I n t e r n a t i o n a l A s s o c i a t i o n o f O i l & G a s P r o d u c e r s
Process Safety –
Recommended Practice on Key Performance Indicators
Report No. 456
November 2011
Table of Contents
Section 1 The need for process safety Key Performance Indicators 1
1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 Leading & lagging KPIs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Section 2 Establishing corporate and facility KPIs 4
2.1 Applying industry recommended practice . . . . . . . . . . . . . . . . . . . . . . 4
2.2 The four tier approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.3 Corporate versus facility KPIs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.4 Identifying critical barriers and selecting KPIs . . . . . . . . . . . . . . . . . . . . 7
2.5 Data collection, communication and review . . . . . . . . . . . . . . . . . . . . 10
Section 3 Tier 1 and Tier 2 12
3.1 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3.2 Consequence levels and material release thresholds . . . . . . . . . . . . . . . . 13
3.3 Normalisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.4 Applicability to Upstream Operations . . . . . . . . . . . . . . . . . . . . . . . 15
3.5 Applicability to Upstream Activities . . . . . . . . . . . . . . . . . . . . . . . . 16
3.6 OGP Data Collection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Section 4 Tier 3 and Tier 4 18
4.1 Tier 3 KPIs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
4.2 Tier 4 KPIs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4.3 Selection of Tier 3 and 4 KPIs . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Appendix A: Determining whether to report a recordable Process Safety Event (PSE) 23
Appendix B: Process Safety Event (PSE) consequence and threshold tables 24
Appendix C: Glossary of terms and definitions 29
Appendix D: List of acronyms 32
Appendix E: Primary references and sources 33
In addition to the Appendices above, a supplement to this report is available which lists over sixty examples
of Process Safety Events (PSE) and will be updated with new examples from companies. It can be down-
loaded from the publications section of the OGP website (http://www.ogp.org.uk)
Disclaimer
Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither the OGP
nor any of its members past present or future warrants its accuracy or will, regardless of its or their negligence, assume
liability for any foreseeable or unforeseeable use made thereof, which liability is hereby excluded. Consequently, such use
is at the recipient’s own risk on the basis that any use by the recipient constitutes agreement to the terms of this disclaimer.
The recipient is obliged to inform any subsequent recipient of such terms.
Copyright notice
The contents of these pages are © The International Association of Oil and Gas Producers. Permission is given to reproduce
this report in whole or in part provided (i) that the copyright of OGP and (ii) the source are acknowledged. All other rights
are reserved. Any other use requires the prior written permission of the OGP.
These Terms and Conditions shall be governed by and construed in accordance with the laws of England and Wales.
Disputes arising here from shall be exclusively subject to the jurisdiction of the courts of England and Wales.
1 The need for
process safety KPIs
1.1 Introduction Process safety
Across the global oil & gas industry, this reason, this document is focused Process safety is a disciplined
considerable effort has been focused on KPIs to prevent such releases; framework for managing the
on the prevention of major incidents. however, much of the guidance can Definition integrity of operating systems and
processes handling hazardous
The International Association of Oil & be applied to other aspects of process substances. It is acheived by
Gas Producers (OGP) has previously safety and asset integrity. applying good design principles,
published Asset Integrity – the key to In response to a number of major engineering, and operating and
managing major incident risks (OGP incidents such as the disasters in maintenance practices. It deals
Report No. 415, December 2008 ) 2005 at the US Texas City Refinery with the prevention and control of
1
which provides advice on how to and the UK Buncefield oil terminal, events that have the potential to
implement an asset integrity manage- the downstream oil industry has been release hazardous materials and
ment system for new and existing developing improved process safety energy. Such incidents can result in
toxic exposures, fires or explosions,
upstream assets. It also includes KPIs. Recommendations provided by and could ultimately result in serious
preliminary guidance on ‘monitoring organisations such as the UK Health incidents including fatalities, injuries,
and review’, including how to establish & Safety Executive (UK HSE) , the property damage, lost production or
2
lagging and leading Key Performance US Chemical Safety and Hazard environmental damage.
Indicators (KPIs) to strengthen risk Investigation Board (US CSB) and the
3
controls (barriers) in order to prevent Independent ‘Baker’ Panel reinforced Asset integrity
4
major incidents. This report is intended the pressing need for improved KPIs. Asset integrity is related to the
as a companion document to Asset This resulted in significant efforts by prevention of major incidents. It is an
outcome of good design, construction
Integrity – the key to managing major the American Petroleum Industry (API), and operating practice. It is achieved
incident risks and describes the practi- the Center for Chemical Process Safety when facilities are structurally and
cal implementation of a KPI system. (CCPS) and others to develop and mechanically sound and perform the
5
The terms ‘process safety’ and ‘asset publish guidance on KPIs for compa- processes and produce the products
integrity’ are both used throughout nies to manage process plant risks and for which they were designed.
the petroleum industry, often syn- prevent unintended loss of hazardous The emphasis in this guide is on
preventing unplanned hydrocarbon
onymously. From the definitions given materials. To ensure the upstream and other hazardous releases that may
here, there are small differences in industry benefits from these efforts, this – either directly or via escalation –
scope as asset integrity can include all OGP guidance builds a framework result in a major incident. Structural
structures in facilities and is not limited and definitions based on a recent failures may also be initiating causes
to processes handling hazardous sub- ANSI/API standard on Process Safety that escalate to become a major
stances. However, it is clear that – for Performance Indicators for the Refining incident.
the oil & gas industry – the emphasis and Petrochemical Industries (Recom- Major incident
of process safety and asset integrity is mended Practice – RP 754) as well as
6
to prevent unplanned releases which guidelines on metrics published by UK An incident that has resulted in
multiple fatalities and/or serious
could result in a major incident. For HSE , CCPS , and OECD . damage, possibly beyond the asset
8,9
10
7
itself. Typically initiated by a
hazardous release, but may also result
from major structural failure or loss of
stability that has caused serious
damage to an asset (note this is
intended to incorporate terms such as
‘Major Accident’ as defined by UK
11
HSE ).
©OGP 1
1.2 Leading & lagging KPIs
Major incidents rarely result from a cheese’ – are management system model below represents the failure of
single cause but rather by multiple procedures, physical engineered several ‘prevention barriers’ resulting
failures that coincide and collectively containment or other layers of protec- in an LOPC event. In our industry there
result in an exceptional event with tion designed to prevent incidents. are sophisticated controls to detect an
severe consequences. This relationship In this guidance we are primarily LOPC event and mitigate its conse-
between sequential failures of multiple interested in ‘Loss of Primary Contain- quences but holes in these ‘escalation
‘risk control systems’ is illustrated ment’ (LOPC) of hazardous material, barriers’ can also align and serious
in Figure 1 using the ‘Swiss cheese which is the predominant cause of harm can result from a fire, explosion
model’ (after James Reason, 1990 major process safety incidents in our or other destructive incident.
12
and 1997 ). The same principles industry. Barriers can have weak-
13
underpin other similar approaches nesses, depicted as ‘holes’ in the Swiss
such as the ‘bow tie’ model or ‘layers cheese. The alignment of holes in the
of protection analysis’ (LOPA).
Hazards are contained by multiple
protective ‘barriers’ or ‘risk control
systems’. The barriers – represented
here by individual ‘slices of Swiss
Figure 1: KPIs applied to the ‘Swiss cheese’ model
12,13
(based on the work of James Reason ) Hydrocarbons or
Prevention barriers other dangerous
material
Escalation barriers Leading indicators
maintain barrier strength, i.e. activities
to maintain risk control systems
LOPC event
Lagging indicators
measure barrier defects (’holes’),
events and consequences
Major incident
or other consequence
2 ©OGP
This model can also be used to Due to the emotional and reputational
distinguish two important types of KPI. impact of incidents that harm people
Recording the number of LOPC events or the environment, companies previ-
or actual consequences – where one ously focused most of their attention on
or more barriers fail simultaneously lagging KPIs by recording workforce
– is a ‘lagging’ indicator. The term injuries or spills to the environment.
lagging indicator may also be used to This ‘reactive’ mode of monitoring and
measure the number and size of holes review is important. However, a strat-
in the barriers to assess the extent egy of waiting for incidents to happen
of weaknesses, defects or failures then learning lessons afterwards is
in the risk control system. Whereas insufficient when aiming to eliminate
monitoring the strength of the barrier major incidents. In contrast, the combi-
– by measuring the company’s nation of leading and lagging KPIs to
performance in maintaining robust risk assess barrier strengths and weak-
controls – is a ‘leading’ indicator. nesses provides the opportunity to be
In this guidance, lagging indica- ‘pro-active’, i.e. more predictive and Near-miss events –
tors are generally retrospective and focused on prevention. The pro-active a KPI gift!
outcome based whereas leading approach should include KPIs that A good example of a KPI which is both leading and
indicators are usually forward-looking assess ‘hard’ technical barriers such lagging is the reporting of near miss events. Near
and input based. In principle, most as engineering design or maintenance misses include those events with consequences that do
LOPC events will have no actual and inspection as well as ‘soft’ barri- not meet the company’s criteria for recordable incidents
consequences but are still failures ers such as training and competence such as a spill of less than one barrel. Near misses also
and therefore lagging outcomes, but or safety culture and behaviour. provide simple observations of an unsafe condition with
low consequence LOPC events also For each critical barrier, the UK no consequences. These are recognised as events which
had the potential – in other slightly different
provide leading information when HSE recommends a ‘dual assurance’ circumstances – to result in consequences that would
predicting the likelihood of major approach in their guide on develop- have been recordable, particularly ‘high potential
incidents with serious consequences. ing process safety indicators . This events’ where a major incident would have been a
7
Thus the terms leading and lagging approach uses a combination of realistic worst case scenario. Therefore, near miss
are generally useful but companies one leading input KPI to test barrier events provide leading information on the likelihood of
need to be aware that some indica- strength and correlate with one actual incidents and also provide lagging information
tors can provide both retrospective lagging output KPI to track any on barrier weaknesses. Near miss investigations can
and forward-looking insights. A good defects in the barrier. In this report, contribute significantly to continuous improvement of
asset integrity and process safety, whether used to
example of a type of indicator that we provide guidance on use of both identify barrier weaknesses or as a warning of a
can be either leading or lagging is a lagging and leading KPIs, including potential catastrophe.
‘near miss’. use of dual assurance.
Why report process safety KPIs?
Preventing major incidents Improving reliability Avoiding complacency
Process safety and asset integrity failures can result in The quality and productivity of a company’s operations are The Baker Panel Report (2007) stated ‘The passing of
4
serious harm to people, the environment, property, reflected in its future profitability. Actions to prevent major time without a process accident is not necessarily an
reputation and financial stability of a company. Recording incidents go hand-in-hand with steps to make operations indication that all is well and may contribute to a
of major incidents and careful analysis of their root causes more reliable, feeding directly into financial performance. dangerous and growing sense of complacency.’ Since
can provide lessons to prevent recurrence. As this analysis major incidents are relatively rare events, it is easy to give
is retrospective and based on relatively infrequent events, priority to other lower consequence risks in the belief that
companies cannot afford to rely on these lessons alone to ‘everything is OK’. KPIs provide a constant reminder of
prevent major incidents. It is therefore necessary to asset integrity, the attention needed on process safety
broaden the analysis to learn from events with less management systems and the warnings from near misses
serious outcomes and management system performance and less severe incidents.
to pro-actively strengthen the barriers which prevent Communicating performance
major incidents. Process safety KPIs therefore generate a It is a constant challenge to communicate the
range of relevant data which can be analysed to improve importance of process safety to the workforce.
preventive actions, such as management system revisions, KPIs provide reassuring evidence of management
procedural changes, training opportunities, or facility focus, transparency and progress which can, in
engineering improvements that aim to minimise and turn, support process safety culture and
eliminate the potential for major incidents.
behaviours.
