Risk Indicators For Major Hazards in The Offshore Petroleum Industry

Risk indicators for major hazards in the offshore petroleum industry
(abbreviated version to be presented at ESREL 2003
Jan Erik Vinnem, HiS/Preventor, Terje Aven, HiS, 4068 Morten Sørum, Statoil, Knut Øien, SINTEF Industrial
4349 Bryne Stavanger 4035 Stavanger Management, 7465 Trondheim
1. INTRODUCTION....................................................................................................................................................1
1.1 BACKGROUND....................................................................................................................................................................... 1
1.2 LEGISLATIVE REQUIREMENTS ................................................................................................................................................ 1
1.3 OVERVIEW OF CURRENT PROJECTS........................................................................................................................................ 1
1.4 OBJECTIVES .......................................................................................................................................................................... 2
1.5 TERMINOLOGY ...................................................................................................................................................................... 2
2. OVERVIEW OF CURRENT PRACTICE ............................................................................................................5
2.1 OCCUPATIONAL HAZARDS ..................................................................................................................................................... 5
2.2 CULTURAL ASPECTS, MANAGEMENT SYSTEM ........................................................................................................................ 5
2.3 MAJOR HAZARDS .................................................................................................................................................................. 5
3. RISK INDICATORS, OBJECTIVES AND REQUIREMENTS .........................................................................7
3.1 CONTEXT FOR USE OF INDICATORS ........................................................................................................................................ 7
3.2 OVERALL OBJECTIVES OF USE OF RISK INDICATORS .............................................................................................................. 7
3.3 REQUIREMENTS TO THE USE OF RISK INDICATORS ................................................................................................................. 8
3.4 USE OF MAJOR HAZARD INDICATORS AT DIFFERENT LEVELS ................................................................................................ 10
4. BASIC APPROACH – INDICATORS FOR MAJOR HAZARDS ...................................................................12
4.1 CLASSIFICATION OF INDICATORS ......................................................................................................................................... 12
4.2 USE OF INDICATORS IN PRACTICE ........................................................................................................................................ 13
4.3 ACCIDENTS, INCIDENTS AND NEAR-MISSES .......................................................................................................................... 13
4.4 BARRIER PERFORMANCE ..................................................................................................................................................... 14
4.5 ACTIVITY LEVEL ................................................................................................................................................................. 14
4.6 CAUSAL FACTORS ............................................................................................................................................................... 14
4.7 MANAGEMENT SYSTEM....................................................................................................................................................... 15
4.8 CULTURAL ASPECTS............................................................................................................................................................ 15
5. LOSS RELATED INDICATORS .........................................................................................................................16
5.1 RECOMMENDED HES INDICATORS ...................................................................................................................................... 16
5.2 RECOMMENDED INDICATORS FOR MAJOR HAZARDS ............................................................................................................ 16
5.3 RECOMMENDED USE OF INDICATORS FOR MAJOR HAZARDS ................................................................................................ 16
6. PROCESS RELATED INDICATORS .................................................................................................................17
6.1 RECOMMENDED HES INDICATORS ...................................................................................................................................... 17
7. INDICATORS RELATED TO CAUSAL FACTORS ........................................................................................18
8. CONCLUSIONS AND RECOMMENDATIONS ...............................................................................................19
9. ACKNOWLEDGEMENT .....................................................................................................................................19
10. REFERENCES...................................................................................................................................................20
Indikator paper rev2a.doc
(page left blank intentionally)

Indikator paper rev2a.doc 1
1. Introduction
1.1 Background
Risk indicators in the offshore industry have traditionally been based on occurrence of injuries to personnel.
This implies that the indicators that may be possible to present, are:
• Trends in the occurrence of injuries to personnel and near-misses, classified according to severity or
potential severity
• Injury causation statistics
Such indicators are suitable for performance monitoring in the context of workplace injury (consequence up
to one fatality). It has been claimed that such indicators can provide information about all safety aspects of
an installation, i.e. also aspects of major hazard risk.
It may be argued that there will be considerable similarity between occupational and major accidents, when
it comes to root causes of organisational nature. Otherwise, the similarity would be expected to be very
limited. Therefore, indicators for personal injuries have very limited applicability for monitoring of major
hazard risk.
This may be further emphasized as follows: A traditional focus on near misses and motivation is no
guarantee for the functioning of normally dormant safety barriers. The indicators based on events and HES
culture therefore need to be supplemented with indicators reflecting the status of safety barriers, in order to
illustrate the total picture.
In the recent NPD management regulations (NPD, 2001a) there is a clear requirement to monitor risk and
present trends in indicators, which shall illustrate the relevant aspects of major hazard risk.
1.2 Legislative Requirements

The recent regulations relating to management in the petroleum activities (NPD, 2001a, ‘the management
regulations’) require the following in terms of monitoring of major hazard risk:
“Section 7 Monitoring parameters and indicators

….The operator or the party responsible for the operation of a facility shall establish indicators to monitor
changes and trends in the risk relating to major accidents.”
UK legislation for offshore installations and operations have similar requirements, in the ‘Prevention of fire
and explosion and emergency response on offshore installations’ (PFEER) Regulations (HSE, 1995), where
Regulation 5 requires establishment of performance standards and suitable measurement and recording.
1.3 Overview of Current Projects

The structure of major hazard barriers that is currently used widely in the offshore petroleum industry is
briefly described in Section 1.5.2. There are currently a number of projects that address modelling or
evaluation of barriers, which may be briefly explained as follows:
• NFR/HES R&D project financed by Norwegian authorities in order to develop decision

Petroleum: support tools for the offshore petroleum industry in Norway
• CORD: Coordinated operation and maintenance offshore (Langli, 2001), Part Project 5
• OLF ORA: OLF project on Operational Risk Assessment
• RNNS: Risk Level on the Norwegian Continental Shelf. NPD project. Se section 1.5.4
• SINTEF/NPD: SINTEF project financed by NPD on modelling of barriers

