated fordefinition of the required sets of performance indicators, for all types of accidents:

The total set of indicators should address a range of incidents, from the insignificant near-misses up tothe most severe and complex accident sequences.

If very different hazards are studied, an incident based indicator reflecting the potential for major acci-dents should be considered, alongside with individual indicators.

Indicators such that they are discussed in this paper should primarily reflect aspects that are possible toinfluence from an operational point of view, although some indicators may not satisfy this requirement,but still be useful.

Such indicators that are considered as intuitively important for personnel with practical operational/HESexperience, should ideally be given priority. One should try to avoid indicators for aspects that areconsidered to have little or no practical relevance.

Indicators should give opportunities for risk reduction potentials that reflect physical accident mecha-nisms or causes which may be related to physical or non-physical aspects, as opposed to synthetic,simplified or artificial modelling parameters. Volume density of process equipment may illustrate suchan artificial modelling parameter. Volume density is used as a parameter in escalation modelling.Volume density would be a rather useless risk indicator, as it is purely a synthetic modelling parameter,which is not considered in design or operation [although there are aspects considered that implicitlyhave influence on the density].

The suitability of indicators is also dependent on which level the indicator is used for. This may also berelated to the so-called "free variables", i.e. quantities that are possible to change.

As an example, let us consider the activity risk indicator, the number of days with a certain [hazardous]activity, such as drilling. Clearly this indicator provides interesting information about risk, and consequentlyis a useful indicator, but it can be discussed to what extent it is related to a free variable. On the nationallevel, the extent (or volume) of drilling activity may be considered a 'free variable', in relation to whichregions or fields to be developed, whereas it is not at the same degree a free variable on the installation levelas this activity in practice must be done, given the frame conditions for the activity on this installation.

On the installation level, more detailed indicators need to be added, to establish a proper set of indicators,and in order to reflect aspects that may be influenced through operational decisions. Such indicators includethe type of drilling of well intervention activity, the number of effective barriers, porosity of the formation,the weight margin of the drilling fluid, etc.

8/13/2019 153536nr5

11/23


Another aspect is related to whether to express annual values, or accumulated over the field lifetime. This isa general problem, but can be illustrated with reference to drilling. If a certain number of wells is needed inorder to develop or maintain production, it will usually not imply overall reduced risk even if the drillingactivities is spread out over several years, as opposed to completing the program in just one year.

One solution for this and similar cases is that the indicator reflects some kind of accumulated values. Thedisadvantage of such a solution will be a more complicated indicator, which will need to be considered over

several years before conclusions may be drawn.

3.3.2 Formal RequirementsThere are a set of formal requirements that indicators should satisfy, in addition to the requirements relatingto HES management as outlined in Section 3.3.1 above. The indicators should satisfy the following formalrequirements, and thus be (cf. Aven, 2003, Kjelln, 2000):

observable and quantifiable

sensitive to change

transparent and easily understood

robust against manipulation

valid

It must be possible to observe and measure performance by applying a recognized data collection methodand scale of measurement. Usually, the indicators are expressed on a ration scale of measurement, such asthe Lost Time Injury (LTI) rate which expresses the number of injuries resulting in absence from work perone million hours of work. It is difficult to establish a data collection method that gives reliable data, i.e. thedata corresponds to the quantity we would like to observe. For example, measuring the true number of LTIsis in practice often difficult. Recording of the events may be poor, and the data may be contaminated byextraneous factors such as rumours and direct manipulation.

Psychological and organizational reasons could in many cases result in a too low reporting. An example, we

may think of an organizational incentive structure where absence of injuries is rewarded. Then we mayexperience that some injuries are not reported as the incentive structure is interpreted as absence ofreported injuries.

A risk indicator must be sensitive to change. It must allow for early warning by capturing changes in ansocio-technical system that have significant effects on accident risks. Clearly, the number of accidentsleading to fatalities would not normally be sufficiently sensitive to change. The LTI rate is more sensitive,but also this indicator could be considered to be too insensitive for changes.