©OGP 3
2 Establishing
corporate and
facility KPIs
2.1 Applying industry recommended practice
In April 2010, API published Recom- (CCPS) . RP 754 is an important wide. Wherever possible consistency
8
mended Practice (RP) Number 754 on standard because it has been globally with the language of RP 754 is main-
6
Process Safety Performance Indicators supported and adopted by down- tained within this report, including the
for the Refining and Petrochemical stream and integrated oil companies. term ‘process safety’ which as previ-
Industries, referred to here as RP 754. As RP 754 is directed at downstream ously noted is taken to be synonymous
This standard was developed using an activities, OGP has recognised the with the term ‘asset integrity’ for the
American National Standards Institute need to provide further guidance to purpose of KPIs. The complete RP 754
(ANSI) multi-stakeholder process and support RP 754’s applicability for is not reproduced here and should be
was based on preliminary guidance upstream activities and to recommend downloaded by companies from the
on metrics from both API and the this standard to E&P companies world- API website .
6
Center for Chemical Process Safety
2.2 The four tier approach
Major incidents are relatively infre- a broader set of more frequent and way the extended dataset from these
quent so KPIs based only on these rare statistically valid data. These include more specific, systematic KPIs can
occurrences may not yield sufficient observations of unsafe conditions, be used to pro-actively monitor and
data to prevent future catastrophic inci- near misses or activations of safety improve the most critical safety barri-
dents. However, Figure 1 demonstrates systems which indicate barrier weak- ers to prevent major incidents. Thus it
that major incidents are the result of nesses. The data can also include has become clear that not one but a
not one but a combination of failures pro-active KPIs to monitor the extent combination of measures is needed
of the barriers that are designed to of a company’s effort to maintain or to monitor barrier performance within
control asset integrity risks. Logic strengthen barriers through application an asset integrity or process safety
suggests that the same barrier failures of its health, safety and environment management system. To structure
causing major incidents also con- management system (HSE-MS). In this this combination of measures, OGP
tribute to lower consequence events recommends a four tier framework
that could have been much worse in of process safety KPIs, illustrated by
slightly different circumstances. There- Figure 2. This is also recommended in
fore KPIs can be developed to gather API RP 754 .
6
Figure 2: Process safety indicator pyramid
(from API RP 754 )
6
Tier 1 Lagging indicators
LOPC events of
greater consequence
Tier 2
LOPC events of
lesser consequence Leading indicators
Tier 3
Challenges to safety systems
Tier 4
Operating discipline & management system performance indicators
4 ©OGP
The four tiers are expressed as a dent triangle shown in Figure 3, based
triangle to emphasise that statistically on insurance claim work in 1931 by H The continuous improvement
14
larger data sets are available from the W Heinrich , and refined in 1969 for cycle
KPIs at the lower tiers. This approach safety by Bird & Germain . The concept of continuous
15
mirrors the now-familiar personal acci- improvement, whether at corporate,
business or facility level, is a
fundamental process for any structured
Figure 3: Occupational safety HSE-MS, which provides the
indicator pyramid framework to address Process Safety
(PS). There are many versions of the
continuous improvement process
including the ‘Plan-Do-Check- Act’
Fatalities cycle, as applied within ISO guides
and standards. The cycle illustrated
here places emphasis on improving the
management system (including legal
Recordable injuries compliance, company standards and
local procedures) by addressing
process safety risks through planned
controls which are implemented within
First aid incidents and near misses day-to-day operations. KPIs,
particularly the more leading Tier 3
and 4 indicators, underpin the three
Management system failings/audit findings steps to monitor operational
performance, enable internal and
external reporting and then finally
review outcomes to determine how to
revise the management system and
embed the continuous improvement.
Such a cycle can benefit both local
Tiers 1 and 2 are more lagging and Tiers 3 and 4 provide more leading and corporate management through
cover asset integrity major and less measures. The indicators are intended use of leading indicators focused on
severe incidents. For consistency with to be much more specific to a com- barriers and lagging indicators
API RP 754 definitions, an incident is pany’s own management system and focused on operational performance.
referred to as a Process Safety Event often will be specific to a particular HSE–MS
(PSE). The Tier 1 and 2 indicators are activity (e.g. drilling) or to an indi- Reviews
fully defined with the intent that these vidual asset, facility or plant. While PS risks
can be reported at the corporate level companies may decide to aggregate
in both internal and external reports data from such indicators, care must Reports
by any company. In order to achieve be taken to ensure that similar facilities Barriers
consistency and comparability, the or activities form the basis of the
indicator definitions have narrowly aggregation, otherwise comparisons PS KPIs
defined scope and are threshold may lead to erroneous judgements. Procedures
based. A description of Tiers 1 and 2 Because comparisons are likely to be Operations
with upstream specific guidance is pro- challenging, OGP will not benchmark
vided in Section 3. OGP has adopted such data initially but will encourage The continuous improvement cycle links
three OGP guidance reports. Report
PSE at these two tiers to enable bench- sharing of company experience and No. 210 relates to development of HSE
marking. Companies may decide to good practice using these two tiers. management systems , the starting
16
collect event data beyond the scope Further information and guidance on point for the cycle. Report No. 415
or thresholds defined but should report Tiers 3 and 4 with upstream specific describes how the HSE-MS addresses
any such data separately from their examples is provided in Section 4. asset integrity risks, barriers and
aggregate corporate reporting of PSEs procedures for E&P operations . This
1
to OGP (see Section 3.6). report continues the cycle by providing
guidance on KPIs, their reporting and
review.
©OGP 5
2.3 Corporate versus facility KPIs
Asset integrity KPIs are established data against industry averages to communicate and engage
by companies to meet three primary and by sharing lessons learned with their stakeholders, but one
needs: with other companies. In section important channel is through
1. Internal monitoring and review 3.6 we outline steps being taken regular, typically annual,
of performance related to the by OGP to promote benchmark- reports – often called sustain-
management system and other ing and learning based on the ability or corporate citizenship
actions to strengthen process KPIs in this guide. reports. Through the recent
safety barriers and reduce 3. Provide transparent disclosure revision of the publication
incidents. KPIs are fundamental of performance to stakehold- ‘Voluntary Sustainability Report-
to continuous improvement, as ers such as employees, local ing Guidance for the Oil &
illustrated on the previous page. communities, investors, govern- Gas Industry’, IPIECA together
2. Assess whether the measured mental and non-governmental with API and OGP have jointly
performance on process safety organisations, and the general endorsed the process safety KPI
meets or exceeds industry public. There are many framework for both upstream
17
norms by benchmarking KPI opportunities for companies and downstream reporting .
Figure 4: Hierarchy of asset integrity KPIs
Data consolidated across a corporation
Examples: Tier 1 and Tier 2 PSE , overdue asset integrity/process safety actions from
corporate audit findings (Tier 4), implementation of corporate safety initiatives (Tier 4)
Data consolidated within a business activity
Company
Example: as above, plus near miss LOPC (Tier 3), demands on safety systems
(Tier 3), Process Hazard Analysis action closures (Tier 4), asset integrity
training (Tier 4), engineering standards implementation (Tier 4)
production, drilling Data collected in detail by operations
Example: as above, plus corrosion inspection findings (Tier
3), operational upsets (Tier 3), safety instrumented system
Exploration,
testing (Tier 4), scheduled maintenance (Tier 4),
competence assessment on safety critical
procedures (Tier 4)
Sites, facilities, plant, wells, pipelines, vessels
Process safety KPIs to meet the three performance, although some may be address specific but critical safety risks
needs above will vary across a com- consolidated at corporate level to test for groups of operations with similar
pany’s organisation from an individual management system controls imple- activities, equipment and environments
facility up to the corporate level. At mented across the whole company. can be analysed. Typically this would
the corporate level, data and other Care must be taken to avoid over- mean that different additional KPIs are
information should be selected care- whelming operations with corporate employed for activities such as produc-
fully to be representative of the whole KPIs and then relying solely on tion, drilling or pipeline operations,
organisation when compiled and these KPIs because measures may either offshore or onshore. Further, at
consolidated to generate meaningful be overlooked for important control the facility level, KPIs can be focused
KPIs. The Tier 1 and 2 KPIs are recom- barriers that are critical to local on more leading KPIs within Tiers 3
mended here for consolidation at operations. Thus, as illustrated by and 4 to locally assess specifically
company level for corporate reporting Figure 4, it is important that additional designed technical barriers such as
against all three needs listed above. In data is collected at lower levels of the alarm systems, procedural barriers
contrast, Tier 3 and 4 KPIs are more organisation so that performance to such as start-ups, or people barriers
appropriate for monitoring facility such as competence assessment.
6 ©OGP
2.4 Identifying critical barriers and selecting KPIs
Selecting effective indicators is a Figure 5: six step approach for selection and review of KPIs
challenge, particularly leading Tier 3
and 4 KPIs which aim to pro-actively
improve process safety at the facility Step 1
level. This requires companies and Ensure management ownership and establish implementation team
their facilities to develop knowledge
and understanding of the most critical
risk control barriers, whether the
barriers are facility-specific or apply Step 2
to groups of similar facilities or even Establish industry Tier 1 and Tier 2 KPIs to assess company performance
apply across the whole company.
An approach to identifying appropri-
ate barriers and selecting indicators
has been provided by the UK HSE in Step 3
a guide on developing process safety Confirm critical process and integrity barriers to prevent major incidents
indicators and further developed in a
7
CCPS book on process safety metrics .
9
Based on these, a 6-step approach is Step 4
recommended, as shown in Figure 5
and detailed overleaf. Select Tier 3 and Tier 4 KPIs to monitor critical barriers at facilities
Step 5
Collect quality data, analyse performance and use to set improvement actions
Step 6
Regularly review critical barriers, actions, performance and KPI effectiveness
©OGP 7
Ensure management Establish industry Tier 1 and Confirm critical process and
ownership and establish Tier 2 KPIs to assess company integrity barriers to prevent
implementation team performance major incidents
Ownership of the KPIs by senior KPIs need to be selected which are It is important to determine and annu-
management is essential to ensure relevant to the operations of the ally confirm the risk control barriers
that the data is reviewed at a level company and reflect its performance which are critical for prevention of
where continuous improvement actions in managing major incident risks. major incidents and to ensure that KPIs
can be agreed and actioned, includ- The recommended Tier 1 and 2 PSE are in place to measure the effective-
ing investment, prioritisation and lagging KPIs in Section 3 provide ness of these barriers. At facility or
resource deployment decisions. KPIs consistent measures that provide base- corporate level, there are three types
that do not result in actions to improve line data on industry and company of inputs which can be used together
performance are not just a waste of performance, and facilitate trend to help identify weak or critical bar-
effort, but can mask true performance. analysis and benchmarking. Depend- riers. These inputs are illustrated in
Therefore a first step is to establish ing on the nature of operational risks, Figure 5 and discussed below.
a team typically bringing together companies may choose to build on • Pro-active input relies upon
operational and safety expertise with and supplement the recommended identification of hazards and
management at facility, business and KPIs by separately collecting addi- risks which could lead to a
corporate levels, as appropriate. tional data, for example on structural major incident. Information can
The KPI implementation team needs integrity failures which do not involve be drawn from recent Process
to have clear lines of accountability an LOPC. In general, while Tier 1 and Hazard Analysis (PHA) and other
within the company’s management 2 PSEs provide baseline performance risk assessments related to asset
structure and should coordinate the information, the number of events integrity/process safety, which
implementation of the next five steps recorded is unlikely to be statistically will include the barriers identified
as an integral part of management’s sufficient or specific enough to assess to manage the risks. Pro-active
safety review cycle. barrier strength and drive continuous input confirms which barriers
improvement, and this is a key reason are in place to control the most
for implementing Tier 3 KPIs. Typically, important process safety risks and
Tier 1 and 2 PSEs are established with the management system elements
the standardised definitions within to maintain and improve those
and across companies. These two barriers.