• Multi national: PRIMA_EU (“a Program for RIsk MAnagement in Europe”), see Momal (2002)
There are also various initiatives and internal projects being conducted within the industry, in order to
develop schemes for barrier performance monitoring.
1.4 Objectives
The Norwegian Government has initiated a research program to improve the safety level offshore. The
program is led by the Norwegian Research Council and a network of Norwegian institutions has been
established in order to realise the program. The ambition is to obtain more adequate tools for risk assessment
and support for decision-making, in general and for the operational phases in particular. The present work is
a part of this program.
The purpose of the paper is to propose a structured approach to definition of suitable risk indicators for
major hazards, based on a brief review of current usage, development plans and experience from existing
projects.
1.5 Terminology
1.5.1 Risk Dimensions
There are three main dimensions of risk according to Norwegian regulatory requirements, which has the
following main elements:
• Risk to personnel
o Occupational accidents
o Major accidents
o Occupational diseases
• Risk to environment
o Accidental spill
o Continuous release
• Risk to assets and production/transportation capacity
o Accidental disruption
Unplanned and planned maintenance are also contributions to disruption of production and transport. These
contributions are normally considered within regularity analysis. Regularity analysis may be considered as
part of risk assessment, if a wide interpretation of the term is used, but may be more efficiently considered a
separate analysis.
The main focus in the paper is risk to personnel, in particular major hazard risk.
1.5.2 Proposed Terminology for Barriers

The new Norwegian regulations for offshore installations and operations make extensive references to the
term ‘barriers’. This term is not defined, but comments given in the regulations (NPD, 2001a) imply that
barriers are actions that are intended to reduce the probability that faults or hazards develop into accidents or
to limit or reduce injury, damage and other unwanted effects.
ISO Standard 17776 defines barrier as follows:
‘measure which reduces the probability of realising a hazard’s potential for harm and of reducing its
consequence. Barriers may be physical, (materials, protective devices, shields, segregation, etc.) or
non-physical (procedures, inspection, training, drills)’
This implies that NPD has adopted the ISO definition. This definition is wide and general, and includes a
wide range of actions which may be considered a barrier. More precise or limited definitions have been
searched for by several specialists.
Another application of the barrier concept is in relation to MTO analysis of accidents and incidents in the
offshore petroleum sector (Bento, 1999). The term ‘barrier’ is in this application given a wide definition, in
line with the ISO definition.
The following definitions are proposed as more precise definitions of barrier related expressions, within the
general definition adopted from ISO 17776. These definitions are proposed in the context of the present
paper, for use in relation to barriers for major hazards and indicators in relation to such risk elements. The
term ‘major hazard barrier’ has been proposed in order to give a more precise definition of the wide term
‘barrier’:
Major hazard barrier ‘Line of defence’ relating to overall functions, as explained below.
Barrier element Part of barrier, but not sufficient alone in order to achieve the required
overall function, as explained below.
[Barrier performance] Influen- Factors that influence the performance of barriers.
cing factor
The NPD management regulations (NPD, 2001a) makes a distinction between physical barrier [elements]
and non-physical barrier [elements]. The former are the ‘hardware’ systems, whereas the latter are
organisational, procedural or human elements.
The influencing factors are particularly important for non-physical barriers.
Barriers may be regarded as ‘lines of defence’, as illustrated in Figure 1 below.
Figure 1 Illustration of ’lines of defence’ principle
Each of these levels will consist of several barrier elements, for instance (but not limited to) the following
for the ignition prevention barrier:
• Automatic gas detection

• Manual gas detection
• Shutdown logic
• Procedures intended to limit open flame exposure
• Area classification rules affecting protection of electrical equipment
[Barrier performance] Influencing factors are factors that influence the performance of barriers. These are
particularly important for non-physical barrier elements.
Consider as an example the manual gas detection performed by personnel performing manual inspection in
the process areas. Factors that will influence the ability of such personnel to detect possible gas leaks are as
follows:
• Procedures for manual inspections

• Organisation of work, work patterns
• Training of process operators
• Experience of process operators
• Motivation of process operators
• etc.
Indicators may be defined for each of these factors, see discussion in Section 7.1.
Please note that what we here consider as influencing factors will often be considered as ‘barriers’ according
to the ISO or NPD definition as stated above.
1.5.3 Terminology for Indicators

This section proposes a structured terminology for indicators.
Risk indicator: A measurable quantity which provides information about risk
Risk indicator related to activity: A measurable quantity related to execution of defined operational
activities, which provides information about risk
Risk indicator based on barrier A measurable quantity related to barrier performance, which provides
performance: information about risk
Risk indicator related to incidents: A measurable quantity related to occurrences of accidents, incidents
and near-misses, which provides information about risk
Risk indicator related to causal A measurable quantity related to causal factors for barrier perfor-
factors: mance, which provides information about risk
Risk indicator related to safety A measurable quantity related to safety climate/culture and its
culture: influence on the performance of barriers, which provides information
about risk
Proactive (leading) risk indicator: A measurable quantity which provides information about risk,
explicitly addressing an aspect of future performance (example;
anticipated number of hot work hours next year)
Reactive (lagging) risk indicator: A measurable quantity based on outcomes of accidents and incidents
It may be discussed whether ‘causal factors’ and ‘influencing factors’ are synonymous expressions, and to
some extent they are. It may be argued that ‘influencing factors’ is a wider term than ‘causal factors’, but
little emphasis is placed on this.
Sometimes the term ‘safety indicator’ is used in stead of or in addition to the term ‘risk indicator’. We use
these terms as synonymous terms in this paper, meaning that safety indicator is a measurable quantity which
provides information about safety. Both the terms safety and risk are used in a wide sense and for the
purpose of this paper we have not distinguished between them. The term ‘risk indicator’ is used throughout
the paper.
1.5.4 Abbreviations
The following abbreviations are used in the paper:
HSE Health and Safety Executive