The "good" set of indicators will reflect changes in risk as well as point to aspects where improvementsshould be sought. In theory a good indicator for the operational phase may be totally insensitive to aspectsthat are fixed in operation, thus the reflection of risk on these aspects are irrelevant.

The risk indicator must be transparent and easily understood, in that its meaning is apparent and compatiblewith the users theoretical understanding and unconscious mental models. Some indicators have been basedon indirect observations of causal factors and complex mathematical manipulation in order to estimate risklevels. This should be avoided, as it completely prohibits transparency.

The risk indicators must also be robust against manipulation. The point is that the indicator should not allowthe organisation to look good by for example changing reporting behaviour, rather than making thenecessary basic changes that reduce accident risk.

This leads us to the requirement of validity, which is a critical point in the evaluation of the goodness of an

indicator. Is the indicator a valid indicator for the accident risk? Does the indicator actually measure whatwe intend to measure? Consider for example the indicator defined by the number of lost time injuries.Clearly, this indicator say something about accident risk, but of course, the accident risk is more than thenumber of lost time injuries, so we cannot use just this indicator to conclude on development in the accidentrisk level as a whole. The validity of a statement concerning the accident risk based on observations of the

8/13/2019 153536nr5

12/23


injury rate only, would thus in most cases be low. But restricting attention to this specific type of injuries,there should be no validity problem, in this respect. But still we have problem in concluding on anydevelopment in the injury risk based on the observations from the indicator. Say that we have observed thefollowing data for the last six years;

1, 2, 1, 3, 3, 5.

We assume that the number of working hours is constant for the time period considered. What do these datasay about the injury risk? Well, risk relates to the future, so the question is then how relevant these data arefor the future activity. If we judge the data as relevant, we can use the data to express risk and if much dataare available, the uncertainties in future predictions of the number of injuries would be small. For the caseabove, it is however not so straightforward to perform the predictions. There seems to be an increase in thenumber of injuries, but is this increase "strong" or "real", in other words do the data show a trend? To decideon this, different approaches can be used, some type of statistical testing or more ad hoc procedures. Thepoint here is to ensure that there is a reasonable rule identifying when a trend is present. For the aboveexample, would a statement concluding that the data show a trend be valid. Well, that depends on theprocedure being used. Using traditional statistical testing, such a statement would clearly have low validityas no test would support such a hypothesis, the amount of data is too little, cf. Aven (2003), Section 2.1.

3.4 Use of Major Hazard Indicators at different LevelsThe following levels are discussed below:

National level

Company/Installation level

Equipment level

One aspect which is valid on all levels is the need to address variations between the best and the worst unitsin addition to average levels.

It should also be noted that development of indicators on a higher level, may in theory be done byaggregating from a lower level. This is in practice seldom so simple, because other indicators may be morerelevant on a higher level than just summing up from a lower level.

3.4.1 Use on a National LevelIndicators may be used on a national level for all dimensions of risk as shown in Section 1.5.1. This sectionis limited to a discussion of indicators for major hazard risk.

Risk indicators for major hazard risk on a national level may be used for:

Identification of status and trends Identification of typical causes of increased risk

Establishing prioritised improvement areas

Status and trends will apply to all facilities and operations in that nations regulatory system. Similarly,typical causes as well as improvement areas apply to all installations and operations. This is important forauthorities as well as the industry as a whole.

On a national level it will usually be need to apply a combination of individual indicators and overallindicators which reflect the importance of various individual indicators i.e., individual indicators andaggregated/overall indicators/indexes.

An example of assessment of individual as well as overall indicators for the national level is shown inHuseb et al (2002). Not only major hazard is addressed, but also occupational injury risk and occupationaldiseases, in addition to cultural aspects and perceived risk. Other examples are discussed in Vinnem et al(2002).

8/13/2019 153536nr5

13/23


3.4.2 Use on a Company/Installation LevelIndicators may be used on a company and/or installation level for all dimensions of risk as shown in Section1.5.1. The discussion in this section is limited to a discussion of indicators for major hazard risk. Sometimesa company operates one installation, then company and installation level are synonymous contexts. Moreoften however, a company operates several installations.

