Tenets of Operational Excellence: Do It Safely or Don't Do It At All

Ram K Goyal,
Adviser - Risk Management and Leader - Central Reliability Engineering, Bahrain Petroleum Company, Kingdom of Bahrain,
Unpleasent incidents in chemical and petrochemical industry that lead to "massive financial loss and property damage and cause multiple fatalities" can be avoided if an organisation looks into the matter seriously. Ram K Goyal, Adviser - Risk Management and Leader - Central Reliability Engineering, Bahrain Petroleum Company, Kingdom of Bahrain, shares his perceptions on how can industry learn from past incidents and ensure industrial safety.

Do we really learn from past incidents? Well, the general public's perception is that we in the chemical, petrochemical, oil and gas industries mostly do not learn well from loss incidents of the past and that is why we keep having repeat incidents. In our region alone in the past decade we have had several major incidents that have resulted in massive financial loss and property damage and/or multiple fatalities in the oil and gas industries in Algeria, Kuwait, and Saudi Arabia.

We want to assure our readers that there definitely are some organisations and individuals who take this learning from incidents very seriously. We can draw useful lessons from not only major incidents that have caught the public and media eye, but also from smaller incidents that occur in one's industry. When an incident is reported in the media, everyone is naturally curious as to what has happened. But if we want to learn from the incident, we have to go beyond simple curiosity. There are some known hurdles in our ability to learn from other people's incidents. In order to learn lessons, we need to review the incident in depth. In analysing these incidents for the purpose of learning lessons for the future, there is no point in trying to blame a specific person or persons. 'Culpability' is applicable in cases of sabotage or other deliberate actions with malice aforethought. In accidents and incidents, it is better to concentrate on systemic or procedural failures or design deficiencies so that viable, effective, and long-term remedial measures can be proposed and implemented. The learning process is not easy. You need to have the will and ability to pay attention to detail. Bapco has recently adopted a unique tool called 'Tenets of Operational Excellence' which lists two over-riding principles: Do it safely or not at all, and There is always time to do it right.

All recorded incidents related to process plant, equipment, instrumentation, and environmental consequences are analysed at Bapco to identify which of the above ten tenets was most likely violated so as to cause the loss incident. This viewing of the historical records through the lens of tenets of operational excellence yields some very interesting results. On the basis of the results, the company is then able to direct resources that remedy the specific shortcomings identified through this analysis. The system provides a ready and usable means of assessing cost-effectiveness of remedial measures.

Looking at Company's Historical Data for Trends
Learning lessons from specific in-company incidents is no different from learning lessons from external incidents. However, in the case of our internal incidents, we can also look at historical trends since we have access to data pertaining to all incidents that occur in the company. An example set of data is shown in Figure 1.

If no other information was taken into consideration, then it can be surmised that there has been an increase in the total number of incidents recorded in the company. In fact, a trend analysis will show that the total number has more than doubled over the past nine years. Recording of personnel injury incidents, motor vehicle collision incidents, and fires had been carried out from very early days. Like most other companies in the region, Bapco had also adopted the recording guidelines issued by various ANSI standards(American National Standards Institute) in recording incidents .

In 1994, Bapco formally adopted the Process Safety Management (PSM) system following the 1992 legislation and guidelines issued by the US OSHA (Occupational Safety and Health Administration) as Code of Federal Register 1910.119. Under PSM, we began to centrally record many other types of incidents as well; for example:process-related incidents, equipment failure incidents, damage incidents, and so on. Initially, the notification and recording process was manual, and not all stakeholders had been fully trained in the notification system. In 2001, we adopted a commercially available database system to capture all information related to incidents; the software package was primarily used as an integrated reliability management tool, and recording of all loss incidents in that system made good sense from a data analysis standpoint. Equipment or property-damage -related incidents could be linked to the plant and asset register already maintained in the system as a part of the reliability trend analysis module. As with all other systems, initially there was some reluctance on the part of incident notifiers to record all incidents. However, a major campaign was launched in 2004 highlighting the benefits of learning from past incidents, and gradually reporting improved. Also, in 2007, incident notifications from other parts of the company (namely Marketing and Oil and Gas Production) were added to the system. These are the reasons for the increase in the total number of incidents on record.