HES Health, Environment and Safety
ISRS International Safety Rating System
KPI Key Performance Indicator
LTI Lost Time Injury
NPD Norwegian Petroleum Directorate
PFEER Prevention of Fire and Explosion, and Emergency Response
QRA Quantified Risk Assessment
RNNS Risk level on the Norwegian Continental Shelf (“Risikonivå norsk sokkel”)
TTS Technical condition of safety systems (“Teknisk Tilstand Sikkerhet”)
2. Overview of Current Practice
2.1 Occupational Hazards

The traditional approach to monitoring in the offshore petroleum industry has been based on different
indicators based on occurrence of injury to personnel, see Kjellén (2000). The following are the most
commonly used indicators:
• H-value: Number of injuries with absence per 1 million exposure hours

• H2-value: Number of injuries per 1 million exposure hours (excluding first aid cases)
Husebø et.al (2002) presents trends in H2-values for the entire Norwegian Continental Shelf, in the period
1990-2001.
There may also be other measures as described by Kjellén (2000), but the H and H2 values are by far the
most commonly used indicators.
2.2 Cultural Aspects, Management System

There are a number of alternative indicators that have been proposed and used for monitoring of
management systems and cultural aspects of safety (cf. Kjellén, 2000):
• International Safety Rating System, ISRS

• Tripod Delta
• Sustainability index (the Learning lab, 2002)
There are in addition a number of questionnaire surveys, interview schemes, etc that have been employed in
order to assess management systems and cultural factors, see Kjellén (2000).
2.3 Major Hazards

There have been a few projects in the industry and research projects that have addressed major hazard
indicators for the offshore petroleum industry:
• TotalFinaElf’s major hazard indicator, 1997-present, (Vinnem, 2000)

• Statoil TTS-project on technical barrier status, 2000-present (Thomassen and Sørum, 2002)
• ‘Indicator project’, research project, 1994-2000 (Øien and Sklet, 2001a)
• Norsk Hydro's KPI project, 2001-present (Øien, 2002)
TotalFinaElf’s major hazard indicator for the Frigg field production complex has been in operation since
1997, and includes 12 individual indicators for technical safety systems and organisational factors for
emergency preparedness. There is in addition an overall indicator which summarises weighted contributions
from the individual indicators.
The Statoil TTS-project has assessed status for technical barriers on offshore installations and onshore
facilities, based on 19 performance indicators per installation. Integrity, effectiveness and robustness are
considered and an overall evaluation of the individual performance indicators is provided.
The [research project] ‘Indicator project’, performed by SINTEF on behalf of NPD covered technical as
well as organisational indicators. The first phase of this project focused on technical (QRA-based) risk
indicators. A set of nine individual indicators was proposed for one specific installation (Øien et al., 1995),
and a second set of nine individual indicators (some being different from the first set) was proposed for
another installation (Øien and Sklet, 1999).
The second phase of the ‘indicator project’ focused on organisational risk indicators as a supplement to the
QRA-based indicators (in those instances where the latter indicators are judged inappropriate due to, e.g.,
few events). Organisational risk indicators covering five organisational factors important to the containment
barrier were proposed for one specific installation (Øien and Sklet, 2001b).
The objective of Hydro’s KPI project is to develop a technical safety indicator and provide a system to
document and follow up the development of the process safety condition during the lifetime of plants, and
provides a management tool to ensure continuous focus. The technical safety indicator, denoted T value,
will be a key performance indicator for technical safety corresponding to the H value for occupational
hazards. This overall indicator consists of four types of indicators; barrier test indicators, inspection
indicators, activity indicators and event indicators. At present 13 individual indicators are proposed used for
a pilot plant (Øien, 2002).
3. Risk indicators, Objectives and Requirements
3.1 Context for Use of Indicators

Management of Health, Environment and Safety (HES) has the following elements (cf. Kjellén, 2000):
• Establishing policies, goals and requirements

• Planning and implementation
• Organisation and responsibilities
• Control and verification
• Corrective actions
• Experience transfer
The management of HES is often described as a control loop (see illustration in Figure 2), with the elements
as mentioned above. Use of indicators has an important role in the control loop, in order to provide basis for
control and verification, identify the need for corrective actions and basis for experience transfer.
Objectives,
requirements,
criteria
Risk & Emergency

preparedness
analysis
Monitoring of
effect
Identification of
measures and their
effect
Implementation of
measures
Figure 2 HES management control loop
Use of risk indicators is one element of the ‘monitoring of effect’ box in Figure 2. It should be noted though
that separate elements are devoted to requirements, analyses, etc. implying that the scope of use of risk
indicators is limited to monitoring.
3.2 Overall Objectives of Use of Risk Indicators

The main purpose of using risk indicators is to enable an effective and proactive HES management of the
systems and operations being considered. Measurement of safety performance is necessary for many reasons
(based on Tarrants, 1980):
• As a basis for causal factor detection

• To identify problem areas
• As a basis for trend analysis

• As a basis for evaluation of risk of injury and other losses
• To describe the safety status of an organization
• As a basis for predicting future accident exposure
• As a basis for evaluating accident prevention program effectiveness
• As a basis for making decisions regarding the allocation of accident prevention resources
• To establish long-term risk management strategies
• To fulfil authority requirements
These objectives are general, and apply to all types of risk indicators. This paper has however, its main
focus on major hazard risk, and the following additional aspects may be considered in this context.
One aspect is special about management of major hazard aspects, namely the need to maintain a continuous
high attention level, often in spite of many years of operation without accidents or near-misses. It is quite
common that motivation and attention may be somewhat degraded over the years, when an installation has
been operated without serious events for a long time.
3.3 Requirements to the Use of Risk Indicators