Areas for use of risk indicators for major hazard risk on a company and/or installation level are the same as

for the national level:

Identification of status and trends

Identification of relevant causes of increased risk


Status and trends will apply to all facilities and operations in the companys sphere of responsibility.Similarly, typical causes as well as improvement areas apply to all installations and operations. It may alsobe required to analyse installations (or groups of installations) separately, if there are significant differences(which are not rare).

On the company/installation level it will usually be needed, similarly as for the national level, to apply acombination of individual indicators and overall indicators which reflect the importance of variousindividual indicators.

Experience with use of indicators on the company/installation level is discussed in Vinnem (2000), whichdiscusses the following aspects:

Experience with use of indicators

Challenges for effective use

One of the aspects discussed is the difference between technical systems and organisational actions, and theneed for continuous attention and motivation.

3.4.3 Use on a Equipment LevelIndicators may be used on an equipment level for all dimensions of risk as shown in Section 1.5.1, providedthat the equipment has relevance for the different dimensions of risk.

Risk indicators for major hazard risk on an equipment level may be used for:

Identification of status

Identification of trends, (in relation to rules for trend identification, see Section 3.3.2)

Identification of relevant causes of increased risk


Status and trends will apply to the relevant equipment, but will be dependent on whether significant trendsmay be established or not. Also relevant causes and improvement areas may be identified. Indicators forsafety critical equipment belong in this category.

8/13/2019 153536nr5

14/23


4. Basic approach Indicators for Major Hazards

4.1 Classification of IndicatorsThere are various ways to classify indicators, two classification schemes that are discussed in this paper, are

the following:

Classification of indicators reflecting how the data is collected

Classification of indicators reflecting steps in the accident chain

The classification of indicators based on how the data is collected is in line with Kjelln (2000), andconsists of the following:

Loss based indicators

Process based indicators

Indicators based on causal factors (including indicators related to safety climate)

Only for quite frequent occurrences may indicators be based on recording of actual losses, otherwise willindicators for risk have to be based on process parameters or causal factors.

Base on discussion in the previous sections, the following types of indicators are required for major hazards:

Incident indicator

Barrier indicator

Activity indicator

Indicators related to causal factors (including indicators related to safety climate)

The relationship of different indicators coupled with modelling of barriers and incidents in accidentsequences is presented in Figure 3. All of these indicators are as the diagram shows, applicable at differentstages of the accident chains.

Figure 3 Loss indicators in relation to accident sequences

Incident indicators are based on occurrence of accidents, incidents and near-misses, and are as such reactiveindicators. This type of indicator is nevertheless needed, as they give important information of what hasoccurred in the past. Indicators based on occurrence of accidents are loss related indicators, whereasindicators based on near-misses and similar are process related indicators.

Incident indicators

Indicators rel to causal factors

Activity indicators

Barrier indicators

8/13/2019 153536nr5

15/23


Barrier indicators are used in order to demonstrate status and trend of barriers, many of which are dormant,in the sense that they are only called for once several other barriers have failed. The majority of theexperience data will be from tests, inspections, actions due to false alarms, etc. This type of indicators maybe called partly reactive, partly proactive.

Activity indicators are almost entirely proactive indicators, which are required in order to manage activelyplanning of activities on the installations and thereby minimise major hazard risk. Activity indicators have

not been utilised to any significant extent so far, but shall reflect major hazard risk due to execution ofdefined operational activities on the installations.

Indicators related to causal factors are a separate category by both classifications. This category willnaturally include safety climate indicators.

4.2 Use of Indicators in PracticeThe following principles are used as basis for development of risk indicators for major hazards:

The main perspective is to provide tools for expressing quantities which provide information about

future risk exposure, with basis in current status and past performance, in order to provide input todecision-making.

Risk indicators should have the main emphasis on illustrating effect on risk of variable parameters.

A mix of proactive and reactive indicators may be required in order to give a comprehensive presen-tation of risk levels

The results from risk analysis may be used to give weights to different risk indicators, and such use isvaluable. It is on the other hand not recommended to use risk indicators in a mechanistic updating ofoverall risk levels. Indicators, usually based on observations, will have to be combined with adjustments andevaluations, if an evaluation of the risk level shall be produced. If this is done in a justifiable manner, thenrisk indicators may be used for updating overall estimations of risk levels.