KPIs should be retained year-on-year • Reactive input is based upon root
to provide a consistent record of a cause investigation of major inci-
company’s performance. dents and high potential events or
demands on safety systems that
Figure 6: Inputs to identify critical barriers could, in other circum-
Proactive
stances, have resulted in
Identify controls to mitigate an actual incident. The
identified hazards and
review of root causes
risks (e.g. HAZOP, PHA)
should be mapped
External
Industry-wide learning, ment system barriers to identify
against both hard
risk control barriers, KPIs
technical and soft manage-
and good practice
those that are most critical to
future incident prevention based
Hazard on past incidents, or to identify
the need for new barriers where
gaps exist. Such a review can
also be supported by evidence
from process safety, asset integrity
and occupational safety audit
findings. At a more detailed level,
Reactive
Weak barriers identified
from asset integrity incidents Consequence • External input takes account of
reactive input identifies the ‘holes’
and high potential events
in barriers.
experience and best practice risk
control systems shared in the oil
& gas or other industries, often as
a result of past major incidents.
Learning from others can highlight
critical barriers and often suggests
KPIs which can be considered in
Step 4.
8 ©OGP
Select Tier 3 and Tier 4 KPIs Collect quality data, analyse Regularly review critical
to monitor weaknesses in performance and set barriers, actions, performance
critical barriers at facilities improvement actions and KPI effectiveness
Companies should select and imple- It is essential that the effort to collect It is important to confirm that process
ment appropriate Tier 3 and Tier 4 and analyse KPI data is not just safety KPIs remain focused on the
KPIs which will generate statistically about ‘counting the score’ but rather most important barriers to prevent
relevant performance data that is it becomes an integral part of the major incidents. While some KPIs,
specific to the critical barriers identi- continuous improvement cycle within particularly the Tier 1 and 2 measures,
fied in Step 2. Because they need to the HSE-MS. In order to have confi- are intended to be implemented and
reflect different operational activities dence in the analysis it is valuable to established for long-term review of
and management systems of the facili- establish quality assurance processes performance, other KPIs may be used
ties, there is a very wide choice of Tier to verify the accuracy, consistency for a few years and then evolve to
3 and 4 KPIs. In Section 4, example and completeness of the collected provide more detailed information
KPIs are provided which may provide data. Trending, correlations and other on barrier strength. It is therefore
useful starting points but companies statistical analysis should then be per- recommended that the implementation
will usually need to tailor and evolve formed which takes into account the team revisit Steps 3 and 4 to ensure
their Tier 3 and Tier 4 measures as quality as well as the inherent repro- that process safety barriers and Tier
some barriers are strengthened and ducibility of the KPI. The performance 3 and 4 KPIs are regularly reviewed,
other weaknesses are identified. data, highlighting meaningful change, typically annually, as part of manage-
should be transparently communicated ment’s review of safety actions and
to management for review resulting in performance. KPIs should be removed
improvement actions as input to the or replaced if they do not provide
continuous improvement cycle (see information that enables performance
Section 2.3). improvement or if they monitor a
barrier which is no longer critical to
address.
For example, a facility may choose to
establish a leading Tier 4 KPI to record
the number of scheduled inspection
and maintenance tasks which are
overdue. Over 2-3 years the indica-
tor may show that performance has
improved and is satisfactory. However,
Step 3 may confirm that the inspection
and maintenance remains a critical
barrier. In this example, the facility
may then decide to improve the effec-
tiveness of its leading KPI by collecting
statistical data on the number and
categories of safety critical findings
from the already tracked inspection
and maintenance tasks. Using the
dual assurance approach, the data
could then be correlated annually with
data on PSEs or other events related
to inspection and maintenance with
the aim of identifying priorities for
improvement of the barrier.
©OGP 9
2.5 Data collection, communication and review
The aim of asset integrity KPIs is to
help prevent major incidents that
are generally the result of multiple,
simultaneous barrier failures. As such
incidents do not occur very frequently,
it can take a very long time to gather
statistically relevant data on major
incidents alone. Therefore, systems
need to be implemented for consistent
collection and analysis of data and
related information on more than just
major incidents. Companies should • Clarify the scope of the KPI. The
consider the following for each KPI: scope should clarify which activi-
• Engage all parties who will be ties are included for reporting.
involved in the data collection In Section 3, further information Communicating the data is important.
and review process to ensure that is provided on the E&P activities If the data is communicated well it
there is common understanding of included for Tier 1 and Tier 2 will quickly highlight relevant trends
the importance and value of the reporting. Companies may decide and changes to promote management
data, and commitment to regularly to widen the scope of a KPI, but review and action. If communicated
submitting a complete set of data should ensure that the data system badly, the presentation of the data
which has been checked for can separate out information may mask performance information
accuracy. which is beyond the guidance and or even misdirect management
• Establish a clear boundary for in Section 3 in order to preserve attention. Regular reporting typically
the facility, business or company consistency for benchmarking includes a combination of graphical
output to show trends, tabulated data
which lists all discrete assets purposes.
which will collect data. IPIECA has and interpretative text . The concept of
a ‘dashboard’ can be effective, espe-
provided guidance on developing
a reporting boundary, and recom- cially when automatically populated
from an electronic database or plant
mends applying the ‘operational
approach’ for collection of Tier control system. Typically a dashboard
combines and highlights asset integrity
1 and 2 data. This approach
is based on collecting data together with related operational data
to quickly show change using ‘traffic
from ‘reporting units’ which are
assets operated by the company lights’, ‘dials’, or other icons. For larger
organisations, it will be appropriate to
(irrespective of the company’s
ownership in the company or joint communicate the data to various levels
of management by consolidating data
venture). Companies should clarify
whether any assets operated by in different views and degrees of
detail. Figure 7 illustrates how different
a contractor on the company’s • Ensure that the definition of the
behalf are to be included. dashboards may be ‘stacked’ in a
KPI is clearly understood and is data system to serve the various needs
not ambiguous. For a new KPI, of an organisation.
a period of pilot testing may be
necessary. There will always be
cases where there is debate about
inclusion of data and therefore a
mechanism should exist to provide
additional guidance, when
required. The set of examples
included as a supplement to this
20
report provide a useful reference
on determining whether an event
should be reported based on the
definitions in Section 3.
10 ©OGP
Having communicated the process Examples of other inputs can include: • Safety culture surveys or behav-
safety KPI data in a timely manner to • High-level management system iour based safety findings
the right audience, the most important or specific process safety audit • Benchmarking data from OGP or
final step is to put the data to work findings other associations
and strengthen the risk control barriers • Summary of investigation out- • Shared good practices from peer
in the management system. For this to comes and implementation of
be part of the continuous improvement lessons learned from Tier 1 and 2 companies
cycle, regular review of the data is incidents, or high potential events • Proposals for new or modified or
required, typically with a full annual eliminated KPIs
review and several interim progress • Responses to major incidents While not all of these inputs may be
reviews. While the review can focus elsewhere in the industry relevant, it is nevertheless important to
on asset integrity performance, it is • Overview of plant reliability and use such sources of existing data and
good practice in the annual review to correlation with process safety information to support interpretation
broaden the range of inputs so that the KPIs and decisions based on the process
KPIs are not reviewed in isolation. • Changes to staffing levels, safety safety KPIs. The annual review should
critical competencies, training, also link to the other data needs of the
demographics company which will normally include
• Impact of major start-ups/shut- external/public reporting to stakehold-
downs, new developments or ers or regulators and also submission
acquisitions of data to enable benchmarking
• Regulatory compliance perfor- against industry performance norms or
comparison with peers.
mance or changes
Figure 7: Use of dashboards in a larger organisation
Corporate
More emphasis on Tier 1 and 2 KPIs,
Business activity greater aggregation, limited or no detail
at facility, plant or shift levels, more text on
high-level interpretation of data.
Business unit
Facility
Great specificity, more emphasis on Tier 3
Plant and 4 KPIs, less aggregation, more data
and greater integration with operational
parameters.
Shift
©OGP 11
3 Tier 1 and Tier 2
3.1 Tier 1 and 2 KPI definitions
The Tier 1 and Tier 2 KPIs count When used in conjunction with lower Tier 1 and Tier 2 PSEs have been
LOPC incidents that are reportable tier indicators, the two PSE KPIs adopted by OGP with the intent that
as Process Safety Events (PSEs), i.e. contribute to a company’s assessment these KPIs are applied across produc-
the incident results in any of the of its process safety and asset integrity tion and drilling operations for the oil
consequences stated in RP 754 . Tier performance and can provide a & gas industry worldwide. Therefore, it
6
1 PSE records incidents with greater company with opportunities for learn- is recommended that, where practical
consequence and is the most lagging ing and improvement. to do so, companies adhere closely
performance indicator within the The Tier 1 and Tier 2 KPI definitions to these definitions. Companies will
four tier approach (Figure 2). Tier 2 are reproduced below directly from RP commonly provide internal guidance,
PSE records incidents with a lesser 754 and list the LOPC consequences particularly in order to align definitions
consequence. Tier 2 PSEs, even those which result in a recordable PSE. The with existing company terminology
that have been contained by second- definitions refer to material release and management systems.
ary systems, indicate barrier system threshold quantities, which have been Appendix A provides a useful flow
weaknesses that may be precursors of reproduced in Appendix B. The full chart to help determine whether an
future, more significant incidents. text of RP 754 should be consulted LOPC is reportable.
when further details are required .
6
Table 1 – process safety event definitions, reproduced from API RP 754
Tier 1 Indicator Definition and Consequences Tier 2 Indicator Definition and Consequences
A Tier 1 Process Safety Event (PSE) is a loss of primary A Tier 2 Process Safety Event (PSE) is an LOPC with lesser
containment (LOPC) with the greatest consequence. A Tier 1 consequence. A Tier 2 PSE is an unplanned or uncontrolled
PSE is an unplanned or uncontrolled release of any material, release of any material, including non-toxic and non-flammable
including non-toxic and non-flammable materials (e.g. steam, materials (e.g. steam, hot condensate, nitrogen, compressed
hot condensate, nitrogen, compressed CO or compressed air), CO or compressed air), from a process that results in one or
2
2
from a process that results in one or more of the consequences more of the consequences listed below and is not reported in
listed below: Tier 1:
• An employee, contractor or subcontractor ‘days away • An employee, contractor or subcontractor recordable
from work’ injury and/or fatality; injury;
• A hospital admission and/or fatality of a third-party • A fire or explosion resulting in greater than or equal to
• An officially declared community evacuation or community $2,500 of direct cost to the Company;
shelter-in-place • A pressure relief device (PRD) discharge to atmosphere
• A fire or explosion resulting in greater than or equal to whether directly or via a downstream destructive device
$25,000 of direct cost to the Company that results in one or more of the following four
• A pressure relief device (PRD) discharge to atmosphere consequences:
whether directly or via a downstream destructive device – liquid carryover
that results in one or more of the following four – discharge to a potentially unsafe location
consequences: – an onsite shelter-in-place
– liquid carryover – public protective measures (e.g., road closure)
– discharge to a potentially unsafe location and a PRD discharge quantity greater than the threshold
– an onsite shelter-in-place quantities in Appendix B in any one-hour period
– public protective measures (e.g., road closure) • A release of material greater than the threshold quantities
and a PRD discharge quantity greater than the threshold described in Appendix B in any one-hour period
quantities in Appendix B in any one-hour
• A release of material greater than the threshold quantities
described in Appendix B in any one-hour period
Note: Non-toxic and non-flammable materials (e.g., steam, hot water, nitrogen, compressed CO or compressed air) have no
2
threshold quantities and are only included in this definition as a result of their potential to result in one of the other consequences.