3.3.1 HES related Requirements
The overall objectives may be broken down into specific requirements. The following may be stated for
definition of the required sets of performance indicators, for all types of accidents:
• The total set of indicators should address a range of incidents, from the insignificant near-misses up to
the most severe and complex accident sequences.
• If very different hazards are studied, an incident based indicator reflecting the potential for major acci-
dents should be considered, alongside with individual indicators.
• Indicators such that they are discussed in this paper should primarily reflect aspects that are possible to
influence from an operational point of view, although some indicators may not satisfy this requirement,
but still be useful.
• Such indicators that are considered as intuitively important for personnel with practical operational/HES
experience, should ideally be given priority. One should try to avoid indicators for aspects that are
considered to have little or no practical relevance.
• Indicators should give opportunities for risk reduction potentials that reflect physical accident mecha-
nisms or causes which may be related to physical or non-physical aspects, as opposed to synthetic,
simplified or artificial modelling parameters. Volume density of process equipment may illustrate such
an artificial modelling parameter. Volume density is used as a parameter in escalation modelling.
Volume density would be a rather useless risk indicator, as it is purely a synthetic modelling parameter,
which is not considered in design or operation [although there are aspects considered that implicitly
have influence on the density].
The suitability of indicators is also dependent on which level the indicator is used for. This may also be
related to the so-called "free variables", i.e. quantities that are possible to change.
As an example, let us consider the activity risk indicator, the number of days with a certain [hazardous]
activity, such as drilling. Clearly this indicator provides interesting information about risk, and consequently
is a useful indicator, but it can be discussed to what extent it is related to a free variable. On the national
level, the extent (or volume) of drilling activity may be considered a 'free variable', in relation to which
regions or fields to be developed, whereas it is not at the same degree a free variable on the installation level
as this activity in practice must be done, given the frame conditions for the activity on this installation.
On the installation level, more detailed indicators need to be added, to establish a proper set of indicators,
and in order to reflect aspects that may be influenced through operational decisions. Such indicators include
the type of drilling of well intervention activity, the number of effective barriers, porosity of the formation,
the weight margin of the drilling fluid, etc.
Another aspect is related to whether to express annual values, or accumulated over the field lifetime. This is
a general problem, but can be illustrated with reference to drilling. If a certain number of wells is needed in
order to develop or maintain production, it will usually not imply overall reduced risk even if the drilling
activities is spread out over several years, as opposed to completing the program in just one year.
One solution for this and similar cases is that the indicator reflects some kind of accumulated values. The
disadvantage of such a solution will be a more complicated indicator, which will need to be considered over
several years before conclusions may be drawn.
3.3.2 Formal Requirements

There are a set of formal requirements that indicators should satisfy, in addition to the requirements relating
to HES management as outlined in Section 3.3.1 above. The indicators should satisfy the following formal
requirements, and thus be (cf. Aven, 2003, Kjellén, 2000):
• observable and quantifiable

• sensitive to change
• transparent and easily understood
• robust against manipulation
• valid
It must be possible to observe and measure performance by applying a recognized data collection method
and scale of measurement. Usually, the indicators are expressed on a ration scale of measurement, such as
the Lost Time Injury (LTI) rate which expresses the number of injuries resulting in absence from work per
one million hours of work. It is difficult to establish a data collection method that gives reliable data, i.e. the
data corresponds to the quantity we would like to observe. For example, measuring the true number of LTIs
is in practice often difficult. Recording of the events may be poor, and the data may be contaminated by
extraneous factors such as rumours and direct manipulation.
Psychological and organizational reasons could in many cases result in a too low reporting. An example, we
may think of an organizational incentive structure where absence of injuries is rewarded. Then we may
experience that some injuries are not reported as the incentive structure is interpreted as “absence of
reported injuries”.
A risk indicator must be sensitive to change. It must allow for early warning by capturing changes in an
socio-technical system that have significant effects on accident risks. Clearly, the number of accidents
leading to fatalities would not normally be sufficiently sensitive to change. The LTI rate is more sensitive,
but also this indicator could be considered to be too insensitive for changes.
The "good" set of indicators will reflect changes in risk as well as point to aspects where improvements
should be sought. In theory a good indicator for the operational phase may be totally insensitive to aspects
that are fixed in operation, thus the reflection of risk on these aspects are irrelevant.
The risk indicator must be transparent and easily understood, in that its meaning is apparent and compatible
with the user’s theoretical understanding and unconscious mental models. Some indicators have been based
on indirect observations of causal factors and complex mathematical manipulation in order to estimate risk
levels. This should be avoided, as it completely prohibits transparency.
The risk indicators must also be robust against manipulation. The point is that the indicator should not allow
the organisation to “look good” by for example changing reporting behaviour, rather than making the
necessary basic changes that reduce accident risk.
This leads us to the requirement of validity, which is a critical point in the evaluation of the goodness of an
indicator. Is the indicator a valid indicator for the accident risk? Does the indicator actually measure what
we intend to measure? Consider for example the indicator defined by the number of lost time injuries.
Clearly, this indicator say something about accident risk, but of course, the accident risk is more than the
number of lost time injuries, so we cannot use just this indicator to conclude on development in the accident
risk level as a whole. The validity of a statement concerning the accident risk based on observations of the
injury rate only, would thus in most cases be low. But restricting attention to this specific type of injuries,
there should be no validity problem, in this respect. But still we have problem in concluding on any
development in the injury risk based on the observations from the indicator. Say that we have observed the
following data for the last six years;
1, 2, 1, 3, 3, 5.
We assume that the number of working hours is constant for the time period considered. What do these data
say about the injury risk? Well, risk relates to the future, so the question is then how relevant these data are
for the future activity. If we judge the data as relevant, we can use the data to express risk and if much data
are available, the uncertainties in future predictions of the number of injuries would be small. For the case
above, it is however not so straightforward to perform the predictions. There seems to be an increase in the
number of injuries, but is this increase "strong" or "real", in other words do the data show a trend? To decide
on this, different approaches can be used, some type of statistical testing or more ad hoc procedures. The
point here is to ensure that there is a reasonable rule identifying when a trend is present. For the above
example, would a statement concluding that the data show a trend be valid. Well, that depends on the
procedure being used. Using traditional statistical testing, such a statement would clearly have low validity
as no test would support such a hypothesis, the amount of data is too little, cf. Aven (2003), Section 2.1.
3.4 Use of Major Hazard Indicators at different Levels