The risk assessment results may also be used for identification of and setting of priorities for different riskmechanisms, based on their contribution to total risk. The risk assessment results may also be used forgiving different weights to the different contributions, if they are being added up to some kind of total value.

Different indicators may be required in order to illustrate all relevant aspects of risk, relating to:

Occurrence of incidents and near-misses.

Performance of barriers

Activity levels relating to performance of hazardous activities and/or simultaneous activities

Development in causal factors affecting the performance of barriers.

4.3 Accidents, Incidents and near-missesLoss based indicators will imply indicators reflecting occurrence of accidents. This requires as mentionedabove, that the volume of accidents is sufficiently high for the extent of installations and operations beingconsidered, in order to establish an indicator based on such events. This will usually be the case, if at all, foronly some kind of hazards, for instance occupational injuries.

But even if the number of occupational injuries may be substantial, it will rarely be sufficient accident datato establish an indicator for fatality risk due to occupational hazards.

Indicators based on incidents and near-misses (process related indicators) are therefore required.

All these indicators are based on actual occurrences, where the valuable information will be much more thanjust the number of occurrences. Actual cases may also give very valuable qualitative information aboutmechanisms, causal factors, etc.

8/13/2019 153536nr5

16/23


The indicators based on accidents, incidents and near-misses may be weighted and normalised as follows:

Weighted Rating of types or categories of events according to severity, thereby implyingthat weighted indicators may be combined in order to create overall indicatorsof different kinds.

Normalised Rating of indicators in relation to volume of exposure measured according to arelevant parameter reflecting the type of risk exposure.

4.4 Barrier PerformanceIndicators that are reflecting barrier performance (in a wide sense) belong in the category process relatedindicators, together with indicators based on occurrence of incidents and near-misses as well as activityindicators. The performance should cover the following barriers:

Physical barriers

Non-physical barriers (organisational, administrative, procedural, etc)

The performance should in general cover a wide range of capabilities (cf. NPD, 2001b):

Functionality and effectiveness

Reliability and availability

Robustness (antonym to vulnerability)

In certain circumstances incident indicators and indicators related to barrier performance may be combinedinto an overall indicator (see further discussion in Sections 5 and 6).

4.5 Activity LevelA review of hydrocarbon leaks on the Norwegian Continental Shelf in 2001 and 2002 has revealed (Husebet al., 2003) that less than one third of the leaks occur during normal operations, whereas a dominatingmajority occurs when special operations are being carried out, such as maintenance, inspection, manualintervention, trips etc. This situation emphasises the need to develop risk indicators that reflect major hazardrisk as a function of the activities being carried out.

Activity indicators have not been used to any significant extent so far, and are the subject of a separate study(Veire, 2002). Activity indicators are almost entirely proactive indicators.

The basis for development of activity indicators has not yet been developed extensively. The basis will haveto reflect risk exposure due to:

Performance of single activities, and/or

Performance of simultaneous activities, and/or

Absence of completed maintenance activities on safety critical equipment according to plan (i.e. noback-log).

Activity indicators may be used in order to estimate the expected risk exposure according to activity plansand combinations, and also for optimisation of operational plans.

4.6 Causal FactorsIndicators for causal factors may cover a wide range of aspects, relating to causes of incidents and near-misses, as well as failure of physical barriers (technical safety systems) and non-physical barriers (human,administrative and organisational functions).

8/13/2019 153536nr5

17/23


One example of causal factors behind occurrence of incidents can be the split of ongoing operations at thetime of occurrence of hydrocarbon leaks, as referred to in Section 4.5. Other examples may include recordsshowing the percentage of personnel having participated in vital safety training or safety motivation coursesor campaigns.

To establish accurate models of how causal factors relate to possible accidents and losses, is difficult - theuncertainties are very large. Extensive R& D efforts are required to obtain models with sufficient credibility.