12 ©OGP
3.2 Consequence levels and material release thresholds
To determine whether an LOPC event recognise that at least one barrier has
is a recordable PSE at the Tier 1 or failed, there was potential for serious Primary containment
Tier 2 level it is necessary to collect consequences and that there is an A tank, vessel, pipe, truck, rail
and analyse data on the conse- opportunity to learn. For this reason, car, or other equipment designed
quences of the unintended release, as an LOPC event is also recordable if the Definition to keep a material within it,
typically for purposes of storage,
detailed in Table 1. If the LOPC causes material is hazardous and the amount separation, processing or transfer
actual harm or damage – a fatality released is significant in terms of of gases or liquids. The terms
or injury, or a fire or explosion – then potential consequences. To determine vessel and pipe are taken to
the level of consequence is relatively whether the LOPC is a recordable PSE include containment of reservoir
straightforward to determine. In the at either Tier 1 or 2 level, tables of fluids within the casing and
case of fatality or injury, the severity release thresholds for different catego- wellhead valving to the surface.
criteria are aligned with standard ries of material are included in RP 754 Loss of Primary Containment
industry practice for reporting occupa- and summarised in Appendix B.
tional safety performance in the E&P A release from a Pressure Relief Device (LOPC)
industry, including the annual data (including a flare) is not considered An unplanned or uncontrolled release
submission to OGP. Most companies a recordable PSE unless the amount of any material from primary
containment, including non-toxic and
also internally capture data on fire of release exceeds a Tier 1 or Tier 2 non-flammable materials (e.g. steam,
and explosion damage. While the threshold and the release also results hot condensate, nitrogen, compressed
direct cost thresholds of $25,000 for in one of four actual consequences CO or compressed air)
2
Tier 1 and $2,500 for Tier 2 in Table listed in Table 1. Of these, ‘liquid For drilling operations, any unplanned
1 might appear low consequences for carry over’ and ‘discharge to a poten- or uncontrolled release to the surface
upstream operations, it is important to tially unsafe location’ are relatively (seabed or ground level) should be
capture these events because further straightforward to apply. The conse- included.
‘escalation’ barriers have failed to quence ‘public protective measures’ Secondary Containment
prevent ignition of the LOPC and would only apply to onshore facilities
cause property damage. When an with public receptors which could be An impermeable physical barrier
specifically designed to prevent release
LOPC falls below the criteria for Tier 1 potentially exposed to impact from into the environment of materials that
or Tier 2, the event may be reported the release. The consequence of ‘an have breached primary containment.
for company internal reporting using a on-site shelter-in-place’ may be a more Secondary containment systems
Tier 3 KPI (i.e. a near miss or demand difficult consequence to apply for include, but are not limited to, tank
on a safety system). For convenience, offshore facilities, and some onshore dykes, curbing around process
the definitions of consequence pro- facilities. In this situation, a company equipment, drainage collection systems
vided in the previous sub-section have should interpret ‘an on-site shelter- into segregated oily drain systems, the
outer wall of double walled tanks etc.
also been summarised in Appendix B. in-place’ as ‘a complete or partial
When an LOPC event happens but evacuation of the workforce off the
there are no or low actual conse- facility’. Mustering alone does not
quences in terms of harm to people or constitute a criterion for a Tier 1 or
property damage, it is still important Tier 2 PSE.
to to record the event in order to
Concept of an Acute Release
Tier 1 and 2 both apply the concept of an acute release to For example:
differentiate a PSE from other LOPCs which occur over a • Valves being left open
prolonged period (such as fugitive emissions) and are • Tanks being overfilled
unlikely to constitute a major incident risk of a fire or • Flare or relief systems not operating as intended
explosion. • Process upsets or errors that result in process
An acute release of material is defined as LOPC which materials entering other process containment
exceeds the reporting threshold for a Tier 1 or Tier 2 PSE systems with no provisions or design considerations
within any period of one hour during the event. Acute
releases include but are not limited to equipment and • Corrosion of a pipe or a gasket failure where the
release over an hour exceeds thresholds
piping failures due to corrosion, overpressure, damage
from mobile equipment, sabotage, etc.
©OGP 13
The material categories used in RP lists represent a common international released should be classified based
754 are based on the classifications basis for use in these KPIs. The UNDG on boiling point and flash point. To
within the United Nations Recommen- lists are comprehensive in terms of promote consistency and for conveni-
dations on the Transport of Dangerous pure chemicals however for hydro- ence, the tables in Appendix B have
Goods (UNDG) commonly used in carbon mixtures, such as crude oil or been supplemented with examples
19
Material Safety Data Sheets (MSDSs). fuels, the UNDG classifies flammable of hazardous materials common in
While these classifications differ from liquids in terms of their physical production and drilling operations for
some of the other hazardous material properties. Whenever possible, when each of the RP 754 material catego-
classifications used by the petroleum determining whether an LOPC is ries.
industry in some countries, the UNDG Tier 1 or Tier 2, the hydrocarbons
3.3 Normalisation
Both Tier 1 and Tier 2 PSEs can be convenient, easily obtained factor for
reported as normalised rates to aid both KPIs. This factor enables OGP
comparability over time and between to calculate a Tier 1 and 2 Process
facilities or companies. As there is no Safety Event Rate (PSER) for annual
uniformly applicable normalisation upstream benchmarking and ulti-
factor for process safety/asset integrity mately to benchmark across the entire
indicators based on facility configura- petroleum industry with API and other
tion, a general consensus was reached associations. The rates are calculated
to use worker exposure hours (as as follows:
used for personal injury rates), as a
Total Tier 1 PSE Count
Tier 1 PSER = x 1,000,000
Total Hours Worked (for drilling and production activities)
Total Tier 2 PSE Count
Tier 2 PSER = x 1,000,000
Total Hours Worked (for drilling and production activities)
Total hours worked includes employ- comparisons at an upstream industry
ees and contractors for applicable or company level. Tier 1 PSER is
company functions within the scope of unlikely to be valid at a facility level,
reporting i.e. drilling and production however a Tier 2 PSER is more likely to
activities are included; exploration, be valid for tracking statistical perfor-
construction work hours are excluded. mance at a corporate or facility level
In addition companies may choose to as Tier 2 events are likely to occur with
use additional normalization factors a higher frequency.
such as mechanical units, or produc-
tion volumes.
Because the frequency of PSEs is likely
to be low, care should be taken when
assessing PSER because the rates are
only likely to be statistically valid for
14 ©OGP
3.4 Applicability to Upstream Operations †
The Tier 1 and Tier 2 PSEs are limited to report such events using Tier 3 extraction using refrigeration
to drilling and production activities KPIs and – in particular – to iden- processing)
because of the inherent potential for tify, investigate and learn from – Liquefied Natural Gas (LNG)
LOPC consequences as described in any such events that had high and Gas to Liquids (GTL)
Table 1. The following list describes potential for a major incident, operations
those operations that are included such a blowout preventer activa- • Flow-lines between wells and
as drilling and production activities tion on a high pressure well). pipelines between facilities
for the purpose of reporting. This list Production for this guidance covers associated with field production
is aligned with the OGP Health and petroleum and natural gas production operations
Safety Incident Reporting System operations, including administrative
18
Users’ Guide which is updated and engineering aspects, repairs, • Oil & gas loading facilities, includ-
annually. ing land or marine vessels (trucks
maintenance and servicing, materi- and ships) when connected to an
Drilling includes all exploration, als supply and transportation of oil or gas production process
appraisal and production drilling, personnel and equipment. It covers
wireline, completion and workover all mainstream production operations • Pipeline operations (including
activities as well as their adminis- including: booster stations) operated by
trative, engineering, construction, • Work on production wells under company E&P business
materials supply and transportation pressure Production excludes:
aspects. For this guidance, Tier 1 • Oil (including condensates) and • Production drilling or workover
and 2 PSEs are recorded only when gas extraction and separation • Mining processes associated with
LOPC occurs when operating ‘in hole’ (primary production) the extraction of heavy oil tar
because this is consistent with the prin- sands
ciple of including only those activities • Heavy oil production where it is
‘connected to the process’. inseparable from upstream (i.e. • Heavy oil when separable from
steam assisted gravity drainage) upstream operations
For drilling operations, Tier 1 and Tier production
2 PSEs are excluded for: • Secondary heavy oil processing
• Drilling/workover/wireline opera- • Primary oil processing (water (upgrader)
tions when not ‘in hole’ (during separation, stabilisation) • Refineries
site preparation, rigging up, site • Primary gas processing (dehy- Tier 1 and 2 PSEs are not required to
restoration, etc.) dration, liquids separation, be reported for exploration (except
• Loss of circulation, loss of drilling sweetening, CO removal) drilling as noted above), construction,
2
mud, well kick or underground • Floating Storage Units (FSUs) and and other unspecified activities as
blowout unless there is an associ- sub-sea storage units listed in the OGP Health and Safety
ated LOPC of material (e.g. gas, • Gas processing activities with the Incident Reporting System Users’
oil, other fluids or mud) released primary intent of producing gas Guide .
18
above ground or above sea-bed liquids for sale;
or onto the rig floor. (Note that it – Secondary liquid separation
is good practice for companies (i.e., Natural Gas Liquids [NGL]
† At joint venture sites and tolling operations, the company should encourage the joint venture or tolling operation to consider applying Tier 1 and Tier 2 PSE KPIs
©OGP 15
3.5 Applicability to Upstream Activities †
All activities related to drilling and pro- • Marine transport operations,
ductions operations (as detailed in 3.4 except when the vessel is con-
above) are applicable to PSE report- nected to the facility or process.
ing, including related facility start-up • Truck or rail operations, except
or shut-down operations, related when the truck or rail car is
brown-field construction activities, connected to the process for the
or decommissioning operations, and purposes of feedstock or product
events resulting from sabotage, terror- transfer, or if the truck or rail car is
ism, extremes of weather, earthquakes being used for onsite storage;
or other indirect causes.
• Vacuum truck operations, except
Events associated with the following connected to the process, e.g.
activities fall outside the scope and onsite truck loading, discharging
shall not be included in data collection operations or use of the vacuum
or reporting efforts: truck transfer pump;
• Routine emissions that are allow- • Activities resulting in LOPC from
able under permit or regulation; ancillary equipment not connected
• Office, shop, warehouse, or to the process (e.g., small sample
camp/compound building activi- containers). The exclusion includes
ties (e.g. resulting in office fires, fuel/oil leaks involving trucks or
spills, personnel injury or illness, other vehicles or other mobile
etc.); equipment not considered part of
• Activities leading to personal the process
safety incidents (e.g., slips, trips, • Quality Assurance (QA), Quality
falls) that are not directly associ- Control (QC) and Research and
ated with onsite response to an Development (R&D) laboratory
LOPC; activities (except pilot plant activi-
ties, which are within scope for
PSE reporting);
• Onsite fuelling operations of
mobile equipment (e.g., pick-up
trucks, diesel generators, and
heavy equipment).
The term “process” for production and
drilling operations includes facilities
such as production equipment (e.g.,
separators, vessels, piping, heaters,
pumps, compressors, exchangers,
refrigeration systems, etc.), drilling
equipment above ground, storage
tanks, ancillary support areas (e.g.
boiler houses and waste water
treatment plants), onsite remediation
facilities, and distribution piping under
control of the Company.
† At joint venture sites and tolling operations, the company should encourage the joint venture or tolling operation to consider applying Tier 1 and Tier 2 PSE KPIs
16 ©OGP
3.6 OGP Data Collection
With the issue of this report, OGP’s The collection of process safety KPI
general aim was to identify a small data is fully integrated with OGP’s More help
number of KPIs that were reliable, existing health and safety data col- Determining whether an event is reportable as a Tier 1
clearly defined, implementable across lection process. Collection of offshore or Tier 2 PSE can be complex and definitions open to
the upstream oil & gas industry, and – and onshore Tier 1 and Tier 2 PSE interpretation. For this reason, OGP has developed a
ideally – aligned with the downstream data commenced in 2011 (for 2010 supplement to this report that lists over 60 example
events with interpretation. Over time, OGP intends to
petroleum industry. data). The initial intent is to review and update the list with new examples to aid interpretation
The annual OGP benchmarking validate the data received to ensure of the PSE definitions. The supplement can be
collection of health and safety data sufficient consistency and accuracy. downloaded from the publications section of the OGP
20
now includes the Tier 1 and Tier 2 PSE Subject to sufficient confidence in the website (http://www.ogp.org.uk).