The following levels are discussed below:
• National level
• Company/Installation level
• Equipment level
One aspect which is valid on all levels is the need to address variations between the best and the worst units
in addition to average levels.
It should also be noted that development of indicators on a higher level, may in theory be done by
aggregating from a lower level. This is in practice seldom so simple, because other indicators may be more
relevant on a higher level than just summing up from a lower level.
3.4.1 Use on a National Level

Indicators may be used on a national level for all dimensions of risk as shown in Section 1.5.1. This section
is limited to a discussion of indicators for major hazard risk.
Risk indicators for major hazard risk on a national level may be used for:
• Identification of status and trends

• Identification of typical causes of increased risk
• Establishing prioritised improvement areas
Status and trends will apply to all facilities and operations in that nation’s regulatory system. Similarly,
typical causes as well as improvement areas apply to all installations and operations. This is important for
authorities as well as the industry as a whole.
On a national level it will usually be need to apply a combination of individual indicators and overall
indicators which reflect the importance of various individual indicators i.e., individual indicators and
aggregated/overall indicators/indexes.
An example of assessment of individual as well as overall indicators for the national level is shown in
Husebø et al (2002). Not only major hazard is addressed, but also occupational injury risk and occupational
diseases, in addition to cultural aspects and perceived risk. Other examples are discussed in Vinnem et al
(2002).
3.4.2 Use on a Company/Installation Level

Indicators may be used on a company and/or installation level for all dimensions of risk as shown in Section
1.5.1. The discussion in this section is limited to a discussion of indicators for major hazard risk. Sometimes
a company operates one installation, then company and installation level are synonymous contexts. More
often however, a company operates several installations.
Areas for use of risk indicators for major hazard risk on a company and/or installation level are the same as
for the national level:
• Identification of status and trends

• Identification of relevant causes of increased risk
Status and trends will apply to all facilities and operations in the company’s sphere of responsibility.
Similarly, typical causes as well as improvement areas apply to all installations and operations. It may also
be required to analyse installations (or groups of installations) separately, if there are significant differences
(which are not rare).
On the company/installation level it will usually be needed, similarly as for the national level, to apply a
combination of individual indicators and overall indicators which reflect the importance of various
individual indicators.
Experience with use of indicators on the company/installation level is discussed in Vinnem (2000), which
discusses the following aspects:
• Experience with use of indicators

• Challenges for effective use
One of the aspects discussed is the difference between technical systems and organisational actions, and the
need for continuous attention and motivation.
3.4.3 Use on a Equipment Level

Indicators may be used on an equipment level for all dimensions of risk as shown in Section 1.5.1, provided
that the equipment has relevance for the different dimensions of risk.
Risk indicators for major hazard risk on an equipment level may be used for:
• Identification of status
• Identification of trends, (in relation to rules for trend identification, see Section 3.3.2)
• Identification of relevant causes of increased risk
Status and trends will apply to the relevant equipment, but will be dependent on whether significant trends
may be established or not. Also relevant causes and improvement areas may be identified. Indicators for
safety critical equipment belong in this category.
4. Basic approach – Indicators for Major Hazards

4.1 Classification of Indicators
There are various ways to classify indicators, two classification schemes that are discussed in this paper, are
the following:
• Classification of indicators reflecting how the data is collected

• Classification of indicators reflecting steps in the ‘accident chain’
The classification of indicators based on how the data is collected is in line with Kjellén (2000), and
consists of the following:
• Loss based indicators

• Process based indicators
• Indicators based on causal factors (including indicators related to safety ‘climate’)
Only for quite frequent occurrences may indicators be based on recording of actual losses, otherwise will
indicators for risk have to be based on process parameters or causal factors.
Base on discussion in the previous sections, the following types of indicators are required for major hazards:
• Incident indicator
• Barrier indicator
• Activity indicator
• Indicators related to causal factors (including indicators related to safety ‘climate’)
The relationship of different indicators coupled with modelling of barriers and incidents in accident
sequences is presented in Figure 3. All of these indicators are as the diagram shows, applicable at different
stages of the accident chains.
Barrier indicators
Indicators rel to causal factors
Incident indicators
Activity indicators
Figure 3 Loss indicators in relation to accident sequences
Incident indicators are based on occurrence of accidents, incidents and near-misses, and are as such reactive
indicators. This type of indicator is nevertheless needed, as they give important information of what has
occurred in the past. Indicators based on occurrence of accidents are loss related indicators, whereas
indicators based on near-misses and similar are process related indicators.
Barrier indicators are used in order to demonstrate status and trend of barriers, many of which are ‘dormant’,
in the sense that they are only called for once several other barriers have failed. The majority of the
experience data will be from tests, inspections, actions due to false alarms, etc. This type of indicators may
be called partly reactive, partly proactive.
Activity indicators are almost entirely proactive indicators, which are required in order to manage actively
planning of activities on the installations and thereby minimise major hazard risk. Activity indicators have
not been utilised to any significant extent so far, but shall reflect major hazard risk due to execution of
defined operational activities on the installations.
Indicators related to causal factors are a separate category by both classifications. This category will
naturally include safety ‘climate’ indicators.
4.2 Use of Indicators in Practice

The following principles are used as basis for development of risk indicators for major hazards:
• The main perspective is to provide tools for expressing quantities which provide information about
future risk exposure, with basis in current status and past performance, in order to provide input to
decision-making.
• Risk indicators should have the main emphasis on illustrating effect on risk of variable parameters.
• A mix of proactive and reactive indicators may be required in order to give a comprehensive presen-
tation of risk levels
The results from risk analysis may be used to give weights to different risk indicators, and such use is
valuable. It is on the other hand not recommended to use risk indicators in a ‘mechanistic’ updating of
overall risk levels. Indicators, usually based on observations, will have to be combined with adjustments and
evaluations, if an evaluation of the risk level shall be produced. If this is done in a justifiable manner, then
risk indicators may be used for updating overall estimations of risk levels.
The risk assessment results may also be used for identification of and setting of priorities for different risk
mechanisms, based on their contribution to total risk. The risk assessment results may also be used for
giving different weights to the different contributions, if they are being added up to some kind of total value.
Different indicators may be required in order to illustrate all relevant aspects of risk, relating to:
• Occurrence of incidents and near-misses.