Data directly supporting the models will seldom be present, and extensive assumptions need to be made toestablish the models. Nonetheless, such models may be useful to get insights - what are the critical factorsand how do different factors correlate? - and study the impacts on risk of various theories and hypothesesrelated to the importance of causal factors. The models should be seen as instruments for structuringknowledge and uncertainties, more than accurate tools for prediction.

Indicators relating to causal factors may actually be important as basis for preventing reoccurrence ofincidents and near-misses. Reflection of causal factors is one of the weak aspects of quantified risk assess-ment, and this is one area where indicators may contribute significantly. The indicators relating to causalfactors should primarily be used individually and separately.

4.7 Management SystemManagement system factors may in principle be considered as causal factors, and be treated in the samemanner. Management system factors are factors that have influence on the performance of barriers, and assuch are important factors. The typical factors that are considered in this context are:

Procedures

Training, competence

Backlogs

etc

It may be asked whether management system factors also influence incidents and activities. They do ofcourse, but through influence on management system barriers intended to prevent occurrence of incidentsand hazardous activities. This is in line with the general definition of barriers stated in Section 1.5.2.

4.8 Cultural AspectsAlso cultural aspects are factors that may be considered as causal factors, and be treated in the same manner.Cultural aspects have influence on the performance of barriers, and are as such important factors.

Cultural aspects also influence occurrence of incidents and performance of activities, but as stated abovethrough influence on barriers intended to prevent occurrence of incidents and hazardous activities. This is in

line with how MTO analysis is performed, and the general definition of barriers stated in Section 1.5.2.

The typical factors that are considered in this context are:

Attitudes

Work practices

Self checking

Management involvement and commitment

Employee involvement

Motivation

Communication

8/13/2019 153536nr5

18/23


5. Loss Related Indicators

5.1 Recommended HES IndicatorsHES indicators discussed in this subsection are exclusive of major hazards related indicators, the latter arediscussed in the following Subsection 5.2.

Loss related indicators may be used for some hazards and some activities, where there is sufficient volumeof data due to frequent occurrences. When this is the case, loss related indicators may be used to indicatetotal risk levels for a certain dimension of risk.

The following loss based indicators are recommended, including suggestions for which level they should beused:

Occupational injuries (with and without lost time) and diseaseo From national level down to individual installations

Accidental spills, minoro From national level down to company level

Pollution from operational activitieso From national level down to individual installations

The current status of use of indicators for occupational diseases in Norwegian offshore activities is such thatloss based indicators are not suitable, because stable and reliable reporting schemes have not been fullydeveloped, see Huseb et al. (2002). This is based on NPDs experience over several years, but is expectedto be a temporary condition, which will pass after a relatively short time.

5.2 Recommended Indicators for Major HazardsBased on the principles stated in Section 5.1, the following loss based indicators are recommended for major

hazards, including suggestions for which level they should be used, as shown in Table 1. The limitedcontents of the table reflects the fact that there are few loss related indicators that are relevant for majorhazards.

Table 1 Recommended combinations of loss related indicators and applicable levels

Level on which the indicators are usedHazard

National level Field/installation level Equipment level

Fires in non-process areas XCollision with field related vessels X

There are thus very few hazards where major hazards related indicators based on actual loss may be used,implying that indicators for most of the hazards have to be based on process related indicators, see Section6.2. Indicators for these two hazards on a national level may be found in the NPD annual report for risk levelon the Norwegian Continental Shelf, see Huseb et al. (2002).

5.3 Recommended Use of Indicators for Major HazardsLoss related indicators are straightforward to use, they give immediate indication of the actual risk level andthe associated trends. Since only two hazards are covered within the major hazards category, they should bepresented separately.

8/13/2019 153536nr5

19/23


6. Process Related Indicators

6.1 Recommended HES IndicatorsHES indicators that are briefly mentioned below are exclusive of major hazards related indicators, the latterare discussed in the following Subsection 6.2.