KPIs detailed in this guide, which are validity of the first one to two years
aligned with API RP 754. OGP also of data collection, the data collected Companies have the option to provide
recognised the need for companies to will be integrated into OGP’s annual
adopt leading indicators. Therefore, public report on health and safety additional information on the catego-
ries of material released and whether
this guide also promotes the use of Tier performance indicators for the E&P
3 and Tier 4 KPIs within companies. industry worldwide. the events occurred during normal
operations, start-up, shutdown or other
Numerical Tier 3 or 4 data is not cur- The process safety data collection is
rently requested by OGP as these KPIs based on numbers of Tier 1 and 2 circumstances. Companies are also
able to provide a detailed description
will be specific and appropriate to a PSEs recorded by companies, sepa-
particular company’s safety controls rately reported for production and of any PSE, including causal factors
and lessons learnt, that either involved
and management system and thus drilling activities, and sub-divided into
unlikely to be comparable to those of offshore and onshore data. or had the potential to result in fatali-
ties.
a different company. In future years, The data is also broken down to
as the data collection process matures, understand the consequences that Further details of the data collection
OGP will encourage companies to determined the PSEs, including: process, including instructions, defini-
share process safety lessons learned • the proportions resulting in harm tions and templates, are now available
and best practices related to both to people (injuries and fatalities) in the annually published OGP Health
leading and lagging KPIs through and Safety Incident Reporting System
18
workshops and similar processes. • damage to property (fires and Users’ Guide .
explosions)
• releases of hazardous materials
(from primary containment or pres-
sure relief device discharge)
©OGP 17
4 Tier 3 and Tier 4
Tier 3 and Tier 4 indicators are systems and automatic distributed As noted previously, barriers can
primarily designed for monitoring control systems be assessed using a combination of
and review of risk control systems (i.e. • escalation controls such as detec- leading and lagging KPIs. Tier 4 KPIs
barriers), especially at the operational tion, shutdown and blow-down are leading and monitor operational
level. Barriers may be hard physical systems activity to maintain or strengthen
barriers or soft human barriers. As a barrier; whereas Tier 3 KPIs are
shown in the ‘Swiss Cheese’ diagram • mitigation controls such as deluge, more lagging and record the number
secondary containment and
(Figure 1), hard barriers are intended of actual or near miss failures of a
to block or respond to LOPC events automated emergency systems barrier. In this context, Tier 3 indica-
and may include: Soft barriers are typically management tors are also considered leading when
• prevention controls such as system-related, such as procedures used as predictive KPIs with respect to
engineering design of containment and processes, or workforce-related, more severe consequences character-
such as training, competence, behav- ised by Tier 1 and Tier 2 PSEs.
iours and culture.
4.1 Tier 3 KPIs
A Tier 3 indicator records an opera- indicators are not generally suitable • Primary containment inspection or
tional situation, typically considered a for company-to-company bench- testing results outside acceptable
‘near miss’, which has challenged the marking or year-on-year corporate limits
safety system by progressing through performance reporting. • LOPC below Tier 2 thresholds
one or more barrier weaknesses to Tier 3 indicators are typically based • Near misses with potential for
result in an event or condition with on more lagging ‘outcomes’, i.e. LOPC
• consequences that do not meet retrospective recording of undesirable
the criteria for a reportable Tier 1 events or findings. A Tier 3 indica- • Asset integrity/process safety
or Tier 2 event; or tor may be associated with one or audit findings indicating barrier
• no actual consequences, but more specific barriers which have an weaknesses
the recognition that, in other associated leading Tier 4 indicator to • Non-compliances with asset integ-
circumstances, further barriers achieve dual assurance (see section rity or process safety voluntary
could have been breached and a 4.3 for further information). standards or legislation
Tier 1 or Tier 2 event could have Types of KPIs implemented at Tier 3 The two examples in this section
happened. could include numerical data or other are brief descriptions of Tier 3 KPIs
Tier 3 indicators are intended primar- parameters related to: provided in RP 754, which should be
ily for internal Company use at the • Demands on safety systems, consulted for the complete text. Further
facility, business or corporate level, e.g. pressure relief devices (see examples of Tier 3 KPIs are provided
but may occasionally support public example) in Table 2 and as a suuplement linked
20
reporting. However, because these • Safe operating limit excursions to this report on the OGP website .
indicators are specific to particular (see example)
facilities or company systems, Tier 3
Tier 3 KPI example: Demands on safety systems
This KPI monitors demands on safety systems designed to • activation of a safety instrumented system A demand resulting from intentional activation of the
prevent LOPC or to mitigate the consequences of an LOPC. • activation of a mechanical shutdown system safety system during periodic device testing, or manual
A system may include sensors, logic solvers, actuators and • activation of a PRD not counted as Tier 1 or Tier 2, activation as a part of the normal shutdown process is
final control devices designed to prevent an LOPC, or it with release of material directly to atmosphere excluded. A PRD is considered to have been activated
may include a Pressure Relief Device (PRD) and flare or • activation of a PRD not counted as Tier 1 or Tier 2, when the system pressure reaches the device set point
scrubber that function together to mitigate the with release of material to atmosphere via a whether or not the PRD performs as designed. Activation
consequences of an LOPC. All of these elements function destructive device (e.g. flare or scrubber) of PRDs includes safety valve (SV) lifts above the set
together as a system and when a demand is placed on the point, rupture disc or pin replacement (except preventive
system, a single event is counted, regardless of the The KPI count is typically segregated by the four types of maintenance) and deflagration vent re-seats but excludes
number of devices that must function within the system. A demand above. Some companies may find that a rate of pressure/vacuum (PV) vents (e.g. on tanks) unless the
demands per safety system type provides a more useful
Demand on a Safety System is counted, regardless of the indicator than a simple count. vent fails to function as intended.
phase of operation (e.g. start-up, shutdown, normal,
temporary, emergency) when one of the following occurs:
18 ©OGP
Tier 3 KPI example: Safe Operating Limit Excursion Figure 7 – Storage Tank Example of Safe Operating Limit KPI
This KPI monitors process parameter deviations that
exceed the Safe Operating Limit (SOL) applicable to
specific operations at a facility. This includes different
operating phases including start-up, shutdown and normal Safe Operating Limit (SOL) or high level shut down
operation which may have different SOLs for the same
equipment. Figure 7 shows the relationship between High level alarm
Normal Operating Limit, High/Low Alarm Limits, and the
SOL (or equivalent High-High Level Shut Down) system. Normal operating limit
Reaching the SOL represents the point beyond which
troubleshooting ends and pre-determined action occurs to
return the process to a known safe state. The Low level alarm
pre-determined action may range from manually executed
operating procedures to a fully automated instrument
based control system.
The Tier 3 KPI counts each event or condition resulting in
an SOL excursion (i.e a recorded exceedance of the SOL in duration, material in the tank and, following investigation, each excursion should be counted separately. A process
a specified time period). A company may want to record root causes of the SOL. A single initiating process event or condition that hovers near the SOL value for one piece of
specific data or information about individual SOL condition may result in a number of SOL excursions for equipment may result in multiple excursions that should be
excursions, including operational phase, excursion different equipment (e.g. site-wide failure of a utility) and counted as a single event or condition.
4.2 Tier 4 KPIs
A Tier 4 KPI represents performance • contractor capability and man- supervisors, engineers and manag-
of the individual risk control barriers, agement ers at the facility or business level
or its components, within a facility’s • audit improvement actions where awareness of specific hazards,
management system, and operating • asset integrity and process safety detailed understanding of the plant
discipline. These KPIs are typically and local ownership of risk manage-
more leading and pro-active because initiatives ment is most critical. However, a few
they reflect activities of the company • workforce and management train- Tier 4 indicators may be rolled up to
directly associated with maintaining ing and development business or corporate level to assess
and improving its risk control barriers. • technical competence assessment management system barriers which
Measures can be focused on barriers and assurance are highly standardised across a
such as: Tier 4 KPIs are more effective when company. Because of specificity to
• engineering and inherently safe applied in combination with lagging facilities or company systems, Tier 4
design indicator information. This would indicators are not generally suitable
• equipment maintenance, inspec- include correlation with Tier 1, 2 for company-to-company bench-
tion and testing and 3 data, and particularly when marking or corporate performance
• process hazard and major inci- root-cause analysis provides specific reporting.
dent risk assessments indications of barrier weaknesses
• quality of, and adherence to, related to the effective implementation
of management system requirements.
operating procedures
• facility management of change Tier 4 indicators are intended primar-
ily for use by operators, first-line
©OGP 19
4.3 Selection of Tier 3 and 4 KPIs Selecting leading and
It is important to choose Tier 3 and 4 As noted earlier, it is recommended lagging KPIs for “dual
KPIs which operators and engineers that facilities determine which barriers assurance”
recognise as meaningful and appli- which are most critical for manage- While Tier 4 indicators are clearly leading, it has been
cable to the specific barrier systems ment of major incident risk then select noted that Tier 3 indicators can be considered as either
in place at the facility. The indicators suitable leading and lagging KPIs for leading or lagging depending on how the data is used,
selected should provide actionable each critical barrier. Care must be e.g. a level alarm going off frequently could be a
information which directs activities to taken to avoid overwhelming staff with leading indicator of the potential for Tier 1 or 2 events
or a lagging indicator of maintenance not having been
further improve barrier strength and too many metrics, and therefore com- performed on schedule. Equally, Tier 2 indicators can
addresses identified weaknesses. panies are encouraged to be selective be considered leading relative to Tier 1 – or lagging
CCPS has provided a comprehensive and focus KPIs on barriers which are relative to Tiers 3 and 4.
selection of possible KPIs for each of either important in terms of mitigating For each critical barrier, those few of highest concern to
20 management system elements . major risk or because there are known the company or facility, a good practice is to identify
5
This list of KPIs was updated in 2010 weaknesses in the barrier that need to one leading KPI at Tier 4 level and one lagging KPI
in their guidelines on process safety be addressed. from a higher tier. These two ‘matched’ KPIs can then
metrics . In RP 754, API has also It is important to view risk control be used in combination to assess the performance of
9
the selected barrier. This approach is called ‘Dual
suggested 10 Tier 4 KPIs and UK barriers and KPIs used in the context Assurance’ by UK HSE and links a lagging and leading
6
7
HSE has illustrated their dual assur- of the overall management system and pair of indicators that can be correlated to statistically
ance concept by providing a selection continuous improvement. Risk control test whether a specific barrier is getting weaker or
of possible leading and lagging barriers are generally equivalent stronger.
indicators for 9 common risk control to management system elements or A simple example of dual assurance would be a leading
barriers . Table 2 provided here is sub-elements; therefore it is advis- Tier 4 KPI to monitor ‘the percentage against plan of
7
updated from OGP Report No. 415 able to align barrier names with the completed tests on a facility’s alarm system’ linked
1
taking into account these references terminology of the company’s own with a more lagging Tier 3 KPI which monitors ‘the
number of alarm system failures (recorded from
and also illustrates the dual assurance management system. As the system testing, near misses or any actual Tier 1 and 2 events)’.
approach advocated by UK HSE . improves over time, the KPIs should In combination these two KPIs provide data to assess
7
be reviewed regularly and subjected whether the ongoing maintenance and testing regime
to their own continuous improvement of safety critical alarms is sufficiently effective to
cycle to ensure that effort is main- ensure that any ‘holes’ in the barrier are monitored and
tained on strengthening those barriers minimised to an acceptably low level.
which are most critical for prevention
of major incidents.