• Performance of barriers
• Activity levels relating to performance of hazardous activities and/or simultaneous activities
• Development in causal factors affecting the performance of barriers.
4.3 Accidents, Incidents and near-misses

Loss based indicators will imply indicators reflecting occurrence of accidents. This requires as mentioned
above, that the volume of accidents is sufficiently high for the extent of installations and operations being
considered, in order to establish an indicator based on such events. This will usually be the case, if at all, for
only some kind of hazards, for instance occupational injuries.
But even if the number of occupational injuries may be substantial, it will rarely be sufficient accident data
to establish an indicator for fatality risk due to occupational hazards.
Indicators based on incidents and near-misses (process related indicators) are therefore required.
All these indicators are based on actual occurrences, where the valuable information will be much more than
just the number of occurrences. Actual cases may also give very valuable qualitative information about
mechanisms, causal factors, etc.
The indicators based on accidents, incidents and near-misses may be weighted and normalised as follows:
• Weighted Rating of types or categories of events according to severity, thereby implying

that weighted indicators may be combined in order to create overall indicators
of different kinds.
• Normalised Rating of indicators in relation to volume of exposure measured according to a
relevant parameter reflecting the type of risk exposure.
4.4 Barrier Performance

Indicators that are reflecting barrier performance (in a wide sense) belong in the category ‘process related
indicators’, together with indicators based on occurrence of incidents and near-misses as well as activity
indicators. The performance should cover the following barriers:
• Physical barriers
• Non-physical barriers (organisational, administrative, procedural, etc)
The performance should in general cover a wide range of capabilities (cf. NPD, 2001b):
• Functionality and effectiveness

• Reliability and availability
• Robustness (antonym to vulnerability)
In certain circumstances incident indicators and indicators related to barrier performance may be combined
into an overall indicator (see further discussion in Sections 5 and 6).
4.5 Activity Level

A review of hydrocarbon leaks on the Norwegian Continental Shelf in 2001 and 2002 has revealed (Husebø
et al., 2003) that less than one third of the leaks occur during normal operations, whereas a dominating
majority occurs when special operations are being carried out, such as maintenance, inspection, manual
intervention, trips etc. This situation emphasises the need to develop risk indicators that reflect major hazard
risk as a function of the activities being carried out.
Activity indicators have not been used to any significant extent so far, and are the subject of a separate study
(Veire, 2002). Activity indicators are almost entirely proactive indicators.
The basis for development of activity indicators has not yet been developed extensively. The basis will have
to reflect risk exposure due to:
• Performance of single activities, and/or

• Performance of simultaneous activities, and/or
• Absence of completed maintenance activities on safety critical equipment according to plan (i.e. no
back-log).
Activity indicators may be used in order to estimate the expected risk exposure according to activity plans
and combinations, and also for optimisation of operational plans.
4.6 Causal Factors

Indicators for causal factors may cover a wide range of aspects, relating to causes of incidents and near-
misses, as well as failure of physical barriers (technical safety systems) and non-physical barriers (human,
administrative and organisational functions).
One example of causal factors behind occurrence of incidents can be the split of ongoing operations at the
time of occurrence of hydrocarbon leaks, as referred to in Section 4.5. Other examples may include records
showing the percentage of personnel having participated in vital safety training or safety motivation courses
or campaigns.
To establish accurate models of how causal factors relate to possible accidents and losses, is difficult - the
uncertainties are very large. Extensive R& D efforts are required to obtain models with sufficient credibility.
Data directly supporting the models will seldom be present, and extensive assumptions need to be made to
establish the models. Nonetheless, such models may be useful to get insights - what are the critical factors
and how do different factors correlate? - and study the impacts on risk of various theories and hypotheses
related to the importance of causal factors. The models should be seen as instruments for structuring
knowledge and uncertainties, more than accurate tools for prediction.
Indicators relating to causal factors may actually be important as basis for preventing reoccurrence of
incidents and near-misses. Reflection of causal factors is one of the weak aspects of quantified risk assess-
ment, and this is one area where indicators may contribute significantly. The indicators relating to causal
factors should primarily be used individually and separately.
4.7 Management System

Management system factors may in principle be considered as causal factors, and be treated in the same
manner. Management system factors are factors that have influence on the performance of barriers, and as
such are important factors. The typical factors that are considered in this context are:
• Procedures
• Training, competence
• Backlogs
• etc
It may be asked whether management system factors also influence incidents and activities. They do of
course, but through influence on management system barriers intended to prevent occurrence of incidents
and hazardous activities. This is in line with the general definition of barriers stated in Section 1.5.2.
4.8 Cultural Aspects

Also cultural aspects are factors that may be considered as causal factors, and be treated in the same manner.
Cultural aspects have influence on the performance of barriers, and are as such important factors.
Cultural aspects also influence occurrence of incidents and performance of activities, but as stated above
through influence on barriers intended to prevent occurrence of incidents and hazardous activities. This is in
line with how MTO analysis is performed, and the general definition of barriers stated in Section 1.5.2.
The typical factors that are considered in this context are:
• Attitudes
• Work practices
• Self checking
• Management involvement and commitment
• Employee involvement
• Motivation
• Communication
5. Loss Related Indicators
5.1 Recommended HES Indicators

HES indicators discussed in this subsection are exclusive of major hazards related indicators, the latter are
discussed in the following Subsection 5.2.
Loss related indicators may be used for some hazards and some activities, where there is sufficient volume
of data due to frequent occurrences. When this is the case, loss related indicators may be used to indicate
total risk levels for a certain dimension of risk.
The following loss based indicators are recommended, including suggestions for which level they should be
used:
• Occupational injuries (with and without lost time) and disease

o From national level down to individual installations
• Accidental spills, minor
o From national level down to company level
• Pollution from operational activities
o From national level down to individual installations
The current status of use of indicators for occupational diseases in Norwegian offshore activities is such that
loss based indicators are not suitable, because stable and reliable reporting schemes have not been fully
developed, see Husebø et al. (2002). This is based on NPD’s experience over several years, but is expected
to be a temporary condition, which will pass after a relatively short time.
5.2 Recommended Indicators for Major Hazards