Process related indicators should be used for hazards and activities that can not be assessed with use of lossbased indicators, see Section 5.2. This will include in the HES field:

Accidental spills, moderate to major (blowout risk and similar)o From national level down to company level

6.2 Recommended Indicators for Major HazardsThere are few loss based indicators that are possible for major hazards, as documented in Section 5.2. Thereare therefore many indicators for major hazards that need to be based on modelling of losses. The list belowoutlines the recommended indicators and on what levels they may be applied. Restrictions on which levelsthat may be included are due to insufficient amount of data.

The recommended combinations of loss related indicators and levels where they should be used, is shown inTable 2. The basis for the recommendations has been developed over several years in the NPD project onrisk levels, see Huseb et.al, (2003). The table is therefore considered to be complete and well justified.

Table 2 Recommended combinations of loss related indicators and applicable levels

Level on which the indicators are usedHazard

National level Field/installation level Equipment level

Hydrocarbon leaks from

process systems

X X

Hydrocarbon leaks fromrisers and pipelines

X

Well kicks from unstablewells

X X

Fires in non-process areas X X XBarriers for hydrocarbonleak hazard, for levels 2,3 and 4 in Figure 1

X X X

Passing vessels oncollision course

X X

Drifting objects/vesselson collision course X X

Collision with fieldrelated vessels

X

Structural damage toinstallations andequipment

X X

Helicopter transportationrisk

X X

Barriers for all hazards,for level 5 in Figure 1

X X X

8/13/2019 153536nr5

20/23


6.3 Recommended Use of Indicators for Major HazardsThe process related indicators should primarily be used as individual indicators, because this provides themost extensive information about risk aspects, causes of major hazards and basis for priorities for riskreduction. But aggregation of individual indicators into overall indicators may also be useful, in order togive insight into what are the most important contributions.

Individual indicators are reported extensively for the national level in the NPD annual report for risk levelon the Norwegian Continental Shelf, see Huseb et al. (2002).

The event based indicators in the list in Section 6.2 may be grouped into the following two categories asshown below, reflecting the ability of installation personnel to influence the rate of occurrence of theseincidents:

Hazards that may be influenced by performance of personnel on the installationo Hydrocarbon leaks from process systemso Hydrocarbon leaks from risers and pipelineso Well kicks from unstable wellso Fires in non-process areaso Structural damage to installations and equipment

External hazards beyond the influence of installation personnelo Passing vessels on collision courseo Drifting objects/vessels on collision courseo Collision with field related vessels (may also be partly dependent on performance of personnel

on the installation)o Helicopter transportation risk

An overall indicator [for a certain dimension of risk] may also be specified based on the individualindicators. Each individual indicator should then be weighted according to the hazard potential. This hasbeen documented for the national level in the NPD annual report for risk level on the Norwegian Continental

Shelf, see Huseb et al (2002).

The example in the NPD report is limited to the national level. Events and barriers should not be integratedinto the same indicator on this level. Event and barrier indicators may only be integrated into an overallindicator on the installation level, because barrier effect and performance is quite installation specific. If itshould be integrated with event indicators on a national level, both would have to be use as average values.

7. Indicators related to Causal FactorsIndicators relating to causal factors must be tailored to the actual hazard in question and its possible causes.

It has therefore been considered impossible to discuss potential causes for all HES related hazards ingeneral, and the discussion below is limited to major hazards.

7.1 Recommended Indicators for Major HazardsCausal factors for major hazards are limited to performance of barriers for major hazards. Potential causesfor major hazards may be classified as:

Technical

Human performance

Organisational

It may be considered that causal factors also influence incidents and activities. As described in Section 4.7they also give such influence, but through influence on management system barriers intended to preventoccurrence of incidents and hazardous activities. This is in line with the general definition of barriers statedin Section 1.5.2.

8/13/2019 153536nr5

21/23


A number of indicators may be defined for each of these categories. Indicators may also be defined for

influencing factors as explained in Section Feil! Fant ikke referansekilden..

7.2 Recommended Use of Indicators for Major Hazards

The recommended use of indicators relating to major hazards is discussed in Section 4.6.