Recording of incidents in a computer database afforded easy access and the ability to conduct data analysis and identify trends.

An example is shown in Figure 2 where a trend in the data related to 'Environmental' incidents has been identified. Under the ISO14001 certification process, a major campaign was launched in 2006 in enhancing environmental awareness in the company. This effort has continued.

The fruits of that awareness campaign are reflected in the downward trend in the number of environmental incidents occurring in the company. The number of leak/spill incidents has reduced drastically; the number of other environmental excursions has also gone down significantly. Similar types of trend analyses can be performed on data recorded in other categories such as electrical incidents, fires, personnel injury, occupational illness cases , and others.

There has been a very significant increase in the number of records categorised as 'process-related' incidents. This rising trend is depicted in Figure 3. It was a cause for serious concern, and a detailed review was performed of all incidents recorded in this category.

There were several clearly identifiable reasons for this increase. The two most prominent were: (1) Due to some unclear guidelines in the PSM standard the number of ESD-related trips (instrumented emergency shutdown systems) were not being reported during the earlier years; this situation was remedied in 2006, and (2) In 2007, several new process plants came on line (eg, the Low Sulfur Diesel Production Complex in the refinery) and as these were going through their initial phases of production, the expected number of process-related incidents was high. This is expected to come down to normal rates after the first turnaround cycle.

Nonetheless, the company recognised the need to actively arrest and reverse the increment in the number of incidents, especially those related to equipment or property and process-related incidents. It was decided to spearhead this effort as a part of the company's adoption of a formal Operational Excellence Management System (OEMS). One of the key elements of OEMS is a set of Tenets of Operational Excellence (as listed in the Abstract ) which is seen as the primary driver to achieve an incident-free environment in the company.

Looking at company's incidents through OE Tenets
All incidents recorded since 2005 were reviewed by a group of reliability specialists from Bapco's Risk and Reliability Management group and each incident was assigned a single OE Tenet violation deemed to be the most significant causal factor. The raw results are summarised in Table 1.

With the above analysis, it became quite clear that violations of Tenets 2, 4, 8, 6, and 1 were dominating the incident causes during this period (2005 -2009). This is illustrated in Figure 4.

Once it was established which tenets were being more frequently violated, it was possible to recommend corrective action that could specifically address the identified shortcoming.

Lessons from some historical incidents
We can learn valuable lessons from incidents that have happened in the process industry (including oil & gas, petrochemicals, chemicals onshore and offshore installations). These incidents created a great deal of public interest at the time of their occurrence; some are etched forever in the memories of people affected by them, and all of them have gone into the history books of safety, loss prevention, or allied subjects. In examining these, one should not delve unnecessarily in any controversial issues of culpability or partisan agenda. The purpose must be to merely extract pertinent lessons so as to prevent or minimise chances of occurrence in your own organisation.

The Feyzin LPG BLEVE (Boiling Liquid Expanding Vapor Explosion) incident resulting in 18 fatalities occurred back in 1966 in a French refinery where the operator was unable to close a drain valve due to the valve freezing open. This incident triggered our pursuit for a greater understanding of the risks associated with bulk storage of LPG.

The phenomenon called 'BLEVE' had not really been well understood prior to Feyzin. There was a fundamental error in thinking that a relief valve on an LPG sphere, designed and sized for the 'external fire' contingency, was sufficient to provide protection regardless of the overall fire exposure duration. It was not clearly recognised at the time that LPG would generate a ground-hugging pancake-shaped vapor cloud that could drift over larger distances and find a source of ignition. The significant hazards associated with the sphere dewatering procedure were not recognised. It is a pity that even with the lessons drawn from Feyzin, vessel BLEVEs caused the heavy losses suffered in November 1984 at the LPG terminal belonging to PEMEX (the national oil company of Mexico) - over 500 people were killed in that accident!

