lp2007 216

“Critical Events”

Applying Continuous Improvement to

Incident Reporting

Nigel CannGeneral Manager

Australian Vinyls

Buncefield

Texas City

Flixborough1 June 1974

•Modification Control

•Use suitably trained, educated and responsible people

•Know what you don’t know

SevesoJuly 1976

• Understanding safe state to leave reactions

• Multiple layers of protection

• Automated Reaction stop systems for exothermic systems

Piper Alpha6 July 1988

•Good functioning Permit to Work System including monitoring

•Never defeat Safety Systems

•Understand the hazards, their consequences and fit appropriate control measures

Longford25 September 1998

Sale

Barry BeachMarine Terminal

Long Island PointFractionation Plant,Crude Oil Tank Farmand Liquids Jetty

LongfordGas & Oil Processing

PortPhillipBay

c

Melbourne

Altona

Monotower

Sub-sea Well Oil Platform

Gas Platform

Concrete Structure

Barracouta Marlin

Snapper

GoodingCompression (GTC)

c

c

• “cold temperatures” • Training needs to impart and refresh knowledge.• Must identify other hazards and provide relevant training.•Corporate knowledge must be captured and kept alive

All of these introduced Major Hazards Legislation

• In Victoria, Australia– Occupational Health and Safety (Major

Hazard Facilities) Regulations 2000– Victoria giving effect to the National Code

of Practice for Major Hazard Facilities

Occupational Health and Safety (Major Hazard Facilities) Regulations 2000

• 302 Identification of major incidents and hazards

• 303 (1) …must conduct a comprehensive and systematic safety assessment…

• 304 (1) … must adopt control measures which…

• 306 (1) … must review, and as necessary revise…

The Deming PDCA Model

PlanAct

DoCheck

What Major Incidents can occur?

What Major Incidents can occur?

PlanAct

DoCheck

What Hazards exist that can cause those Incidents?

What Major Incidents can occur?

What Hazards exist that can cause those Incidents?

PlanAct

DoCheck

What Control Measures can be used to manage and contain those hazards?

What Major Incidents can occur?

What Hazards exist that can cause those Incidents?

What Control Measures can be used to manage and contain those hazards?

PlanAct

DoCheck

What SafetyManagement

System (SMS)Maintains those

Controlmeasures?

What Major Incidents can occur?

What Hazards exist that can cause those Incidents?

What Control Measures can be used to manage and contain those hazards?

What Safety Management

System (SMS) maintains those

control measures?

The Deming PDCA Model

PlanAct

DoCheck

How does theOperator maintainSMS performance

by reviewing KPI’s and SOP’s?

Australian Vinyls

STRIPPINGCOLUMN

DEG ASSER

AUTOCLAVES

STEAM

ADDITIVES

VCM TANKER

CHARGE WATER

VCM GASHOLDER

LIQUID VCM STORAGE

VCM RECO VERYPLANT

BAGGING ANDPAL LET IZ ING

BULK SUPPL Y

SLURRYTANK

STORAGESIL O

FLUID BED DRYER

CENT RIFUGE

PACKAGED SUPPL Y

Plan

Government Level

Acts Regulations Codes of Practice and other guidance

Commonwealth 7 7 20

Victorian State 18 29 28

Local Laws 2

Plan

• Safety Management Systems should not exist!

• Identify a framework– ISO 9000 & 14000 series– API 9100– AS/NZS 4801– AS ISO/IEC 17025

Maintaining performance via a SMS

• Top Down� • Permit to Work System� • Induction procedures� • Control of Third Parties� • Auditing program� • Purchasing procedures� • Recruiting processes� • Personnel and

organisational change processes

� • Engineering Modification controls

� • Emergency Response Procedures

� • Incident Investigation processes

• Bottom up– Identified control

measures must be managed

– Set Performance Standards

– Put in place Monitoring Systems

– AUDIT– Draw conclusions and

take action to close the loop.

• Need to develop robust system– Eg HAZOP keywords

• Be systematic in identifying Incidents– Recommend use of LOC

• Use of Databases and “Bow ties”

Hazard Identification and Safety Assessment

The Laverton Resin Plant

Hole > 150mm

in Storage Tank

HAZARDS

• Working wrong tank

•Corrosion

•Vehicle Hits it

•Flange breaks

•Overpressure

•Fire under tank

•Bullet Hole

•Overfilling

•Wrong Material

Tank Design

Control Measures

Control Measures

Hazard & Control Measure

Identification

•Permit to Work

•Barriers

•Speed Limit

•Signs

•Stand by

•Security

•Bunds

How does a Control Measure become CRITICAL?

Control Measure CRITICALITY

Hole > 150mm

in Storage Tank

HAZARDS

• Working wrong tank

•Corrosion

•Vehicle Hits it

•Flange breaks

•Overpressure

•Fire under tank

•Bullet Hole

•Overfilling

•Wrong Material

Tank Design

Control Measures

Control Measures

Hazard & Control Measure

Identification

•Permit to Work

•Barriers

•Speed Limit

•Signs

•Stand by

•Security

•Bunds

Hole > 150mm

in Storage Tank

HAZARDS

• Working wrong tank

•Corrosion

•Vehicle Hits it

•Flange breaks

•Overpressure

•Fire under tank

•Bullet Hole

•Overfilling

•Wrong Material

Tank Design

•Relief Valves

•Gasholder Venting Procedure

•High Pressure Alarms

•Return to Service Procedure

Control Measures

Control Measures

Hazard & Control Measure

Identification

Draw a “Bow-Tie”

Hole > 150mm in Storage

Tank

Tank Design

Vessel exceeds pressure

Relief Valves

Procedure for venting

to gasholder

High Pressure Alarms

Procedure for Return to Service

Vessel out for

Maintenance

Air in Vessel

Supports Earthquake designed

Vehicle impacts supports

Speed LimitRoad BarrierPTWVehicle

needs to access

area

Draw a “Bow-Tie”

Derive Performance Measures

– No failure on demand– No failure on testing.– As received from duty, pop test to

be within 10% of setting– Inspection and test to be no more

than 3 months overdue

Leading Indicator Monitoring

Latent Unsafe ConditionsDecision-Makers

Latent Unsafe ConditionsLineManagement

Latent Unsafe ConditionsPre-Conditions

Active FailuresProductiveActivities

Active FailuresandLatent Unsafe Conditions

Defences

The Reason “Swiss Cheese” Model: Stages to an Accident

Accident & InjuryAccident & Injury

Investigation of Critical Events

Operator failed to detect significant Reaction Temperature Deviation

Operator failed to detect significant Reaction Temperature Deviation

• 16 Actions that resulted1. Resolve persistent Panel Alarms that should not be there2. Generate list of Critical Alarms

1. Review list of Critical Alarms to see what is on DCS 2. Review list of Critical Alarms on DCS3. Review High Pressure Alarm Recipe settings

1. Set appropriate High Pressure Limits for S1 A/C’s2. Change High Pressure Limits for S1

4. Check S2 Agitator Motor Current settings in DCS

3. Review Trip 18 conditions on DCS4. Reinforce the importance of the Panel with CRO’s

Operator failed to detect significant Reaction Temperature Deviation

5. Specify Temperature Deviation alarm sensitivity at either end of phase 61. Change Temperature Deviation Alarm Sensitivity at either end of

phase 6

6. Check DCS for S2 Temperature Deviation Alarms1. Put Temperature Deviation Alarm on DCS

7. Alarm Controller Output of 09 Valves

8. Assess Effectiveness and Completeness of changes to DCS alarms

Suggestions for other Industries

• Flammable, Toxic or Radioactive Materials– LOC

Suggestions for other Industries

• Complex Machinery

– Catchpoints– Energy Sources– Access Points– Cleaning

Suggestions for other Industries

• Electricity

– Distribution– HV Switching– Working at Heights

Suggestions for other Industries

• Public Transport, Logistics, Port Operations– Third Party collisions– Single vehicle collisions– Derailing– Lifting operations etc

SUMMARY