8. Conclusions and RecommendationsIt is concluded that the following indicators are required for a comprehensive risk monitoring in relation tomajor hazard risk:

Incident indicator

Barrier indicator

Activity indicator

Indicators related to causal factors, including indicators related to safety climate

There are few loss related indicators that are feasible for major hazards, only on the national level, as shownin Section 5.2. For major hazard risk, most of the indicator will have to be of the process type (Section 6.2)and causal indicators (Section 7.1).

The recommendations for use of loss related indicators, process related indicators and indicators relating tocausal factors are found in Sections 5.3, 6.3 and 7.2 respectively.

9. AcknowledgementThe authors are indebted to NFR for the funding of the work and their parent organisations for thepermissions to publish this paper. During the preparation of the paper, a large group of specialists has beenconsulted at various stages, orally and in writing. We are obliged to all those that have provided comments,for the time they have taken to review and provide very valuable input to the process.

8/13/2019 153536nr5

22/23


10. ReferencesAven, T. 2003. How to approach risk and uncertainty to support decision-making. Wiley, N.Y. to appear.

Bento, J-P., 1999. Human Technology Organisation; MTO-analysis of event reports. OD-00-2. (In

Swedish). Restricted.

HSE. 1995. Prevention of fire and explosion and emergency response on offshore installations (PFEER)Regulations 1995, (SI 1995/743)

Huseb et al, 2002. RNNS report 18.4.2002

Huseb et al, 2003. RNNS report April 2003 (to be published)

IEC, 1998/2000. Functional safety of electrical/electronic/programmable electronic safety related systems,Edition 1.0

Kjelln, U., 2000. Prevention of Accidents Through Experience Feedback. Taylor & Francis, London andNew York..

Langli, G. 2001. CORD, Coordinated operation and maintenance offshore research and development,presentation at the Offshore Operations and Maintenance conference, 10-11 October, 2001

Momal, P. 2002. Risk Management in Europe, PRIMA_EU description, EDF, September, 2002

NPD, 2001a. Regulations relating to the management in the petroleum activities, (The managementregulations), stipulated 3.9.2001

NPD, 2001b. Guidelines to the management regulations, stipulated 3.9.2001

OLF, 2001. Recommended guidelines for the application of IEC61508 and IEC61511 in the petroleumactivities on the Norwegian continental shelf

Tarrants, W. E., 1980. The Measurement of Safety Performance. Garland STPM Press, New York.

The Learning lab, 2002. http://www.laeringslaben.no/index_english.php?side=2

Thomassen, O., Srum, M. 2002. Mapping and monitoring the safety level, presented at SPE InternationalConference on Health, Safety and Environment in Oil and Gas Exploration and Production, Kuala Lumpur,20-22. March, 2002

Veire, G. 2002. Private communication.

Vinnem, J.E. 2000. Risk Monitoring for Major Hazards, SPE61283, SPE International Conference onHealth, Safety and the Environment in Oil and Gas Exploration and Production in Stavanger, Norway 2628June 2000.

Vinnem, J.E., Tveit, O.J., Aven, T. And Ravns, E. 2002. Use of risk indicators to monitor trends in majorhazard risk on a national level, ESREL 2002, Lyon, France, March, 18-21, 2002

ien, K. 2002. Private communication

ien, K., Rosness, R., Sklet, S., 1995. Indicators for the surveillance of changes in the risk level on Ekofisk2/4T. (In Norwegian, Confidential). SINTEF Report STF75 F95033, Trondheim: SINTEF IndustrialManagement, Norway.

8/13/2019 153536nr5

23/23


ien, K., Sklet, S., 1999. Risk indicators for the surveillance of the risk level on Statfjord A. (In Norwegian.Confidential). SINTEF Report STF38 F98435, Trondheim: SINTEF Industrial Management, Norway.

ien, K., Sklet, S., 2001a. Risk Analyses during Operation (The Indicator Project) Executive Summary.SINTEF Report STF38 A01405, Trondheim: SINTEF Industrial Management, Norway.

ien, K., Sklet, S., 2001b. Organisational risk indicators Pilot study at Statfjord A. (In Norwegian.

Confidential). SINTEF Report STF38 F00421, Trondheim: SINTEF Industrial Management, Norway.

153536nr5

Documents

Transcript of 153536nr5