20 ©OGP
Table 2: Examples of risk control barriers and associated “dual assurance” Tier 3 and 4 KPIs
Barrier/risk control system Example KPI (Tier 3) Example KPI (Tier 4)
• % of manager inspections of work locations
completed
• Percentage of manager inspections delegated
to subordinates • Total hours spent on MWE activities by
Management and workforce • % of safety meetings not fully attended by staff managers and by staff
engagement (MWE) on safety/ working that day • % MWE suggestions implemented
asset integrity
• Number of barrier weaknesses, including • Staff opinion/attitude survey outcomes on
unsafe conditions, identified from MWE health of asset integrity/process safety barriers,
including leadership, competence, safety culture
and equipment design
• Number of recommendations/actions • Number of planned HIRA completed on
unresolved by their due date schedule
Hazard identification and risk • Number of actual or near-miss LOPC events • Average number of hours per P&ID for
assessment (HIRA) where inadequate HIRA was a causal factor conducting
• Numbers of P&ID corrections and other actions a) baseline PHAs
identified during PHAs b) PHA revalidations
• Number of actual or near-misses, LOPC events,
plant trips, equipment damage linked to
a) trainees
Competence of personnel b) lack of technical understanding • % personnel assessed to be i) partly, ii) fully,
(categorised as employees and c) lack of experience and iii) exceeding local competence criteria for
supervised contractors, also a) d) inadequate training all asset integrity/process safety critical roles in
operators b) first-line e) absence of skills in team each personnel category
supervisor, c) managers, and • Number and outcome of periodic reviews to
d) technical authorities) • Number of workers in each personnel category check accuracy of asset/process knowledge
whose training is overdue
• % time that asset integrity/process safety critical
positions have gone unstaffed
• Number of operational errors due to incorrect/
unclear procedures
• Number of operational shortcuts identified by • % of procedures reviewed and updated versus
Operational procedures near misses and incidents plan
• Number of PHA recommendations related to
inadequate operating procedures
• Number of actual or near-miss LOPC events
where inadequate inspection or maintenance
• Number of non-routine and emergency
maintenance work orders
Inspection & maintenance • No. of process leaks identified during operation • % maintenance plan completed on time
(focused on equipment critical or downtime
to asset integrity/process • % of planned preventative maintenance versus
safety) • Number of temporary repairs or deferred total maintenance (including unplanned)
maintenance items in service
• % of safety-critical plant/equipment that
performs to specification when tested was a
causal factor
©OGP 21
Table 2: Examples of risk control barriers and associated “dual assurance” Tier 3 and 4 KPIs
Barrier/risk control system Example KPI (Tier 3) Example KPI (Tier 4)
• Number of post-startup modifications required
by Operations
• Number of incidents or near-misses where
Plant design errors in plant design are identified as a • Number of deviations from applicable codes
and standards
contributory cause
• % safety-critical equipment/systems fully in
compliance with current design codes
• Total number of SIA activations reported by
Safety instrumentation and operations • Mean time between alarm activations and
operator responses
alarms (SIA) • Total number of SIA faults reported during tests • Number of individual SIA tests versus schedule
• Alarms per hour
• % relevant personnel trained on S&S prior to
• Number of near-misses or incidents during S&S commencing S&S
Start-ups and shutdowns (S&S) • Number of deferred start-ups and unplanned
shutdowns • % relevant personnel present during S&S versus
plan
• Number of planned MOCs performed and time
• Number of actual or near-miss LOPC where taken
inadequate MOC was a causal factor
Management of change • % MOCs for which the drawings or procedures • % plant changes suitably risk assessed and
(MOC) approved before installation
were not updated
• Number of emergency or temporary MOCs • Average time taken to fully implement a change
once approved
• % incidents/near misses during work covered • Number of PTW issued
by a PTW
Permit to work (PTW) • Average time per permit spent on writing,
• % PTWs sampled which failed to identify all reviewing, and approving PTW
hazards or specify suitable controls
• % required contractor training conducted on
• Asset integrity and general safety KPIs for schedule
contractor companies, average for all clients
Contractor Management and when under contract to company • Frequency of, and percentage attendance
during, contractor safety meetings
• Number and % of open/unresolved contractor
safety suggestions • Percentage of qualification audits/checks/
criteria met prior to entry
• Number of emergency exercises on schedule
• Number of emergency response elements that and total staff time involved
are not fully functional when activated in • % of staff who have participated in an
Emergency management
a) a real emergency emergency exercise
b) an emergency exercise • Number of emergency equipment and
shutdown devices tested versus schedule
• Number of compliance violations related to • % of existing standards reviewed as per
Compliance with standards
asset integrity/process safety schedule to ensure evergreen status
22 ©OGP
Appendix A
Determining whether to report a Recordable Process Safety Event (PSE)
With reference to the six tables in Appendix B, the flow chart recommends four
questions to ask when determining if a LOPC or PRD activation is recordable as a
Process Safety Event (PSE) for the purpose of OGP benchmarking.
1
Was the event the result of an
LOPC or PRD discharge from part of a No Event is not OGP recordable but may be
production or drilling process? (See Sections 3.4 reportable by the Company as part of a
and 3.5 and definitions in Appendix B) broader or different KPI
Yes
2
Did the event (LOPC or PRD activation)
result in an incident with any of the harmful or Yes
damaging consequences listed in Table 1?
No
3
If LOPC, as noted in Table 2, did the Event is OGP recordable by the Company
amount of the material released exceed any Yes as a PSE and should be classified as
threshold in Tables 4-6? either Tier 1 or Tier 2
No
4
If PRD
activation, did the
material release (either directly to
atmosphere or via flare or other destructive Yes
device) exceed any threshold listed in Tables
4-6 as well as any of the four
consequences in Table
3?
No
Event is not a Tier 1 or Tier 2 PSE and not OGP recordable
but the Company may report the event within one of its
internal process safety KPIs (i.e. at Tier 3)
©OGP 23
Appendix B
Process Safety Event (PSE) consequence and threshold tables
As described in the report, practical guidance on how to implement the Tier on Tier 1 and Tier 2 categories listed
implementation of the Process Safety 1 and Tier 2 KPIs for recording PSEs in RP 754, which are in turn based
Event (PSE) KPIs can be challenging in upstream operations. As an aid to on international UNDG regulations
due to the complexity of applying the implementation, this Appendix pro- for transport of materials . To help
19
hierarchy of Tier 1 and Tier 2 defini- vides further detail in the form of six companies, examples of materials
tions and consequences as listed in tables which summarise the hierarchy commonly found in upstream opera-
Section 3.1 of this report, which are in of LOPC (and PRD discharge) conse- tions are provided in Tables B–3 to
turn reproduced from the API/ ANSI quences and thresholds in RP 754. The B–6. However, companies may need
Standard Recommended Practice tables are intended to be used to help to provide more detailed guidance on
(RP) 754: Process Safety Performance companies decide whether an LOPC hydrocarbon mixtures or other gases
Indicators for the Refining and or PRD discharge should be recorded or liquids specific to their operations.
Petrochemical Industries . Companies as a PSE. It should be noted that when an event
6
implementing the Tier 1 and 2 KPIs Table B–1 below lists the conse- results in multiple thresholds exceeded,
in this report should use RP 754 as a quences related to harm to people the PSE should be recorded at the
source document for detailed defini- of damage to property which would highest Tier applicable to any one of
tions and guidance. However, RP result in a Tier 1 or Tier 2 PSE. the exceeded thresholds. A download-
754 was developed for the refining However most PSE recorded by able supplement to this report may
20
and petrochemical industry, and not companies are unlikely to result in be downloaded from the OGP website
specifically for the upstream oil & gas significant acute harm or damage, but that also provides examples of PSEs
industry. instead result from an LOPC or PRD which help demonstrate how these
In order to gain the KPI consistency discharge which has exceeded mate- tables are applied in practice.
and benchmarking value that took rial release thresholds as described Appendix A provides a flow chart
many years to achieve for personal below in Table B–2 or B–3, respec- which may be helpful in understanding
safety, OGP have aligned definitions tively. The relevant thresholds for the how to use the following six tables.
in this report with RP 754 but offers amount of material released are based
Table B–1 (of 6): Thresholds for LOPC resulting in actual harm or damage
LOPC or PRD discharge is recordable as a PSE Level
PSE when it results in one or more of the
consequences in this table (irrespective of Tier 1 Tier 2
the amount of material released)
Fatality and/or Lost Workday Case (‘days Recordable occupational injury (restricted
Injury to Employee or Contractor
away from work’ or LTI) work case or medical treatment case)
Fatality, or injury/illness that results in a
Injury to Third Party None
hospital admission
Impact to the Community Officially declared community evacuation None
or community shelter-in-place
Fire or Explosion resulting in greater than Fire or Explosion resulting in greater than
Fire or Explosion or equal to $25,000 of direct cost to the or equal to $2,500 of direct cost to the
Company Company
24 ©OGP
Table B–2 (of 6): Thresholds for LOPC material releases
LOPC is recordable as a PSE, even when no PSE Level
serious harm or damage results, if the
amount of material released exceeds Tier 1 Tier 2
specified thresholds
An LOPC release of a gas or liquid exceeds See Tables B–4, 5 or 6 for Tier 1 threshold See Tables B–4, 5 or 6 for Tier 2 threshold
the material release threshold quantities in quantities quantities
any one hour period
Table B–3 (of 6): Thresholds for PRD discharges
A PRD discharge event is recordable as a PSE Level
PSE if it results in serious harm or damage,
or exceeds the material release threshold
quantities while resulting in any of four Tier 1 Tier 2
listed criteria
Event results in a Tier 1 PSE if the Event results in a Tier 2 PSE if the
consequence is listed in Table B–1, consequence is listed in Table B–1,
regardless of the quantity released, or regardless of the quantity released, or
Event results in a: Event results in a:
A pressure relief device (PRD) discharges • liquid carryover, or • liquid carryover, or
either directly to atmosphere or to a • discharge to a potentially hazardous • discharge to a potentially hazardous
destructive device (e.g. flare, scrubber) location, or location, or
• on-site shelter in place, or • on-site shelter in place, or
• public protective measures, • public protective measures,
and quantity discharged equals or exceeds and quantity discharged equals or exceeds
any Tier 1 threshold in Tables B–4, 5 or 6 any Tier 2 threshold in Tables B–4, 5 or 6
©OGP 25
Table B–4 (of 6): Non-Toxic Material Release Threshold Quantities for LOPC
LOPC is recordable as a PSE only when
release is ‘acute’, i.e. exceeds a threshold Tier 1 Tier 2
quantity in any one hour period. PSE Tier is (Categories below refer to API/ANSI standard RP 754) (Categories below refer to API/ANSI standard RP 754)
highest of all that apply
Material hazard classification Outdoor release Indoor release Outdoor release Indoor release
(with example materials)
Flammable Gases – e.g.
• methane, ethane, propane, butane, 500 kg (1,100 lb) 250 kg (550 lb) 50 kg (110 lb) 25 kg (55 lb)
• natural gas (Cat.5) (Cat.5) (Cat.5) (Cat.5)
• ethyl mercaptan
Flammable Liquids with Boiling Point ≤ 35°C
(95°F) and Flash Point < 23°C (73°F) – e.g.
500 kg (1,100 lb) 250 kg (550 lb) 50 kg (110 lb) 25 kg (55 lb)
• liquefied petroleum gas (LPG), (Cat.5) (Cat.5) (Cat.5) (Cat.5)
• liquefied natural gas (LNG)
• isopentane
Flammable Liquids with Boiling Point > 35°C
(95°F) and Flash Point < 23°C (73°F) – e.g.