Based on the principles stated in Section 5.1, the following loss based indicators are recommended for major
hazards, including suggestions for which level they should be used, as shown in Table 1. The limited
contents of the table reflects the fact that there are few loss related indicators that are relevant for major
hazards.
Table 1 Recommended combinations of loss related indicators and applicable levels
Hazard Level on which the indicators are used

National level Field/installation level Equipment level
Fires in non-process areas X
Collision with field related vessels X
There are thus very few hazards where major hazards related indicators based on actual loss may be used,
implying that indicators for most of the hazards have to be based on process related indicators, see Section
6.2. Indicators for these two hazards on a national level may be found in the NPD annual report for risk level
on the Norwegian Continental Shelf, see Husebø et al. (2002).
5.3 Recommended Use of Indicators for Major Hazards

Loss related indicators are straightforward to use, they give immediate indication of the actual risk level and
the associated trends. Since only two hazards are covered within the major hazards category, they should be
presented separately.
6. Process Related Indicators
6.1 Recommended HES Indicators

HES indicators that are briefly mentioned below are exclusive of major hazards related indicators, the latter
are discussed in the following Subsection 6.2.
Process related indicators should be used for hazards and activities that can not be assessed with use of loss
based indicators, see Section 5.2. This will include in the HES field:
• Accidental spills, moderate to major (blowout risk and similar)

o From national level down to company level

There are few loss based indicators that are possible for major hazards, as documented in Section 5.2. There
are therefore many indicators for major hazards that need to be based on modelling of losses. The list below
outlines the recommended indicators and on what levels they may be applied. Restrictions on which levels
that may be included are due to insufficient amount of data.
The recommended combinations of loss related indicators and levels where they should be used, is shown in
Table 2. The basis for the recommendations has been developed over several years in the NPD project on
risk levels, see Husebø et.al, (2003). The table is therefore considered to be complete and well justified.
Table 2 Recommended combinations of loss related indicators and applicable levels
Hazard Level on which the indicators are used

National level Field/installation level Equipment level
Hydrocarbon leaks from X X
process systems
Hydrocarbon leaks from X
risers and pipelines
Well kicks from unstable X X
wells
Fires in non-process areas X X X
Barriers for hydrocarbon X X X
leak hazard, for levels 2,
3 and 4 in Figure 1
Passing vessels on X X
collision course
Drifting objects/vessels X X
on collision course
Collision with field X
related vessels
Structural damage to X X
installations and
equipment
Helicopter transportation X X
risk
Barriers for all hazards, X X X
for level 5 in Figure 1

The process related indicators should primarily be used as individual indicators, because this provides the
most extensive information about risk aspects, causes of major hazards and basis for priorities for risk
reduction. But aggregation of individual indicators into overall indicators may also be useful, in order to
give insight into what are the most important contributions.
Individual indicators are reported extensively for the national level in the NPD annual report for risk level
on the Norwegian Continental Shelf, see Husebø et al. (2002).
The event based indicators in the list in Section 6.2 may be grouped into the following two categories as
shown below, reflecting the ability of installation personnel to influence the rate of occurrence of these
incidents:
• Hazards that may be influenced by performance of personnel on the installation

o Hydrocarbon leaks from process systems
o Hydrocarbon leaks from risers and pipelines
o Well kicks from unstable wells
o Fires in non-process areas
o Structural damage to installations and equipment
• External hazards beyond the influence of installation personnel
o Passing vessels on collision course
o Drifting objects/vessels on collision course
o Collision with field related vessels (may also be partly dependent on performance of personnel
on the installation)
o Helicopter transportation risk
An overall indicator [for a certain dimension of risk] may also be specified based on the individual
indicators. Each individual indicator should then be weighted according to the hazard potential. This has
been documented for the national level in the NPD annual report for risk level on the Norwegian Continental
Shelf, see Husebø et al (2002).
The example in the NPD report is limited to the national level. Events and barriers should not be integrated
into the same indicator on this level. Event and barrier indicators may only be integrated into an overall
indicator on the installation level, because barrier effect and performance is quite installation specific. If it
should be integrated with event indicators on a national level, both would have to be use as average values.
7. Indicators related to Causal Factors

Indicators relating to causal factors must be tailored to the actual hazard in question and its possible causes.
It has therefore been considered impossible to discuss potential causes for all HES related hazards in
general, and the discussion below is limited to major hazards.

Causal factors for major hazards are limited to performance of barriers for major hazards. Potential causes
for major hazards may be classified as:
• Technical
• Human performance
• Organisational
It may be considered that causal factors also influence incidents and activities. As described in Section 4.7
they also give such influence, but through influence on management system barriers intended to prevent
occurrence of incidents and hazardous activities. This is in line with the general definition of barriers stated
in Section 1.5.2.
A number of indicators may be defined for each of these categories. Indicators may also be defined for
influencing factors as explained in Section Feil! Fant ikke referansekilden..

The recommended use of indicators relating to major hazards is discussed in Section 4.6.
8. Conclusions and Recommendations

It is concluded that the following indicators are required for a comprehensive risk monitoring in relation to
major hazard risk:
• Incident indicator
• Barrier indicator
• Activity indicator
• Indicators related to causal factors, including indicators related to safety ‘climate’
There are few loss related indicators that are feasible for major hazards, only on the national level, as shown
in Section 5.2. For major hazard risk, most of the indicator will have to be of the process type (Section 6.2)
and causal indicators (Section 7.1).
The recommendations for use of loss related indicators, process related indicators and indicators relating to
causal factors are found in Sections 5.3, 6.3 and 7.2 respectively.
9. Acknowledgement
The authors are indebted to NFR for the funding of the work and their parent organisations for the
permissions to publish this paper. During the preparation of the paper, a large group of specialists has been
consulted at various stages, orally and in writing. We are obliged to all those that have provided comments,
for the time they have taken to review and provide very valuable input to the process.
10. References
Aven, T. 2003. How to approach risk and uncertainty to support decision-making. Wiley, N.Y. to appear.
Bento, J-P., 1999. Human – Technology – Organisation; MTO-analysis of event reports. OD-00-2. (In
Swedish). Restricted.
HSE. 1995. Prevention of fire and explosion and emergency response on offshore installations (PFEER)
Regulations 1995, (SI 1995/743)
Husebø et al, 2002. RNNS report 18.4.2002
Husebø et al, 2003. RNNS report April 2003 (to be published)
IEC, 1998/2000. Functional safety of electrical/electronic/programmable electronic safety related systems,

Edition 1.0
Kjellén, U., 2000. Prevention of Accidents Through Experience Feedback. Taylor & Francis, London and
New York..
Langli, G. 2001. CORD, Coordinated operation and maintenance offshore – research and development,
presentation at the Offshore Operations and Maintenance conference, 10-11 October, 2001
Momal, P. 2002. Risk Management in Europe, PRIMA_EU description, EDF, September, 2002
NPD, 2001a. Regulations relating to the management in the petroleum activities, (The management
regulations), stipulated 3.9.2001
NPD, 2001b. Guidelines to the management regulations, stipulated 3.9.2001
OLF, 2001. Recommended guidelines for the application of IEC61508 and IEC61511 in the petroleum
activities on the Norwegian continental shelf
Tarrants, W. E., 1980. The Measurement of Safety Performance. Garland STPM Press, New York.
The Learning lab, 2002. http://www.laeringslaben.no/index_english.php?side=2
Thomassen, O., Sørum, M. 2002. Mapping and monitoring the safety level, presented at SPE International
Conference on Health, Safety and Environment in Oil and Gas Exploration and Production, Kuala Lumpur,
20-22. March, 2002
Veire, G. 2002. Private communication.
Vinnem, J.E. 2000. Risk Monitoring for Major Hazards, SPE61283, SPE International Conference on
Health, Safety and the Environment in Oil and Gas Exploration and Production in Stavanger, Norway 26–28
June 2000.
Vinnem, J.E., Tveit, O.J., Aven, T. And Ravnås, E. 2002. Use of risk indicators to monitor trends in major
hazard risk on a national level, ESREL 2002, Lyon, France, March, 18-21, 2002
Øien, K. 2002. Private communication
Øien, K., Rosness, R., Sklet, S., 1995. Indicators for the surveillance of changes in the risk level on Ekofisk
2/4T. (In Norwegian, Confidential). SINTEF Report STF75 F95033, Trondheim: SINTEF Industrial
Management, Norway.
Øien, K., Sklet, S., 1999. Risk indicators for the surveillance of the risk level on Statfjord A. (In Norwegian.
Confidential). SINTEF Report STF38 F98435, Trondheim: SINTEF Industrial Management, Norway.
Øien, K., Sklet, S., 2001a. Risk Analyses during Operation (The Indicator Project) – Executive Summary.
SINTEF Report STF38 A01405, Trondheim: SINTEF Industrial Management, Norway.
Øien, K., Sklet, S., 2001b. Organisational risk indicators – Pilot study at Statfjord A. (In Norwegian.
Confidential). SINTEF Report STF38 F00421, Trondheim: SINTEF Industrial Management, Norway.

Risk Indicators For Major Hazards in The Offshore Petroleum Industry

Uploaded by

Copyright:

Available Formats

Risk Indicators For Major Hazards in The Offshore Petroleum Industry

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Risk Indicators For Major Hazards in The Offshore Petroleum Industry

Uploaded by

Copyright:

Available Formats

Risk indicators for major hazards in the offshore petroleum industry

(abbreviated version to be presented at ESREL 2003

(page left blank intentionally)

1.2 Legislative Requirements

“Section 7 Monitoring parameters and indicators

1.3 Overview of Current Projects

• NFR/HES R&D project financed by Norwegian authorities in order to develop decision

• SINTEF/NPD: SINTEF project financed by NPD on modelling of barriers

1.5.2 Proposed Terminology for Barriers

ISO Standard 17776 defines barrier as follows:

The influencing factors are particularly important for non-physical barriers.

Barriers may be regarded as ‘lines of defence’, as illustrated in Figure 1 below.

Figure 1 Illustration of ’lines of defence’ principle

• Automatic gas detection

• Procedures for manual inspections

1.5.3 Terminology for Indicators

Risk indicator: A measurable quantity which provides information about risk

HSE Health and Safety Executive

2. Overview of Current Practice

2.1 Occupational Hazards

• H-value: Number of injuries with absence per 1 million exposure hours

2.2 Cultural Aspects, Management System

• International Safety Rating System, ISRS

2.3 Major Hazards

• TotalFinaElf’s major hazard indicator, 1997-present, (Vinnem, 2000)

3. Risk indicators, Objectives and Requirements

3.1 Context for Use of Indicators

• Establishing policies, goals and requirements

Risk & Emergency

Figure 2 HES management control loop

3.2 Overall Objectives of Use of Risk Indicators

• As a basis for causal factor detection

• As a basis for trend analysis

3.3 Requirements to the Use of Risk Indicators

3.3.2 Formal Requirements

• observable and quantifiable

3.4 Use of Major Hazard Indicators at different Levels

3.4.1 Use on a National Level

• Identification of status and trends

3.4.2 Use on a Company/Installation Level

• Identification of status and trends

• Experience with use of indicators

3.4.3 Use on a Equipment Level

4. Basic approach – Indicators for Major Hazards

• Classification of indicators reflecting how the data is collected

• Loss based indicators

4.2 Use of Indicators in Practice

• Occurrence of incidents and near-misses.

4.3 Accidents, Incidents and near-misses

• Weighted Rating of types or categories of events according to severity, thereby implying

4.4 Barrier Performance

• Functionality and effectiveness

4.5 Activity Level

• Performance of single activities, and/or

4.6 Causal Factors

4.7 Management System

4.8 Cultural Aspects

The typical factors that are considered in this context are:

5. Loss Related Indicators