The Flixborough incident forced the researchers into recognising the reality of the 'unconfined' vapor cloud explosion. Prior to this incident, an UVCE was considered somewhat of a theoretical possibility - Flixborough changed that overnight. The UK Government had promulgated 'The Health and Safety at Work Act' in that year (1974), and this incident brought home in a shocking way the need for employers to be proactive when dealing with the health and safety of their work forces. Another major lesson from this incident was that changes and modifications to plant and equipment, whether temporary or permanent, must be 'managed' in a thorough and systematic manner.

The Seveso incident was the primary motivator in the EEC's adoption of the Seveso Directive that enshrines into law the public's right to know about the hazards posed by the plants and industrial installations in their midst .

Bhopal, and its aftermath, will remain a black mark in the history of our industry. Management that was so single-mindedly driven by short-term profit maximisation and cost-cutting with no regard to safety - how else could one justify the switching off of the refrigeration unit of the tank to save a few rupees - has no business running our industry.

Piper Alpha taught us that adherence to the work permit system must be ensured at all times and every time. The UK Government passed extensive legislation related to safety at offshore installations following the Piper Alpha disaster. The incident was very thoroughly investigated by a royal commission headed by Lord Cullen. His report provides excellent details and a careful analysis of the root causes of this incident.

The Houston Phillips explosion (1989) acted as the wake-up call for the American Petroleum Institute (API) which, soon after the incident, issued its recommended practice RP-750 (1990) detailing the process safety management system that had been originally conceived and popularised by the Center for Chemical Process Safety of the American Institute of Chemical Engineers (c. 1985, immediately post-Bhopal). Not only the API, but the US government bodies had to respond, which they did in the form of Federal Register OSHA 1910.119 (Process Safety Management) in February 1992.

The BP Texas City incident highlights the need to eliminate all on-plot relieving vents in favor of properly designed flare systems. We must make sure that when we permit 'oil-in' during the start-up of a unit after a turnaround and inspection phase, there are no personnel present on site who are not directly involved in the unit startup. Furthermore, we must make sure our senior management clearly understands the difference between 'personnel safety' and 'process safety.' Risks to process plants, especially pipelines, from vandals and saboteurs have become a serious cause for concern over the past decade. Transportation of crude and products via pipelines in many parts of the world was seen as the most cost-effective option - for example: lines from the Russian Federation to Europe, Nigeria, Angola, South Africa, and neighboring countries, and Southern Iraq; and routing from Oman to India, and Iran to India; and a host of other proposals .

In general, the history of incidents teaches us that in the field of loss prevention in the process industry, there are a few key features related to layout and design which tend to enhance the intrinsic safety of a plant. For example:
  • Proper spacing (between equipment/units)
  • Proper size (pipe/vessel size/wall thickness, etc.)
  • Proper steel (correct metallurgy)
These features, when incorporated into the layout and design of a refinery or process plant, provide a significant degree of safety by mitigating the consequences of process deviations and other incidents. Furthermore, they are, by and large, immune from the adverse effects of human error or other uncalled-for human intervention. In well laid-out refineries, risk exposures will be limited because of the generous inter-unit distances. The EML (Estimated Maximum Loss) calculations carried out by the insurers in such cases reflect this lower risk, which, in turn, translates into lower premiums.

The intrinsic safety principle aimed at avoiding incidents needs to be fully supported by efficiently working management systems and robust leadership accountability philosophy in a company. Even though the number of incidents in modern times might be decreasing slightly, the cost per incident keeps on escalating. Likewise, a greater awareness and sharing of information with the public is a must. It makes it far more important for company leadership to promote the concept of 'Zero Accidents and Zero Incidents' as viable corporate targets. Proactive leadership does not wait for an incident to occur or the public to complain before striving for excellence in all its operations and business practices. Bapco intends to march towards operational excellence by creating a work culture and ethos based on our 'value' system that consists of the following elements: Businesslike approach, Respect for everyone, Teamwork, Integrity, Innovation, and Personal accountability.