• gasoline/petrol, toluene, xylene, 1,000 kg (2,200 lb) 500 kg (1,100 lb) 100 kg (220 lb) 50 kg (110 lb)
• condensate or or or or
• methanol 7 bbl (Cat.6) 3.5 bbl (Cat.6) 1 bbl (Cat.6) 0.5 bbl (Cat.6)
• > 15 API Gravity crude oils (unless actual
flashpoint available)
Combustible Liquids with Flash Point ≥ 23°C
(73°F) and ≤ 60°C (140°F) – e.g. 2,000 kg (4,400 lb) 1,000 kg (2,200 lb) 100 kg (220 lb) 50 kg (110 lb)
• diesel, most kerosenes, or or or or
• < 15 API Gravity crude oils (unless actual 14 bbl (Cat.7) 7 bbl (Cat.7) 1 bbl (Cat.6) 0.5 bbl (Cat.6)
flashpoint available)
Liquids with Flash Point > 60°C (140°F)
released at a temperature at or above its flash
point – e.g. 2,000 kg (4,400 lb) 1,000 kg (2,200 lb) 100 kg (220 lb) 50 kg (110 lb)
or
or
or
or
• asphalts, molten sulphur, 14 bbl (Cat.7) 7 bbl (Cat.7) 1 bbl (Cat.6) 0.5 bbl (Cat.6)
• ethylene glycol, propylene glycol
• lubricating oil
Liquids with Flash Point > 60°C (140°F)
released at a temperature below its flash point
– e.g. 1,000 kg (2,200 lb) 500 kg (1,100 lb)
or
or
• asphalts, molten sulphur, Not applicable Not applicable 10 bbl (Cat.7) 5 bbl (Cat.7)
• ethylene glycol, propylene glycol
• lubricating oil
26 ©OGP
Table B–5 (of 6): Toxic Material Release Threshold Quantities for LOPC
LOPC is recordable as a PSE only when
release is “acute” i.e. exceeds a threshold Tier 1 Tier 2
quantity in any one hour period. PSE Tier is (Categories below refer to API/ANSI standard RP 754) (Categories below refer to API/ANSI standard RP 754)
highest of all that apply
Material hazard classification Outdoor release Indoor release Outdoor release Indoor release
(with example materials)
TIH Hazard Zone A materials – includes:
• acrolein (stabilised) 5 kg (11 lb) (Cat.1) 2.5 kg (5.5 lb) 0.5 kg (1 lb) (Cat.1) 0.25 kg (0.5 lb)
(Cat.1)
(Cat.1)
• bromine
TIH Hazard Zone B materials – includes:
• hydrogen sulphide (H S), 25 kg (55 lb) (Cat.2) 12.5 kg (27.5 lb) 2.5 kg (5.5 lb) 1.3 kg (2.8 lb)
(Cat.2)
(Cat.2)
(Cat.2)
2
• chlorine (Cl )
2
TIH Hazard Zone C materials – includes:
100 kg (220 lb) 50 kg (110 lb)
• sulphur dioxide (SO ) 2 (Cat.3) (Cat.3) 10 kg (22 lb) (Cat.3) 5 kg (11 lb) (Cat.3)
• hydrogen chloride (HCl)
TIH Hazard Zone D materials – includes:
200 kg (440 lb) 100 kg (220 lb
• ammonia (NH ) 3 (Cat.4) (Cat.4) 20 kg (44 lb) (Cat.4) 10 kg (22 lb) (Cat.4)
• carbon monoxide (CO)
Other Packing Group I Materials – includes:
• aluminum alkyls
• some liquid amines 500 kg (1,100 lb) 250 kg (550 lb) 50 kg (110 lb) 25 kg (55 lb) (Cat.5)
• sodium cyanide (Cat.5) (Cat.5) (Cat.5)
• sodium peroxide
• hydrofluoric acid (>60% solution)
Other Packing Group II Materials – includes:
• aluminum chloride
• phenol 1,000 kg (2,200 lb) 500 kg (1,100 lb) 100 kg (220 lb) 50 kg (110 lb)
• calcium carbide or or or or
• carbon tetrachloride 7 bbl (Cat.6) 3.5 bbl (Cat.6) 1 bbl (Cat.6) 0.5 bbl (Cat.6)
• some organic peroxides
• hydrofluoric acid (<60% solution)
©OGP 27
Table B–6 (of 6): Other Material Release Threshold Quantities for LOPC
LOPC is recordable as a PSE only when
release is “acute” i.e. exceeds a threshold Tier 1 Tier 2
quantity in any one hour period. PSE Tier is (Categories below refer to API/ANSI standard RP 754) (Categories below refer to API/ANSI standard RP 754)
highest of all that apply
Material hazard classification Outdoor release Indoor release Outdoor release Indoor release
(with example materials)
Other Packing Group III materials – includes:
• sulphur
• lean amine
• calcium oxide 2,000 kg (4,400 lb) 1,000 kg (2,200 lb) 100 kg (220 lb) 50 kg (110 lb)
• activated carbon or or or or
• chloroform 14 bbl (Cat.7) 7 bbl (Cat.7) 1 bbl (Cat.6) 0.5 bbl (Cat.6)
• some organic peroxides
• sodium fluoride
• sodium nitrate
Strong Acids or Bases – includes:
• sulphuric acid, hydrochloric acid 2,000 kg (4,400 lb) 1,000 kg (2,200 lb) 100 kg (220 lb) 50 kg (110 lb)
or
or
or
or
• sodium hydroxide (caustic) 14 bbl (Cat.7) 7 bbl (Cat.7) 1 bbl (Cat.6) 0.5 bbl (Cat.6)
• calcium hydroxide (lime)
Moderate Acids or Bases – includes: 1,000 kg (2,200 lb) 500 kg (1,100 lb)
None None or or
• diethylamine (corrosion inhibitor) 10 bbl (Cat.7) 5 bbl (Cat.7)
28 ©OGP
Appendix C
Glossary of terms and definitions
Asset integrity Contractor employee Fire
Asset integrity is related to the prevention of major Any person employed by a Contractor or Contractor’s Any combustion resulting from an LOPC, regardless
incidents. It is an outcome of good design, construction Sub-Contractor(s) who is directly involved in execution of the presence of flame. This includes smoldering,
and operating practice. It is achieved when facilities are of prescribed work under a contract with the reporting charring, smoking, singeing, scorching, carbonizing, or
structurally and mechanically sound and perform the Company. the evidence that any of these have occurred.
processes and produce the products for which they were
designed. Destructive device First Aid
The emphasis in this guide is on preventing loss of A flare, scrubber, incinerator, quench drum, or other A consequence of an event that required medical atten-
primary containment (LOPC) that may, either directly similar device used to mitigate the potential conse- tion, often consisting of one-time, short-term treatment
or via escalation, result in a major incident. Apart from quences of a PRD release. and requiring little technology or training to administer.
LOPC, there are other types of asset integrity event, First aid can include cleaning minor cuts, scrapes, or
such as a structural failure, that could also cause a major Direct cost scratches; treating a minor burn; applying bandages and
incident, but these are not covered by the guidance in Cost of repairs or replacement, cleanup, material dressings; the use of non-prescription medicine; draining
this report. disposal, environmental remediation and emergency blisters; removing debris from the eyes; massage; and
Barriers response. drinking fluids to relieve heat stress. A full list of 14
first aid treatments is provided by OGP in Reference 18.
Direct cost does not include indirect costs, such as busi-
A functional grouping of safeguards, such as primary ness opportunity, business interruption and feedstock/ First aid cases are not classified as recordable incidents
containment, process equipment, engineered systems, product losses, loss of profits due to equipment outages, for the purpose of reporting to OGP but may be used by
operational procedures, management system elements, costs of obtaining or operating temporary facilities, companies as a criterion for reporting of events as Tier
or worker capabilities designed to prevent LOPC and or costs of obtaining replacement products to meet 3 KPIs.
other types of asset integrity or process safety events, customer demand. Direct cost does not include the cost of
and mitigate any potential consequences of such events. the failed component leading to LOPC, if the component High potential event
A set of barriers is also often referred to as a risk control is not further damaged by the fire or explosion. Any event (incident or near miss) that could have
system. resulted in one or more fatalities but had the potential to
Drilling do so in other circumstances.
Company
When designated with a capital C or “the Company”, All exploration, appraisal and production drilling and Hospital admission
workover as well as their administrative, engineering,
refers to the specific oil & gas industry company construction, materials supply and transportation Formal acceptance by a hospital or other inpatient
reporting the KPIs. The Company may be an OGP aspects. It includes site preparation, rigging up and health care facility of a patient who is to be provided
member and its reporting boundary should include its down and restoration of the drilling site upon work with room, board, and medical service in an area of the
divisions and its consolidated affiliates/subsidiaries. For completion. Drilling includes all exploration, appraisal hospital or facility where patients generally reside at
guidance on general reporting boundaries, please see and production drilling. least overnight.
reference 17 (Oil and gas industry guidance on voluntary Treatment in the hospital emergency room or an
sustainability reports), Appendix A (Detailed guidance on Escalation overnight stay in the emergency room would not by
developing a reporting boundary).
The process by which an initial – sometimes small – itself qualify as a ‘hospital admission’.
Company employee event triggers a further – sometimes larger – event that Hours worked
Any person employed by and on the payroll of the may be classified as a near miss or an incident The actual ‘hours worked’, including overtime hours, are
reporting Company, including corporate and manage- Event recorded in the case of onshore operations. The hours
ment personnel specifically involved in exploration An unplanned or uncontrolled outcome of a business worked by an individual will generally be about 2,000
and production. Persons employed under short-service operation or activity that has or could have contributed per year.
contracts are included as Company employees provided to an injury, illness or physical damage or environmental
they are paid directly by the Company. For offshore workers, the ‘hours worked’ are calculated
damage. on a 12-hour work day. Consequently average hours
Construction Exploration worked per year will vary from 1,600 to 2,300 hours per
person depending upon the on/off shift ratio. Vacations
Major construction, fabrication activities and also and leaves are excluded.
disassembly, removal and disposal (decommissioning) Geophysical, seismographic and geological operations,
including their administrative and engineering aspects,
at the end of the facility life. Includes construction of construction, maintenance, materials supply, and For drilling, hours worked includes all activities whether
process plant, yard construction of structures, offshore transportation of personnel and equipment; excludes the operation is ‘in hole’ or not ‘in hole’.
installation, hook-up and commissioning, and removal of Incident
redundant process facilities. drilling. An event or chain of events that has resulted in record-
Contractor Explosion able injury, illness or physical damage or environmental
An individual or organization performing work for the A release of energy resulting from an LOPC that causes damage.
a pressure discontinuity or blast wave (e.g. detonations,
reporting company, following verbal or written agree- deflagrations, and rapid releases of high pressure
ment. ‘Sub-contractor’ is synonymous with ‘Contractor’.
caused by rupture of equipment or piping).
©OGP 29
Key Performance Indicator (KPI) Mitigation Offshore work
Information or data that provides evidence of a A barrier which limits consequences, generally by All activities and operations that take place at sea,
company’s performance in managing its key risks, which limiting escalation, but which does not prevent the initial including activities in bays, in major inland seas, such
in this guide are those risks related to asset integrity event. as the Caspian Sea, or in other inland seas directly
and process safety. KPIs may also be referred to as connected to oceans. Events involving transportation of
performance metrics. Near miss people and equipment from shore to the offshore loca-
Lost Time Injury (LTI) An event or chain of events that has not resulted tion, either by vessel or helicopter, should be recorded
as ‘offshore’.
in recordable injury, illness or physical damage or
A fatality or lost work day case. The number of LTIs is environmental damage but had the potential to do so in Onshore work
the sum of fatalities and lost work day cases. other circumstances.
All activities and operations that take place within a
Lost Time Injury Frequency (LTIF) Number of employees landmass, including those on swamps, rivers and lakes.
The number of lost time injuries (fatalities + lost work Average number of full-time and part-time employees Land-to-land aircraft operations are counted as onshore,
day cases) per 1,000,000 work hours. involved in exploration and production, calculated on a even though flights may be over water.
full-time basis, during the reporting year.
Lost Work Day Case (LWDC) Pressure Relief Device (PRD)
Any occupational injury or illness, other than a fatal Number of fatalities A device designed to open and relieve excess pressure
injury, which results in a person being unfit for work on The total number of Company’s employees and/or Con- (e.g. safety valve, thermal relief, rupture disk, rupture
any day after the day of occurrence of the occupational tractor’s employees who died as a result of an incident. pin, deflagration vent, pressure/vacuum vents).
injury. ‘Any day’ includes rest days, weekend days, leave ‘Delayed’ deaths that occur after the incident are to be
days, public holidays or days after ceasing employment. included if the deaths were a direct result of the incident. Primary containment
A LWDC is a recordable incident. For example, if a fire killed one person outright, and a A tank, vessel, pipe, truck, rail car, or other equipment
second died three weeks later from lung damage caused designed to keep a material within it, typically for
Loss of Primary Containment by the fire, both are reported. purposes of storage, separation, processing or transfer
(LOPC) Occupational illness of gases or liquids. The terms vessel and pipe are taken
An unplanned or uncontrolled release of any material to include containment of reservoir fluids within the
casing and wellhead valving to the surface. Note that
from primary containment, including non-toxic and Any abnormal condition or disorder, other than one primary containment for a specified material may
non-flammable materials (e.g. steam, hot condensate, resulting from an occupational injury, caused by comprise a vessel or pipe that is inside another vessel
nitrogen, compressed CO or compressed air). For drilling exposure to environmental factors associated with that is also designed as primary containment for a dif-
2
operations, any unplanned or uncontrolled release to employment. Occupational illness may be caused by ferent material; for example, a heating tube is primary
the surface (seabed or ground level) should be included. inhalation, absorption, ingestion of, or direct contact containment for fuel gas or fuel oil, even though the
LOPC is a type of event. An unplanned or uncontrolled with the hazard, as well as exposure to physical and tubes may be inside a firebox which is in turn within an
release is an LOPC irrespective of whether the material psychological hazards. It will generally result from oil-water separator.
is released into the environment, or into secondary prolonged or repeated exposure. Refer to OGP/IPIECA
containment, or into other primary containment not Report No. 393, Health Performance Indicators (2007). Process
intended to contain the material released under normal Occupational injury
operating conditions). Facilities used in drilling and production operations in
Any injury such as a cut, fracture, sprain, amputation, the oil & gas industry. This includes rigs and process
Major incident etc. which results from a work-related activity or from equipment (e.g. vessels, piping, valves, boilers, genera-
An incident that has resulted in multiple fatalities and/ an exposure involving a single incident in the work tors, pumps, compressors, exchangers, refrigeration
systems) and includes storage tanks, ancillary support
or serious damage, possibly beyond the asset itself. environment, such as deafness from explosion, one-time areas (e.g. boiler houses and waste water treatment
Typically a major incident is initiated by an LOPC event, chemical exposure, back disorder from a slip/trip, insect plants), on-site remediation facilities, and distribution
but may also result from major structural failure or loss or snake bite. piping under control of the Company.
of stability that has caused serious damage to an asset. Officially declared
(note this definition is intended to incorporate terms such
as “Major Accident” as defined by UK HSE). A declaration by a recognised community official (e.g.
fire, police, civil defense, emergency management) or
Medical Treatment Case (MTC) delegate (e.g. Company official) authorised to order the
A recordable incident involving injury or illness that has community action (e.g. shelter-in-place, evacuation).
required management and care of the patient above
and beyond first aid, but not severe enough to be a
reportable fatality or lost work day case or restricted
work day case.
30 ©OGP
Process safety Recordable Material release threshold quantity
Process safety is a disciplined framework for managing A type of event or incident, including an LOPC or an The weight of gas, liquid, or solid material released
the integrity of operating systems and processes occupational injury or illness, or other outcome which from an LOPC which, if exceeded, results in the event
handling hazardous substances by applying good design has been determined to meet or exceed definitions, crite- being recordable as either a Tier 1 or Tier 2 PSE. The
principles, engineering, and operating and maintenance ria or thresholds for inclusion and classification in data threshold quantities are described more fully in API/
practices. It deals with the prevention and control of provided to OGP (or other agencies or stakeholders). The ANSI standard RP 754 (see Reference 6) and follow the
events with the potential to release hazardous materials broader term ‘reportable’ is often used to indicate the UNDG classification system.
and energy. Such releases can result in toxic effects, fire, wider range of KPI data collected within the company
explosion, and could ultimately result in serious incidents for local or corporate use, of which only part will also be Total Recordable Incidents (TRI)
including fatalities, injuries, property damage, lost recordable. The sum of fatalities, lost work day cases, restricted
production and environmental damage. work day cases and medical treatment cases.
Restricted Work Day Case (RWDC)
Process Safety Event (PSE) Any work-related injury other than a fatality or lost United Nations Dangerous Goods
A Loss of Primary Containment (LOPC) from a process work day case which results in a person being unfit for (UNDG)
that meets the Tier 1 or Tier 2 definitions in this guide. A full performance of the regular job on any day after the
PSE is a Key Performance Indicator (KPI) and is record- occupational injury. Work performed might be: A classification system used to evaluate the potential
able. For the purpose of recording a PSE: • an assignment to a temporary job hazards of various materials when released, which
is used by most international countries as part of
• Drilling facilities are considered to be part of a • part-time work at the regular job the product labeling or shipping information (see
process when operations are ‘in-hole’. • working full-time in the regular job but not Reference 19).
• Land or marine vessels (trucks and ships) are performing all the usual duties of the job
considered to be part of a process when physically Unsafe location
connected to a production facility. Where no meaningful restricted work is being per-
formed, the incident should be recorded as a lost work An atmospheric pressure relief device discharge point
Process Safety Event Rate (PSER) day case (LWDC). This is a recordable incident. or downstream destructive device (e.g. flare, scrubber)
discharge point that results in a potential hazard, such as
The number of process safety events per 1,000,000 Secondary containment the formation of flammable, toxic or corrosive mixtures
(1 million) work hours (production and drilling work at grade level or on elevated work structures, or ignition
hours only). An impermeable physical barrier specifically designed to of relief streams at the point of emission.
prevent release of materials into the environment that
Production have already breached primary containment (i.e. an Work-related injury
Petroleum and natural gas producing operations, LOPC). Secondary containment systems include, but are See occupational injury.
not limited to: tank dykes, curbing around process equip-
including their administrative and engineering aspects, ment, drainage collection systems into segregated oily
minor construction, repairs, maintenance and servicing, drain systems, the outer wall of double walled tanks, etc.
materials supply, and transportation of personnel
and equipment. It covers all mainstream production Tier
operations including wireline. Gas processing activities
with the primary intent of producing gas liquids for sale One of the four levels of the OGP framework for asset
including; integrity KPIs as described in this report, which is in
turn based on the API/ANSI standard RP 754 (see
• secondary liquid separation (i.e. Natural Gas Reference 6).
Liquids [NGL] extraction using refrigeration
processing) Third party
• Liquefied Natural Gas (LNG) and Gas to Liquids A person with no business relation with the Company or
(GTL) operations contractor.
©OGP 31
Appendix D
List of Acronyms
ANSI LTIF RP
American National Standards Institute Lost Time Injury Frequency Recommended Practice
API MOC RWDC
American Petroleum Institute Management Of Change Restricted Work Day Case
CCPS MTC SIA
Center for Chemical Process Safety Medical Treatment Case Safety Instrumentation and Alarms
E&P MWE S&S
Exploration and Production Management and Workforce Engagement Start-ups and Shutdowns
HIRA OECD SOL
Hazard Identification and Risk Assessment Organization for Economic Coordination and Safe Operating Limit
Development
HSE-MS TIH
Health, Safety and Environment Management System PHA Toxic Inhalation Hazard
Process Hazard Analysis
IPIECA TRI
International Petroleum Industry Environmental PRD Total Recordable Incidents
Conservation Association Pressure Relief Device
US CSB
KPI PS US Chemical Safety and hazard investigation Board
Key Performance Indicator Process Safety
UK HSE
LOPC PSE United Kingdom Health and Safety Executive
Loss Of Primary Containment Process Safety Event
UNDG
LWDC PSER United Nations recommendations on the transport of
Lost Work Day Case Process Safety Event Rate Dangerous Goods
LTI PTW
Lost Time Injury Permit To Work
32 ©OGP
Appendix E
Primary references and sources
1. OGP. 2008. Asset integrity – the Key to Managing Major Incident Risks, International Association of Oil & gas
Producers (OGP) Report 415, http://www.ogp.org.uk/pubs/415.pdf
2. UK HSE. 2010. Reports and recommendations arising from the Competent Authority’s response to the Buncefield
incident. Available from UK HSE at http://www.hse.gov.uk/comah/buncefield/response.htm
3. US CSB. 2007. BP Texas City Final Investigation Report. Available from US CSB at
http://www.csb.gov/investigations/detail.aspx?SID=20
4. BP. 2007. The Report of the BP U.S. Refineries Independent Safety Review Panel. Report Available from BP at
http://www.bp.com/bakerpanelreport/
5. CCPS (Center for Chemical Process Safety). 2007. Guidelines for Risk Based Process Safety, American Institution of
Chemical Engineers. (via John Wiley & Sons) at: http://www.aiche.org/CCPS/Publications/Print/index.aspx
6. API. 2010. ANSI/API Recommended Practice 754: Process Safety Performance Indicators for the Refining and Petro-
chemical Industries, (First Edition, April 2010). Available from API at: http://www.api.org/Standards/new/api-rp-754.cfm
7. UK HSE (Health and Safety Executive). 2006. Step-By-Step Guide to Developing Process Safety Performance Indica-
tors (Health and Safety Guide HSG254). Available from UK HSE at http://www.aiche.org/ccps/publications/psmetrics.aspxCCPS.
2008.
8. Process Safety Leading and Lagging Metrics, American Institute of Chemical Engineers. Available from CCPS at
http://www.aiche.org/ccps/publications/psmetrics.aspx
9. CCPS. 2010. Guidelines for Process Safety Metrics, American Institution of Chemical Engineers. Available from
CCPS at: http://www.aiche.org/ccps/publications/psmetrics.aspx (via John Wiley & Sons) OECD. 2008.
10. Guidance on Safety Performance Indicators Related to Chemical Accident Prevention, Preparedness and Response
for Industry (2 edition), Organization for Economic Coordination and Development (OECD) Environment,
nd
Health and Safety Publications, Series on Chemical Accidents No. 19, Paris, 2008. Available from OECD at
http://www.oecd.org/dataoecd/6/57/41269710.pdf
11. HMSO. 1999. The Control of Major Accident Hazards (COMAH) Regulations Statutory Instrument 1999 No. 743.
See UK HSE http://www.hse.gov.uk/comah/background/index.htm and available from Her Majesty’s Stationary Office, London,
at http://www.legislation.gov.uk/uksi/1999/743/regulation/2/made
12. Reason, James. 1990. Human Error, Cambridge University Press. ISBN-10: 0521314194, ISBN-13: 978-0521314190.
13. Reason, James. 1997. Managing the Risks of Organisational Accidents. Hants, England, Ashgate Publishing Ltd
14. Heinrich, H. W. 1931. Industrial Accident Prevention.
15. Bird Frank E., Germain George L.1969. Loss Control Management: Practical Loss Control Leadership, Revised Edition,
Det Norske Veritas Inc. (U.S.A.), 1996.
16. OGP. 1994. Guidelines for the Development and Application of Health, Safety and Environmental Management
Systems, OGP Report 210, http://www.ogp.org.uk/pubs/210.pdf
17. IPIECA/API/OGP. 2010. Oil & gas Industry Guidance on Voluntary Sustainability Reporting (2 Edition) at
nd
http://www.ipieca.org/publication/oil-and-gas-industry-guidance-voluntary-sustainability-reporting-0
18. OGP. 2010. Health and Safety Incident Reporting System Users’ Guide – 2010 data, OGP Report 444,
http://www.ogp.org.uk/pubs/444.pdf
19. United Nations Economic Commission for Europe (UNECE), ECE/TRANS/202, Vol. I and II (“ADR 2009”),
European Agreement Concerning the International Carriage of Dangerous Goods by Road (ADR), 2009.
http://www.unece.org/trans/danger/publi/adr/adr2009/09ContentsE.html
20. OGP. 2011. Upstream PSE Examples, OGP Report 456sup, http://www.ogp.org.uk/pubs/456supp.pdf
©OGP 33
London office: 209-215 Blackfriars Road, London SE1 8NL, UK Tel: +44 (0)20 7633 0272 Fax: +44 (0)20 7633 2350
Brussels office: 165 Bd du Souverain, B-1160 Brussels, Belgium Tel: +32 (0)2 566 9150 Fax: +32 (0)2 566 9159
Web: www.ogp.org.uk E-mail:[email protected] A company limited by guarantee Registered in England, No. 1832064
The words you are searching are inside this book. To get more targeted content, please make full-text search by clicking here.
Discover the best professional documents and content resources in AnyFlip Document Base.
Search
Process Safety OGP
- 1 - 36
Pages: