Proceeding 2

Page 247 Page 246
What information will be used to dene

critical behaviours?
How will teams receive feedback reports?
How will feedback reports be published?
This does not cover everything, but will go a long
way towards getting the process started. It is
strongly recommended that experts be engaged
to help with the process. (A company such as
IRCA is ideally placed to assist in this regard.)
1.3 PROCESS APPROACH
Guidelines to initiate and sustain a culture change
process, aimed at achieving a world-class safety
culture, must be provided during the training sessions.
The support processes needed to maintain long-term
commitment are Leadership, Communication, and
Recognition. Each of these processes must be addressed
during the intervention, and aspects that will be covered
include characteristics of effective leaders; language
that increases resistance and should be avoided; and
levels of resistance that can be inuenced by leadership,
communication, and recognition.
Research has shown that the most effective leaders are
enthusiastic, honest, motivated, condent, analytical,
informed, and exible.
Although these characteristics are sometimes viewed
as permanent personality traits, they can be increased
through education, communication, recognition, and
involvement in a behaviour based process. While it may
be useful to look for natural leaders when selecting
members of an Implementation Team, it is important
to realise that leadership qualities could have been
suppressed in some people by their lack of empowerment.
New processes and eventual culture change might bring
out leaders you did not know existed. Involvement and
commitment are essential aspects of building a world-
class safety culture, and it can be increased in many
ways.
1.3.1 NEED FOR BEHAVIOUR BASED PROCESS
Survival in this millennium requires organizational
performance, fuelled by growth practices, which
will ensure the optimum utilisation of resources.
The cost of lacking performance excellence,
incidents, and accidents not only causes a break
in protability, but also puts extreme pressure
on business performance, thereby creating an
even greater potential for performance impeding
incidents. This demands a scientic and professional
approach to the science of integrating those job
variables affecting organizational performance. A
well-planned, dedicated, and continuous effort to
ensure safety performance excellence among the
total work force is therefore imperative.
The answer to the question Why embark on a
behaviour intervention process? is as follows:
It is the logical next step in the process of
continuous improvement,
It is an essential pre-requisite for world-class safety
performance,
Analysis of injury statistics shows:
o 87% of injuries are attributable to at-risk
behaviour;
o 11% of injuries are attributable to at-risk
conditions;
o 2% of injuries are attributable to force majeure or
natural causes.
1.3.2 CUSTOMIZING THE PROCESS
The implementation procedures must be customised,
since organizational cultures vary widely. There must
be signicant input from the people affected by the
process and from whom long term participation is
needed. It takes signicant time, effort, and resources
to implement a behaviour-based safety process.
With this in mind, it is recommended that
organisations set small-term goals to build condence
and optimism on small win accomplishments; and
then, with patience and dedication, long-term goals
for continuous improvement can be set. Increase the
impact of activators and manage the consequences
such as celebrating achievements on the way, to
effectively increase safe work practices and decrease
at risk behaviours.
Rather than adapting to intervention programmes
that sound good, processes that work are needed.
The intervention process should be founded on
sound research and rigorous evaluation, and not
on common sense. Only through rigorous process
evaluation can we know whether an intervention is
worth pursuing. What kind of process evaluation is
most appropriate for a particular situation? The need
for achievement-oriented methods to keep score of
safety efforts is important. This enables people to
consider safety in the same context as production and
quality.
This implies, of course, the need for evaluation data that
people can understand and learn from, which will lead to
continuous improvement.
1.3.3 EVALUATING THE PROCESS
Many consultants ignore several key evaluation principles.
For example, their measures, typically:
Target only one of the three dimensions (workplace,
behaviour, or person factors),
Have a short term focus,
Focus on downstream factors such as injury rates,
fatality rates, etc., instead of upstream measures of
cause and measures of control,
Include statistical analyses that take substantial time to
collect and complete, and are not readily understood
by the average person, and
Often do not include a cost / benet analysis.
Basic principles should not be overlooked when evaluating
an intervention to achieve continuous improvement.
Specically, the BBS process will ensure that:
The performance that the intervention is intended
to address is clearly specied, while allowing for the
problems associated with individual versus
organizational performance,
All three dimensions of improvement are measured
that is, workplace, behaviour, and person factors,
A thorough cost-benet analysis to justify the
intervention is done,
Process measures are applied periodically, especially
audits of workplace conditions and work practices,
Evaluation and feedback are done with data that is
meaningful to all process participants, thereby ensuring
the provision of continuous improvement by rening
interventions.
1.3.4 PERFORMANCE EXCELLENCE
Safety performance excellence can only be realised
through effective leadership, focusing on integrating
relationship dynamics, process optimisation and
continuous technological serviceability. This, however,
should continuously be supported and guided by
regulatory systems to ensure purpose and focus.
Excellence in performance depends on the manner in
which the work force attains specic pre-determined
goals whether these goals are high production gures
or excellence in safety.
Safety performance excellence requires a team effort
throughout the organisation, which will only be realised
if each hierarchical level within the organisation succeeds
in achieving its purpose:
Business Leaders: Creating a culture of safety
performance excellence requires business leaders
to focus their efforts on creating parameters for job-
orientated behaviour.
Team Leaders [Coaches]: Team leaders, being
closer to the action, have to stimulate co-operation
between employees, whilst, at the same time exploit
every opportunity to reinforce the companys
powerful vision of success.
Team Members: Team leaders and team members
from the front-line of any organisation. As such, they
should show perseverance towards safety assurance
at all times, and show pride in striving towards
performance excellence in safety.
1.4 BBS DELIVERABLES
The BBS process is cutting-edge technology that focuses on
the so-called third dimension of safety assurance. Its primary
focus is on the behaviour of persons, using the IMBOP process
to eliminate at-risk behaviours from the workplace, resulting
in substantial improvements of safety performance to world-
class standards.
The behaviour intervention process offered by BBS will build
on your current efforts and will maximise the investment
you have already made in training, equipment, and other
improvements.
Good consultants can assist in customising a behaviour-based
system to meet the needs of any business. Typically, their
services should include the following:
A supporting software package,
Culture / Perception surveys,
Training of Process Champions, Steering Team/s, line
management, supervisors and employees,
Reinforcement,
Behaviour modeling,
Observation and feedback,
Problem solving,
Long-term follow-up and support.
Page 249 Page 248
Conference & Exhibition
Implementing Safety during the Design
Phase of a Project
Thomas E. Kramer,
P.E., C.S.P. LJB Inc.
American Society of Safety Engineers - Middle East Chapter
9
th
Professional Development Conference & Exhibition
Kingdom of Bahrain, February 20-24, 2010
ASSE-MEC-2010-31
1. INTRODUCTION
It might be easier to see the hazards in an existing facility,
but its safer and more cost effective to implement safety
measures before structures are built. Using case studies
this session will examine the process and benets
of implementing safety during the design phase of a
project.
KEYWORDS
Hazard identication, Hierarchy of Control, hazard
abatement, cost implications
2. BACKGROUND
This paper addresses how to minimize the risk of
potentially dangerous or fatal hazards by taking a
proactive approach to worker safety.
The paper will examine the benets and process of
implementing safety measures during the programming
and design phases of a project.
The concept of Safety by Design is a mechanism
for moving the discussion of safety hazards and harmful
risks into the design and programming phases of
projects. This involves incorporating hazard analysis
and risk assessments earlier than usual in the project
process. This also involves taking the necessary steps to
mitigate the risk of incidents that can cause damage or
injuries to workers. Risks are mitigated to an acceptable
level and various other aspects such as health and
environmental concerns are considered in these early
phases of development.
Although it can be easier to identify hazards in an existing
facility or process after construction is complete, its
generally safer and more cost effective to implement safety
measures before facilities or processes are built. By using
this proactive approach to safety, engineering controls are
put in place in the early stages of construction, resulting in
the mitigation of potentially dangerous or fatal accidents.
3. IDENTIFYING POTENTIAL HAZARDS
Though it can be difcult to identify hazards in the
early phases of conceptual design development, several
strategies can be employed to recognize potential safety
risks:
Plans and designs can be compared to similar,
existing systems or facilities, taking into account
what measures were successful, then employing
them into the new project.
People who have experience with similar, existing
systems can be interviewed to determine the
successes and challenges they have realized in their
safety program.
Plans can be reviewed by a Qualied Person, that
has both engineering and safety backgrounds and is
capable of creating designs that ensure compliance
with industry safety regulations, standards and
owners requirements.
Organizations can provide safety standards
or guidelines to consultants and equipment
manufacturers prior to building design.
Careful implementation of these strategies in the
conceptual design phase helps ensure successful hazard
identication that will serve as the foundation of a safer
work environment.
The individuals who will be working with the new process
or in the new facility, should be involved in early discussions
on how the facility or process will be designed and
maintained. A successful implementation process involves:
Awareness training for the design team and facility
managers: this ensures that they understand the
importance of proactive safety approaches and how
employees can be best protected from potentially
dangerous or fatal situations.
Plans and designs are reviewed by an OSHA Qualied
Person who is experienced in safety design.
A post-construction assessment of the facility should be
completed by an OSHA Qualied Person to ensure that
latent hazards are identied and mitigated as early in
development as possible.
This process, combined with the strategies for hazard
identication previously presented, provides a workshop
approach to hazard identication and abatement. These
strategies allow the design team, personnel and facility owners
to build the list of possible hazards, while the implementation
process allows these hazards to be identied on the schematic
drawings and abated.
4. COSTS IMPLICATIONS
A study conducted by an international consumer-goods
manufacturer showed that implementing safety measures
during the programming and schematic design phases of a
project resulted in substantially lower costs than implementing
systems during or after construction.
The following chart summarizes the relative cost required to
achieve the same level of safety for a given hazard based on
when the hazard is abated during the design and construction
process.
Stage Relative Cost
Programming/Schematic Design$1
Construction Documents$10
Construction/Installation.$100
Commissioning$1,000
After Contractor Leaves Site...$10,000
If hazard abatement is not addressed until after the contractor
leaves the site of a new facility, a relative cost of $10,000 could
be the implication to provide the same level of safety.
Compare the two scenarios below, which illustrate the
difference between implementing safety at step one versus at
step ve.
4.1 Cost Scenario - Step One
When safety is implemented during the programming/
schematic design phase, safety is incorporated from the
beginning. So, use of the Hierarchy of Control (Figure 1) can
be optimized by evaluating a systems defeatability and long-
term cost comparisons. Avoidance of interferences, connection
details, layout issues and required clearances are incorporated
into the original design. At this point, the designer does not
even need to erase lines on their drawings the safety aspects
are simply programmed into the design. This represents a base
cost to abate the hazard.
4.2 Cost Scenario - Step Five
After the contractor leaves the site, and the facility or process
is already in place, the use of the Hierarchy of Control has
been compromised due to the lack of pre-planning. Although
it can still be optimized by evaluating a systems defeatability
and long-term cost comparisons, eld conditions will affect
costs and will dictate how a hazard is abated. In certain cases,
the only means of protecting employees is through the use
of personal protective equipment due to existing interferences
and inability to access the area with appropriate engineering
controls unless signicant, costly modications are made.
All interferences, connection details, layout issues and
required clearances must be eld veried, and details must
be developed and designed to match existing conditions.
Additional framing may be required to work around existing
equipment, so physical modications will be required. Added
to the base cost to abate the hazard include the costs of design,
additional drawings set for hazard abatement, mobilization
of the contractor, potentially signicant eld modications,
potentially signicant rework of interferences, long-term costs
of not using the ideal abatement method and cost associated
with using a potentially riskier means of hazard abatement,
such as PPE.
Figure 1: The graph above illustrates the Hierarchy
of Control
Page 1 Page 250
When abating a hazard, keep in mind the total cost for
hazard abatement. Short-term and recurring costs should
also be thoroughly considered prior to implementing an
abatement solution. Short-term costs include installation
of systems such as walking/working surfaces, personal
fall arrest systems and equipment, as well as employee
training. Recurring costs include additional time for
equipment inspections or modications that may
become necessary considerations for safety planning,
retraining personnel, and productivity gains and losses
due to the type of abatement method used.
A simple example is using engineering controls (such as
platforms with guardrails with a xed ladder access to
a work location) in a fall hazard program rather than
a personal fall arrest system. This is one example that
could have been considered during the design phase.
Engineering controls often allow workers to also perform
their tasks more quickly and efciently.
5. CONCLUSION
Safety by design is an economical way of doing
business. The point is not how much it will cost if you
wait until the end, but rather how little it will cost if
you implement it earlier. Earlier implementation reduces
injuries, illnesses (from mold for example) and damage
to the environment. Additionally, using the safety by
design approach ensures that business owners will avoid
expensive retrotting, reducing overall operating costs.
By incorporating safety into the design process, business
owners will yield a positive impact on not only worker
safety, but also quality and productivity. Additionally,
costs are lowered, task performance is improved and
life-threatening work hazards are reduced.
This unique, proactive approach to safety helps business
owners focus on hazard elimination, engineering control
strategies, and the general principal to stay toward the
top of the hierarchy of control. This results in identifying
and controlling hazards more effectively and efciently.

Eastern Province Jubail Industrial City Jeddah Palestine Mall -
Tel: 03 347 4451/52 Fax: 03 347 1838 Tel: 02 661 2233 Fax: 02 661 4352
E-Mail : [email protected] Page # 1/1

Dallah Human Skills Development
(DHSD)

Are we?
Dallah Human Skills Development was established according to Total-
Quality-Management concept;: Which the customer is the focus of the
business in the fields of:
Strategic Planning.
Organization of conferences.
Manpower Development.
Organizational Development.
Financial System, Costing and Control.
Feasibility Studies.
Evaluation of Schemes & Investments.
Safety & Industrial Security.
Information Technology.

Are we in this field?
Being a sister company of prominent Dallah Group, Dallah Human
Skills Development was established based upon a clear vision towards
training and development issues Furthermore, Dallah being a pillar in the private
sector, the sense of responsibility to upgrade, enhance and develop national cadres
through education and training in parallel to other economical and social development
schemes undertaking by the government. It is therefore DHSD is a pioneer in this
filed being one of the first specialized entities that granted appropriate permits to
operate a decade and half ago.
Hence, it should not be understood that we are claiming that we are the only quality
training & development firm in the Saudi market but proud to say that we are one of
the best with a proven record.

Who
Why
Page 253 Page 252
Are You Spending Too Much on Process Design Safety?
Dr. Tony Clark, Process Iprovement Institute (PII),
Europe
9
th
ASSE-MEC-2010-32
ABSTRACT
Optimizing the expenditure on safety features in a
process design requires balancing the number and
effectiveness of safety features versus the residual risk
that can be tolerated by the organization. This involves
an examination of the options available and their
merits and can be achieved by applying the concept of
ALARP (i.e., ensuring the risks are as low as reasonably
practicable). The aim of this paper is to demonstrate
how acceptable safeguards can be implemented without
incurring signicant expenditure for a gas processing and
underground storage facility and how this can be done
using qualitative, semi-quantitative, and quantitative
risk analysis techniques.
1. INTRODUCTION
It is a common perception that the more you spend on
safety measures, the safer your installation. Companies
handling and processing hazard materials can spend
considerable amounts of money on safeguards, but
get very little in return in terms of improved safety.
It is important to get the balance right so that the
money you spend on safety features is not grossly
disproportionate to the risk reduction that might be
gained. The concept of ALARP and the use of cost
benet analysis for determining the requirements of
safety features for hazardous installations are outlined.
The benets of safety features can be estimated
qualitatively, semi-quantitatively, and quantitatively. The
information required or each type of assessment varies,
but regardless, the information should be suitable and
sufcient.
The different types of risk assessment can be used in
determining the requirements for certain safety features
during the design phase for hazardous installations (as
well as other periods in the life-cycle of a process). This
paper considers a gas processing facility associated with
underground storage caverns and demonstrates that
safety measures, such as ammable gas detectors and
reghting facilities, do not necessarily provide any real
benet in terms of reducing risks.

2. THE ALARP PRINCIPLE AND COST
2.1 Acceptability Criteria
Acceptability criteria for individual risk of fatality varies
between different countries and between companies.
Typical data relating to risk tolerability criteria are
summarized in Table 1, which includes the criteria
published by the UK Health and Safety Executive (HSE,
2001) is commonly applied in assessing the tolerability of
risks. Usually, risk levels are divided into three bands of
increasing risk. In the lowest band the broadly acceptable
region where the risk is negligible, there is no requirement
for further action to reduce the risk. However, continuing
vigilance is required to ensure that the risk remains at this
level. Risks that fall into the uppermost band are termed,
intolerable. In such cases, either action should be taken
to reduce the risk levels, or the activity giving rise to the risk
should be halted.
Between the intolerable and broadly acceptable regions,
the risk is considered to be tolerable if it is as low as
reasonably practicable (ALARP). The risk is ALARP when
the cost of any further risk reduction measures would
be grossly disproportionate to (much greater than) the
benets gained. The ALARP principle arises from the fact
that innite time, effort, and money could be spent on the
attempt of reducing a risk to zero, but this gross expenditure
is not efcient. This is represented by the ALARP triangle
in Figure 1. Another fact related to lowering risk to ALARP
is that as more layers of protection are added, the system
complexity increases and so does the number of common
failure/error modes. So, many times to actual risk is increasing
with number of layers, because humans have limits on how
many critical activities they can manage independently.
2.2 Cost Benet Analysis
A cost benet analysis (CBA) is regarded as a useful tool
for judging the balance between the benets of considered
options and the costs incurred for implementation. This
requires putting a monetary value on achieving a reduction in
As shown in Table 1, there are variations in the boundaries
for the tolerable and negligible risk levels, which have been
the subject of debate. Different criteria have also been
applied to new and existing hazardous installations.
a fatality, which itself is open to debate. One approach in
obtaining the value for preventing a fatality (VPF) has been
by index-linking from a benchmark gure of 1,000,000 in
2001 which was adopted by the Department of Transport,
Local Government and the Regions for the approval of new
road schemes in the UK (HSE 2001). The VPF today would
therefore be in the region of 1,250,000. However, in
Page 255 Page 254
the USA, the VPF is currently $12,000,000 (6-7 times
higher) for chemical plant workers and $5,000,000 for
construction workers. USA companies are typically at
a 10-4 to 10-3 for a maximum tolerable risk of death
to the worker doing a task compared with 10-3 in the
UK, but the cost of death value is ten times higher in
the USA. The UK value of VPF means the residual cost
risk for fatality is about $2500/yr; whereas in the USA,
the value we typically use $1,200/yr to $12,000/yr (so
about the same range for acceptable tolerable risk on
an economic scale).
In assessing whether the cost of implementing a
particular safety measures is justied, the group risk
is used. This is calculated from the product of the
individual risk per annum and the number of people
exposed to that risk and is dened as the Probability of
the Loss of Life (PLL).
The justiable cost for the implementation of safety
features can be obtained:
Justiable cost = PLL reduction (per year) x plant life x
VPF
3. MAJOR ACCIDENTS RISKS FROM
A GAS PROCESSING PLANT AND
ASSOCIATED GAS STORAGE
CAVERNS
Figure 1 ALARP Diagram
Figure 2 Block Diagram of GPI
The facility being considered involves the transfer of
natural gas between a National Transmission System (NTS)
compound and underground storage caverns via wellheads,
a gas manifold area (GMA) and a gas plant. The entire
facility is referred to as the Gas Plant Infrastructure (GPI).
A block diagram of the GPI is illustrated in Figure 2. The
gas plant basically comprises metering, an inlet separator,
compressors, dehydration and regeneration units and gas
heaters. The use of the process equipment depends on the
mode of operation and the facility operates in four basic
modes:
Injection by Free Flow When the NTS pressure is
sufciently above the cavern pressure; gas can free
ow into the caverns.
Injection by Compression When there is a low
difference between the NTS pressure and the cavern
pressure and when the NTS pressure is below the
cavern pressure, injection to the caverns requires the
use of compression.
Withdrawal by Free Flow When the cavern pressure
is sufciently above the NTS pressure, gas can free
ow from the caverns to the NTS compound.
Withdrawal by Compression When there is a small
difference between the cavern pressure and the NTS
pressure and when the cavern pressure is below
the NTS pressure, compression will be required to
withdraw gas and into the NTS.
The GPP is permanently manned and the NTS GMA and wellsites
are normally unmanned.
3.1 Potential Outcomes of Accidents
There can be a number of different outcomes, following the
releases of ammable gas resulting from plant equipment
failures. These are considered to include:

Jet ames
Flash res
Vapour cloud explosions (VCEs); and
Fireballs
The likelihood and magnitude of the outcome depends on the
size of the release, probability that the release is ignited, the
dispersion of the ammable vapour and the reliability of the
emergency systems.
Jet Flames
Jet ames are usually caused by loss of containment of a
pressurized ammable gas with immediate ignition or delayed
ignition following ash back to the release point. Loss of
integrity of any equipment or piping in ammable gas service
can potentially result in a jet ame and can arise from a gasket
or valve gland leak, which usually produces an aperture of small
equivalent diameter. Mechanical impact accident such as from
a dropped object or vehicle impact can result in either a clean
or a partly severed fracture and so the release of gas would be
much larger.
Impact of the ignited jet on equipment items or structural
members can be rapidly destructive due to the high ame
temperature / high radiation ux. Damage to process equipment
is likely to occur if exposed to thermal radiation levels of around
37.5kW/m2. (Lees, 2001)
Flash Fires
In the absence of immediate ignition of a ammable gas
release, a vapour cloud is formed, the boundary of which is
determined by the rate of release, the lower ammable limit
(LFL) of the ammable material, mixing with atmospheric air,
diffusion, local topography and prevailing weather conditions.
In the event of the ammable cloud encountering an ignition
source remote from the release, ame will propagate from the
ignition point back to the release point. The ash back to the
release point will occur with the heat and gas expansion effects
and in the absence of congestion the overpressure arising
from the gas expansion is insufcient to cause damage, but
the heat radiation effect may ignite other materials and has a
high probability of fatality for personnel within or close to the
ash back. Upon the ash back reaching the release point of
the ammable gas, a jet re will be formed.
Vapor Cloud Explosions (VCEs)
If the ame travelling through a hydrocarbon /air cloud can
accelerate and attain a signicantly higher ame speed than
that associated with a ash re, an overpressure wave could
be generated. This phenomenon is referred to as VCE and in
order for a ame to accelerate from a low speed to a high
speed, some form of congestion is necessary, e.g., a gas cloud
in a plant area. Or, if more than about 10,000 kg of ammable
in the cloud at the right mixture, then the cloud has sufcient
mass to compress internally as the ame accelerates, causing
a detonation of the cloud and high overpressures (0.5 atm or
higher).
VCEs are characterised by the generation of levels of
overpressure that are created by the connement of the gas
(i.e., retaining the gas expansion within a xed volume). The
overpressures generated can cause damage to equipment
and the destruction of buildings beyond the ammable
cloud envelope. Therefore direct human fatalities can occur
from the blast that are outside the ammable cloud though
most casualties arise indirectly from crush injuries in collapsed
buildings or impact injuries from projected fragments.
Fireballs
A reball in this instance could occur following the rupture of
an underground section of gas pipeline and immediate ignition
of the released gas. The gas is rapidly burnt as a spherical
reball, which rises due to the initial momentum of the release
and high buoyancy of the hot ames. The size of the reball
and its duration is determined by the initial mass of fuel.
The physical effects of thermal radiation load on people,
equipment and buildings will depend on the intensity
of radiation received and the duration of exposure. The
consequence level for reballs is normally expressed in terms of
the thermal dose, which is a product of the thermal radiation
level and the exposure time.
4. ASSESSING THE IMPACT OF PROPOSED
SAFEGUARDS
The proposed safeguards considered for the GPI are:
Page 257 Page 256
Flammable gas detection;
Fire ghting provision;
Safety instrumented systems
These were considered for the four main units of the GP1
the wellsites, GMA, gas plant and NTS compound.
4.1 Flammable Gas Detection
Flammable gas detectors are used to trigger alarms if a
specied concentration of gas or vapour is exceeded.
It should be noted that the gas leak detectors do not
prevent releases of the ammable gas from occurring,
but are provided to alert personnel to its presence so
that appropriate mitigation can be taken. This may
involve an emergency shutdown (ESD) in which the leak
is isolated and if a release were to occur at the gas plant,
followed by emergency depressurization (EDP) of the
plant sections.
In the assessment, the benet from installing ultrasonic
gas leak detectors at the wellheads, GMA, gas plant,
and NTS compound were considered as the means of
alerting personnel to a gas leak. Ultrasonic gas leak
detectors were deemed to be more reliable than point
and line of sight ammable gas detectors. Furthermore,
since the detection of noise is omni-directional, the
number of devices required would be less than for gas
detectors responding to ammable gas concentrations.
The ultrasonic gas leak detectors were also considered
to be appropriate for detecting jet ames because of
the noise levels that would be generated from ignited
high pressure gas releases. The activation of a single gas
detector would initiate an alarm in the control room at
a specied noise level.
Any person who is outdoors and relatively nearby,
whether it be the general public or an employee, is just
as likely to hear a gas release as would be detected by
an ultrasonic gas leak system. Therefore the benet of
the ultrasonic gas leak detectors would be to alert control
room personnel of a release, when no one is present near
the release point when it occurs.
The approach taken in the assessment was to calculate the
increase in the likelihood of causing fatalities arising from
prolonged undetected gas releases. The fatality risks from
the absence of gas leak detectors are considered to arise
from personnel being present in the vicinity who do not
detect a large gas leak, which is then ignited. The likelihood
of a delayed ignition of an undetected release is taken to
be the increase in a major accident risk from not installing
outdoor gas leak detectors. The risk of fatality will depend
on the probability of exposed people being killed from the
outcome.
The event tree used to determine the additional risk of
occurrence of a major accident from undetected gas
releases at the gas plant is shown in Figure 3, which was
calculated to be:
7.70 x 10-6 + 7.70 x 10-5 + 6.93 x 10-5 + 3.85 x 10-5
=1.93 x 10-4 /yr
The additional risks for the other units were determined
to be:
Each wellsite: 5.56 x 10-6 /yr
GMA: 3.46 x 10-5/yr
NTS Compound: 1.42 x 10-6 /yr
The probability (given that a release has indeed occurred)
of a person being killed at the wellsites, GMA, and NTS
compound is assumed to be 1 on the basis that the same
persons are likely the cause of the delayed ignition (and
hence are present). Since the gas plant occupies a relatively
large area, the probability of personnel on the plant being
exposed to the outcome is judged to be 0.5.
The PLL reduction per year at each of the sites are shown
in Table 2 and are obtained on the basis that all exposed
personnel would be killed.

ASSE-MEC-2010-32 Are You Spending Too Much on Process Design Safety? 5
and if a release were to occur at the gas plant, followed
by emergency depressurization (EDP) of the plant
sections.
In the assessment, the benefit from installing ultrasonic
gas leak detectors at the wellheads, GMA, gas plant, and
NTS compound were considered as the means of alerting
personnel to a gas leak. Ultrasonic gas leak detectors
were deemed to be more reliable than point and line of
sight flammable gas detectors. Furthermore, since the
detection of noise is omni-directional, the number of
devices required would be less than for gas detectors
responding to flammable gas concentrations. The
ultrasonic gas leak detectors were also considered to be
appropriate for detecting jet flames because of the noise
levels that would be generated from ignited high pressure
gas releases. The activation of a single gas detector would
initiate an alarm in the control room at a specified noise
level.
whether it be the general public or an employee, is just as
likely to hear a gas release as would be detected by an
ultrasonic gas leak system. Therefore the benefit of the
ultrasonic gas leak detectors would be to alert control
increase in the likelihood of causing fatalities arising
from prolonged undetected gas releases. The fatality risks
from the absence of gas leak detectors are considered to
arise from personnel being present in the vicinity who do
not detect a large gas leak, which is then ignited. The
likelihood of a delayed ignition of an undetected release
is taken to be the increase in a major accident risk from
not installing outdoor gas leak detectors. The risk of
fatality will depend on the probability of exposed people
being killed from the outcome.
calculated to be:
7.70 x 10
-6
+ 7.70 x 10
-5
+ 6.93 x 10
-5
+ 3.85 x 10
-5
=1.93
x 10
-4
/yr
to be:
Each wellsite: 5.56 x 10
-6
/yr
GMA: 3.46 x 10
-5
/yr
NTS Compound: 1.42 x 10
-6
/yr
hence are present). Since the gas plant occupies a
relatively large area, the probability of personnel on the
plant being exposed to the outcome is judged to be 0.5.
Table 2 Calculated PLL Figures

GPI
Risk Reduction
(per year)
Probability of
being killed
from outcome
Exposed
personnel
PLL
(per year)
Wellsite 5.56 X 10
-6
1 2 1.12 X 10
-5

GMA 3.46 X 10
-5
1 2 6.92 X 10
-5

NTS 1.42 X 10
-6
1 2 2.84 X 10
-6

GPP 1.93 X 10
-4
0.5 5 4.85 X 10
-4

The justifiable costs are calculated based on a plant
life of 25 years and a VPF of 1,250,000 and are
compared with indicative costs for the ultrasonic gas
detection systems at each of the four sites.

Table 3 CBA of Risk Reduction Options

GPI PLL (per year) Justifiable Cost Estimated actual cost
Wellsite 1.12 X 10
-6
350 8000
GMA 6.92 X 10
-5
2165 16000
NTS 2.84 X 10
-6
90 16000
GPP 4.85 X 10
-4
15100 135000
and if a release were to occur at the gas plant, followed
by emergency depressurization (EDP) of the plant
sections.
In the assessment, the benefit from installing ultrasonic
gas leak detectors at the wellheads, GMA, gas plant, and
NTS compound were considered as the means of alerting
personnel to a gas leak. Ultrasonic gas leak detectors
were deemed to be more reliable than point and line of
sight flammable gas detectors. Furthermore, since the
detection of noise is omni-directional, the number of
devices required would be less than for gas detectors
responding to flammable gas concentrations. The
ultrasonic gas leak detectors were also considered to be
appropriate for detecting jet flames because of the noise
levels that would be generated from ignited high pressure
gas releases. The activation of a single gas detector would
initiate an alarm in the control room at a specified noise
level.
whether it be the general public or an employee, is just as
likely to hear a gas release as would be detected by an
ultrasonic gas leak system. Therefore the benefit of the
ultrasonic gas leak detectors would be to alert control
increase in the likelihood of causing fatalities arising
from prolonged undetected gas releases. The fatality risks
from the absence of gas leak detectors are considered to
arise from personnel being present in the vicinity who do
not detect a large gas leak, which is then ignited. The
likelihood of a delayed ignition of an undetected release
is taken to be the increase in a major accident risk from
not installing outdoor gas leak detectors. The risk of
fatality will depend on the probability of exposed people
being killed from the outcome.
calculated to be:
7.70 x 10
-6
+ 7.70 x 10
-5
+ 6.93 x 10
-5
+ 3.85 x 10
-5
=1.93
x 10
-4
/yr
to be:
Each wellsite: 5.56 x 10
-6
/yr
GMA: 3.46 x 10
-5
/yr
NTS Compound: 1.42 x 10
-6
/yr
hence are present). Since the gas plant occupies a
relatively large area, the probability of personnel on the
plant being exposed to the outcome is judged to be 0.5.
Table 2 Calculated PLL Figures

GPI
Risk Reduction
(per year)
Probability of
being killed
from outcome
Exposed
personnel
PLL
(per year)
Wellsite 5.56 X 10
-6
1 2 1.12 X 10
-5

GMA 3.46 X 10
-5
1 2 6.92 X 10
-5

NTS 1.42 X 10
-6
1 2 2.84 X 10
-6

GPP 1.93 X 10
-4
0.5 5 4.85 X 10
-4

The justifiable costs are calculated based on a plant
life of 25 years and a VPF of 1,250,000 and are
compared with indicative costs for the ultrasonic gas
detection systems at each of the four sites.

Table 3 CBA of Risk Reduction Options

GPI PLL (per year) Justifiable Cost Estimated actual cost
Wellsite 1.12 X 10
-6
350 8000
GMA 6.92 X 10
-5
2165 16000
NTS 2.84 X 10
-6
90 16000
GPP 4.85 X 10
-4
15100 135000
The justiable costs are calculated based on a plant life of 25
years and a VPF of 1,250,000 and are compared with indicative
The costs in Table 3 clearly show the estimated minimum cost
of implementation exceeds the justiable cost, in particular
at the wellheads and NTS Compound. It should be noted,
however, that the VPF value can vary in different organisations
and depends on the hazardous situation. Even if the VPF gure
were doubled, the estimated costs for installing the gas leak
detectors would still be considerably higher than the calculated
justiable costs.
4.2 Fire Fighting Provision
The use of re ghting measures for the three types of re
that could occur from ignited ammable gas releases at the GPI
facilities - jet ames, ash res and reballs are assessed.
Jet Flames
The application of rewater in the event of a jet ame could be
to cool adjacent equipment and structural members to prevent
or delay their failure. However, the risk to operating personnel
from an escalated event is considered highly unlikely since if
not affected by the initial event, personnel are likely to escape
to a safe area. Therefore, the application of rewater does not
provide any benet in reducing the fatality risks to members of
the workforce from an escalated event arising from jet ames.
Indeed it can be argued that fatality risks could increase if
personnel are likely to be in a hazardous area in order to apply
the rewater.
The design intention, in the event of a process gas leak would
be to isolate the various plant sections and then depressurise in
accordance with API 521. This would have the effect of reducing
the magnitude of the jet ame as the pressure decreases. There
is the potential for jet res to cause secondary res of other
materials, such as at site buildings or grass\undergrowth res in
the surrounding elds. The rewater would therefore be used
to extinguish these types of re.
costs for the ultrasonic gas detection systems at each of the
four sites.
Flash Fires
The nature of a ash re, being of short duration is such that
the application of rewater would have negligible benet in
terms of reducing the escalation risks from ash res directly.
Discharging rewater under pressure is sometimes used to
enhance dispersion of ammable vapours. However, in the
event of a loss of containment, the process gas, being lighter
than air and at high pressures would rapidly entrain air and
disperse Therefore, there would be no real advantage from
using the rewater.
However, the rewater, would again be available to control
any secondary res of other materials, ignited by the initial
ash re.
Fireballs
A reball is considered to result from the immediate ignition
of a pressurised release from an underground pipeline rupture.
Since it would be of relatively short duration, rewater would
provide no benet in terms of reducing the risks to personnel
and protecting process equipment.
However, it is possible that the consequences of a reball
would again be to cause ignition of vegetation in the vicinity
of a pipeline failure or in nearby buildings. The rewater would
therefore be used to control and extinguish such secondary
res.
Fire ghting options
It has been determined that the main benet from the
application of rewater would be for secondary res that
might be caused by jet ames, ash res or reballs resulting
from ignited gas releases. With respect to the gas plant, three
options for the design and operation of rewater application
Page 259 Page 258
systems were examined with the objective of getting the
right balance between cost and risk reduction.
A dedicated rewater pond will be installed and the three
options considered in the assessment for the application
of the rewater are described. The philosophy for each
of the proposed options is that the local Fire Brigade will
take responsibility for the application of the rewater.
Option 1: a xed rewater main with exible hoses
being connected to hydrants strategically positioned
throughout the gas plant site with permanent rewater
pumps being used to pressurise and transfer the rewater
through the main to the affected area. The main would
be maintained in a dry condition and in the event of
a re, the main would be lled and pressurised using
transfer the firewater from the firewater pond through the
main to the affected area. Therefore there is no
requirement for permanent firewater pumps.
Immedia
te
Ignition?
Personnel
identifies fire/
release?
Orientation
of release
Delayed
ignition
?
Outcome Frequency / year
0.95
HGSL personnel
alerted to jet
flame
3.14E-03
Yes
0.3
Yes
No
Prolonged jet
flame and
escalation
1.65E-04
0.05
Large Release
from GPP
1.10E-02 /yr 0.95
HGSL personnel
alerted to gas
release
7.32E-03
Yes
0.1
Jet flame 7.70E-06
Yes
0.2
Vertically
up
No No Prolonged gas
release
6.93E-05
0.7 0.9
0.5
Flash fire \ VCE
followed by jet
flame
7.70E-05
Yes
0.4
45 Degrees
No Prolonged gas
release
7.70E-05
No 0.5
0.05
0.9 Flash fire \ VCE
followed by jet
flame
6.93E-05
Yes
Horizontal
0.2
No Prolonged gas
release
7.70E-06
0.1
0.5
Flash fire \ VCE
followed by jet
flame
3.85E-05
Yes
Vertically
down
0.2
No Prolonged gas
release
3.85E-05
0.5
Figure 3 Event Tree Releases from the Gas Plant
permanent rewater pump(s). An electrical-driven pump
would be started initially, with a diesel-engine driven pump
provided as back-up. The plant operating company would
be responsible for starting up the pump(s) to pressurise the
main with rewater. On arrival at the site, the Fire Brigade
would connect hoses to the appropriate hydrant(s) and
then apply the rewater onto the affected areas.
Option 2: a xed rewater main with exible hoses being
connected to hydrants strategically positioned throughout
the GPP site, but using a pump-in point located close to
the rewater pond to enable pressurisation of the rewater
main by the re engine and transfer the rewater from
the rewater pond through the main to the affected area.
Therefore there is no requirement for permanent rewater
pumps.
Option 3: The third option does not incorporate the use of
permanent rewater pumps, nor a xed distribution system.
The proposed arrangement is for the Fire Brigade to draw water
directly from the rewater pond using the re tender driven
pumps with rewater being discharged from the hose as re-
ghters approach an affected area. An alternative source of
water could be provided by a dry hydrant at the surface linked
to the rewater pond in the event that the rewater pond were
inaccessible.
Assessment of the Options
The assessment of the options for the design of and operation
of the systems for applying rewater was undertaken
qualitatively.
In the event of a signicant process gas re, the ESD/EDP
system would be activated, which would reduce the extent
of the hazard following the initial release. It is expected that
people on site not harmed initially by a process re would
escape and, since the local Fire Brigade will be responsible for
ghting res, there will be no requirement for site personnel to
return to plant areas affected by a re. Once alerted, it would
take about 15 minutes for the Fire Brigade to arrive at the gas
plant site. Therefore, in terms of plant equipment protection
Therefore Option 3 was selected as it provides both the lowest
risk and the lowest cost.
4.3 Safety Instrumented Systems
The function of a Safety Instrumented System (SIS) is to prevent,
control or mitigate hazardous events by taking the process to
a safe state when predetermined conditions are violated. A SIS
comprises a combination of logic solver(s), sensor(s), and nal
element(s). An example of a SIS would be the ESD for the gas
plant.
A Safety Instrumented Function (SIF) is designed to prevent,
control or mitigate a hazardous event by taking a process to
a tolerable risk level. A SIF is also made up of logic solver(s),
sensor(s), and nal element(s). One or more SIFs comprise a SIS,
Figure 3 Event Tree Releases from the Gas Plant
from a signicant process gas re, the application of rewater
is not considered to be effective in further reducing the risk of
damage and escalation in this case.
It has been determined that the there would be no reduction
in the level of risk to personnel from the application of
rewater for process gas res and that the application of
rewater would most benecial to control and extinguish
res in buildings or grass/undergrowth res that may have
been caused by an ignited process gas leak or non process
reasons. Option 3, which involves the Fire Brigade drawing
water directly from the rewater pond, using the re tender
pumps and their hoses to apply the rewater is considered to
be a more practical arrangement. It is more benecial in terms
of exibility of access and providing better protection for re-
ghters in dealing with a re situation. The provision of a xed
distribution main and associated hydrants (Option 2) together
with permanent rewater pumps (Option 1) main would incur
considerable costs. There would also be a requirement to store
diesel on site for Option 1.
The re-ghting facilities and relative risks for each of the
options were analysed qualitatively and are summarised in
Table 4.
Option 3: The third option does not incorporate the use of
permanent firewater pumps, nor a fixed distribution
system. The proposed arrangement is for the Fire Brigade
to draw water directly from the firewater pond using the
fire tender driven pumps with firewater being discharged
from the hose as fire-fighters approach an affected area.
An alternative source of water could be provided by a dry
hydrant at the surface linked to the firewater pond in the
event that the firewater pond were inaccessible.
Assessment of the Options
The assessment of the options for the design of and
operation of the systems for applying firewater was
undertaken qualitatively.
In the event of a significant process gas fire, the
ESD/EDP system would be activated, which would
reduce the extent of the hazard following the initial
release. It is expected that people on site not harmed
initially by a process fire would escape and, since the
local Fire Brigade will be responsible for fighting fires,
there will be no requirement for site personnel to return to
plant areas affected by a fire. Once alerted, it would take
about 15 minutes for the Fire Brigade to arrive at the gas
plant site. Therefore, in terms of plant equipment
protection from a significant process gas fire, the
application of firewater is not considered to be effective
in further reducing the risk of damage and escalation in
this case.
It has been determined that the there would be no
reduction in the level of risk to personnel from the
application of firewater for process gas fires and that the
application of firewater would most beneficial to control
and extinguish fires in buildings or grass/undergrowth
fires that may have been caused by an ignited process gas
leak or non process reasons. Option 3, which involves the
Fire Brigade drawing water directly from the firewater
pond, using the fire tender pumps and their hoses to apply
the firewater is considered to be a more practical
arrangement. It is more beneficial in terms of flexibility
of access and providing better protection for fire-fighters
in dealing with a fire situation. The provision of a fixed
distribution main and associated hydrants (Option 2)
together with permanent firewater pumps (Option 1)
main would incur considerable costs. There would also
be a requirement to store diesel on site for Option 1.
The fire-fighting facilities and relative risks for each of
the options were analysed qualitatively and are
summarised in Table 4.
Table 4 Qualitative Assessment of Firewater Options

Option 1 Option 2 Option 3
Firewater ring-main Y Y N
No. of hydrants 12 12 1
Permanent firewater pumps 2 0 0
Diesel fuel storage Y N N
Relative cost 3 2 1
Relative risk 3 2 1
Therefore Option 3 was selected as it provides both the
lowest risk and the lowest cost.
4.3 Safety Instrumented Systems
The function of a Safety Instrumented System (SIS) is to
prevent, control or mitigate hazardous events by taking
the process to a safe state when predetermined conditions
are violated. A SIS comprises a combination of logic
solver(s), sensor(s), and final element(s). An example of
a SIS would be the ESD for the gas plant.
A Safety Instrumented Function (SIF) is designed to
prevent, control or mitigate a hazardous event by taking a
process to a tolerable risk level. A SIF is also made up of
logic solver(s), sensor(s), and final element(s). One or
more SIFs comprise a SIS, which is assigned Safety
Integrity Level (SIL) rating depending on the amount of
risk that needs to be reduced.
A SIL is a measure of safety system performance, or
probability of failure on demand (PFD) for a SIF or SIS.
There are four discrete integrity levels associated with
SIL. The higher the SIL level, the lower the PFD for the
safety system and the better the system performance.
However, it should be noted that the higher the SIL
rating, the cost and complexity of the system also
increases.
There are a number of ways that SIL ratings for a SIS or
a SIF can be determined. One such method is a Layer of
Protection Analysis (LOPA).
LOPA
LOPA is a simplified form of risk assessment and is used
to verify if sufficient layers of protection are required. In
order to this risk tolerance criteria should be established
which is assigned Safety Integrity Level (SIL) rating depending
on the amount of risk that needs to be reduced.
A SIL is a measure of safety system performance, or probability
of failure on demand (PFD) for a SIF or SIS. There are four
discrete integrity levels associated with SIL. The higher the SIL
level, the lower the PFD for the safety system and the better
the system performance. However, it should be noted that the
higher the SIL rating, the cost and complexity of the system
also increases.
There are a number of ways that SIL ratings for a SIS or a SIF
can be determined. One such method is a Layer of Protection
Analysis (LOPA).
Page 261 Page 260
LOPA
LOPA is a simplied form of risk assessment and is used
to verify if sufcient layers of protection are required. In
order to this risk tolerance criteria should be established
and Table 5 gives an example of criteria that are typically
applied with respect to risks to people.
An example of the application of the LOPA technique
is considered for the scenario of a high temperature
in the discharge line from a natural gas compressor,
which is housed in an enclosure. The cause of the high
temperature is failure of the after-cooler temperature
control loop that results in the design temperature of the
pipework being exceeded. This potentially leads to minor
damage to the pipework and a moderate gas leak which
if ignited would give rise to a jet re that could result in
serious injury to exposed personnel.
The determination of the required SIL rating is illustrated
in Table 6. In this example, since scenario is expected to
result in serious injury, the tolerable frequency will be 1 x
10-5 /yr.
It shows how taking into account other independent protection
layers (IPLs), enabling conditions and conditional modiers
can result in a lower SIL ratings being required than may have
previously been perceived.
Therefore since the frequency of the mitigated event is less
than the tolerable frequency, there is no requirement for any
further protection in this particular example.
5. CONCLUSION
The concept of ALARP has been used to determine what
safeguards would be acceptable for a gas processing, transfer
and storage facility. It has demonstrated that safety measures
that may have been perceived initially as being required would
provide little if any benet in terms of improved safety.
Therefore, through the application of qualitative, semi-
quantitative and quantied risk analysis techniques proposed
safety measures to minimize risks of major accidents from
hazardous installations can be compared and determined. The
ndings are may be surprising to operating companies in that
the budget allocated for safety measures could be signicantly
reduced.
REFERENCES
Health and Safety Executive, 2001 Reducing Risks, Protecting
People
Health and Safety Executive, 1988, The Tolerability of Risk from
Nuclear Power Stations, HMSO
Lees F P (2001), Loss Prevention in the Process Industries, 2nd
Edition
Layer of Protection Analysis (LOPA), 2001, CCPS/AIChE
*Note: This temperature loop may not be allowed by a strict interpretation of the rules for LOPA
and by a strict reading of the IEC-6150/61511 standard for counting of non-SIS instrument loops as
safeguards.
and Table 5 gives an example of criteria that are typically
applied with respect to risks to people.
An example of the application of the LOPA technique is
considered for the scenario of a high temperature in the
discharge line from a natural gas compressor, which is
housed in an enclosure. The cause of the high
temperature is failure of the after-cooler temperature
control loop that results in the design temperature of the
pipework being exceeded. This potentially leads to minor
damage to the pipework and a moderate gas leak which if
ignited would give rise to a jet fire that could result in
serious injury to exposed personnel.
The determination of the required SIL rating is illustrated
in Table 6. In this example, since scenario is expected to
result in serious injury, the tolerable frequency will be 1 x
10
-5
/yr.
Table 5. Safety Threshold Criteria

Severity Level Consequences Tolerable Frequency (/yr)
S1 Slight injury non permanent No special requirement
S2 Serious injury / death of 1 person 1 x 10
-4

S3 Death of several people (<10) 2 x 10-
6

S4 >10 fatalities Use QRA

Table 6. Example LOPA Estimation

Description Probability Frequency (/yr)
Consequence Serious injury
Tolerable
frequency

1.0 x 10
-4

Initiating
event
Failure of temperature control
loop

1.0 x 10
-1

Enabling
event
Compressor operating for 40%
of the time
0.4

Conditional
Modifiers
Probability of ignition
0.1

Probability of personnel in
affected area
0.11

Orientation of jet
0.5

Frequency of unmitigated consequence 2.2 x 10
-4

IPLs Upstream temperature trip*
0.1

Total PFD for all IPLs 0.1

Frequency of mitigated consequence 2.3 x 10
-5

*Note: This temperature loop may not be allowed by a strict interpretation of the rules for LOPA and by a
strict reading of the IEC-6150/61511 standard for counting of non-SIS instrument loops as safeguards.

It shows how taking into account other independent
protection layers (IPLs), enabling conditions and
conditional modifiers can result in a lower SIL ratings
being required than may have previously been perceived.
Therefore since the frequency of the mitigated event is
less than the tolerable frequency, there is no requirement
for any further protection in this particular example.
5. CONCLUSION
The concept of ALARP has been used to determine what
safeguards would be acceptable for a gas processing,
transfer and storage facility. It has demonstrated that safety
measures that may have been perceived initially as being
Page 263 Page 262
Is Safety a Common Sense?
A systemic Approach to Safety for
Project Management and Construction
Ahmed Hussein Al-Jaafar,
EHS Regional Manager
GE Energy Power Services
9
th
ASSE-MEC-2010-33
ABSTRACT
Many believe that SAFETY is common sense and it is
known by all of us working on projects and constructions.
So Is it really a common sense? I am convinced it is
not; rather effective Safety Management is based on a
common understanding of risks (by those involved) and
controlling these risks is brought about through good
and constant management. This paper will attempt to
demonstrate what appears to be unrelated concepts and
practices in project management and construction are in
fact interrelated and managing them will benet project
management and construction teams in achieving their
project construction targets.
1. SAFETY VS. COMMON SENSE
What is Safety? Safety may be dened as Relative
freedom from danger, risk, or threat of harm, injury,
or loss to personnel and/or property, whether caused
deliberately or by accident. But do all people on a
project site see danger, risk and potential injury the same
way? If this is true, then this understanding is common
amongst all regardless of language, level of education,
craftsmanship and the like; and therefore, safety is
common sense.
I am convinced it is not; rather effective Health and Safety
Management is based on a common understanding
of risks (by those involved) and controlling these risks
is achieved through high-quality plan and constant
management. What appears to be unrelated concepts
and practices in project management and construction
are in fact interrelated and managing them will benet
project management and construction teams in saving
time, avoid delays, prevent accidents, and leading to
achieving project targets including those set for the
projects safety performance
1.1 Perceiving Safety as Common Sense
An effective safety management strategy stars with a
genuine understanding of acceptable risk in a world where
different people perceive risks differently. Our perception
of risk is based on some kind of a frame of reference.
This frame of reference is developed through the education
we receive, the environment we grow up in, coaching
given us, and from seeing others executing construction
activities. To bring this gap, we need to have a systematic
approach in dening and managing risks.
1.2 Managing Project EHS Risks
To manage risks encountered on a project to an acceptable
level will help us achieve the projects established safety
targets; this will require us to develop a plan and make all
involved work as ONE TEAM on the following:
1.2.1 Customer/Proponent EHS Project
Requirements
The rst step in having an effective EHS Project
Management starts with a well dened Customer/
Proponent EHS or Loss Prevention Requirements and
Safety Performance Goals for the Project (in some
projects the Owner hires a Project Management
Contractor (PMC) to draw the Project requirements as
well as manage all aspect of the Project). Lacking such
a fundamental step will put the safety performance
of the project in a disadvantage or possibly on the
wrong path even before setting foot and digging the
ground for the rst time for site preparation. Some
of the questions the Customer/Proponent needs to
ask are:
As an owner or PMC of the facility, what is my
Safety Performance Goals for the Project?
As an owner or PMC of the facility, how do I plan to
communicate my Safety Performance Goals
to potential bidders?
As an owner or PMC of the facility, have I included
a section on Safety/Loss Prevention Requirements for
contractors in all contracts?
As an owner of PMC of the facility, have I specied
the minimum acceptable requirements, ways to deal
with non-compliance and assistance that I will
provide to contractors on establishing feasible and
effective safety practices for the job?
As an owner or PMC of a facility, have I an EHS
Construction Program/Manual addressing Expansion/
Project jobs?
As an owner or PMC of the facility, do I require
contractors to submit their Safety Construction Plans/
Program meeting the owners EHS Construction
Program/Manual?
As an owner or PMC of the facility, have I the right
EHS Staff for the project during the design and
construction phases?
As an owner or PMC of the facility, have I
developed criteria to help me in selecting
the Engineering, Procurement and Construction
(EPC) Contractor in terms of safety history
performance?
As an owner of the facility, have I developed an
incentive program to recognize the EPC for meeting
the safety performance goal of the Project?
As an owner or PMC of the facility, have I developed
a disincentive measures to penalize missing the
Projects Safety Goals?
1.2.2 EPC Understanding of EHS Project Requirements

It is equally important that EPC contractors bidding for
a project understand the Owners Safety Performance
Goals and expectations and include these goals in the
bidding cost of the project. EPC Project Management
must have commitment to EHS performance and welling
to set aside resources to achieve these goals. They need
to consider safety performance as one parameter of the
projects success equal in importance to meeting the
schedule and budget. Some of the questions an EPC
Contractor must answer are:
Does EPC Contractor have a written EHS Construction
Plan/Loss Prevention Program conforms to Customers
Requirements and local regulations?
Does the EHS Plan/Loss Prevention Program address
all phases and all activities encountered during the
execution of the project?
Has EPC Contractor budgeted for EHS cost including
competent and adequate number of safety staff to
execute the project safety program?
Does EPC Contractor; have developed criteria to help
select Sub-contractors, Vendors and Engineering,
Procurement and Construction (EPC) Contractor in
terms of safety history performance?
As EPC Contractor, have I communicated the overall EHS
Requirements and Expectations to Sub-Contractors and
Vendors prior to bedding on the project?
As EPC for the project, have I developed an incentive
program to recognize Sub-Contractors and Vendors
working under my direct EPC supervision for meeting
the safety performance goal of the Project?
As EPC Contractor for the project, have I developed
a disincentive measures to penalize EHS violation and
missing the Projects Safety Goals?
2. MANAGEMENT COMMITMENT
A clearly dened EHS project requirements and expectations
are crucial for the success of a project; however, without
commitment of various levels of Project Management, success
will not be achieved in meeting safety goals set for the project.
Demonstrating this commitment starts with answering the
following questions:
Have owner/proponent/PMC, EPC an EHS Policy for their
respected company and signed by senior management?
Have owner/proponent/PMC, EPC and sub-contractors
budgeted for safety and willing to committed to secure
needed resources (money, time, people, material)?
Does various level of management on the Project clear
on EHS expectations?
Does Management practice commitment to EHS and
lead by example (exhibit safe behavior, use PPE, use right
access, etc.)?
Do EPC, Sub-Contractors and Vendors are prepared to
provide competent and adequate EHS Professionals on
site?
2.2 Safety Commitment during Const-ruction and
Commission Phases of the Project
Continuous presence and visible demonstration of
Page 265 Page 264
management commitment and involvement to safety
during construction and commissioning is a paramount
to the success of the project in general and in the
safety performance in particular. This presence can be
demonstrated through:
Leading by example through exhibiting safety
attitude on the project site.
Promote safety culture on site by encouraging
safe behavior and reprimanding violations.
Secure resources needed by Safety Department.
Actively participate in Project Safety Committees.
Actively participate in Safety inspection, safety
Walkthrough, safety audits and the like.
Follow up on signicant incidents and insure
root cause analysis and recommendations are
implemented.
3. PROJECT MANAGEMENT PRE-
DESIGN AND PRE-CONSTRUCTION
REQUIREMENTS
3.1 Project Planning Meeting
A project planning meeting attended by representatives
from owner/proponent, PMC, Safety, Security to outline
project safety considerations and establishes a unied set
of instructions for the contractors should be conducted
at least 6 months prior to starting the project design
or construction. Assessment from other disciplines on
the Project Team may be needed to supplement current
knowledge of site access, power, waste disposal,
medical, re prevention support, etc. and should be
requested as needed.
A list of Mandatory Safety Requirements to be complied
with during the design and construction phases of the
contract must be detailed and sequential steps set forth.
Some of these steps includes and not limited to:
Secure all required permits including (land,
environmental assessment, and other permits)
Process Hazard Analysis (PHA) for the design
phase
Hazard and Operability (HAZOP) Study
Safety Risk Assessment for design phase and
construction phase
Job Explanation Meeting for design phase and
construction phase
Pre-Construction Kick-off safety Meeting for
design phase and construction phase
Contractors response to Project Teams hazard
identication data for design phase and construction
phase
Contractor EHS Plan for design phase and
construction phase
3.2 Job Explanation Meeting
Sufcient advance notice to the Job Explanation Meeting for
design phase and construction phase to allow availability of
team members (Client/PMC and Contractors) attendance
is needed to insure success of such meetings.
During this meeting the Owner/PMC staff from Safety,
Project and other designated representative will have to
explain the following to the potential bidders for the job
being bid:
Work scope
EHS requirements and local safety laws/regulations
The work to be done and any special safety measures
and equipment
Document submission time frame stipulated in the
contract for the awarded contractor
Potential delay of mobilization if safety documents
are not submitted in time
Owner/PMC representative will explain the process
for submitting any EHS inquires from Contractors
and the way they will be answered.
3.3 Site Tour to the Project Site
Project Team needs to organize a mandatory follow-up
site tour for all perspective contractors following the Job
Explanation Meeting. This site visit will allow those bidders
an opportunity to consider the material, manpower,
scheduling, costs and the initial Risk Assessment data
pertinent to the project.
3.4 Response to Contractor EHS Inquiries
Owner/PMC Project Team will need to incorporate all
questions received from contractors at this stage of the
project process, prepare clear answers and disseminate/
shared with all contractors without any exceptions.
4. KICK-OFF MEETING
Once a contract has been awarded and signed, a Kick-Off
Meeting shall be convened and the following should be
covered:
Owner/PMC and Contractor Project Teams key personnel
are formally introduced to each others
Owner/PMC Team will chair the meeting and will present
work scope, site access security requirement, etc.
The contractor will be advised of the requirement to
produce a Contractor EHS Plan that addresses the
requirements outlined in the Owner/PMC EHS Program/
Manual as well as being site specic. The Contractor
further advised of his responsibility to ensure that any
company subcontracted to it also complies with the
Owner/PMC Project EHS Requirements and Owner/PMC
Safety Program/Manual.
The contractor will be advised of the requirement to
produce detailed Health Risk Assessment (HRA), based on
data provided by PM Team in Job Explanation Meeting.
The detailed Health Risk Assessment is required to be
completed by the Contractor after Owner/PMC and
Contractor representatives conduct a site HRS Tour.
In the meeting it will be made clear that no commencement
of work on site until the Contractors EHS Plan and
HRA have been completed, submitted for review and
acceptance by Owner/PMC Project Team.
Owner/PMC EHS representative will cover EHS
expectations at this meeting and answer any questions.
5. CONTRACTOR(S) EHS PLAN
The EHS Plan or Loss Prevention Program, as some calls it, is
the framework and guide to all safety aspects on the project.
No mobilization or work execution at the project site is carried
without rst having a written job-specic Safety Plan or loss
prevention program submitted and accepted by Owner/PMC
for the EPC. The same rules should apply where by all sub-
contractors written job-specic Safety Plans be submitted and
accepted by the prime contractor (EPC). As a minimum, the
program should address the following:
A safety policy statement signed by senior management
Brief description of scope of work
Organization chart and key site plan
Security plan (main gate security, entry and gate pass
permits for vehicle, equipment and personnel, etc.)
Risk assessments, safety meetings and toolbox talks
Trafc plan, parking areas and house-keeping
Assignment of responsibilities (prime contractor,
subcontractor and management/supervision
Safety training (Safety Orientation/ induction, work
permit, etc.), and incentive program
Personal protection equipment (PPE)
Regular project safety audits, inspections, and incident
investigation, reporting and safety records keeping
First aid facility and re prevention
Various project shelters (rest, eating, smoking, washing,
toilet facilities, etc.)
Emergency response and evacuation
High risk activities (heavy equipment movement, lifting,
excavation, form work, welding cutting, radiography,
etc.)
Lay down yards and fabrication shops
Contractors camp sanitation and safety
Scaffolding, ladders and working at height
Work permit, lock out and tag out systems
Electrical and equipment and safe use of power tool
Commission, Start Up and Performance Run
Demobilization
6. SITE MOBILIZATIONS AND EHS PLAN
EXECUTION
Like a buttery that goes through a metamorphosis before it
reached its nal formation; a project evolves through many
phases before it becomes a running producing facility. Each
phase of a project development (i.e. mobilization, construction,
commissioning, start up, performance run and demobilization)
brings with it different type of risks. And therefore, controlling
these risks is a continuous effort and brought about through
the implementation of EHS Plan of the project. In the following
text, we will briey touch on aspects of safety that are often
overlooked
6.1 Mobilization
There is a miss conception that EHS project performance and
accountability begins when a sizable number of staff from the
Owner/PMC mobilizes to the site. This assumption and practice
have caused accidents during this phase. Even though the
limited activities starts with site preparation including ground
leveling, ground compacting, temporary fencing and setting
up the project ofces, lay down yard and the like. It is here
that implementation and execution of the EHS Plan begins.
Safety PMC/Prime Contractor and other subcontractors as
well as direct supervision staff on site are required to start
implementing and enforcing the Safety Plan. Keen attention
should be paid to the risk associated with heavy equipment/
vehicle movement, backlling, crane lifting, excavation,
and temporary power generation, security of personnel
and material. It is equally important to have medical and
re emergency system set up at sire or by utilizing available
industrial or community Emergency Response System nearby.
Page 267 Page 266
6.2 Responsibilities for Safety at Project Site
Safety does not belong to Safety Department or staff, it
is owned by all those working in the project, regardless
of their discipline or position. Every individual on the
project has a safety role to play and therefore, a clearly
written description of responsibilities and accountability
to safety for the various positions on the project is a
must. These positions that will need a safety responsibility
description are:
Owner/PM, EPC and Sub-Contractor Management
(Admin, construction)
Engineers/Supervisors (eld and non-eld)
Safety Managers, Safety Supervisors, and Safety
Ofcers
Workers
7. CONSTRUCTION TO
COMMISSIONING
This phase of the project is always critical in terms of
safety, the type and magnitude of hazard can increase
thousand folds over night. At this stage, ENERGY is
introduced which changes the rule of the game in a very
profound way. For many months, workers have been
carrying work activities in a particular way, a welder for
example have carried thousand of various welds and
cuts with no concern of the presence of ammable gas
hazards and his conception of risk cant be changed
overnight. Other disciplines and activities will face
different risks brought about by the introduction of
ammable, explosive and inert gasses into the facility.
Potential personal injury from becoming in contact with
hazardous material such as steam, caustic, acid, toxic
material will require different approach and extra effort
to control. Working around energizing equipment of
the facility is one of the most hazardous activity and
work permit and lock-out-tag-out systems must be
developed for this phase and implemented rigorously.
Fire and explosive hazard from smoking or driving and
mobile phone usage in the facility will require a stringent
control.
8 GE APPROACH
Over the years GE has developed and adopted a
methodical approach to its turbine installations. The
approach is divided into two phases, the project phase
before award of contract is called Inquiry to Order (ITO)
Process. It is basically to understand the job, evaluate EHS
risks; identify required resources, incorporate the cost of
EHS then recommends weather to bid or not to bid. If a
bidding is recommended, then it goes to approval process
and GE bids on the job. The project second phase after
award of contract is called Order to Remittance (OTR)
Process. It is for the project management to prepare for
the project and make sure that resources committed and
remain unchanged and are clearly identied in the OTR
and site budgets. It is also the time to prepare for pre-
mobilization, EHS Plan, mobilization, execution of EHS Plan
and demobilization.
8.1 GE - Inquiry to Order (ITO) Process
The EHS review strategy for this process is to minimize risks
to GE employees and potential future liabilities by limiting
to the extent of feasible highly hazardous work activities or
activities related to hazardous materials in the job scope.
Second, is to implement risk mitigation strategies where
elimination of risk is not possible. Third, is to identify costs
associated with risk mitigation strategies in order to prevent
margin erosion. And nally is to ensure that necessary
terms and conditions are included in contract language
to protect GE, limit liabilities, and provide for delays. The
following are the main parts of the ITO:
8.1.1 Initial Review EHS Activities
Review Opportunity Details
Discuss Transaction Strategy
Initial EHS Risk Screen
Bid or No Bid Decision
8.1.2 Risk & Cost Evaluation EHS Activities
Review Proposal Strategy & Bid Details
Project EHS pre-planning Risk Review & Mitigation
Needs:
Group 1 or 2 Country
Access to Medical Care
Project Security Needs
Emergency Response Needs
Safe Transportation Needs
Environmental Concerns
Unique Scope Concerns
Housing/Living Conditions
Training Needs (Offshore)
Local EHS Laws/Requirements
Customer EHS Requirements
EHS Resource Needs Etc.
Verify EHS Mitigations included in Bid Pricing
Project pre-planning EHS Release
Receive Approval to Issue Bid
8.1.3 Validate Risk & Cost Measures EHS Activities
Incorporate EHS T&Cs
8.2 GE - Order to Remittance (OTR) Process
Now that the contract is awarded, the project team, led by
the Project Manager, works insure that EHS Customer and GE
requirements are taken care off prior to mobilization, during
mobilization, execution and demobilization phases of the
project. The following is a list that gives us an idea of these
aspects of EHS.
8.2.1 Site Pre-Mobilization EHS Activities
Project EHS Plan nalizedCustomer CTQs and Risk
Mitigation Methods included (View Project EHS Plan)
Site Survey & Risk Assessment
Project team briefed & Trained on Site Safety Plan, project
risks and specic requirements
Project-specic EHS training completed (View EHS
Training Matrix)
Regular customer communications
Detailed planning of higher risk activities
Travel Security Process Followed
8.2.2 Mobilization/Execution EHS Activities
Project start-up to discuss operating arrangements
Site Safety Plan & GE Global EHS Program Execution
Customer Permit to Work Process implemented
Task Hazard Analyses & Job Safety Analyses completed
Daily
Daily toolbox talks / weekly safety meetings conducted
Regular project audits, inspections, and monitoring
Extensively Trained Field Engineers and Technical Advisors
execute EHS Plan
Project EHS Resource Support and Management
Use of Qualied and Certied Afliate Organizations
drive consistent EHS expectations
Focused management of Contractor Safety & High Risk
Activities
8.2.3 Demobilization EHS Activities
Project Closeout/Post-mortem meeting with customer
focus on lessons learned
Review of execution against Customer CTQs
Project EHS documentation retained with job les.
Internal EHS Quality Reviews
Reduced long term customer costs through effective
management of EHS liabilities
9. GE CUSTOMER FEEDBACK
In addition to the Closeout/Post-mortem meeting with
customer and focusing on lessons learned during the project;
GE is also very keen to know how its customers evaluate the
service GE provides.
Therefore, after every completion of a project or other work,
GE seeks the Customer feedback through a process called the
Net Promoter Score (NPS).
It is based on asking customers one simple question: Would
they recommend or do business with GE again on a scale
from zero to ten? This communicates to GE the quality of the
relationship with its customers and gives GE an indicator of
customer loyalty.
10. CONCLUSION
As one can see, Safety is not something that can be pulled
off the cuff; instead it is a process and it entails knowledge,
planning, implementation and follow-ups. It requires necessary
resources, commitment and professionals to monitor and
provide assistance at all levels. In other works, not all people
know this process, if they did, then Safety is a common since,
and there is no need for any of what we discussed in this
paper. So, ask yourself again and tell me if Safety is common
sense?
Page 269 Page 268
The S.O.S. System Combining Hazard Recognition
and Behavioral Observation
Wayne P. LeBlanc,
President and CEO, W C Safety Systems International, Inc.
9
th
ASSE-MEC-2010-34
ABSTRACT
Heart disease is the biggest killer in the world. Every
year Companies should consider using one continuous
thought process from task inception, planning, and
hazard recognition through behavioral observations. The
same system should be used for company employees as
well as contractor employees.
The S.O.S. System was originally designed for BP. It
assisted employees in perfecting a Job Safety/Hazard
Analysis or conducting a pre-job meeting. It is also
used for performing Behavioral Observations. The
S.O.S. System is icon-based and is easy to learn, easy
to participate in, and works in any language. Data is
then collected and disseminated through the included
Tracking and Trending process.
KEYWORDS
Hazard Recognition, Job Safety/Hazard Analysis, BBS,
Behavioral Observation System, Language Difculties,
Good or Bad Attitudes.
1. OVERVIEW
This paper is presented to demonstrate the advantages
of combining many of the elements of safe job
planning and performance into one consistent thought
process. We will be discussing the S.O.S. System as
it demonstrates how such an integrated system might
look.
Ultimately, whether a company uses the S.O.S. System
or another system, this information should be thought
provoking and lend itself to creating discussion of what
is possible within your company.
2. BACKGROUND
Many companies use one system for Hazard Identication,
one system for a Job Safety Analysis/Job Hazard Analysis
(JSA/JHA), and still another system for Behavioral
Observations. Not only is this cumbersome and potentially
confusing, but employees have difculty becoming truly
procient in two or three disciplines simultaneously. It is far
more benecial to teach employees one system to be used
throughout.
Language difculties inherent to a multinational
workforce
make the job of providing a safe workplace even more
difcult. Words and concepts are often mistranslated and
robbed of their effectiveness.
Employee attitudes also play a vital role in a companys
success. Good attitudes create positive workplaces. Poor
attitudes create hazardous workplaces. An employees
attitude is usually shaped by his/her background, the
home environment, the work environment, or by one or
more workers. Additionally, an employees attitude may
be affected by confusion or misunderstanding in the
workplace.
A company may have the best tools and equipment, a well
trained workforce, and superior safety systems, but one
employee with a poor attitude may exhibit poor behavior
and still cause an incident. One employee with a poor
attitude has the potential to infect many others.
Our attitude determines our behavior. The better job we do
in communicating with employees, the better opportunity
we have to create a safe and positive work environment.
3. THE S.O.S. SYSTEM
The S.O.S. System was created to assist employees in nding
the hazards to our routine and non-routine jobs. It provides a
systematic mental checklist for employees to search for hazards
by groupings thus simplifying their hazard recognition and
behavioral observation processes. All this is accomplished while
minimizing language difculties.
3.1 Origin of the System
Years ago BP was having difculty on a well they were drilling
in the Gulf of Mexico. The drilling contractor had a trained
workforce, had good safety systems in place, and in general
had a good overall safety attitude among the employees.
However, the crew began having numerous near-misses. Upon
review it was discovered that their JSAs were decient in
recognizing all hazards associated with the task. While hazards
and control measures such as watch for pinch points and wear
the appropriate PPE were noted, many hazards associated with
the routine tasks were being overlooked. The employees simply
did not recognize the everyday hazards always around them
and no action was taken to mitigate or control these hazards.
The majority of incidents typically occur while employees are
performing their routine or everyday tasks. Unfortunately, these
were the types of hazards that were overlooked.
BP asked if we could devise a system that would enable
employees to search for hazards in any task. A guide if you will.
We determined that this system would have to be easy to use
and understand, work for any task, integrate with a companys
existing systems, address language difculties, and possess
portability.
The result is the S.O.S. System.
3.2 Situations of Potential Accidents
There are ten causes or contributing causes for most incidents.
The logic behind the S.O.S. System is quite simple. Since
there are only ten causes of incidents, if we search for and
control the hazards associated with each of these causes, we
should reduce or eliminate incidents. We call these causes the
ten Situations of Potential Accidents. We have assigned
a picture or icon to each of the ten. Following is a list of the
Situations of Potential Accidents and a brief explanation for
each. Figure 1 also shows the associated icons.
3.2.1. Operating Without Proper Training or
Authority;

Doing a job we are not trained to do; Doing someone
elses job; Doing a job we dont fully understand.
3.2.2. Failure to Lock or Secure;

Not using proper Lockout/Tag Out procedures; Failure to
secure a load; Failure to use barrier tape or guards.
3.2.3. Failure to Warn or Communicate;

Not posting warning signs; Failure to remove unnecessary
warning signs; Incorrect hand signals; malfunctioning
radio or telephone equipment.
3.2.4. Unsafe Loading or Overloading;

Overloading a lifting device or slings; Overloading power
tools; Overloading electrical circuits; Overloading our
bodies; Overloading our minds.
3.2.5. Unsafe Speed;

Running rather than walking; Working too fast; Driving
too fast or too fast for the conditions.
Figure 1
Page 271 Page 270
3.2.6. Additional PPE;

Not wearing the basic PPE; Not wearing additional
PPE required for the job such as fall protection,
breathing mask, chemical gloves, etc.
3.2.7. Using an Improper or Damaged Tool;
Using a damaged tool; Using the wrong tool for
the job; Using modied tool such as cheater
pipe; using tools without guards.
3.2.8. Poor Housekeeping;

Any slips, trips, fall hazards? Spills; Blocked
passageways; No escape route.
3.2.9. Improper Positioning;
Lifting in the improper position; Standing in the
line of re; Pinch points; Between a moving and a
xed object; Under a load.
3.2.10. Conditions of People;
Mental condition; Distracted employee; Mental or
physical fatigue; Unsteady employee.
By assigning an icon to each of the ten Situations of
Potential Accidents (gure 1), the system becomes
easy to understand and easy to learn. Language barriers
no longer exist. A padlock in any language is still a
padlock.
Each icon or picture represents a category of hazards to
look for. Regardless of the type of work the employee
is performing, by using categories to search for hazards,
the system will always be effective. Ideas conveyed
through pictures are far more effective than using words
or phrases alone.
The icons are taught using a memory system. Learning
through a memory system is fun, employees become
fully engaged, and there is a lasting benet to training
in this manner. It is impractical to ask our employees to
carry excess paperwork into the eld. If the paperwork is
lost, so is the information. A memory system cannot be
lost. It is available and can be used at any time by simply
recalling the icon.
4. THE S.O.S. JSA SYSTEM
When completing JSAs most employees use what we
refer to as a random approach to nding hazards. The
hazards recognized are those which we remember at that
point in time. Or worse, employees use a pre-congured
JSA as if nothing ever changes from location to location.
The S.O.S. JSA System uses a targeted, systematic
approach to nding hazards. The Situations of Potential
Accidents is used as a checklist, similar to the manner in
which a pilot uses a pre-ight checklist. The pilot knows
what to check, the checklist is simply a reminder so he
does not overlook an item. Our checklist works the same
way, and our checklist is in the employees mind in the
form of ten pictures. Of course there are ample workplace
reminders such as posters, decals, etc. but the basics are
rmly implanted.
Once a step to the job is identied, the employee starts
with number one, the crane operator, (gure 1) and asks
if any hazards are present from training or authority. If
so, he determines the method to control or eliminate the
hazard. Number two, the padlock, directs him to look
for hazards associated with lock or secure. Again, if a
hazard exists, he determines how to control or eliminate
it. Number three, the warning triangle, directs him to look
for hazards associated with warn or communicate and so
forth. The employee continues through all ten pictures in
a similar fashion. Once nished with number ten, he then
proceeds to the second step of the job and begins again
with number one.

In this manner most hazards are recognized and controlled.
Of course, the system is only as good as the person utilizing
it. But even an employee with a limited understanding of
how to prepare a quality JSA would still nd more hazards
using a systematic method then he would without it.
The S.O.S. JSA System works equally well when a
formal JSA is not required or when a simple job is being
undertaken. In this case the employees should conduct a
pre-job or tailgate or toolbox safety meeting. Using the
Situations of Potential Accidents as a guide, employees
discuss the job and recognize hazards by again following
the ten icons.
5. THE S.O.S. BEHAVIORAL
OBSERVATION SYSTEM
Since we recognized hazards and planned our job using
the Situations of Potential Accidents as a guide, it makes
perfect sense to observe based on how we planned.
The Situations of Potential Accidents provides a template to
insure that employees behave as they agreed to behave during
the JSA or pre-job meeting. The employees are again, using the
same thought process throughout the entire job.
There are four steps to a successful behavioral observation
system. They are:
Observe our surroundings
Intervention
Recordation
Tracking and trending
5.1 Observe Our Surroundings
When we walk through a location we will usually nd hazards.
But are we nding all of the hazards? To become a more
effective observer requires training and repetition. Using the
Situations of Potential Accidents as a tool, we begin to view
our workplace differently. We become more focused on what
could happen. And that makes us better observers.
Figure 2
Imagine that you heard a story of someone backing their
automobile from their driveway and running over a child. You
formed a mental picture of that incident. For a period of time
you remembered to look for a child before backing. As time
progresses though, you became less and less aware of looking
before backing until the thought was probably not there. If
you then placed your picture of the incident in your vehicle
you would be reminded to again look before backing. The
icons work the same way. In discussions prior to the job the
employees see the icon and relate a hazard or hazards to it.
As employees are working, they remember the icon and are
reminded of the hazards they discussed earlier. The more we
work with the system, the better observers we become.
The S.O.S. Observation Card provides a guide to assist us
with our observations. Not only does it list the Situations of
Potential Accidents but it also lists sub areas with specic
behaviors. See gure 2.
5.2 Intervention
Once an observation is made of either proper or at-risk
behavior, it is time to intervene or have a discussion with
the employee observed. There are specic steps to follow to
conduct a proper intervention. For the purposes of this paper
we will not discuss these specics here.
5.3 Recordation
Completion of the observation card is not the ultimate goal
of a behavioral observation process. Making the observation
and removing an employee from danger is the primary
focus. Recordation is simply a report of the activity we have
performed.
After making an observation and speaking with the observed
employee, then and only then do we complete the S.O.S.
Observation Card. (Figure 2)
Notice that the S.O.S. Observation Card not only contains
the same Situations of Potential Accidents used throughout,
but also contains sub areas under each. For example, an at-
risk observation for Unsafe Loading or Overloading (block
number 14) would be further explained by also checking the
sub area Overloading Body, if someone was attempting to lift
a heavy object alone.
These sub areas will serve an important function in utilizing
the tracking and trending data.
Page 273 Page 272
5.4 Tracking and Trending
Completed observation cards contain valuable
information. Due to limited administrative employees,
many companies are unable to make effective use of
this valuable data. At times they may only be able to
count how many cards are turned in as a measure of the
programs success.
We feel Tracking and Trending is a vital portion of the
process so we provide this service for our clients as part of
our system. Completed observation cards are collected,
reviewed, and discussed daily at each location. Weekly,
the completed cards are forwarded to our ofce to be
entered into a custom database.
Each month, a report is prepared showing the number
of proper and the number of at-risk observations that
were made; the number of observations made attributed
to each of the ten areas for both proper and at-risk
behaviors; the number of observations made for each
sub-area; and trending data over several months. Figure
3 shows a partial monthly report.
By looking at the data over a period of months, trends
often appear that allow us to take action prior to having
an incident. For example, if a signicant number of
observations are recorded for Improper Positioning
(number 19) with a sub area of Pinch Point Hands, this is
a signal to commence a hand safety awareness program
at once.
Conversely, if a signicant number of observations are
made for proper housekeeping (number 8) with a sub area
of walkways, this is a sign to launch a recognition program
for the positive efforts being made to maintain clean and
clear walkways.
Tracking observations can also provide proof that a corrective
action is indeed being implemented. If hand injuries begin
to occur, you will probably launch an initiative to increase
focus on hand safety. You should then see a spike in the
number of observations for proper (number 9) or at-risk
(number 19) Positioning with a sub area of Pinch Points
Hands. This provides proof that more attention is being
given to hand safety.
6. SUMMARY
There are tangible benets to the company, the employees,
the customer, the contractors, and everyone involved to
join together in preventing incidents. Creating a task-
based system that is easy to learn, easy to understand, and
easy to participate in, will more readily receive employee
buy-in.
Whether using the S.O.S. System or an alternate
system, combining Hazard Recognition, JSA, Behavioral
Observation and Tracking and Trending into one continuous
thought process has many positive benets. Our success is
determined by how well we protect our most valued asset
our people.
SH&E Leading & Lagging Indicator Dynamics
Troy OConnor,
Managing Director
Easy Risk Solutions Pty Ltd., Australia
9
th
ASSE-MEC-2010-35
ABSTRACT
So we are all safety, health and risk professionals but do
manage our performance based on a set of dened SH&E
performance indicators which are aligned with our corporate
objectives, targets and strategy? Should we use leading or
lagging SH&E indicators or a combination of both? Do these
risk indicators give your company the data required to report
our Social performance in the international market?
This paper discusses how to develop, build and implement
a Leading and Lagging SH&E indicator program through a
Balanced Scorecard approach which can in turn be thought
of as the strategic chart of accounts for an organization.
It captures both the nancial and the non-nancial elements
of a companys strategy, leading and lagging indicators and
discusses the cause and effect relationships that drive business
(SH&E) results. It allows, for the rst time, an organization to
look ahead - using leading indicators - instead of only looking
back using lagging indicators. The Balanced Scorecard puts
strategy - the key driver of results today - at the centre of the
SH&E management process.
The leading and lagging indicators used in todays competitive
market need to also support the ability to report performance
under the triple bottom line reporting requirements (Financial,
Environmental and Social) aligned with the Global Reporting
Initiatives (GRIs). With this approach adopted companies will
be able to benchmark SH&E performance as the available
performance data and output will be the same irrespective
of what country or countries you operate in.
KEYWORDS
Safety; Social; Balanced Score Card; Global Reporting
Initiatives; Leading / Lagging Indicators; Triple Bottom Line

1. INTRODUCTION
In 2006 ERSG conducted a research project in Australia
hypothesizing that all Safety Professionals developed budgets
and safety initiatives in line with corporate objectives and targets
supported by performance indicators. The short research based
on a response from 1241 companies surveyed showed the
following:
181 companies formally aligned budgets and safety
initiatives with corporate objectives and targets supported
by performance indicators (leading / lagging scorecard)
reported as part of the GRI.
753 used gut feel to decide what safety initiative to
take and performance indicators (lagging) were used by
management for their own gain not reected in GRI.
307 were mostly not aware of the use of leading
indicators, balanced score cards or the Global Reporting
Initiatives (not listed companies) as a diver of SH&E
The ndings were surprising as we had assumed that safety
professionals (Loss Prevention staff) used tangible data gained
from balanced score cards as a driver to motivate budgets.
The fact that the majority of companies, especially non-listed
companies, would allocate budgets on what the safety (loss
prevention) thought was the latest requirement or even on
lagging indicators was disappointing.
2. PERFORMANCE INDICATORS / SCORE
CARDS
2.1 What are balance score cards?
Balanced Score Card Management practice that
attempts to complement drivers of past performance (nancial
measures) with the drivers of future performance, such as
customer satisfaction, development of human and intellectual
Page 275 Page 274
capital, and learning. Standard balanced scorecards do
not include environmental considerations. Proposed by
Robert Kaplan (co-inventor of activity based accounting)
and David Norton in 1996.
2.2 What are performance indicators?
Performance Indicators A denition from the
Ofce of Public Management (NSW Australia) is: A
performance indicator denes the measurement of a
piece of important and useful information about the
performance of a program expressed as a percentage,
index, rate or other comparison which is monitored
at regular intervals and is compared to one or more
criterion.
Leading Metrics a forward looking set of metrics
which indicate the performance of the key work
processes, operating discipline, or layers of protection
that prevent incidents.
Lagging Metrics a retrospective set of metrics
that are based on incidents that meet the threshold of
severity that should be reported as part of the industry-
wide process safety metric.
3. DEVELOP, BUILD AND IMPLEMENT
A LEADING AND LAGGING SH&E
INDICATOR PROGRAM THROUGH A
BALANCE SCORECARD
3.1 Developing a Leading / Lagging System
An essential element of any improvement program is the
measure of existing and future performance. Therefore,
to continuously improve upon SH&E performance, it
is essential that companies in all industries implement
effective leading and lagging safety metrics using a
well constructed balanced score card. At the top of
the Performance Indicator food chain lays the Global
Reporting Framework with all other performance
indicator guides developed to support this reporting
requirement. The PIs should always be aligned with
the company corporate strategy. The Loss Prevention
professional should have a set of well dened objectives
and targets which are extrapolated into measurable
units in the form of a balanced score card.
3.2 What is the GRI Framework?
The (Global Reporting Initiative) GRI Reporting Framework
is intended to serve as a generally accepted framework for
reporting on an organizations economic, environmental,
and social performance. It is designed for use by
organizations of any size, sector, or location. It takes into
account the practical considerations faced by a diverse
range of organizations from small enterprises to those
with extensive and geographically dispersed operations.
The GRI Reporting Framework contains general and sector-
specic content that has been agreed by a wide range of
stakeholders around the world to be generally applicable
for reporting an organizations sustainability performance.
The information or data you create will now be fed into a
centralized Risk data base which will impact on the level of
risk being experienced by your company so issues such a
common language and centralized data capture will allow
your organization to feed you with intelligence relating
to the issues you need to focus on and spend your budget
on.
Indicator Protocols exist for each of the Performance
Indicators contained in the Guidelines. These Protocols
provide denitions, compilation guidance, and other
information to assist report preparers and to ensure
consistency in the interpretation of the Performance
Indicators. Users of the Guidelines should also use the
Indicator Protocols.
3.3 Management Approach and Performance
Indicators
Core Indicators have been developed through GRIs multi-
stakeholder processes, which are intended to identify
generally applicable Indicators and are assumed to be
material for most organizations. An organization should
report on Core Indicators unless they are deemed not
material on the basis of the GRI Reporting Principles.
Additional Indicators represent emerging practice or
address topics that may be material for some organizations,
Figure I: The GRI Reporting Framework
but are not material for others. Where nal versions of Sector
Supplements exist, the Indicators should be treated as Core
Indicators.
3.4 Getting started
There are 2 types of generic approaches to developing safety
metrics depending on what you are trying to improve:
FOCUSED: focused application on a specic loss or
exposure potential or actual
ORGANIZATIONAL: broad application of potential loss
or exposure areas
3.5 Building your approach
Key Selection Criteria
Correlate leading and lagging indicators
Peel back from loss and exposure analysis, accident
investigations, etc.
Thorough analysis to select best leading indicators that
will drive positive change (management levers)
Make this a group effort. People will own the issues and
actions. Continue on a regular basis
Be comprehensive in approach (training w/out
enforcement wont work)
Warning: watch what you measure (ex. # Good
performance reviews per manager)
Drive accountability and chareback with leading
indicators
Continuously test, review and adjust leading and lagging
Indicators based on Results and changes in corporate
strategy.
Figure II: GRI PIs
extract relating to S&H
Figure III: Safety Metrics
Pyramid
3.6 What Do RM Leading & Lagging Indicators look
Like? Examples
3.7 Slip Fall Program
3.7.1 Engineering
Floor Design
Floor Condition
Signs & Warning
Maintenance and Cleaning
3.7.2 Employees
Training
Accountability
Shoe Program
3.7.3 Post Incident
Investigation
Claims Management
3.8 Leading OH&S Indicators
3.8.1 Incidents
Percent of reported injuries investigated by supervisors
Percent identied corrective actions completed
Percent identied corrective actions completed for
reported
Concerns / complaints
Percent near misses investigated
Percent of safety related work orders completed in 2
business days
Percent of work place injuries reported within 2 days
3.8.2 Training
Percent of training completed for staff that require safety
training
Percent of staff receiving back safety training
Percent of monthly safety talks completed
Percent of new employees that have completed new
Employee orientation
3.8.3 Industrial Hygiene
Percent of employees in hearing conservation program
receiving annual audiogram
Percent of employees in respiratory protection program
that have a physicians written recommendation on le
Page 277 Page 276
Percent of positions using hearing protection that
have a noise exposure data on le
Percent of positions using respirators that have a
exposure data on le
3.8.4 Hazard Assessment
Percent of planned safety audits completed
Percent of identied safety hazards corrected
within set period of time
Percent of ergonomic evaluations conducted
Percent of new employees work stations
evaluated
Percent of positions with job safety analysis (JSA)
conducted
Percent of equipment inspected that has guards
in place and functional
Percent of new operational changes that included
hazard analysis
Employees in hearing conservation program
receiving annual audiogram
3.8.5 Policy / Program
Percent of safety behavior observations consistent
with expectations
Percent of scheduled safety committee meetings
held
Percent committee member attendance at safety
committee meetings
Percent of safety committee minutes published
within 1 week
Percent preventative maintenance completed
versus planned
Percent MSDS on hand for chemicals used
Percent of MSDS received for new chemicals being
used
Number evacuation drills completed compared to
required
Percent safety policies reviewed annually
Fire extinguisher inspections
Percent of organizations annual safety goals
achieved
Percent of position descriptions that outline health
and safety responsibilities
Percent of employee drivers with valid drivers
license
Percent of positions that have physical demands
identied
3.9 Lagging OH&S Indicators
3.9.1 Lagging Indicators
# of incidents reported
# of injuries reported
# of needle sticks
Equipment damage reports
OH&S recordable incident rate
OH&S days away from work [LOST TIME]
Worker Compensation claim rate
Worker Compensation costs
3.10 Summary of Key Concepts
Focus on Risk Management Quality Leading Indicators
(Culture, Engineering, Training, etc.) to Drive Down
Lagging Indicators (Incidents, losses, etc.)
Choose Leading Indicators Carefully
Thorough Causal Analysis of Past losses and
Potential Exposures
Choose indicators that will drive positive
behaviors and improvements
Make sure they correlate to the lagging
indicators
Be comprehensive in approach (training w/out
accountability is worthless)
Be Practical
Must choose approach that ts with culture
and needs of organization
Measure the Big ticket items The ones
that will cause the most change in lagging
indicators.
Be outcome focused. (Change Employee
Perception)

Figure IV: What do Leading Indicators look like?
Figure VI: Process Safety Incidents & Severity Categories
Figure V: Balanced Score Card Template
All leading and lagging indicators will be incorporated in the
balanced score card. A description of the overall process of
how you would build a Balanced Scorecard is described below.
The process consists of seven steps over three phases:
Phase I: The Strategic Foundation
Step1: Communicate and align the organization around a
clear and concise strategy. This is the fundamental starting
point behind everything else. Your strategy is what feeds the
Balanced Scorecard.
Step 2: Determine the major strategic areas or scope for getting
the organization focused on those things the organization can
actually do.
Step 3: Build a strategic grid for each major strategic area (step
2) of the business. Out of all the steps in the entire process, this
can be the most difcult since we must take our entire strategy
(step 1) and transform it into specic terms that everyone
can understand. And everything must be linked to form one
complete strategic model.

Phase II: Three Critical Components
Step 4: Establish Measurements: For each strategic objective on
each strategic grid, there needs to be at least one measurement.
Measurement provides the feedback on whether or not we are
meeting our strategic objectives.
Step5: Set Targets for each measurement: For each measurement
in your scorecard, establish a corresponding target.
Step 6: Launch Programs: Things will not happen unless the
organization undertakes formal programs, initiatives or projects.
This effectively closes the loop and links us back to where we
started driving the strategy that was formulated in phase I.
Phase III: Deployment
Step 7: Once the Balanced Scorecard has been built, you need
to push the entire process into other parts of the organization
until you construct a single coherent management system. This
pulls everything together, allowing successful execution of your
strategy.
The 7 steps are required to build a successful balanced
score card
4. CENTER FOR CHEMICAL PROCESS
SAFETY (CCPS)
In the interest of the large numbers of delegates working
in or related industry I have added a section in this paper
describing the work done by the CCPS on Performance
Indicators for the Chemical Industry: In 2006, the CCPS
Technical Steering Committee authorized a project, and the
creation of a project committee, to develop a Guideline book
for the development and use of Leading and Lagging Process
Safety Metrics. In the initial meeting, the committee identied
that the key breakthrough opportunity for industry was the
development of an industry lagging metric that would become
the benchmark across the chemical and petroleum industry
for measuring process safety performance. To achieve this
objective, it would become essential to involve representatives
and members from each of the major chemical and petroleum
trade associations as well as other key stakeholders. CCPS
elected to extend invitations to a number of organizations,
soliciting their involvement in this project.
Page 279 Page 278
4.1 Lagging Indicators
4.1.1 Industry Process Metrics
It is recommended that companies implement and
publicly report the following three process safety
metrics:
Total Count of Process Safety Incidents
(PSIC): The count of all incidents which meet
the denitions of a PSI.
Process Safety Total Incident Rate (PSTIR):
The cumulative (annual) count of
incidents normalized by man-hours.
Process Safety Incident Severity Rate
(PSISR): The cumulative (annual) severity-
weighted rate of process safety incidents.
To assist in benchmarking, it would be benecial
if trade associations or consortiums collect and
publish this information for member companies.
4.2 Leading Indicators
4.2.1 Mechanical Integrity
A. (Number of inspections of safety critical
items of plant and equipment due during
the measurement period and completed on
time / Total number of inspections of safety
critical items of plant and equipment due
during the measurement period) x 100 %.
This metric is one measure of the effectiveness
of the process safety management system to
ensure that safety critical plant and equipment
is functional.
This involves collecting data on the delivery of
planned inspection work on safety critical plant
and equipment.
The calculation of the metric involves
Dene the measurement period for inspection
activity.
Determine the number of inspections of safety
critical plant and equipment planned for the
measurement period.
Determine the number of inspections of
safety critical plant and equipment completed
during the measurement period.
Inspections not undertaken during the previous
measurement period are assumed to be carried
forward into the next measurement period.
4.2.2 Action Items Follow Up
(Number of past due and /or having approved
extension of process safety action items / Total
number of active or open action items) x 100 %.
This metric may be congured as one aggregate
metric or several individual metrics of specic past
due items, such as:
(Number of past due and/or having approved
extension of audit action items / total number of
audit action items active or open) x 100 %
extension of PHA action items / total number of
PHA action items active or open) x 100 %
(Number of past due and/or having approved/
extension of incident investigation action items
total number of incident investigation action
items active or open) x 100 %
Number of outstanding incident investigation
action items closed vs. total number of incident
investigation action items raised during the
period.
extension of regulatory issue / action items /
total number of PHA action items active or
open) x 100 %
4.2.3 Management of Change
Percentage of audited MOC's that satised all
aspects of the sites MOC procedure.
This metric measures how closely the sites MOC
procedure is being followed.
Involves a periodic audit of completed MOC
documentation. Steps in conducting the audit:
Dene the scope of the audit: time frame,
frequency, and operating department(s).
Determine the desired and statistically-signicant
sample size. This can be done using widely-
available tables, based on the total number of
MOC documents in the population.
Review the completed MOC documentation,
including backup documentation such as the
hazard review and updated Process Safety
Information such as operating instructions and
P&ID's.
Calculate the metric:

% of MOC's properly executed = 100 x (# of properly
executed MOC's) (total # of MOCs)
Percentage of audited changes that used the sites
MOC procedure prior to making the change.
This metric measures how well a department/site (i)
recognizes changes that require use of the sites MOC
procedure and (ii) actually makes use of the
procedure prior to implementing changes.
Involves a periodic audit of the changes made in a
department/site and a determination of which changes
required use of MOC. Steps in conducting the audit:
Dene the scope of the audit: time frame and
operating department(s).
Identify the types of changes that may have
bypassed the sites MOC procedure, based on how
the sites MOC procedure denes changes
(see denition below).
Identify changes that bypassed the MOC procedure.
This can be done by:
o Reviewing maintenance work orders,
o Reviewing documentation from capital and
maintenance projects,
o Reviewing Distributed Control System
programming changes, and/or
o Interviewing department personnel.
Calculate the metric:

% of changes using MOC = 100 x (# of MOCs). (# of
MOCs + # of changes that bypassed MOC)
Process Safety Training & Competence for PSM
Critical Positions (Number of Individuals Who
Completed a Planned PSM Training Session On-
time) / (Total Number of Individual PSM Training
Sessions Planned)
Denitions:
PSM Critical Position:

Any facility position that includes key activities,
tasks, supervision, and/or responsibility for
component procedures critical to the prevention of
and recovery from major accident events.
Planned PSM Training Session:

A specic exercise designed to enhance an individuals
knowledge, skill, and/or competency in a PSM critical
position for areas that directly inuence the prevention
of and recovery from major accident events. A single
individual may have multiple training sessions during a
reporting period. A single exercise may involve multiple
individual training sessions (e.g., a training class with
multiple individuals).
Training Competency Assessment
(Number of Individuals Who Successfully Complete
a Planned PSM Training Session on the First Try) /
(Total Number of Individual PSM Training Sessions
with Completion Assessment Planned for that time
period)
Denitions:
Successful Completion:

A passing grade on an exam or competency assessment
for which there is no requirement to repeat/redo the
training, exam, competency assessment or any part
thereof.
Training Session with Completion Assessment: A
planned PSM training session for which there is a
required demonstration of knowledge or skill through
an examination or competency assessment.
Failure to follow procedures / safe working practices.
(Number of safety critical tasks observed where all
steps of the relevant safe working procedure were not
followed / Total number of safety critical tasks observed)
x 100%
To determine by work place observation of tasks
identied as being safety critical that have a relevant
safe operating procedure, whether all of the relevant
steps are followed.
4.2.4 Safety Culture
Safety Culture

A mechanism for measuring the effectiveness of process
safety culture within chemical process organizations
would be to adopt the use of a cultural survey of the
type included as Appendix G and discussed throughout
Page 281 Page 280
the Baker panel report, used to determine
the adequacy of the safety culture at BPs US
reneries.
The chemical and downstream oil processing
sectors should consider use of this or similar
survey. If used, the safety culture survey should
be undertaken in such a way that the results are
made anonymous, so that respondent cannot
be identied and that there will be no negative
judgment on respondents that may affect
their willingness to participate or their level of
openness.
Undertaking a culture survey of this nature
will not enable comparison of results between
organizations because of the many other factors
that can affect the results, but it will be of benet
in determining changes within an organization
over time.
5. DO YOU MANAGE OUR
PERFORMANCE BASED ON A SET
OF DEFINED SH&E PERFORMANCE
INDICATORS WHICH ARE ALIGNED
WITH OUR CORPORATE OBJECTIVES,
TARGETS AND STRATEGY?
Research has shown that only 14.58% of respondents
in the Australian research actually have dened SH&E
leading performance indicators that are aligned with
their companys corporate objectives, targets and the
strategy.
6. SHOULD WE USE LEADING OR
LAGGING SH&E INDICATORS OR A
COMBINATION OF BOTH?
It is imperative that both leading and lagging indicators
are dened and used to determine our performance.
The indicators must as the key driver and as such be the
centre of the SH&E Management process.
7. DO THESE RISK INDICATORS
GIVE YOUR COMPANY THE
DATA REQUIRED TO REPORT
OUR SOCIAL PERFORMANCE IN THE
INTERNATIONAL MARKET?
Most safety professionals have not yet been exposed to
the impact of GRIs as this requirement is not part of the
Saudi stock exchange to date.
8. INFORMATION AND QUESTIONS
For more information, contact the ERS Pty Ltd, Australia,
Managing Director, Mr. Troy D. OConnor, at: troy@ersgltd.
com .
REFERENCES AND CITATIONS
1. Banham, R., Enterprising views of risk management,
Journal of Accountancy, June 2004, 65-71.
2. Baranoff, E.G., Risk management: A focus on a more
holistic approach three years after September 11,
Journal of Insurance Regulation, 71-81.
3. Bowling, D.M., Rieger, L., Making sense of COSOs
new framework for enterprise risk management,
Bank Accounting & Finance, February-March 2005,
29-34.
4. Bowling, D.M., Rieger, L., Success factors for
implementing enterprise risk management, Bank
Accounting & Finance, April-May 2005, 21-26.
5. Dickinson, G., Enterprise risk management: Its origins
and conceptual foundation, The Geneva Papers on
Risk and Insurance 26:3, 2001, 360-366.
6. Levinsohn, A., How to manage risk Enterprise-
wide, Strategic Finance, Nov. 2004, 55-56.
7. Millage, A., ERM is still in its infancy, Internal Auditor,
Oct 2005, 16-17.
8. Smiechewicz, W., Case study: Implementing
enterprise risk management, Bank Accounting &
Finance 14:4, 2001, 21-27.
9. Stroh, P.J., Enterprise risk management at United
Health Group, Strategic Finance, July 2005, 27-35.
10.Beasley, M.S., Clune, R., Hermanson, D.R., ERM: A
status report, Internal Auditor, Feb 2005, 67-72.
11.Kleffner, A.E., Lee, R.B., McGannon, B., The effect
of corporate governance on the use of enterprise
risk management: Evidence from Canada, Risk
management & Insurance Review 6:1, 2003, 53-73.
12.Schaefer, A.G., Cassidy, M., Internal audits and
ethics education: A holy alliance to reduce theft and
misreporting, Employee Relations Law Journal 32:1,
2006, 61-84.
13.Walker, .L., Shenkir, W.G., Barton, T.L., ERM in practice,
Aug 2003, 51-55.
14.Robert, .S. , Kaplan, David. P., Norton, The Balanced
Scorecard, Translating Strategy into Action, 1996.
15.Thomas, .R., Krause, Forward by John L. Henshaw,
16.Leading with Safety, 2005
17.Beasley, M.S., Bradford, M., Pagach, D., Outsourcing? At
your own risk, Strategic Finance, Jul 2004, 23-29.
18.Beneda, N., Managing an asset management rms risk
portfolio, Journal of Asset Management 5:5, 2005, 327-
337.
19.Dash, G.H., Jr., Kajiji, N., A nonlinear goal programming
model for efcient asset-liability management of
property-liability insurers, INFOR 43:2, 2005, 135-156.
20.Rhoden, T., Safety software: Questions to consider before
making a purchase, Professional Safety, Mar 2006, 52-
55.

Process Safety Leading and Lagging Metrics
...You don't improve what you don't measure
(Initial Release Dec. 20, 2007)
Mahesh Agrawal (Reliance Industries), Steve Arendt (ABS
Consulting), Christie Arseneau (PPG Industries, Inc.), Randy
Barton (Albemarle), Michael Broadribb (BP ), Jon Carter (UK
Health & Safety Executive), Elroy Christie (Honeywell Specialty
Materials), Susie Cowher (INEOS Olens & Polymers USA),
Glen Erwin (United Steelworkers, USW), Eric Freiburger
(NOVA), Harry Glidden (DuPont), Kent Goddard (Solutia),
Richard Grifn (ChevronPhillips Chemical), Kenneth
Harrington (ChevronPhillips Chemical), Steven Hedrick
(Bayer MaterialScience, LLC), John Herber (3M), Kim
Jennings (EPA), Shakeel Kadri (Air Products)
Greg Keeports (Rohm and Haas), Dorothy Kellogg (AcuTech),
Kevin MacDougall (Husky Oil), Dr. Sam Mannan (Mary
Kay OConnor, Process Safety Center at Texas A&M), Bill
Marshall (Eli Lilly), Mike Marshall (OSHA), Darren Martin
(Shell), Randy, Matsushima (Suncor), Jack McCavit (CCPS
Emeritus), Mark Miner (Nalco), Jim Muoio (Lyondell),
Americo Neto (Braskem), Tim Overton (Dow Chemical),
Randy Patton (Valero), Jeff Philiph (Monsanto), Cathy
Pincus (ExxonMobil), Bill Ralph (BP), Irv Rosenthal (Wharton
Risk Management and Decision Processes Center), Randall
Sawyer (Contra Costa County Health Department), Angela
Summers (SIS-Tech) Ian Travers (UK Health & Safety
Executive), Bill Watson (Shell), Brian Wilson (Rohm and
Haas)
Page 283 Page 282
The Embedded Safety Coach: A Global Solution
to Localized Challenges
Bradley A. Brewster,
Safety Leadership Consultant, Randy Smith Training Solutions
9
th
ASSE-MEC-0210-36
ABSTRACT
Large-scale multinational organizations, created
through the globalization of the world economy, face
unique safety challenges not present in an era of small,
regional organizations. Continued success requires both
consistency across key safety elements and an eye for site
specic safety strategies. Utilizing an Embedded Safety
Coach provides global support through a partnership
between the organization and the regional worksite.
This ensures the best safety practices of the regional site
are aligned with the global safety vision.
This paper explores the need for an Embedded Safety
Coach and why the concept proves to be a best safety
practice for global organizations. Also presented are
seven proven hallmarks that exemplify a successful
safety coaching relationship:
1. A unied management team
2. Purposefully selected safety coaches based on
proven criteria
3. Coaches armed with necessary resources to coach
effectively
4. A workforce that is prepared for the safety
coaching process
5. A group that trusts the coach and the safety
coaching process
6. A process that is nonpunitive
7. Pre-planned criteria for measuring results.
1. INTRODUCTION
Large-scale multinational organizations, created
through the globalization of the world economy, face
unique safety challenges not present in an era of small,
regional organizations. Continued success requires both
consistency across key safety elements and an eye for site
specic safety strategies. Many multi-national organizations
have embarked on ambitious projects to transform their
safety culture to word-class envy. The rst thing many
organizations do is instigate a global training initiative. This
expenditure (usually large) will provide success in various
key performance indicators and will move the organization
closer to the goal of universal consistency and a zero-
incident safety culture. However, the organization is left
with the challenge of addressing site specic road blocks
which are a critical piece to the safety culture puzzle. The
solution is simple but rather unique: safety coaching.
Coaching is a widely recognized tool for improving human
performance. The concept of coaching has been used for
hundreds of years but the modern use of the term in work
place settings can be traced back to 1965 (Thompson H.B.
et al, 2008). It is unclear how long it has been applied
specically to safety management but research suggests
there is a lack of consistency on its unied meaning.
Denitions of coaching span from a simple interpersonal
conversation to a planned safety audit process. The
authors use of the term embedded safety coach is more
specialized; specically referring to someone who operates
from within the worksite and is involved in all of the safety
decisions of the team.
The embedded safety coach is exible in day-to-day
operations because what they may encounter can vary
greatly (see appendix A for what a typical day may look like).
For instance, the coach may start the morning attending a
job risk analysis meeting with the crew. He or she would
listen to the team operationally discuss the risk analysis but
would guide them through improving the human factors
of the conversation. Later that afternoon the coach may
see a team engaged in an at-risk behavior and take the
opportunity to stop and discuss the situation. The day
may end with helping a new team member through an
energy isolation process. The coach is not performing the work
but rather guiding the team members through improving the
human performance of safe working practices. One key trait
of coaching is the team member is the job expert; the coach
simply guides them through pathways to help improve and
determine direction (Welch-Mooring, S. 2005).
2. CHALLENGES A SAFETY COACH CAN
HELP ADDRESS
Most industries, energy specically, are dealing with a
rapidly evolving workplace, but the evolutions may occur at
different paces and with a different direction at each locale.
If an organization takes a wide-sweeping approach to safety
culture development they may miss critical opportunities for
site specic improvement. For instance, one worksite may face
an aging workforce, representing a higher number of years of
experience. The older worker may bring with them a sense of
complacency hindering their ability to analyze risk or properly
use organizational safety tools. A different (but similar) site
may have a generational change of workers that represents a
much lower median age. This workforce may lack knowledge
about the organizational safety culture and the representative
tools. For leadership to take a one stroke approach across
the organization would lead to very different outcomes for
each site. The embedded safety coach can apply the broader
global safety initiative but also address the site specics of the
workforce to instill greater change and increase the probability
of success.
In addition, the globalization of the workforce is creating unique
challenges surrounding intercultural communication and group
cohesion impacting an individuals willingness to communicate
about safety. Cultures that historically remained separate are
now being thrust into close work spaces as companies import
workers into other continents. Interpersonal communication
can be awkward on any subject but the sometimes personal
nature of safety discussions can elevate tensions between
different cultures. The safety coach can not only act as an
intermediary but also provide valuable tools to help in these
difcult situations.
All individuals, regardless of experience or culture, bring a wide
array of cognitive biases to the worksite that inuences their
judgment (Yudkowsky, E. 2006). The mind has a powerful
mechanism that allows one to ll in the blanks and self-
correct their view of the situation. Frequently our own
perception, from inside the group, is too intimate and close
to provide the needed truths. As the common expression goes
you cant see the forest for the trees. The safety coach is in
unique situation to be able to provide a different perspective
to the same situation because of his or her eye is trained to
observe critical safety issues.
An additional key benet of an embedded safety coach is
that he or she provides a concerted focus in what can be a
chaotic environment. If the principal focal point of a team
member is production then secondary objectives like safety
can be misinterpreted or mis-executed. With global economies
currently experiencing an economic recession many companies
have had to downsize. The result is work normally conducted
by two individuals is now being completed by one. This
creates a faster paced environment in which safety can take
a secondary consideration to productivity. The safety coach
can intervene in this chaotic environment, systematically think
through the situation and provide support to what might have
been overlooked by the local workforce due to the increasing
pressure for productivity.
3. INTERNAL OR EXTERNAL COACH
There are two types of embedded safety coaches: internal
and external. The internal safety coach is chosen from within
the ranks of the organization to serve the sole purpose of
coaching. Some of the main advantages of an internal coach
are a lower cost of service and familiarity with the company
policies and culture. An external safety coach is selected from
outside the organization and provides a fresh workplace
perspective, specic knowledge in behavioral based safety and
no personal relationship hindrances. Company leaders often
have difculty deciding whether to use an internal or external
safety coach. Most leaders prefer to use external coaches but
the decision to utilize an internal coach is often purely scally
based. In a pivotal international study conducted in 2005,
researchers explored many aspects of coaching including
the correlation for success when using internal and external
coaches. The statistical evidence is profound in showing a
greater correlation of success when using external coaches.
The higher up in the organization one is, the greater success
he or she will have with a coach. The internal coaches did
show a correlation for success but only at the lowest level
of the organization (Thompson H.B. et al, 2008). Hence, the
leader who makes a purely nancial decision on whether to
use an external or internal coach would be disappointed in
low (or no) results and ultimately lose money in the process. It
is the authors experience that the best coaching relationships
are with external individuals. Regardless, once the decision
has been made, the next step is getting the most out of the
relationship.
Page 285 Page 284
4. HALLMARKS OF SUCCESS
Below are seven proven hallmarks or traits of a successful
coaching relationship based on industry best-practices.
4.1 A unied management team

This is a simple universal truth about any safety
management program. The success of the safety
coaching process rests heavily on the support received
from a unied management team. Senior leadership
would nd the investment of coaching useless if a
middle manager resisted and undermined the process.
Once the commitment has been made, the coach has a
responsibility to include management in the process. At
the very least, there needs to be a system in place for
the coach to check-in with management and provide
periodical updates.
4.2 Purposefully selected safety coaches based
on proven criteria
All coaches are not made equal. Since there is little
accreditation on the coaching profession (and none
specically for the safety industry), it is up to the
company leader to ensure quality of the individual(s). If
choosing an external coach, there are many reputable
safety consulting/training companies that have proven
track records with embedded coaching. This is the
easiest way to ensure a quality coaching relationship.
If faced with numerous candidates, either internally or
externally, two of the greatest determinants for success
are experience in the industry and experience in a
consulting relationship. Both have very strong statistical
evidence proving these should be heavily weighted
factors. Also of strong consideration should be validated
results, recommendations and personal interviews
(Thompson H.B. et al, 2008). Only a few of these are
likely possible with an internal candidate but all should
be easily attained when utilizing an external coaching
source.
The best safety coaches share several key interpersonal
traits and skills. Do not be afraid to coach the coach;
these traits can be developed and/or heightened.
Besides looking for industry and consulting experience,
seek individuals with these abilities:
Listening- Effective coaching requires strong
listening skills. As the old adage goes: we
learning more by listening than by talking. The
organizations leadership can get a good indication
of this skill level through the interview process.
Language of coaching- There is a language to
safety coaching that is a learned skill. Coaches
ask multiple open-ended questions to gain more
insight and to help team members make their own
corrections. They guide individuals rather than direct
their work. The language of safety coaching is a two-
way communication process designed to encourage
team members to carefully thing through a situation
rather than having the coach simply impart his
knowledge to the group.
Emotional Intelligence- Successful coaching requires
the ability to emphasize and sympathize with the
work group as well as knowledge of how to react
appropriately in varying situations. For every at-risk
behavior or aw in the use of company safety tools
there is an underlying reason. To understand some of
these reasons, the coach needs to momentarily place
him or herself in the shoes of the employee. Putting
the at-risk behavior in this context is often the rst
step before entering the coaching dialogue.
Flexibility- As previously discussed, in a typical work
day, the coach may be involved in any aspect of
safe working practices for that workplace. Safety
coaching is much more than simply addressing at-
risk behaviors. The coach who is only prepared to
address this one element will be missing many other
opportunities to improve human performance and
expand the safety culture.
Knowledge of company culture- The coach who is
thrust into a workgroup without any prior research
or background information will have difculty in
assimilating into the organizational culture. The best
coaches take time to understand the companys
policies and procedures, the organizational hierarchy
and the company culture before entering the
worksite.
Strong experience in safety tools- There are
performance coaches for any industry. But a coach
in the safety industry brings a unique experience
with safety tools. These are not tools in the physical
sense but rather human performance tools. These
injunctive tools aid in interpersonal communication,
360 feedback, and team interaction (among other
things). For instance, a safety tool may be a six-step
safety conversation or a risk analysis process. This
ensures uniformity from coaching session to coaching
session and reduces any element of favoritism. These
safety tools are also universal regardless of industry. The
risk analysis conversation at a construction site can easily
and successfully transfer to an oil renery. The benet
for a global organization is that these universal tools are
applied at the local level in a consistent format.
More than anything, these are proven safety industry tools based
on best practices. There are many tools which accomplish the
same objective; none are right or wrong, but some are better
than others. Often times, the organization itself have similar
tools. If this is the case, before the coaching relationship starts,
the organizations leaders and coach must agree on which
processes will be used.

4.3 Coaches armed with necessary resources to
coach effectively
The duty of the coach is to help employees perform their jobs
better; therefore, he or she needs the resources and authority
to do so. The coach will have his or her own safety tools to
provide support to a local workforce, but company resources
are equally important; for instance, a coach may need entry to
the company intranet in order to guide an employee through
a training module. Company policies and procedures are an
essential tool for a global organization and a coach without
this in hand will be lacking critical information that assists in
dening safe working practices for a regional site. If these
documents do not exist at any level within the organization,
the safety coach can assist management and the work teams in
creation. An often overlooked resource is time. The coach who
is tasked with responsibilities outside his or role as an embedded
safety coach will be diminishing the time spent improving the
safe working practices of the work team. A coach with limited
company resources to aid in the growth of the employees will
be of little use to that worksite.
4.4 A workforce that is prepared for the safety
coaching process
Just as all coaches are not made equal, not all work groups are
made equal. Some teams may be very ready to accept a coach
while others may be resistant. Regardless of the difference
among groups, this challenge is the inherent strength (and
usually the impetus) of a locally embedded safety coach as he
or she can address these group differences from site to site. The
blanket approach of a corporate-wide training initiative will not
account for site specic differences and success will be varied.
Experience demonstrates that clearly communicating the
reason for the coaching process increases the likelihood of
team members viewing it as successful (Thompson H.B. et al,
2008). If a group is resistant, leadership needs to explore why
the resistance is occurring. Team members may not see the
reason for the coach or are resistant to the idea of a third party
being integrated into their work area. Having senior leadership
continually reinforcing the benets of coaching from the teams
perspective can signicantly reduce resistance.

Not only does the coach need to have a high level of emotional
intelligence, the same holds true for the group. Emotional
intelligence aids individual performance as well as the dynamics
of the group (Gardenswartz, L. et al, 2009) by increasing the
ability to provide perspective in the relationship between the
coach and the team. Consider a coach who stops a team and
asks them to reect on the at-risk behavior and to see the
event from another team members perspective. One outcome
is the team (or a member) argues about who is right and
who is wrong and leaves the interaction frustrated and angry.
The other outcome is the team is able to see the event from
anothers perspective and apply the right emotion at the right
time, thereby turning the event into a constructive learning
experience. This is a tough element for some work teams to
grasp and develop, but training has proven effective in helping
increase group emotional intelligence.

4.5 A group that trusts the coach and the safety
coaching process
Trust is one of the most crucial elements of an effective
coaching relationship and one of the most difcult to attain.
While still not easy, this can be a benet of choosing an
internal safety coach. The group will already have a working
relationship with the newly designated coach and therefore
will know what to expect. Establishing trust will be a greater
challenge for the external coach as no one knows what to
expect from this individual and the process. Management can
being establishing a basis for trust by discussing expectations
for the coaching process beforehand. Ambushing a crew one
morning with the introduction of the new safety coach does not
build trust. Instead, introduce the concept a few days or weeks
earlier to give the group time to consider what the coaching
process means, then introduce the coach at a later date. The
most successful external coaching relationships occur when
the group knows the individual beforehand. This is a common
practice in the training environment, where the coach will
facilitate a workshop (or series of workshops) and then does
onsite coaching to reinforce the behaviors highlighted in the
classroom setting. The team goes into this process knowing
what to expect from the coach and how they behave. The
coaching process is founded on one single principle: trust.
Page 287 Page 286
4.6 A process that is nonpunitive
A common concern of a group it is that they will be
punished for what the coach observes. The individuals
may feel the coach has been assigned as a spy from
senior management to report daily his or her ndings.
The coach should stop at-risk behaviors and take all
opportunities for coaching but none should result in any
form of punishment. The coach has the opportunity to
record observations and use the raw data anonymously;
for example, to lead future training sessions based on
frequency of certain observations. If individuals in the
work group feel their name is attached to any data
delivered to management, the coaching process will be
awed from that point forward.
4.7 Pre-planned criteria for measuring results

Management needs to decide how they will dene
success in this relationship by thinking beyond simply
lowered incident rates, which are a lagging indicator.
There will likely be a number of different factors (none
of which are weighed alone) that will determine success.
The management team also needs to be mindful that
what is dened as success on the entire organizational
level may be not be the same on the local site level. The
purpose of the embedded safety coach is to account for
differences between regional worksites and act based on
these specics, therefore success should be determined
on these unique factors. The coach and management
team need to be open to re-adjusting the process to t
current and situational needs. An effective safety coach
will embody this spirit and be willing to think outside
the box.
5. CONCLUSION
There are no guarantees of a successful safety coaching
relationship but rather best-practices that highly increase
the likelihood of this occurring. While this is a list of best
practices there are things that deteriorate a coaching
process. Two of the most commonly cited reasons for
terminating a coaching relationship are a mismatch
between coach and employees and questionable
expertise of the coach (Thompson H.B. et al, 2008). The
seven hallmarks, if properly implemented, will ensure
that these two detractors do not negatively inuence
the process.
An embedded safety coach is one element in improving
an organizations safety culture. There is a strong
statistical correlation for success when this is used as part
of a wider training and development program (Thompson
H.B. et al, 2008). It is not the single answer to a systemic
problem but rather one element of a greater effort that can
be implemented globally to provide localized support. The
use of an embedded safety coach is a unique relationship. It
breaks traditionally held denitions of coaching. It is much
deeper than a conversation to address at-risk behaviors or
a traditional audit process or a supervisor simply providing
task-related knowledge. The embedded safety coach brings
a unique perspective to human capital and safety culture
development. A key benet of embedding a safety coach is
the coach models safe behavior and effective interpersonal
workplace relationships. Employees walk away from the
coaching experience with newly imparted knowledge but
foremost they have a picture of what safe and effective
looks like. Embedding a safety coach is so effective,
because even after the coach leaves the facility, what has
been role modeled and learned will continue. This is the
embodiment of a safety culture; the perpetuation of safe
and effective behaviors that are self-regulating regardless
of a changing and evolving workforce
REFERENCES
Gardenswartz, L. et al. Coaching Teams for Emotional
Intelligence in Your Diverse Workplace. Training and
Development; 63 (2009), 44.
Geller, E.S. et al. Behavior-Based Safety Coaching: 10
Guidelines for Successful Application. Safety Management;
July 2004, 42-49.
Richardson, M.R. Coaching for Safety. Occupational
Hazards; 58 (1996), 59-62.
Stone, F.M. Coaching, Counseling & Mentoring: How to
Choose & Use the Right Technique to Boost Employee
Performance. New York: AMACOM Books, 1999.
Thompson, H.B. et al. Coaching: A Global Study of
Successful Practices. American Management Association,
www.amanet.org, 2008.
Welch-Moring, S. Pathways to Success. Training and
Management Development Methods; 19 (2005), 1-5.
Yudkowksy, E. Cognitive Biases Potentially Affecting
Judgment of Global Risks. Global Catastrophic Risks,
2006.
Fall Protection Overview: ANSI Z359 Standard
Thomas E. Kramer,
P.E., C.S.P. LJB Inc.
9
th
ASSE-MEC-2010-37
1. INTRODUCTION
Learning how to minimize the risk of potentially dangerous
or fatal fall hazards allows organizations to take a proactive
approach to worker safety. This paper provides an overview of
effective fall protection programs, giving participants proven
strategies for identifying, evaluating and controlling fall hazards.
All information presented will be in accordance with the ANSI
Z359 family of fall protection standards.
KEYWORDS
Fall hazard assessments, hazard evaluation and abatement, fall
protection training, rescue planning and program evaluation,
fall protection equipment.
2. BACKGROUND
Falls impact the quality of life for the worker and the bottom
line for the company. Common fatal misconceptions about fall
protection are that with fall safety precautions in place, it is
harder to work, it slows down work activity, and it is too difcult
to implement. Regulations clearly are not enough, because after
70+ years of standards, rules and regulations workers are still
falling to their deaths.
This presentation will include additional background on current
fall protection standards, regulations, statistics and trends,
before outlining critical elements of a fall protection program.
The information presented is organized around the guidelines
and requirements for managed fall protection programs, as
published in the ANSI Z359.2-2007 standard. This is the only
fall protection standard in the world that comprehensively
addresses these issues.
Key topics include fall hazard assessments, hazard evaluation
and abatement, fall protection training, rescue planning and
program evaluation. General information about fall protection
equipment will also be provided, including equipment
components, system development, anchorages, and clearance
requirements.
3. FALL PROTECTION PROGRAMS
The elements of a fall protection program, as outlined in the
ANSI Z359.2-2007 standard, are foundational for creating
a program that reduces risk and enhances employee safety.
When one or more of these elements is missing, a program
can become stalled or be deemed ineffective.
The program elements outlined in the ANSI/ASSE Z359.2-
2007 are:
Policies, duties and training
Fall protection procedures
Eliminating and controlling fall hazards
Rescue procedures
Incident investigations
Evaluating program effectiveness

3.1 Policies, Duties and Training
Unfortunately, the cause of many unsafe conditions can often
be traced to aws or inadequacies in their policies, duties and
training programs. For example:
- The company policy on fall protection is not clearly
stated, nor adhered to
- The roles and responsibilities within the program are not
properly dened
- Workers and supervisors are expected to do their jobs
safely without proper training
An effective policy statement provides overall program
guidance and emphasizes managements commitment
to providing a safe workplace for employees exposed to fall
hazards, (ANSI/ASSE Z359.2, Section 3.11).
Page 289 Page 288
The Z359.2 standard explicitly outlines the specic duties
of employers, as well as others within a fall protection
program. The employers duties include providing
sufcient resources to support the program and
naming a program administrator to lead the initiative.
Additionally, the standard states that employers are
responsible for identifying and abating hazards in the
workplace, developing and maintaining fall protection
and rescue procedures, and properly training authorized
and competent persons.
For fall protection training to be effective, it is critical
that trainers make this very complex and potentially
overwhelming subject understandable and practical for
participants. Despite the amount of material, it must be
handled in a way that resonates with the audience.
3.2 Fall Protection Procedures
Fall protection procedures are an important element of
any comprehensive, managed fall protection program.
They should be developed by the employers competent
or qualied persons and should be specic to each
workplace and task. The procedures should provide
continuous protection throughout the work activities
and should include the qualications and training that is
required of the worker (authorized person).
The standards also provide specic requirements for
procedures for the following systems or activities: fall
arrest systems; work positioning and travel restraint
systems; installing and dismantling of fall protection
equipment; and inspection.
Before developing solutions to fall hazard concerns,
it is critical to understand the location of all existing
fall hazards and the risk those hazards present. This
understanding is accomplished by conducting a fall
hazard survey, which is described in the Procedures
section of the Z359.2 document.
3.3 Eliminating and controlling fall hazards
Once fall hazards are identied, the evaluation phase
focuses on determining the appropriate priorities and
measures for abating the hazards. The Hierarchy of
Controls (HOC) can play a signicant role in evaluating
the appropriate abatement methods. Clearly, the goal
is to select the most effective solution that is the least
likely to be defeated within the physical environment.
Figure 1: The graph above illustrates the Hierarchy
of Control
Additional aspects involved in the evaluation of hazards are
probability and severity. Probability considerations include
the number of workers exposed to the hazard. On the
severity side, it is important to evaluate the height of a
possible fall, the landing surface and likely level of injury.
After fall hazards have been identied and evaluated, the
next step is to control the fall hazards. When considering
an active fall protective system, the type of system and
corresponding anchorage must be evaluated. Because of the
variety of types and uses, designing and using anchorages
can be complex. However, it is critical to understand
different anchorages. The ANSI Z359 standard provides
helpful information on anchorages, including the difference
between certied and non-certied anchorages.
3.4 Rescue Procedures, Incident Investigation,
and Evaluating Program Effectiveness
It is clear that prompt rescue is critical, but rescue procedures
are one of the most overlooked areas of fall protection.
Even if a worker has been rescued by an active fall
protection system after a fall, there must also be a plan in
place for summoning a professional rescue agency or an
in-house rescue service.
Unfortunately, many fall protection system designers think
their work has been accomplished with the initial rescue.
But, the likelihood of additional injuries or even a fatality
can still be high if the suspended worker is not truly
rescued. The recommended timeframe for contact (verbal
communication or physical contact) with the fallen victim
is within six minutes. This can only be accomplished if the
proper rescue procedures are in place.
At regular intervals, and most importantly, when an incident
occurs, the program must be re-evaluated. If there is an
incident, the immediate needs of the worker must be attended
to. Following that, a true comprehensive managed fall
protection program response is to launch a thorough incident
investigation. This investigation provides an opportunity to
evaluate the work practices occurring at heights and all aspects
of the overall program to determine what is and is not working
properly. Elements of a thorough incident investigation include
but are not limited to a review of duties, policies, procedures
and training. Additionally, there should be an evaluation of
the fall protection systems, anchorages and equipment in
use at the time of the incident, including inspection logs and
communication during the incident.
As an element of continuous improvement, an evaluation
of the programs effectiveness should be conducted at least
biannually. This is one of the responsibilities of the program
administrator, but a team approach involving employees and
management is preferred. The team approach is specically
referenced when recommending action steps to be taken as a
result of the program evaluation.
4. CONCLUSION
Signicant time and effort is required to execute a successful
managed fall protection program. But, with the direction
provided in the ANSI Z359.2-2007 standard, organizations have
more information than ever before to create and maintain a
comprehensive program. In addition to the primary aspects of
fall hazard identication, evaluation and control, it is important
to execute appropriate policies and training, as well as rescue
procedures, incident investigations and program evaluations.
Although it may not be easy, developing an effective fall
protection program is a critical step toward providing employees
with a safe work environment. Today it is easier than ever to
get started, thanks to the ANSI Z359 standards.
Page 291 Page 290
Identifying Conned Spaces
Warren K Brown,
CSP, ARM, CSHM
9
th
ASSE-MEC-2010-38
INTRODUCTION
Some facilities may not have conned spaces and are
not concerned about conned space entry. However, all
facilities should be assessed for the presence of conned
spaces. This paper will discuss the proof of the need,
some denitions, the identication process and the
documentation of the process.
When there is no conned space entry procedure in place
and something goes wrong fatalities are many times the
result. Some of the typical outcomes are unapproved
lighting was used resulting in a re, a ammable gas
leaked into the space, a lockout procedure was not
followed, there was some type of equipment failure or
malfunction, no test of the atmosphere was taken prior
to entry, there was no know reason for the entry and no
harness or lifeline was used to aid rescue. A couple of
examples of fatal incidents include an instance where
a clipboard was dropped in a conned space and the
person went after it. Due to the lack of oxygen in the
space the person died. In another example an engineer
went into a landll area where there was inadequate
oxygen and was overcome. A companion tried to rescue
him and was overcome also. Both people subsequently
died. In one other case a farmer got caught in a grain
silo and died as a result of suffocation by the material
in the silo. As can be seen over and over, the results of
entering conned spaces without following a procedure
often results in death.
The rst step is to have a good understanding of the
denition of a conned space so they can be isolated
and marked for identication. The common denition
of a conned space in the United States is an area
that has limited or restricted means of entry or exit,
and is large enough for a worker to enter and perform
an assigned task, and is not designed for continuous
employee occupancy. Any open top tank or pit more than
four feet deep that meets the above conditions is also
considered a conned space. Some examples of conned
spaces are storage tanks, degreasers, pits, ventilation
ducts, machinery pits, vessels and manholes. Also boilers,
furnaces vats, sewers tunnels silos and open surface tanks.
There may be spaces that a worker cannot completely
enter but may as a result of the work task requirements
introduce an atmospheric hazard. Even though the space
does not strictly meet the conned space requirements,
some conned space procedures may need to be used.
By denition entry into a conned space occurs when
any part of the entrants body enters the opening into the
space. Other considerations are what has been previously
stored in the conned space and what is being taken into
the conned space.
After the space has been identied it must be evaluated
and a determination made if it is a permit required conned
space or a non-permit required conned space. A sign
must be posted at the space and a log of the spaces must
be kept and updated as necessary.
A non-permit conned space does not contain or have
the potential to contain any hazard capable of causing
death or serious physical harm. Examples would be areas
with natural or permanent ventilation that will not allow
accumulations of hazardous atmospheres. If there is a
change in conguration the area must be re-evaluated. A
permit-required conned space contains or has the potential
to contain on or more of the following: atmosphere hazard,
engulfment hazard, conguration hazard or any other
recognized serious safety or health hazard.
A hazardous atmosphere may expose employees to serious
risk of death, incapacitation, impairment, injury or acute
illness. Examples of hazardous atmospheres are: oxygen
concentration is below 19.5% or above 23.5%, a ammable
gas, vapor or mist exceeds 10% of its lower ammable
limit, airborne dust concentration of a substance whos TLV
exceeds acceptable standards, or any other atmosphere hazard
that could impair an employees ability to escape or be IDLH.
An engulfment hazard is when surrounding and capture of a
person by a liquid or nely divided ow able solid substance such
as grain, salt, sand or plastic pellets could occur. The substance
can either plug the respiratory system or constrict breathing by
exerting pressure on the outside of the body. Trenching cave-
ins could fall into this category as well as bridged materials in
a silo for example.
Conguration hazards are when an internal conguration that
could trap and asphyxiate an employee. Examples could be
inwardly converging walls or a chute that tapers to a smaller
cross section. Mixing tanks, grain processing tanks, sand chutes
and duct work could fall into this category.
Other hazards are hazards capable of causing death or serious
physical harm. Examples could be high pressure gas lines,
steam lines, footing problems, temperature extremes, electrical
concerns, sharp edges, minimum work room and mechanical
problems.
The identication process requires a visual inspection of
the facilities using a conned space hazard analysis form. A
good start is to make a walk through of the facilities to get
an idea of what exists in the way of conned spaces. Procure
a plant layout of the facilities making sure that all oors of
the facility are represented. These layouts should include the
roof, out buildings, storm sewers, water systems and any tank
age that might be above or below ground. Manufacturing and
plant engineering personnel should be consulted as well as
maintenance personnel. Plant security personnel are another
source of potential information.
At each potential site complete the conned space hazard
analysis form so you will have a documented assessment of all
potential spaces. All spaces identied as conned spaces should
be transferred to a conned space log for use by plant security
and those who may have to enter the spaces. This log removes
the chance that a space will not be properly categorized and
entry take place without proper precautions.
All spaces determined to be a conned space must have a sign
indicating that they are either a non-permit conned space or
a permit required conned space.
A communication program must be put in place to tell all
employees that conned spaces exist in the facility and that
they are not to enter them under any circumstances. Only
employees who have attended a conned space entry training
program will be allowed to enter the spaces and then only
when following a very specic procedure.
Attachment: Conned Space Hazard Analysis Form
Conned Space Hazard Analysis Form Annotations
The following is a step-by-step process to assist the PLANT
NAME conned space team in the hazard analysis of a
conned space. Each entry on the example Hazard Analysis
Form is numbered for reference to the descriptions that follow.
The Safe Entry Procedures will be established based on a
combination of current & previous space evaluations and entry
experience in the space; however each entry supervisor must
take into account the specic work activity and chemicals used
in the each conned space entry. Note: A notation must be
made in each space on the analysis form, Mark N/A if
appropriate.
1. Location and description of the conned space (i.e.
Stamping B press slide lock).
2. Date hazard analysis is taking place.
3. Department where the conned space is located or
department that owns the conned space.
4. Generate a conned space identication number;
this number must coincide with conned space log
numbering system. If it is a reevaluation of a space,
utilize the number that is already assigned.
5. Enter the bay location of the conned space.
6. Name of person or persons completing the form.
7. Mark all boxes that apply to the area to determine if
it is a conned space. For an area to be considered a
conned space all three boxes must be checked next
to question #1 or the area must be an open top pit as
dened in question #2.
8. Once you have classied an area as a conned space it
must be determined if it is a permit required conned
space. Mark all boxes that apply to the space- only one
box needs to be checked for a space to meet the criteria
of permit required. If the only hazard is atmospheric the
space may be classied as alternate procedure permit
required.
9. Identify the potential hazards and describe the conditions
for each hazard category, it should be noted how each
hazard will be abated prior to entry. A space cannot be
classied as alternate procedure permit required if there
is any other hazard besides atmospheric:
A. Atmospheric hazard
i. Identify source of atmospheric hazard (i.e. sludge)
Page 293 Page 292
a. Oxygen levels are below 19.5% or above
23.5%
b. The Lower Flammable Limit is at or above 10%
c. Airborne combustible dust at a concentration
that meets or exceeds its LFL
d. Exposure to a toxic substance in excess of
permissible limits
e. Any other atmospheric condition that is
immediately dangerous to life or health.
ii. Identify means of controlling the atmospheric
hazard
iii. Enter any additional comments related to the
atmospheric hazard or controls.
B. Engulfment hazard
i. Identify source of engulfment hazard (i.e.
wastewater)
a. The surrounding of a person by a liquid or
owable solid that can be inhaled to cause
death by lling or plugging the respiratory
system or that can exert enough force on the
body to cause death by
strangulation, constriction, or crushing.
i. Identify means of controlling the engulfment
hazard
ii. Enter any additional comments related to the
engulfment hazard or controls.
C. Conguration hazard
i. Identify source of conguration hazard
a. Floors slope downward and/or taper
b. Walls converge inward
c. Obstructions and/or difcult to exit
ii. Identify means of controlling the conguration
hazard
iii. Enter any additional comments related to the
atmospheric hazard or controls.
D. Other serious hazards
i. Identify source of serious hazard
a. High pressure steam lines
b. Natural gas lines
c. Chemical/Hazardous material lines
d. Mechanical hazards
e. Any other serious hazard not listed
ii. Identify means of controlling the serious hazard
iii. Enter any additional comments related to the serious
hazard or control
10.Other conditions may exist that make working in a
conned space hazardous. Typically these conditions
do not cause a space to be classied as a permit
required conned space. It is up to the team that is
performing the hazard analysis to decide.
11.List the equipment that will be used to test for
atmospheric conditions and or toxic substances. Also
list what is acceptable by OSHA standards.
12. Identify the atmospheric hazard that must be
continuously monitored and the equipment to be
used.
13.Identify the atmospheric hazard that must be
periodically monitored and the equipment to be
used, include how often it must be checked. At a
minimum, periodic monitoring should be done
following interruption of work or if new hazard is
introduced.
14.Enter any additional testing information or
comments.
15.Identify the equipment needed to enter the space
and describe the equipment if appropriate.
16.Mark the box that describes the classication of the
conned space being analyzed.
RESOURCES
USA OSHA Standard 29 CFR 1910.146
Conned Space EntryAn AIHA Protocol Guide -
Second Edition 2001
ANSI/ASSE Z117.1-2003Safety Requirements for
Conned Spaces.
REFERENCES
1. Accident Prevention Manual National Safety
Council
2. The Occupational Environment-Its Evaluation and
Control
3. American Industrial Hygiene Association
4. The Safety professionals Handbook-Management
Applications
5. American Society of Safety Engineer
Trafc Safety in Saudi Aramco
Abdullah M. Al-Harbi
Saudi Arabian Oil Company (Saudi Aramco)
9
th
ASSE-MEC-2010-39
ABSTRACT
Trafc accidents are the leading cause of off-the-job accidental
death among employees at the Saudi State Oil Company, Saudi
Aramco. The Companys Industrial Security Organization (ISO)
has been actively attempting to change driver behavior and
improve safety through a combination of public education,
stricter enforcement in Saudi Aramco facilities, and cooperation
with the Kingdoms trafc authorities. This paper describes
the complex issues faced by ISO and the methods used to
accomplish the goal of accident-free driving in the Kingdom of
Saudi Arabia.
1. SAUDI ARAMCO AND ISOs MISSION
Owned by the Saudi Arabian Government, Saudi Aramco is
a fully-integrated, global petroleum enterprise and a world
leader in exploration and producing, rening, distribution,
shipping and marketing. The Company manages the largest
proven reserves of conventional crude oil, 260 billion barrels,
and manages the fourth-largest gas reserves in the world,
263 trillion cubic feet. Saudi Aramco, through its afliate, Vela
Marine International Ltd, owns and operates the world's second
largest tanker eet to help transport its crude oil production,
which amounted to 1.7 million barrels per day in 2008. In
addition to its headquarters in Dhahran, Saudi Arabia, Saudi
Aramco, through its afliates, has joint ventures and subsidiary
ofces in China, Japan, the Netherlands, the Republic of Korea,
Malaysia, Singapore, the United Arab Emirates, the United
Kingdom and the United States. Saudi Aramco also renes
and distributes oil products throughout the Kingdom of Saudi
Arabia to meet domestic daily energy demands.
Saudi Aramcos Industrial Security Organization (ISO) has the
following mission:
To protect the Companys employees, assets, and facilities in a
highly efcient, transparent, and cost effective manner using
the most qualied workforce and latest technology.
It is the primary mission of the ISO to secure and protect the
physical assets of the Company and to safe guard the Companys
workforce. As a major component of that responsibility, ISO is
mandated to enforce company regulations, promote accident
prevention strategies and provide accident investigation
services. As part of that responsibility, ISO, in cooperation with
civil authorities, has taken on the challenge of road safety.
Road trafc crashes are one of the worlds largest public health
and injury prevention problems. The problem is all the more
acute because the victims are overwhelmingly healthy prior
to their crashes. According to the World Health Organization
more than a million people are killed on the worlds roads each
year. (1)
2. SAUDI ARABIA TRAFFIC SAFETY
STATISTICS 2007-2008
The Kingdom has the highest per capita trafc-related fatalities
in the world; approximately 22 deaths per 100,000. In 2007,
an average of 50 motor vehicle accidents occurred each hour,
and a trafc related death every two hours. These last statistics
are based on deaths that occur at the site of the accident and
escalate to approximately 1 death per hour when adjusted
to international reporting standards (to include trafc related
deaths within 30 days of an accident).
In addition to tragic loss and destruction of families, the burden
to the Saudi economy is massive. Car accident victims account
for one third of all hospital beds in the Kingdom. According to
an conservative analysis performed by the High Commission
for the Development of Riyadh, a total of 13.6 billion Saudi
Riyals or about 1% of the nations GDP was lost due to trafc
related deaths and injuries. Sadly, Motor Vehicle Accidents
(MVA) also claimed 31 Saudi Aramco lives and 151 injuries in
2008 (Figure 1).
Page 295 Page 294
Figure 1. Saudi Aramco vehicle accident
Table 1 - Violations & Penalty Points
Table 2 - Saudi Aramco Trafc Violations
( From January 1 August 1 )
3. SAFE DRIVING: THE TARGET GROUPS
AND BEHAVIOURS
One approach is for ISO to vigorously enforce trafc
rules for the following:
Employees - These individuals may feel entitled to
speed with the justication that they dont want
to be late for a meeting.
Contractors - As employees of other Companies,
they are often not familiar with ISOs zero-
tolerance for trafc infractions.
Guest Drivers - Hired from other countries, their
driving skills meet the minimum for obtaining
a license, but they often have no knowledge of
defensive driving.
Business Visitors - Visitors from other countries
who may be severely fatigued from jet lag.
Dependents - Young men who often drive without
adult supervision and in some cases, without the
fathers knowledge and permission. They are the
most prone to speed.
Retirees - Senior citizens who due to age or illness,
may exhibit poor response times and bad driving
habits.
4. GENERAL INSTRUCTION 6.030
PENALTY POINTS
To enforce trafc safety, ISO punishes bad driving with
penalty points, that can result in the loss of Company-
car privileges, the drivers license itself, and will inuence
the employees annual performance appraisal, resulting
in the loss of a raise or denial of a promotion. If a
dependent earns penalty points, they are assigned to
the employee.
ASSE-MEC-2010-39 Traffic Safety in Saudi Aramco 2
injuries. Sadly, Motor Vehicle Accidents (MVA) also
claimed 31 Saudi Aramco lives and 151 injuries in 2008
(Figure 1).
Figure 1. Saudi Aramco vehicle accident
3. SAFE DRIVING: THE TARGET GROUPS AND
BEHAVIOURS
One approach is for ISO to vigorously enforce traffic rules
for the following:
Employees - These individuals may feel entitled to
speed with the justification that they dont want to be
late for a meeting.
Contractors - As employees of other Companies, they
are often not familiar with ISOs zero-tolerance for
traffic infractions.
Guest Drivers - Hired from other countries, their
driving skills meet the minimum for obtaining a
license, but they often have no knowledge of
defensive driving.
Business Visitors - Visitors from other countries who
may be severely fatigued from jet lag.
Dependents - Young men who often drive without
adult supervision and in some cases, without the
fathers knowledge and permission. They are the most
prone to speed.
Retirees - Senior citizens who due to age or illness,
may exhibit poor response times and bad driving
habits.
4. GENERAL INSTRUCTION 6.030 PENALTY
POINTS
To enforce traffic safety, ISO punishes bad driving with
penalty points, that can result in the loss of Company-car
privileges, the drivers license itself, and will influence the
employees annual performance appraisal, resulting in the
loss of a raise or denial of a promotion. If a dependent earns
penalty points, they are assigned to the employee.
Table 1 - Violations & Penalty Points
Type of Traffic Violation Old New
Reckless driving 10 14
Speeding - exceeding speed limit
by:
Less than 10 kph
10 to 20 kph
21 to 30 kph
Over 30 kph
3
6
8
10
3
6
1
0
1
2
Driving on the wrong side of
a divided roadway
10 12
Passing in a No Passing
zone
6 8
Underage dependant driving
a motor vehicle
- 10
Failure to obey a traffic
signal or stop sign
8 8
Not using seat belts (drivers
or passengers)
8 8
Use of mobile phone under
conditions prohibited in GI
6 6
Failure to yield to
pedestrians at a crosswalk or
intersection
- 6
Following too closely
(tailgating)
- 6
Turning or switching lanes
without signaling
- 4
Turning from the wrong lane - 8
Driving during night time
without headlights
- 8
Failure to stop when
directed by Industrial
Security
- 10
Table 2 - Saudi Aramco Traffic Violations
Table 3 - Speed and Time Saved
This table was used in ISOs Traffic Safety Campaign to
illustrate the futility of speeding. Before you can change a
behavior, you have to explain what is wrong with the
behavior. Employees and dependents were presented with
the table and two simple questions:
How valuable are the minutes that we save at the
expense of our safety and the safety of others?
How valuable are these minutes to our grieving
families and children?
5. SAUDI ARABIA VS. OTHER COUNTRIES
According to the Riyadh Traffic Police Department, when
comparing the number of injuries per traffic accident in
Saudi Arabia to the respective ratios in the U.S. and
Europe, it appears that the ratio in Saudi Arabia is
approximately 6 times higher. This reflects the magnitude
of the severity of traffic accidents in Saudi Arabia. The
severity of traffic accidents in Saudi Arabia is very high.
Large families, a lack of seat belt use, and speeding
combine to produce accidents of a nature rarely seen in
Western Countries. For example, a recent two car accident,
involving two families, in the Eastern Province resulted in
38 casualties.
The rate of national production loss due to traffic accidents
is 4.7% in the Kingdom compared to 1.7% in the U.S.(2)
6. MAJOR CAUSES OF TRAFFIC ACCIDENTS IN
KSA
Speeding
Ignoring traffic rules and regulations
Irresponsible/reckless driving
Inexperienced drivers
Poor vehicle maintenance
Driving distractions
Adverse weather conditions
An analysis of traffic accidents, over 10 years, in the
Kingdom, determined the following:
Speeding was the number one cause of traffic
accidents in the Kingdom (causing 31 percent of the
total number of accidents). See Figure 2.
Ignoring traffic rules and regulations was the
second category of causes.
Other causes included driving distractions, bad road
conditions, bad weather conditions, and the
influence of medication. (3)
Figure 2. Speeding at night leaves little time to respond to
obstacles on the road, like this camel.
Violation type 2009 2008 2007
Speeding 1022 1137 907
Parking 1002 1015 797
Moving ( Mobile
phoneSeat belt
Stop sign )
1324 1186 1086
Total 3348 3338 2790
Table 2 - Saudi Aramco Traffic Violations
This table was used in ISOs Traffic Safety Campaign to
illustrate the futility of speeding. Before you can change a
behavior, you have to explain what is wrong with the
behavior. Employees and dependents were presented with
the table and two simple questions:
How valuable are the minutes that we save at the
expense of our safety and the safety of others?
How valuable are these minutes to our grieving
families and children?
According to the Riyadh Traffic Police Department, when
comparing the number of injuries per traffic accident in
Saudi Arabia to the respective ratios in the U.S. and
Europe, it appears that the ratio in Saudi Arabia is
approximately 6 times higher. This reflects the magnitude
of the severity of traffic accidents in Saudi Arabia. The
severity of traffic accidents in Saudi Arabia is very high.
Large families, a lack of seat belt use, and speeding
combine to produce accidents of a nature rarely seen in
Western Countries. For example, a recent two car accident,
involving two families, in the Eastern Province resulted in
38 casualties.
The rate of national production loss due to traffic accidents
is 4.7% in the Kingdom compared to 1.7% in the U.S.(2)
6. MAJOR CAUSES OF TRAFFIC ACCIDENTS IN
KSA
Speeding
Ignoring traffic rules and regulations
An analysis of traffic accidents, over 10 years, in the
Kingdom, determined the following:
Speeding was the number one cause of traffic
accidents in the Kingdom (causing 31 percent of the
total number of accidents). See Figure 2.
Ignoring traffic rules and regulations was the
second category of causes.
conditions, bad weather conditions, and the
influence of medication. (3)
Figure 2. Speeding at night leaves little time to respond to
obstacles on the road, like this camel.
Violation type 2009 2008 2007
Speeding 1022 1137 907
Parking 1002 1015 797
Moving ( Mobile
phoneSeat belt
Stop sign )
1324 1186 1086
Total 3348 3338 2790
This table was used in ISOs Trafc Safety Campaign to illustrate
the futility of speeding. Before you can change a behavior, you
have to explain what is wrong with the behavior. Employees
and dependents were presented with the table and two simple
questions:
How valuable are the minutes that we save at the expense
of our safety and the safety of others?
How valuable are these minutes to our grieving families
and children?
According to the Riyadh Trafc Police Department, when
comparing the number of injuries per trafc accident in Saudi
Arabia to the respective ratios in the U.S. and Europe, it appears
that the ratio in Saudi Arabia is approximately 6 times higher.
This reects the magnitude of the severity of trafc accidents in
Saudi Arabia. The severity of trafc accidents in Saudi Arabia is
very high. Large families, a lack of seat belt use, and speeding
combine to produce accidents of a nature rarely seen in Western
Countries. For example, a recent two car accident, involving
two families, in the Eastern Province resulted in 38 casualties.
The rate of national production loss due to trafc accidents is
4.7% in the Kingdom compared to 1.7% in the U.S.(2)
6. MAJOR CAUSES OF TRAFFIC ACCIDENTS
IN KSA
Speeding
Ignoring trafc rules and regulations
An analysis of trafc accidents, over 10 years, in the Kingdom,
determined the following:
Speeding was the number one cause of trafc accidents
in the Kingdom (causing 31 percent of the total number
of accidents). See Figure 2.
Ignoring trafc rules and regulations was the second
category of causes.
conditions, bad weather conditions, and the inuence
of medication. (3)
7. DRIVING BEHAVIOR RELATED TO
DEMOGRAPHICS
Saudi Arabias population is very young.
The Kingdoms Population of 28,686,633, (for 2009), has the
following age structure:
0-14 years: 38% (male 5,557,453/female 5,340,614)
15-64 years: 59.5% (male 9,608,032/female
7,473,543)
65 years and over: 2.5% (male 363,241/female 343,750)
(4)
Teens are at a greater risk of than any other age group to be
involved in a crash, due largely to lack of experience. Many
of those crashes could be avoided with proper education.
Common mistakes by new drivers include tailgating, speeding
and poor judgment, especially when making left-hand turns
across oncoming trafc.
Driving requires our full attention and distraction is a major
hazard for teen drivers. In addition to talking on cell phones
and texting, other distractions that take a drivers attention
from the road include talking with passengers in the car, tuning
the radio or iPod, or reaching for coffee or a water bottle.
Drowsy driving is another risk behavior common among young
drivers. The U.S. National Highway Trafc Safety Administration
estimates that more than 100,000 crashes every year are due
Figure 2. Speeding at night leaves little time to respond
to obstacles on the road, like this camel.
Page 297 Page 296
to driver fatigue, resulting in more than 1,500 deaths
and 71,000 injuries. (5)
During Ramadan, Saudi Aramco has its Muslim
employees work half shifts to reduce fatigue-related
accidents.
Older Drivers
The large majority of drivers age 55 and older are
unaware of the potentially dangerous combination of
medications and driving 95 percent of respondents
55 and older have one or more medical conditions and
78 percent use one or more medications, yet only 28
percent indicated some awareness of the potential
impact on driving performance associated with those
medications. (6)
Older drivers pose a problem for trafc enforcement
due to Saudi Cultural factors. Saudis show great respect
to the elderly, and an older driver is much more likely to
be warned instead of ticketed, or not pulled over at all.
Here the challenge is to train trafc enforcers to apply
the rules to the elderly as rmly as they do with younger
drivers.
Bad Driving Habits
In the past, trafc safety was rarely enforced. Children
learn good driving habits from their fathers. The result
is both an older and younger generation who fail to
use seat belts, ignore trafc lights, and fail to use their
indicators. In addition, it was quickly observed that
employees who demonstrated excellent driving habits
on Company facilities reverted to their bad habits once
they left our areas.
To correct this problem, ISO has been working with
civil authorities to upgrade public trafc enforcement
through better equipment, training, and sharing of
information. An employee who gets tickets for speeding
on the highway will face the same consequences as if
the offense took place on Company grounds.
Our Focus - Speeding
2008 Eastern Province Statistics:

o 127,460 reported trafc incidents
o 6110 reported injuries
o 1113 reported fatalities (7)
Speed is a contributing factor in most accidents. Speeding
kills - even at normal highway speeds accidents at 120KPH
are deadly. From January 2006 to January 2007, there
were 283,648 trafc incidents causing 5,883 fatalities and
35,884 injuries. In 2007, over half a million people were
involved in trafc crashes. In 1998, there were 3,130 car
accident fatalities. In 2008, that number had increased to
6,385 deaths.
Who is Responsible?
We are all responsible for safety. Authorities must ensure
that roads are maintained in a safe condition and that
rules are enforced. Drivers must obey the rules and respect
other drivers. Vehicle owners must properly maintain their
vehicles. By sharing in the responsibility for the problem,
we can work together for the solution. Only through a
combination of enforcement and education can we make
driving safe.
Factors that can Save Lives
ISO believes you get the behavior you reinforce - these are
the behaviors:
o Obey posted speed limits
o Always wear your seat belt
o Do not use a mobile phone while driving
o Obey trafc rules and signs
o Do not be a misbehaving driver
Saudi Aramco has forbidden the use of cell phones in all
company cars and will issue a citation for anyone operating
a cell phone while driving. If an employee must use a cell
phone, the driver must pull over and stop his vehicle rst.
To further enhance enforcement, automatic roadside
cameras have recently been brought into use throughout
the Kingdom.
As part of driver education, ISO has distributed literature,
explaining how to avoid unsafe driving practices through
the following 5-Action steps:
1. STOP at every stop SIGN.
2. Park ONLY in Authorized Parking areas.
3. Never EXCEED the speed limit.
4. Always WEAR a seat belt.
5. NEVER use a mobile phone while driving.
8. SUMMARY
Trafc accidents claim many lives each year on Saudi Arabias
roads. Speeding and ignoring trafc rules and regulations
are the two major causes of these accidents. A combination
of zero-tolerance enforcement and driver education, through
a Corporate-Public alliance, is being used to change driver
behavior and enhance safety.
REFERENCES
1. http://en.wikipedia.org/wiki/Road_trafc_safety
2. http://www.rt.gov.sa/
3. The Public Security Directorate General for Trafc in
Riyadh
4. https://www.cia.gov/library/publications/the-world-
factbook/geos/sa.html
5. http://www.wtxl.com/Global/story.asp?S=11041686&na
v=menu594_10_10_2
6. http://www.aaafoundation.org/pdf/MedsOlderDriversFS.
pdf
7. Alyaum Newspaper, Saturday, January 31, 2009
Page 299 Page 298
Implementing a Corporate Electric Arc Flash
Safety Program
Abdullah M. Al-Zahrani,
Electrical Engineer, IEEE & SSSEE Member
9
th
ASSE-MEC-2010-40
ABSTRACT
The number of fatalities and injuries caused by electric
arc ashes is a worldwide concern. Arc ashes may
occur during electrical isolation, operating breakers or
switches, racking breakers in or out, testing voltage,
applying safety grounds, etc.
This paper describes the components of Saudi Aramcos
corporate program to provide consistent safe work
practices for protection of personnel against electrical
arc ash hazards in accordance with NFPA 70E, Standard
for Electrical Safety in the Workplace, and Saudi
Aramco General Instruction (G.I.) 2.721, Electrical Arc
Flash Hazard Mitigation. This arc ash safety program
addresses the application of arc ash energy calculations,
labeling of existing electrical equipment, operation and
maintenance safe work procedures, use of personal
protective equipment (PPE), worker certication and
training, etc. Detailed design specications for new
electrical equipment and design of retrots for existing
electrical equipment are beyond the scope of this
program, since these hardware issues are addressed by
company standards.
Index Terms Arc ash, engineering controls,
administrative controls, personal protective equipment
(PPE), operation and maintenance safe work procedures,
worker certication and training.
1. INTRODUCTION

An arc ash often inappropriately referred to as
a ashover is the explosive release of energy when
electric current jumps from one phase conductor to
another or to ground. It is considered to be the most
hazardous type of electrical incident. Arc ashes can
reach heat levels four times the temperature of the suns
surface, blast pressures of 100 psi and eject ying debris at
speeds of 700 mph.
Electrical operators and technicians are often exposed
to the potential dangers of arc ashes, especially during
circuit breaker racking and switching. The greatest danger
occurs when operators and technicians engage in unsafe
behaviors, such as not following procedures, taking
shortcuts or being overcondent. Human error accounts
for most arc ash incidents. The remainder is due to
equipment failure or inadequate procedures.
Mitigating or eliminating the potential hazards associated
with arc ashes is of particular signicance in the oil and
gas industry. Just one arc ash can have catastrophic
consequences.
2. ARC FLASH ELECTRICAL SAFE
OPERATION PROGRAM
In addition to the requirement that work be performed
only on de-energized equipment, Saudi Aramco is taking
extensive measures to mitigate arc ash incidents. The
Arc Flash Electrical Safe Operation Program is a corporate
initiative, which is comprised of members from various
departments within the company, to eliminate arc ash
injuries and fatalities. This program focuses on three
interrelated elements that help in mitigating arc ash
incidents. These elements include: engineering controls,
administrative controls and personal protective equipment
(PPE) controls. The program has the following goals:
Implement new corporate arc ash safety
requirements at all company facilities.
Evaluate and deploy new technologies.
Develop company-wide electrical worker training
and certication.
Develop uniform operating and maintenance
procedures, as well as clear delineation of
responsibilities.
Promote arc ash awareness programs throughout the
company.
2.1 Engineering Controls
The further away operators and technicians are kept from the
source of an arc ash, the safer they are. The Arc Flash Electrical
Safe Operation Program is exploring available engineering
controls (technologies) that can ensure a safe distance is
maintained by either keeping the operator and technician away
from the arc or containing the arc away from the operator. It is
also evaluating their applicability to Saudi Aramco facilities and
reecting these applications in engineering standards, as well
as developing action plans for existing equipment.
2.2 Administrative Controls
Despite the benets of technological advances in mitigating arc
ash hazards, engineering controls (technology) alone will not
prevent these incidents.
Consistent and clear processes and procedures (administrative
controls) are crucial. Currently, each facility operates and
maintains electrical equipment based on guidelines and
procedures developed by each facility. These individual
guidelines and procedures differ between plants when it comes
to operation and maintenance procedures and certication and
training requirements. Therefore, the Arc Flash Electrical Safe
Operation Program is working to develop uniform corporate
requirements that will identify consistent safe work procedures,
certication and training requirements in accordance with the
latest international safety standards. [2]
Moreover, the company has introduced an awareness program
to highlight the dangers of arc ashes and the precautions
necessary to avoid them.
2.3 Personal Protective Equipment Controls
Personal protective equipment (PPE) is necessary to help prevent
injury from arc ash for personnel working on energized
electrical equipment, especially where other controls have not
yet been implemented or have been implemented and found
to be inadequate to completely control the risk.
Flame resistant clothing (FRC) is the most common and industry
accepted PPE that protects the body from burns due to a ame
or arc ash. The benecial characteristic of FRC is that it will not
continue to burn when a ame source is removed. This type of
clothing must be worn to limit the incident energy level of an
arc ash to 1.2 cal/cm against the workers skin. [3]
The everyday work clothing for electrical workers is FRC that
conforms to NFPA 70E Hazard/Risk Category 2, which has a
minimum arc ash rating of 8 cal/cm2. [1] This Category 2 FRC
and arc rated face shield are to be worn by anyone working on
energized electrical equipment operated at higher than 240
volts.
Electrical workers are to wear a higher rated arc ash suit,
including a ash hood and gloves, to safely perform a number
of specied tasks that have a potential risk for an arc ash with
an incident energy level higher than 8 cal/cm2, including when
racking, switching, or performing voltage testing. [1]
2.4 Program Teams
The program involves all levels of management, engineers, and
technicians from across the company. The program addresses
various root causes behind arc ash incidents and is segregated
into ve working groups: Technology, Certication, Operation
and Maintenance (O&M) Procedures, O&M Delineation, and
Awareness.
2.4.1 Technology
The Technology Team is responsible for exploring viable
available technologies that will help in mitigating arc
ashes, evaluating their applicability to Saudi Aramco
Facilities, reecting these applications in engineering
standards, and developing action plans for existing
equipment.
2.4.2 Certication
The certication group will develop training and
certication requirements for all Saudi Aramco electrical
system operators, embed the requirements in each
facilitys operation procedures, and coordinate with
training department to implement these requirements.
Since electrical system operators are the most vulnerable
to arc ash incidents, it is vital that all Saudi Aramco
and contractor electrical system operators are properly
certied and fully trained in their eld.
2.4.3 O&M Procedures
Consistent and clear operation and maintenance (O&M)
procedures are crucial in preventing arc ash incidents. [2]
Currently, Saudi Aramco facilities operate and maintain
electrical equipment based on procedures developed
individually by each facility. As such, the O&M Procedure
Team ensures that Saudi Aramco switching
Page 1 Page 300
and maintenance procedures for all facilities are
in accordance with international standards and
incorporated into plant operation procedures.
2.4.4 O&M Delineation
Clear jurisdiction between organizations eliminates
gray areas of O&M responsibility that can lead
to mistakes which cause arc ashes. The O&M
Delineation Team is responsible for identifying
and establishing a best-in-class operation and
maintenance jurisdiction between different Saudi
Aramco facilities and departments to maximize
safety, and reliability, as well as optimize overall
cost.
2.4.5 Awareness
The right attitude and the proper training will
provide the prevention necessary to eliminate
human error, which accounts for the majority
of all arc ash incidents. The Awareness Team
is responsible for identifying and establishing
platforms to advocate the dangers of arc ashes
and the precautions necessary to avoid them at all
levels within the Company, as well as contractor
companies. In addition to participating and holding
forums, campaigns, and seminars, the team also
developed a company newsletter, e-courses, and
regular classroom courses on arc ash safety.
3. CONCLUSIONS
Effective implementation of an Arc Flash Electrical Safe
Operation Program is vitally important for protecting
company and contractor employees, equipment and
facilities from injury, damage or loss. Nonetheless, similar
to all programs, its effectiveness ultimately depends on
people adopting the proper safety behaviors.
Copyright Saudi Aramco, 2009. All rights reserved.
No portion of this article may be reproduced, by any
process or technique, without the express written
consent of Saudi Aramco
ACKNOWLEDGMENT
I would like to express my gratitude and thanks to
Steven R. Hemler, for his supervision of this work,
valuable guidance, continuous encouragement and help
in preparation and writing up of this paper. I have drawn
greatly from his knowledge and experience. I would also
like to extend my appreciation to Awareness Team leader
Saleh A. Alamri, for his invaluable support and advice.
REFERENCES
1. Saudi Arabia. Saudi Aramco (2009), General
Instruction 2.721, Electrical Arc Flash Hazard
Mitigation
2. Saudi Arabia. Saudi Aramco (2009), Safety
Management System (SMS-Element #6)
3. USA National Fire Protection Association (2009) NFPA
70E, Standard for Electrical Safety in the Workplace
Page 303 Page 302
9
th
ASSE-MEC-2010-01
ASSE-MEC-2010-41
Training Electrical Engineering and Maintenance
Employees to be Qualied
Dennis K. Neitzel, CPE, ASSE Member
AVO Training Institute, Inc.
ABSTRACT
Training electrical engineering and maintenance
employees to be qualied is vital to a safe and efcient
work force, as well as to the reliability and integrity of
electrical systems and equipment. There are several
key components needed to develop a comprehensive
training program that will help qualify engineering
and maintenance employees. Understanding the
requirements for a qualied person will be of benet
in conducting the needs assessment, and the job/task
and hazard analysis, and will therefore benet the
development of the training program.
KEYWORDS
Qualied Person, Needs Assessment, Job/Task Analysis,
Job Hazard Analysis, Training Methods, Systematic
Approach to Training (SAT), Instructional Systems Design
(ISD).
1. INTRODUCTION
The subjects addressed in this paper should help clarify
some of the basic concepts needed in order to develop
an effective training program.
The subjects that will be addressed are:
Qualied Person Requirements
Needs Assessment
Job/Task Analysis and Job Hazard Analysis
Training Methods Overview
The question is often asked; How do I develop an
effective training program? This has always been
a mystery, especially to someone who has not been
formally trained in curriculum development. This paper
will address some of the basic concepts for developing
a training program and will provide a good starting
point for most companies. There are literally volumes of
material and information on how to develop effective
training programs on the market today. This paper is not
attempting to address all of the philosophies surrounding
curriculum development; however it will address most
of the basic concepts.
The typical method utilized for developing an effective
training program is the Systematic Approach to
Training or SAT, which utilizes the Instructional
Systems Design or ISD methodology for performing
the analysis, design, development, implementation, and
evaluation for a training program, to meet the specic
needs of a company. The ISD provides a systematic
procedure for identifying the job-related skills and
knowledge necessary for performance-based training.
The analysis phase of the ISD will be the primary focus of
this paper and will address several key elements which
include the requirements for a qualied person, as well
as conducting a needs assessment, job/task analysis,
and job hazards analysis. Combined, these elements
should provide the majority of information that would
be needed to develop the training programs necessary
for qualifying maintenance employees.
2. QUALIFIED PERSON REQUIREMENTS
Before the needs assessment and job/task analysis can
be properly conducted the requirements for qualifying
employees must be established. These OSHA mandated
requirements establish the foundation for training
and qualifying maintenance employees and must be
considered when conducting the needs assessment as
well as the job/task analysis.
Early editions of the National Electrical Code (NEC) and
OSHA 29 CFR 1910.399 dened a Qualied Person as:
One that is familiar with the construction and operation
of the equipment and the hazards involved. [1] OSHA also
states that qualied persons are intended to be only those
who are well acquainted with and thoroughly conversant
in the electric equipment and electrical hazards involved
with the work being performed. [2] The 2005 Edition
of the NEC expanded this denition and now requires a
qualied person to have received safety training on the
hazards involved. [3]
Since one of the three qualication requirements is being
familiar with the hazards of the equipment, it must be
addressed specically. OSHA has provided strict regulations
for safety training that go hand-in-hand with the
qualication of an employee. The following information is
provided in order to clarify the OSHA mandates for training
employees in the electrical eld.
OSHA 29 CFR 1910.269(a)(2)(i) requires employees to
be trained in and familiar with the safety-related work
practices, safety procedures, and other safety requirements
as it pertains to their respective job assignments. OSHA
also requires employees to be trained in any other safety
practices, including applicable emergency procedures
that are related to their work and are necessary for their
safety.
Qualied employees are required to be trained and
competent in:
Skills and techniques necessary to distinguish live
parts for other parts
Skills and techniques necessary to determine the
nominal voltage
Minimum approach distances to live parts
The proper use of:
o Special precautionary techniques
o Insulating and shielding materials
o Insulated tools and test equipment
o Job planning
OSHA states that a person must have this training in order
to be considered a qualied person. They also require
the employer, through regular supervision and annual
inspections, to verify that employees are complying with
the safety-related work practices. Additional training or
retraining may also be required if:
The supervision or annual inspection indicate non-
compliance with work practices
New technology
New types of equipment
Changes in procedures
Employee is required to use work practices that they
normally do not use
OSHA also considers tasks that are performed less often
than once per year to necessitate retraining before the
performance of the work practices involved. This retraining
may be as simple as a detailed job brieng prior to the
commencement of the work or it may require more in-depth
classroom instruction along with on-the-job training.
All training is required to establish employee prociency in
the work practices and procedures. In fact, OSHA requires
the employee to demonstrate prociency in the work
practices involved before the employer can certify that they
have been trained. [4]
Note the statement that requires the employee to
demonstrate prociency in the work practices involved.
The only way the employee can demonstrate prociency is
through a written exam and/or to actually do the work after
receiving or as part of the training. Hands-on training would
be required in order to accomplish this OSHA requirement
(see Fig. 1).
Figure 1 Hands-On Low-Voltage Circuit Breaker
Training
The OSHA Electrical Safety-Related Work Practice regulation,
29 CFR 1910.331-.335 [6], provides the same basic
requirements as 1910.269 for training qualied persons.
These same training requirements are also found
Page 305 Page 304
in the NFPA 70E-2009, Standard for Electrical Safety in
the Workplace. [9]
As can be seen by the above statements, proper training
is a vital part of the workers safety and prociency, as
well as being a mandated OSHA requirement.
3. NEEDS ASSESSMENT
Now that it is understood who a qualied person is
and why they must be properly trained, the next step
is to determine what the specic needs are. The needs
assessment is required before any signicant training
can be developed and implemented. This assessment
involves relevant company personnel who are aware of
the job requirements and all applicable codes, standards,
and regulations. Information that is collected will provide
insights into any past or present performance problems
that must be addressed in the training program. This
process can also be used to determine whether or not
training is the solution to any problems that may exist.
Other factors, which affect performance, must also be
recognized and considered. These other factors could
include the quality of procedures, human factors,
management style, and work environment. Any one or
all of these factors may affect job performance.
The needs assessment should include, but not be limited
to, an in-depth review of the following:
Standard Operating Procedures (SOP)
Department Procedures
Technical Specications/Standards
Job Questionnaires
Organization Charts
Operating Logs
Qualication Standards
Unusual Occurrence Reports (UOR)
Review of these documents has a twofold purpose: 1) It
enables the evaluator to learn about the general nature
of the jobs being assessed, and 2) It tells the evaluator
how much of the analysis has already been done. [10]
The information collected during the needs assessment
will provide the starting point for the job/task and
hazard analysis and ultimately the design, development,
implementation, and evaluation of the training program
that meets the specic needs of a company.
4. JOB/TASK ANALYSIS AND JOB HAZARD
ANALYSIS
This section will address the nal two elements of
the analysis phase of the ISD. Establishing proper job
procedures and training programs is one of the benets of
conducting job/task analysis (JTA) as well as a job hazard
analysis (JHA). To do this, carefully study and record each
step of a job, identify the tasks and elements that make
up the job, identify existing or potential job hazards, and
determine the best way to perform the job along with
reducing or eliminating the hazards.
4.1 JOB/TASK ANALYSIS [10]
A review of the information collected during the needs
assessment will help to write the initial job description. The
description should contain the following components:
Job Title
Qualication requirements for the job
General description of job requirements
Description of the job position within the
organization, including lines of supervision and
assistance available to the employee.
Description of job environment
Listing of tools and equipment used in the job
Listing of resource documents and references used
in the job
Inventory of tasks
The most difcult part of the job description to develop is
the task inventory, which is a listing of all tasks that make
up the job.
A task is dened as an observable, measurable unit of
work which has a denite beginning and end. A task can
be a performed in a relatively short period of time (i.e.,
minutes, hours, or days), and is independent of other
actions. Attachment 1 contains guidelines for writing
task statements.
Tasks themselves are made up of discrete, manageable
steps, or elements. Elements may or may not require
sequential performance. To avoid confusing tasks
and elements with one another, the evaluator should
remember the following distinctions:
A task is always performed for its own sake in the
job situation. An element never is.
Each task is independent of other tasks. Each
element is dependent on other elements. An element
is relatively meaningless outside the group of
elements that make up a task.
When organizing task lists, the evaluator may sometimes
nd it helpful to categorize groups of tasks into duty areas.
For example, a facility electrician may have duties in electrical
utilization equipment and systems, power generation,
distribution equipment and systems, and substation
maintenance and testing.
All of the duty areas and tasks performed by a single worker
comprise a job. A facility electrician is an example of a job.
Attachment 2 shows the hierarchical arrangement of these
terms.
The next step is to verify the accuracy of the job description
by interviewing/surveying job incumbents. The primary
concerns of the verication process are to ensure that:
1. All tasks performed by all levels of personnel, who do
the job, are included in the task list, and
2. The task statements are consistent with the guidelines
in Attachment 1.
It is important to consult a number of different people in
the verication process, since different individuals will paint
different pictures of the job.
The interview/survey is intended primarily to verify with job
incumbents the accuracy and validity of the task list. Do the
tasks reect the job as it really is? For the tasks that do, the
job incumbent is asked to assess ratings in the following
categories:
Importance
Difculty of performing
Difculty of learning
Frequency of performing
Time spent performing
The rating system is based on Attachment 3, and the results
for all tasks are compiled on the Attachment 4 form.
Tasks that, according to the interview/survey, do not belong
on the list are omitted from the job description. Those that
were incorrectly stated are rewritten. Any vital tasks that are
overlooked are added to the list and assessed.
Next, the revised task listing is submitted for assessment and
validation to the management of the referent organization.
The same procedure as that described for job incumbents is
used. Again, the listing is revised as necessary.
The next step is to select tasks for training/detailed analysis.
This is a critical step because it obligates resources for both
curriculum development and actual training.
Four criteria are used in the process of selecting tasks for
training/detailed analysis:
1. The percentage of incumbents performing the task
2. Average rating of task importance
3. Average rating of task difculty
4. Average rating of frequency of task performance
Numbers for each criterion are based on the interview/
survey results.
Attachment 5 is a owchart that can serve as a general
guide in the task selection process. Each task is put into
the chart on the left, branching according to its difculty,
importance, and frequency. The task output is on the right
at one of the 18 positions shown. Each position reads either
Train Extensively, Train, or Dont Train.
For a task with a Dont Train output in Figure 6, no formal
training is required; often, a trainee can learn the task while
performing the job. Train requires some type(s) of formal
training such as classroom lecture, on-the-job training,
training manuals, etc. Train Extensively requires more
intensive formal training.
This essentially concludes the job analysis phase of the job/
task analysis. The task analysis must now be conducted.
The principal purpose of the task analysis is to determine
the skills and knowledge, which the job incumbent must
have in order to perform tasks safely and efciently.
The recommended method for obtaining task analysis
information is to interview Subject Matter Experts (SME).
A skill is dened as an action required in order to perform
a task that involves coordination of body movements. In a
sense, it is nothing more than the application of a workers
knowledge. Knowledge is dened as understanding of
facts, principles, or concepts, including the cognitive process
necessary to process information.
Task analysis involves much more than pinpointing required
skills and knowledge for the task. It focuses on all-important
aspects of the task, including:
Page 307 Page 306
All the steps or elements required for task
performance
The conditions under which the worker must
perform the task
Standards for adequate performance
An integral part of the analysis phase is continuing
evaluation. Data collected must be evaluated regularly
for consistency with changes in the needs of the facility
and personnel.
It is important to note that the information from the job/
task analysis does not necessarily include all steps for
every job in the industry. It is important that the analysis
be conducted for every job function in the company
in order to identify all of the steps necessary to work
efciently and safely.
The following is a summary of the recommended steps
for conducting a Job/Task Analysis:
Review available job information using existing
procedures, standards, reports, etc., to learn the
general nature of the job.
Write an initial job description. The most difcult
part of the job description to develop is the
task inventory, which is a listing of all tasks that
make up the job.
Identify the tasks. A task is dened as an
observable, measurable unit of work.
Organize task lists. The evaluator may sometimes
nd it helpful to categorize groups of tasks into
duty areas. The tasks performed in a given duty
area, by a worker(s), would comprise a job.
Select tasks for training and/or detailed analysis.
4.2 JOB HAZARD ANALYSIS
A job hazard analysis can provide a great deal of
information and direction toward reducing accidents
and injuries in the workplace, but it is only effective if it
is reviewed and updated periodically. The frequency of
review and update will vary from weeks, months, or even
years. OSHA identies several areas to be considered
that would require review and update; new technology,
new types of equipment, or changes in procedures. [4]
Even if no changes have been made in a job, hazards
that were missed in an earlier analysis could be detected.
It is recommended that at least an annual basic review
be conducted; in fact, OSHA requires several annual
reviews such as for energy control procedures [7] and
for work on electric power generation, transmission, and
distribution lines and equipment. [4]
The following are the recommended steps for conducting
a Job Hazard Analysis:
Select jobs for analysis and prioritize them by
hazardous conditions and frequency performed.
Before beginning the job hazard analysis, look at
the general conditions under which the job is to be
performed and develop a checklist.
Most jobs can be broken down into steps.
After you have recorded the job steps, examine
each step to determine the hazards that exist or
that might occur.
Determine the probable cause of the hazards.
Recommend safety procedures and personal
protective equipment (PPE).
Revise the Job/Task Analysis as necessary based on
the hazards.
Performing a hazard analysis is not an option. OSHA
29 CFR 1910.132(d)(1) requires that The employer shall
assess the workplace to determine if hazards are present,
or are likely to be present, which necessitate the use of
personal protective equipment (PPE) [8] (see Figure 2).
Figure 2 Electrical Personal Protective Equipment
Examples (Arc/Flash Suit, Rubber Gloves w/Leather
Protectors, Insulated Tools)
NFPA 70E-2009 also requires a Flash Hazard Analysis be
performed to determine the level of the electrical energy
hazard and to establish a Flash Protection Boundary
in order to properly select ash protective clothing and
equipment for employees that may be exposed to this
hazard by working within the Flash Protection Boundary
(see Fig.3 & 4). [9]

Figure 3 Flash Hazard Analysis Determines the Level
of Protection Required on this Motor Control Center
(8 cal/cm2)

Figure 4
40 cal/cm2 protection required for this Low-Voltage
Circuit Breaker Cubicle work, based on the Flash
Hazard Analysis
In addition to this assessment OSHA also requires, under
1910.132(f)(1), that: The employer shall provide training to
each employee who is required by this section to use PPE.
[8]
Any time a job/task or hazard analysis is revised, training
in the new job methods or protective measures should be
provided to all employees affected by the changes. A job/task
or hazard analysis can also be used to train new employees
on job steps as well as job hazards.
5. TRAINING METHODS OVERVIEW
OSHA has provided the industry with several good mandated
reasons for the training and qualication of employees.
There are also many benets to having well trained and
qualied employees. One of the major benets expressed by
industry is the reduction of unscheduled down time. Another
major benet is the safety of each of their employees. The
more extensive the training program the better qualied the
employee. It has been proven that the most effective training
programs include a combination of lecture and hands-on
instruction. As an example; an employee attends a course on
circuit breaker maintenance and testing using the following
agenda:
1. The instructor explains, in lecture, all of the
maintenance and testing techniques;
2. The instructor then demonstrates those techniques on
a circuit breaker; and
3. The employee performs hands-on maintenance and
testing of the circuit breaker using the techniques that
were presented and demonstrated.
In this example, employees, on average, would retain at least
90% of what they were taught. This method of training
has proven to be the most effective means for qualifying
employees.
Performing a thorough needs assessment and then
conducting an in-depth job/task and hazard analysis
will provide the required information for developing a
comprehensive training program. This process will provide
the means to properly train electrical maintenance employees
to be qualied.
6. CONCLUSION
The goal of any training program is to develop and maintain
an effective and safe work force. Utilizing the SAT and ISD
methodology can help accomplish this goal.
Electrical power systems today are often very complex.
Protective devices, controls, instrumentation, and interlock
systems demand that technicians be trained and qualied at
a high technical skill level. Safety and operating procedures
utilized in working on these systems are equally as complex
requiring technicians to be expertly trained in all safety
practices and procedures.
OSHA Regulations require employers to document that
employees have demonstrated prociency in electrical
tasks. Employers must certify that their employees are
qualied and that this certication is maintained for the
duration of the employees employment. OSHAs intent
here is to ensure that the training is well documented; a
notation in the employees training record would sufce
for in-company training. If the employee attends training
outside of his/her company, a Certicate of Completion
would serve as acceptable documentation that the training
was successfully completed. A copy of the certicate should
be maintained in the employees training record.
Page 309 Page 308
REFERENCES
[1]. OSHA 29 CFR 1910.399(a), Denitions
[2]. OSHA Instructions STD 1-16.7, Directorate of
Compliance Programs, July 1, 1991
[3]. NFPA 70, National Electrical Code, 2002 Edition
[4]. OSHA 29 CFR 1910.269, Electric Power
Generation, Transmission, and Distribution, Jan.
31, 1994
[5]. OSHA Federal Register 29 CFR 1910, Electric
Power Generation, Transmission, and
Distribution; Electrical Protective Equipment; Final
Rule, Monday, January 31, 1994 (Preamble to 29
CFR 1910.269)
[6]. OSHA 29 CFR 1910.331-.335, Electrical Safety-
Related Work Practices, Aug. 6, 1990
[7]. OSHA 29 CFR 1910.147, Control of Hazardous
Energy Source (Lockout/Tagout), Sept. 1, 1989
[8]. OSHA 29 CFR 1910, Subpart I, Personal Protective
Equipment, 1910.132, General Requirements
[9]. NFPA 70E, Standard for Electrical Safety in the
Workplace, 2004 Edition
[10]. Safety Analysis Seminar, Course No. 9807,
Rev.1, January 1999, AVO Training Institute, Inc.
INFORMATION AND QUESTIONS
For more information, contact Dennis K. Neitzel, CPE
(Member-ASSE; Senior Member, IEEE) Mr. Neitzel is the
Director of AVO Training Institute, Inc. (a Subsidiary
of Megger); Dallas, Texas. Contact Mr. Neitzel at:
[email protected]
Attachment 1
Guidelines for Writing Task Statements
Attachment 2
Hierarchical Arrangement of Jobs, Tasks, and Elements
Attachment 3
Task Rating System
Page 1 Page 310
Attachment 4
Task Assessment Summary
Attachment 5
Criteria for Selecting Tasks for Training
Page 313 Page 312
9
th
ASSE-MEC-2010-42
Practical Engineering Solutions for
Controlling Arc Flash Hazards
Ahmed A. Al-Sufyani, IEEE Member
ABSTRACT
Exposure to electrical arc ashes often results in a variety
of consequences ranging from minor burns to fatality.
Arc ash hazards can be well controlled by maintaining
a safe distance between electrical workers and sources
of arc ashes, limiting the arc ash energy, or containing
the hazards away from the work environment. This
paper will focus on various engineering solutions to
mitigate the hazards of arc ash for personnel working
around electrical equipment. In this connection, it will
highlight existing equipment design modications and
other technological solutions.
Index Terms Arc ash, safe distance, incident energy,
remote racking, remote switching.
1. INTRODUCTION
Electrical operators and technicians are the most
exposed personnel to the potential danger of arc
ashes; especially during circuit breaker racking in/out
or switching.
Saudi Arabias state oil company, Saudi Aramco,
manages proven reserves of 260 billion barrels of oil
and manages the fourth-largest gas reserves in the
world, 263 trillion cubic feet. Saudi Aramco is taking
extensive measures to provide arc-safe environments
for its employees/contractors and eliminating arc ash
injuries and fatalities by implementing a comprehensive
arc ash mitigation program. The program mainly
focuses on three interrelated system elements, which
are people, processes and equipment. Failure of any
component is always the main cause of any arc ash
incident. For processes, consistent and clear guidelines
and procedures are crucial in preventing arc ash
incidents. For people, the right attitude and proper
training will eliminate most human errors, which account
for the majority of all incidents.
The scope of this paper is conned to only Saudi Aramco
efforts in arc ash mitigation techniques for equipment. In
this regard, the main objective is to maintain a safe working
distance of personnel from the equipment. The farther
workers are kept from arc ash sources, the safer they will
be from arc ash hazards. A Technology team, which is
a part of the Saudi Aramco program, explored different
available technologies or techniques that can ensure a safe
working distance by either keeping the workers away from
the arc blast or containing the arc blast away from the
worker. The team also evaluated the solutions applicability
to Saudi Aramco facilities and incorporation of these
applications into the companys engineering standards, as
well as developing action plans for modication of existing
equipment.
2. ARC FLASH HAZARD ANALYSIS
The purpose of arc ash hazard analysis is to calculate the
level of incident energy, which may be present at various
system locations during a fault. The ash protection
boundary is the distance from the arc at which the incident
energy is 1.2 calories/cm, a level above which skin burn
is considered incurable. Once the incident energy is
determined, appropriate preventive measures, such as
utilizing technologies or personal protective equipment
(PPE), shall be selected.
To calculate the incident energy and ash protection
boundary for a given installation, a number of steps shall be
followed. An arc ash hazard analysis starts with collecting
the system data. Then a detailed analysis is performed to
determine the bolted and arc fault currents to develop a
protective device coordination study. Finally, an evaluation
is done to determine whether the equipments current
rating is within acceptable limits. Incident energy and arc
ash boundaries are calculated following the NFPA 70E and
IEEE 1584 standards.
An option to make this analysis easier is to use one of the
electrical power system software programs available in the
market, to solve multiple scenarios and determine the worst
case incident energy level.
3. TECHNOLOGIES
The following technologies were evaluated in Saudi Aramco
to mitigate arc ash hazards by addressing the equipment
component:
3.1. Remote Switching Devices
Remote switching is a device used to operate different
types of circuit breakers distantly. It provides a safe distance
between the operator and the equipment the source of
the hazards.
The Arc Flash Technology team has been evaluating ve
methods for implementing remote switching for switchgears
from 0.48 kV to 69 kV.
3.1.1 Remote Control Panels
These panels operate low and high voltage breakers and are
installed inside the substation away from the switchgear.
The panel size depends on the number of targeted breakers.
Each breaker requires a control switch and indicating lamps
showing the breaker status. The panels dont require major
modications to the control circuit or expensive materials;
and hence it is cost effective.
3.1.2 Expansion of Distributed Control Systems
(DCS)
This method entails expansion of the existing DCS to
accommodate breaker control for switchgears. It requires
additional control and status points in addition to control
wires between switchgear cubicles and the control room.
This modication to existing control circuits and existing DCS
is not easy and therefore is relatively high in cost.
3.1.3 Upgrading of Remote Terminal Units (RTU)
Upgrading RTUs will ease the remote control of high voltage
switchgears. The upgrade requires additional control and
status points besides control cables between switchgear
cubicles and RTU, which is costly, in turn.
3.1.4 Handheld Pushbuttons
Perhaps the best and simplest solution is to use handheld
pushbuttons, connected via a wire to a male socket, which
is connected to a permanently installed female socket
available in each breaker cubicle. This requires minimum
modications to the control circuit and it can be added to
new or existing installations for a relatively low cost.
3.2. Remote Racking Mechanism
Since keeping ones distance is vital for safe operation of
circuit breakers, a remote racking system helps operators
to stand at a safer distance when racking in or out of
the breaker. Remote racking systems replace the manual
racking and removes the operators from direct contact with
the breaker and hence the hazards.
Different manufacturers are providing different mechanisms
for remote racking solutions. The technology team surveyed
all breakers types in Saudi Aramco facilities rated 480V-
34.5KV to identify what type of remote racking mechanisms
are required for existing Saudi Aramco facilities. The team
has been evaluating amending the mechanism from being
merely an option to becoming a required standard in Saudi
Aramcos engineering standards and specications.
3.3. Arc Detection Scheme
The main concept of an arc detection scheme is to minimize
duration of an arc and to isolate the source of an arc. To do
this, this scheme will rst detect an arc and then cut the
ow of current. The ow of current is usually interrupted by
opening a circuit breaker.
M
e
t
h
o
d
C
o
n
t
r
o
l
C
ir
c
u
it

M
o
d
i
c
a
t
io
n

M
o
d
i
c
a
t
io
n

t
o

D
C
S

o
r

R
T
U

E
x
is
t
in
g

S
y
s
t
e
m

D
if
c
u
lt
y

C
o
s
t
Handheld
Pushbuttons Yes No Low Low
Remote
Control
Panels Yes No Moderate Moderate
Expansion
of RTU Yes Yes High High
Expansion
of DCS Yes Yes High High
Page 315 Page 314
An arc detection scheme works by detecting light emitted
by an arc through light sensors connected to light
detecting relays with an optical ber cable. Whenever
there is an arc, the sensor will detect the intense light
and the relay will trip the breaker instantaneously.
Saudi Aramco has been evaluating the inclusion of this
scheme into Saudi Aramcos engineering standards and
is working to identify critical substations for retrot of an
arc detection scheme into the existing equipment. The
technology team is also evaluating modifying existing
standards for 4.16KV Motor Control Centers and 480V
switchgear to improve the fault clearance timing.
3.4 Bus Differential Schemes
When a fault is detected within a zone of a differential
protection system, tripping occurs instantaneously for
faults within that particular zone. This will increase
personnel safety, reliability of facilities, and elimination
of intentional time delay.
Saudi Aramcos engineering standards require bus
differential protection for 13.8kV and above switchgear.
Currently, the technology team is evaluating expanding
the scope of implementation of this scheme to 4.16kV
switchgears.
3.5 Arc Resisting Switchgear
Conventional switchgear is designed to not withstand
rapid rise in temperature and pressure inside the
enclosure caused by a high arc energy fault.
Arc resistant switchgear is designed to minimize the
spread of an arcing fault to other compartments, and
thereby protect personnel and equipment around
the switchgear. It is also designed to allow each
compartment door and barrier plate to withstand the
pressure surge. Also, hot fumes and molten particles
are allowed to escape through pressure relief vents on
top of the enclosures. Arc resistant switchgear doors
are designed to allow breaker rack in or rack out while
the door is closed, and they have a view window to
observe the breaker status. In addition, the low voltage
compartment is completely segregated to avoid any
pressure build up.
Arc resistant switchgear incorporates three types of
protection schemes depending on where electrical
workers can perform their job, yet be protected if an
internal arc occurs in energized switchgear:
Type A: Arc resistant protection from an internal arc only at
the front of the switchgear.
Type B: Arc resistant protection at the front, back, and sides
of the switchgear.
Type C: Arc resistant protection at the front, back, sides
and also between compartments within a cell and adjacent
cells. [1]
Based on incident energy calculations, the technology team
has been evaluating the need for arc resistant switchgears,
while considering the higher cost for such technology.
If applicable, inclusion into Saudi Aramcos engineering
standards will be considered.
3.6 Smart Motor Control Center (MCC)
A smart MCC integrates three technologies: intelligent
devices, device-level communication network, and
precongured monitoring software. [2]
During operation or maintenance of an MCC, workers are
exposed to electrical energy during operating disconnects
or circuit breakers, troubleshooting starters, and when
performing voltage or current measurements.
A smart MCC affords an opportunity for improved safety
by reducing exposure to hazards during startup and
troubleshooting, since most information can be obtained
without opening the MCC doors. In addition, smart
MCCs have remote racking mechanisms combined with
remote monitoring and control capabilities that guarantee
operating from a safe distance.
Smart MCCs are part of Saudi Aramcos engineering
standards and are being implemented in a number of its
facilities.
3.7 High Resistance Grounding
High resistance neutral grounding combined with sensitive
ground fault relays and isolating devices can quickly
detect and shut down the faulted circuit. High-resistance
grounding of the neutral limits the ground fault current to
a very low level (typically under 25 amps). It is used on low
voltage systems of 600 volts or less, under 3,000 amps.
The technology team is studying the applicability of high
impedance grounding in Saudi Aramcos facilities.
4. CONCLUSION
Using remote racking and switching devices is the easiest
and most effective method to maintain a safe distance
from arc ash hazards during operation. Proper selected
PPE, based on a comprehensive arc ash analysis for the
electrical system, will be required during maintenance
activities.
Bus differential and arc detection technologies shall be
incorporated for new installations to reduce fault-times,
and hence this increased safety could reduce injuries and
even save lives. In this regard it is strongly recommended
to include the above requirements in all relevant industrial
standards.
ACKNOWLEDGMENTS
I would like to acknowledge and extend my heartfelt
gratitude to the following persons who have made the
completion of this work possible:
Saleh A. Alamri and Abdulaziz A. Alghamdi for their vital
encouragement and support.
Shoukat Raza, Ahmed Bakhsh and Steven Hemler for their
valuable comments.
Saudi Aramcos Arc Flash Safe Operations team members.
REFERENCES
1. D. D. Blair, D. L. Jensen, D. R. Doan, and T. K.
Kim, Networked intelligent motor-control systems,
IEEE Mag. Ind. Applicat., vol. 7, pp. 18-25, Nov.-Dec.
2001.
2. E. W. Kalkstein, R. L. Doughty, A. E. Paullin, J.
Jackson, and J. Ryner, The safety benets of
arc resistant metalclad medium voltage switchgear,
IEEE Trans. Ind. Applicat., vol. 31, pp. 1402-1411,
Nov.- Dec. 1995.
For effective implementation, an organization should
develop the capabilities and support mechanisms necessary
to achieve its policy, objectives and targets.
Page 317 Page 316
9
th
ASSE-MEC-2010-43
Implementing Inherent Safety
David A. Moore, PE, CSP Lee Salamone
AcuTech Consulting Group
ABSTRACT
What do we mean when we speak of an inherently
safer chemical process? A chemical manufacturing
process is inherently safer if it reduces or eliminates
the hazards associated with materials and operations
used in the process, and this reduction or elimination
is permanent and inseparable. In theory, this is an
obvious and easy concept to adopt. But in practice it is
more difcult in most applications since inherent safety
is more of a concept that it is a prescribed approach.
As such, engineers typically have used inherent safety
(IS) in design and modication of process facilities only
indirectly.
In recent years, the concept of IS has grown more
commonplace in the United States and in the Europe
Community. While evidence of its practice spreads,
the lack of published evidence of its benets may be
a symptom of the lack of formal and agreed upon IS
analysis approaches; another reason may be that the
requirement to consider IS approaches simply havent
existed until recently to drive documentation of the
considerations and results.
In general, the strategy for reducing risk, whether
directed toward reducing the frequency or the
consequences of potential accidents, can be classied
into four categories. These categories are inherent,
passive, active, and procedural.
KEYWORDS
Inherent safety, process safety management,
minimization, moderation, simplication, substitution.
INTRODUCTION
In general, the strategy for reducing risk, whether directed
toward reducing the frequency or the consequences of
potential accidents, can be classied into four categories.
These categories are:
Inherent - Eliminating the hazard by using materials
and process conditions which are non-hazardous;
e.g., substituting water for a ammable solvent.
Passive - Minimizing the hazard by process and
equipment design features which reduce either the
frequency or consequence of the hazard without
the active functioning of any device; e.g., providing
a diked wall around a storage tank of ammable
liquids..
Active - Using controls, safety interlocks, and
emergency shutdown systems to detect and
correct process deviations; e.g., a pump which is
shut-off by a high level switch in the downstream
tank when the tank is 90% full. These systems
are commonly referred to as engineering controls
although human intervention is also an active layer.
Procedural - Using policies, operating procedures,
training, administrative checks, emergency
response, and other management approaches
to prevent incidents, or to minimize the
effects of an incident; e.g. hot work procedures
and permits. These approaches are commonly
referred to as administrative controls.
This paper will examine the concept of inherent safety
and present methods for systematically analyzing
the potential for inherent safety and in effectively
implementing it within the organization.
Dening Inherent Safety:
The essential issue with the concept of inherent safety
(IS) is that the focus should be on reducing or eliminating
hazards by changing the materials, chemistry, and process
variables such that the reduced hazard is characteristic of the
new conditions. This compares with adding layers of safety
to a process to reduce the risk, but not reducing the nature
of the hazard directly.
The process with reduced hazards is described as inherently
safer, rather than inherently safe, as it is a move in the direction
of reducing the risk of realizing the consequences of concern.
This terminology recognizes there is no chemical process that
is without risk, but all chemical processes can be made safer
by applying inherently safer concepts. The nal goal in risk
management is acceptable risk, where inherent safety could
be one effective strategy to achieve that goal. Inherent safety
is not the only process risk management strategy available
and may not be the most effective. A system of strategies is
applied to reduce risks to the lowest levels practicable.
A chemical manufacturing process is inherently safer if it
reduces or eliminates the hazards associated with materials
and operations used in the process, and this reduction or
elimination is permanent and inseparable. To appreciate
this denition fully, it is essential to understand the precise
meaning of the word hazard. A hazard is dened as a
physical or chemical characteristic that has the potential
for causing harm to people, the environment, or property
(adapted from CCPS, 1992). The key to this denition is
that the hazard is intrinsic to the material, or to its conditions
of storage or use.
Some specic examples of hazards include:
Chlorine is toxic by inhalation.
Sulfuric acid is corrosive to the skin.
Ethylene is ammable.
Steam conned in a drum at 600 psig contains a
signicant amount of potential energy (PV and Thermal
energy).
Acrylic acid monomer can polymerize releasing large
amounts of heat.
These hazards cannot be changed -- they are basic properties
of the materials and the conditions of usage. The inherently
safer approach is to reduce the consequences or likelihood
of the hazard or by completely eliminating the hazardous
agent.
For these reasons, the inherently safer approach should be
an essential aspect of any process safety program. If the
hazards can be eliminated or reduced, the extensive layers of
protection to control those hazards will not be required or
may be less robust.
Inherent Safety Principles:
IS includes four basic strategies to apply for risk management
of chemical facilities:
Substitution - to replace a material with a less
hazardous substance
Minimization - to use smaller quantities of hazardous
substances
Moderation - to use less hazardous conditions, a
less hazardous form of a material, or facilities
that minimize the impact of a release of
hazardous material or energy
Simplication - to design facilities or processes which
eliminate unnecessary complexity and make operating
errors less likely or which are forgiving of errors that
are made
These four strategies could be independent ideas or they
may relate to one another, depending on the situation.
There is no dened and agreed upon way to consider them
in a formal analysis methodology. Engineers are encouraged
to consider them to the extent possible, but given the
innumerable situations where they may be applied there
is still no agreed-upon rule regarding what is an adequate
consideration of IS.
In 1996 the AIChE CCPS published the book Inherently
Safer Chemical Processes A Concept Book, to clarify the
concept and to help provide examples. Updated in 2008
(Inherently Safer Technology-A Life Cycle Approach), the
2nd Edition is one of the leading practitioners guides to
understanding and applying inherent safety concepts. It
is the leading reference mentioned in various regulatory
actions and proposed actions in the United States.
Challenges in Inherent Safety:
Inherent safety is a challenge for all parties the owner,
chemist, operator, design engineer, regulator, and the
public. There are limitations to inherent safety and technical
and business constraints to its usage. There are examples
of where inherent safety has been very useful and where
opportunities to employ it may exist, but since it is a concept,
the blanket requirement of inherent safety poses issues.
Page 319 Page 318
Some of these challenges include:
Undocumented considerations
IS is not new, but regulation of IS is new. Most of industry
is already practicing it in some way, but not formally
documenting how they use inherent safety as a strategy
for risk management. Engineers tend to make orderly,
inherently safer decisions by practice for the most
part. This has been expected of industry as a matter of
principle, and there is evidence it is being practiced, but
without a degree of measurement of their actions or
the benets. One of the suspected reasons for this is
the lack of formal and agreed IS analysis approaches,
and the other is that these requirements simply havent
existed until recently to document the considerations.
Requires judgment and is potentially
subjective
It is precisely because IS is vague and involves
considerable judgment that it is very difcult to dene
and implement to any degree of uniformity and
objectivity. This is particularly true in the chemical and
petrochemical industries where the diversity of chemical
uses and processes and site specic situations prevents
clear characterization of the industry and a one-sized-
ts-all solution.
IS can also be very subjective how safe or secure is
safe or secure enough is a decision made by the analyst
conducting the study or the management group using
the results for decision making. There are no clear and
objective guidelines for how to make these decisions
as it is considered both a concept to apply as one sees
t and as opportunities arise. The state of the practice
is not perfectly clear on how it should be dened,
conducted, analyzed, assessed, or judged as adequately
performed.
Value and Perspective
What is inherently safer to one person is not necessarily
inherently safer to another it is a matter of perspective.
If one takes an insular view of what is inherently safer, it
may not be the most inherently safe decision for society
as a whole. For example, if a plant decides to lower
its risk at a given xed chemical plant site by reducing
inventory or making an alternative product, this could
simply either transfer the risk to more of the public
through increased shipments of hazardous materials in
the community or move the same operation to another
location which may be more problematic.
Companies may be unclear on the value of IS or may
be unable to easily prove that IS is benecial to employ.
Methods to prove the value of IS and to quantitatively
measure whether a given process is as inherently safe as
is practicable are generally unavailable or unproven. Case
studies showing the economic and other benets are not
available for a wide array of industrial situations.
Depending on the goals, the perspective may be that it
is safe or secure enough as it is. For example, the plant
is designed to operate at a given capacity and has been
optimized through careful engineering design to produce
the product safely, efciently, and cost-effectively. Many IS-
type considerations have already gone into the design or
operating philosophy of the plant. When confronted with
the need to conduct an IS study, engineers often nd that
there are few opportunities to improve on that design,
short of a complete change of technology, even if another
technology exists that is inherently safer. If it does exist,
they nd it troubling to consider changing the technology
when the gains may be questionable for safety or security.
As such, the net change may be limited.
Safety and Security Conficts
The need to introduce inherent safety as a strategy for
security is questionable. A requirement to do so could result
in a great deal of analysis to consider a single strategy has
been applied, thereby causing a very large documentation
problem and undoubtedly many technical and legal
dilemmas. This is contrasted with a preferred approach
of allowing a facility or industry to set security objectives
to determine the relevant issues and vulnerabilities and
make appropriate risk management decisions. It should
be considered as a potential strategy rather than the rst
priority and allow the most effective homeland security
strategies to be applied rather than force a particular one
or a change in every technology.
In fact, what is inherently safer is not necessarily what is
inherently more secure. For example:
Moderation - a process that successfully applied an
inherently safer technology may have changed a catalyst
to end with a moderated process one that is operated
at a lower pressure and temperature. This is commendable
for safety, but may have little to do with security. The
process may be disabled just the same, which is an issue of
economic security, or it may release a ammable or toxic
cloud which is just as signicant.
Minimization - In another case, an owner may have
reduced the inventory of a feedstock in a tank to reduce
the consequences of an attack. The feedstock is a toxic
substance, so this appears sensible, but the material is also
a dual purpose chemical that could be used to make an
improvised chemical weapon. In that case, simply reducing
the volume may not matter for the threat of theft of the
materials in fact, smaller quantities may be more man-
portable thereby accommodating theft. The plant may
need more frequent deliveries of the material, which also
increases the chance of theft.
Simplication - An owner may invest considerable sums
of capital to improve the simplicity of the control system,
thereby lessening the chance of human error as a cause
of an accident. This may result in a control system that is
easier to compromise.
Substitution A petroleum rener may substitute
hydrogen uoride catalyst with sulfuric acid for alkylation
(along with substantial process changes). While the
individual offsite impacts may be reduced from storage,
the opportunities for disruption of the transportation chain
are increased due to the additional deliveries of acid that
are required. Besides the number of additional volumes
of materials transited throughout the community, the site
has increased vulnerability each time a vehicle has to enter
the perimeter. Generally speaking, security professionals
try to nd ways to reduce penetrations through a secured
perimeter.
Inherent Safety Regulations and
Mandates:
As a concept, IS is particularly difcult to regulate or to
mandate. What is inherently safer in one instance may just
be a transfer of risk in another.
Today, there are only a few examples of regulatory
requirement for process safety or security related to IS.
For example, IS requirements are part of the Contra Costa
County, California, local Industrial Safety Ordinance (ISO),
enacted in 1998, which affects only eight chemical sites.
As for security, the only requirement that exists is in New
Jersey where the Governor enacted a Prescriptive Order
which includes the need to consider IS for chemical security
for certain sites in the state. Neither regulation goes so far
as to require a change in technology due to the enormous
challenges and liabilities associated with that move.
There is an effort afoot in the US Congress now to mandate
consideration of IS for the purposes of homeland security
regulations. While it is not the rst time this debate has
taken place, the political climate in the US is now more
favorable and acceptance of some manner of IS mandate
is much more likely.
Applications of Inherently Safer Designs:
Applications of IS are widely applicable in corporate risk
management including use as a corporate philosophy for
reducing risks associated with process safety, environmental
protection, security, and operational upsets. It has been
successfully implemented to reduce the likelihood of or the
potential severity from process safety events.
Successful applications of IS considerations should formalize
consideration of the principles of IS rather than include them
by happenstance. This can be done by supporting inherent
safety options in a direct or indirect manner to fully realize
potential benets and documenting all options considered.
Inherent safety can be analyzed in multiple ways some
alternatives are:
Checklist Process Hazard Analysis (PHA)
Independent Process Hazard Analysis (PHA)
Integral to Process Hazard Analysis (PHA)
Institutionalizing considerations of IS can be accomplished
by implementing policy and procedures including gaining
management commitment and accountability for the
process instituting policies and procedures encouraging IS,
establishing principles, goals and incentives for its use and
developing practical tools to facilitate IS such as checklists
and analytical methods -- either independent or integrated
into routine activitiesas well as auditing protocols and
Inherent Safety indices.
CONCLUSION
As IS gains momentum in both practice and success, its use
will be promote as a normal way of doing business. To do
so some tools are needed:
Methods to identify, evaluate and prioritize various
inherent safety options
Guidance for conducting IS reviews
If conducting an ISD study for regulatory purposes, be
prepared to explain:

Page 321 Page 320
9
th
ASSE-MEC-2010-44
Protection of Oil and Gas Installations against Fires
Fadi Hamdan, Middle East and North Africa (MENA)
FABIG representative
Managing Director, Market Opportunities
ABSTRACT
Steel structures and components should be designed and
constructed such that they maintain their load bearing
function during the design re condition and any structural
failure occurs in an inherently safe manner. It is important
that component failure is ductile rather than sudden, and
that there are alternative load paths within the structure to
redistribute the load shed by failed components.
While a signicant amount of work on the protection of
installations against res has been published, what is required
is a concerted effort to incorporate all the new developments
into one design procedure for the design and protection of
oil and gas installations against res. To this end, the Fire and
Blast Information Group (FABIG) supported by the oil industry
carried out a comprehensive review of all previous guidance
and updated it to incorporate all recent developments into
its eleventh technical note, published in 2009.
This paper summarizes the Technical Note mentioned above
with special emphasis on simplied procedures for estimating
re loads, new data for the mechanical properties at elevated
temperature for structural stainless steels and guidance on
the application of the Eurocode approach to structural steel
re resistant design to offshore steel structures.
KEYWORDS
Fire risk reduction measures, design against res, simplied
re loads, quantitative risk assessment, re and explosion
protection, elevated temperature material properties
1. INTRODUCTION
The Interim Guidance Notes [ ] which were developed in 1992
in the wake of the Piper Alpha disaster provided guidelines
for the protection of offshore structures against res and
explosions. These guidelines summarized the state of
knowledge following the completion of the JIP on Fire and
Blast Engineering for Topside Structures Phase I [ ]. Section
4 of the Interim Guidance Notes [1] had 6 sub-sections, only
the last of which addressed the response of structures to
res. Notwithstanding the advances made in the Interim
Guidance Notes, which provided a comprehensive approach
to design against res using both advanced and simplied
methods, FABIG Technical Note 1 [ ] was issues in 1993
shortly after the publication of the Interim Guidance Notes
[1] to compliment the latter in the following areas:
Provide more information in the loading, response and
protection subject areas.
Provide more commentary, particularly with regard to
analysis methods
Provide worked examples.
Phase 2 of the Blast and Fire Engineering for Topside
Structures [
4
], which was completed in 1998, addressed gaps
in knowledge mainly related to the loading characteristics
of hydrocarbon res and means of militating against those
res. The experiments in Phase 2 were carried out at large
scale to generate data representative of offshore scenarios
and to study the inuence of scale on explosion and re
characteristics, as all previous research had been carried out
at small and medium scale.
FABIG Technical Note 6 [
5
] was issued in 2001 to disseminate
elevated temperature material data on high strength carbon
steels and stainless steels used offshore. It also provided
mechanical properties to high strength steel types used
on offshore structures and not covered in the Eurocode
for Building design, EC3 Part 1.2 [
6
]. These steel types are
Grades 355EMZ and 450 EMZ. FABIG Technical
The basis of your decisions on how safe is safe
enough
The technical basis of ISD method used
Inherently safer design is a fundamentally different way of
thinking about the design of chemical processes and plants. It
focuses on the elimination or reduction of the hazards, rather
than on management and control. This approach should
result in safer and more robust processes, and it is likely that
these inherently safer processes will also be more economical
in the long run.
REFERENCES
Center for Chemical Process Safety (CCPS) (2009). Inherently
Safer Chemical Processes - A Lifecycle Approach, 2nd Edition.
New York: American Institute of Chemical Engineers.

Page 323 Page 322
Note 6 [5] also covered stainless steel Grades 1.4301
(304), 1.4404 (316L), 1.4462 (2205) and 1.4362 (SAF
2304).
In 2007, the UKOOA Fire and Explosion Guidance [
7
] was
issued to provide an update to recent developments in
the elds of re loading, re response, explosion loading
and explosion response.
Notwithstanding the above developments, FABIG
Technical Note 11 [
8
] was developed in 2009 with the aim
of updating the Interim Guidance Notes to reect recent
developments in a manner consistent with material in
previous FABIG Technical Note 1 [3] and FABIG Technical
Note 6 [5] and with the Eurocode for Building Design,
EC3 Part 1.2 [6]. In particular, the following issues were
addressed:
To provide a Technical Note compatible with the
Eurocode (EC3 part 1.2) and reecting technical
knowledge in the Interim Guidance Notes [1] and
subsequent developments within FABIG Technical
Note 1 [3] and FABIG Technical Note 6 [5].
To provide an update of material properties at
elevated temperatures and present it in a
format suitable for use with the EC3 Part 1.2 [6]
terminology.
To provide an update on the use of advance
probabilistic methods for design against res (not
covered in this paper).
2. SIMPLIFIED GUIDANCE ON
ESTIMATING OFFSHORE FIRE LOADS
The technical note provides guidance on how to assess
jet and pool re hazards, including two-phase jet res,
the effects of connement and behaviour of jet and
pool res with water deluge. It updates and extends
the UKOOA Guidance [7] and the jet re overview by
Lowesmith [
9
].
2.1 Guidance on Gas Jet Fires
Guidance is provided for different size of gas jet res
(0.1kg/s, 1kg/s, 10kg/s and those >30kg/s). For each
of the above sizes tabulated values are provided for
the following variables: ame length, fraction of heat
radiated, CO level and smoke concentration, initial total
heat ux, initial radiative ux, initial convective ux,
ame temperature, ame emissivity and convective heat
temperature coefcient.
2.2 Effect of Connement on Gas Jet Fires
The behaviour of a jet re within a conned or partially
conned area will depend upon the degree of connement
and the direction of the jet relative to the ventilation
opening. It should be noted that certain ventilation patterns
and deluge strategies could lead to ame instability and
extinguishment. Instances where these conditions occur
are identied and discussed within Technical Note 11
[8]. Furthermore the effect of connement on the main
tabulated variables is also presented and tabulated.
2.3 Effect of Deluge on Gas Jet Fires
The most usual forms of active water deluge are water
curtains (used to protect an escape corridor), general
area deluge and dedicated vessel deluge. The success or
otherwise of active water deluge in mitigating the effect of
jet res depends upon the nature of the jet re (gas, liquid
or two-phase), the surrounding environment (conned or
open) and objective to be achieved (reduction of incident
thermal radiation or protection of engulfed objects). The
effect of water deluge on the main tabulated variables is
also presented and tabulated.
2.4 Guidance on Two-Phase Jet Fires
In contrast to gas jet res, the generally lower exit velocities
from ashing liquid releases lead to ashing liquid jet res
with shorter ame lift-offs and more buoyant ames overall.
For horizontal releases the ames have a shorter horizontal
reach, although the overall ame lengths are comparable
with those of natural gas. These lower velocities also result
in res that are more wind affected whilst the higher
hydrocarbon content of these fuels increases the ame
luminosity.
Guidance is provided for different size of gas jet res
(0.1kg/s, 1kg/s, 10kg/s and those >30kg/s). For each of the
above sizes tabulated values are provided for the following
variables: ame length, fraction of heat radiated, CO level
and smoke concentration, initial total heat ux, initial
radiative ux, initial convective ux, ame temperature,
ame emissivity and convective heat temperature
coefcient.
2.5 Effect of Connement on Two Phase Jet
Fires
The results of Phase II of the BFETS project, carried out
at SINTEF NBL, conrmed and extended the ndings for
conned gas jet res to condensate jet res and larger scales
[
10
, ,
11
]. Again, it was found that there was no signicant
dependency of scale.
Deluge of a conned jet re at typical offshore application
rates (10-12 litres/m2/min) may lead to ame extinguishment
and hence a serious explosion hazard from the continuing
release. In the case of a two-phase jet re, extinguishment
may result in a mist-air explosion hazard and/or the formation
of a liquid pool. The factors affecting the likelihood of ame
extinguishment are discussed in detail in the Technical Note.
Furthermore the effect of connement on the main tabulated
variables is also presented and tabulated.
2.6 Effect of Deluge on Two Phase Jet Fires
Compared to the situation with a gas jet re, the use of
dedicated vessel deluge to protect a vessel against a ashing
liquid jet re (eg propane, butane) can be more effective. For
two-phase jet res of live crude, dedicated deluge (at 10
litres m-2 min-1) offer limited protection and no reduction
in the rate of temperature rise in the area where the re
impacted the obstacle. Specic situations are identied
where the combined use of area and dedicated deluge may
prevent temperature rise if effectively applied. Furthermore
the effect of deluge on the main tabulated variables is also
presented and tabulated.
2.7 Guidance on Pool Fires
A pool re is a turbulent diffusion re burning above a pool
of vaporising liquid fuel where the fuel vapour has very low
initial momentum. A pressurised release of a hydrocarbon
liquid which is not sufciently atomised or volatile to vaporise
and form a jet re will form a pool. Similarly a spillage from
non-pressurised liquid storage will result in a liquid pool being
formed. Ignition of the vapours evolving from the liquid can
lead to a pool re. The physical effects of pool res that
determine their potential for harm are:
Pool spread and pool shape
Ignition and spread of ame
Mass burning rate
Flame size and shape
Heat uxes to impinged or engulfed objects
External thermal radiation eld
Properties of combustion products (smoke, gases,
thermal plumes)
The temporal variation of all the above,
particularly the re duration.
Guidance is provided for hydrocarbon pool res on land,
methanol pool res and hydrocarbon pool res on the sea.
For each of the above types, tabulated values are provided for
the following variables: typical pool diameter, ame length,
mass burning rate, fraction of heat radiated, CO level and
smoke concentration, initial total heat ux, initial radiative
ux, initial convective ux, ame temperature, ame
emissivity and convective heat temperature coefcient.
2.8 Effect of Connement on Pool Fires
The behaviour of conned pool res will depend on the
degree of ventilation and whether the conning structure
becomes hot and re-radiates heat to the re. The effect
of connement on the main tabulated variables is also
presented and tabulated.
2.9 Effect of Deluge on Pool Fires
General area deluge can be very effective in controlling
hydrocarbon pool res and mitigating their consequences.
If the water is capable of reaching the liquid pool, the
cooling of the fuel reduces vapour evolution and hence
reduces the size of the ame. This, in turn, leads to reduced
radiative heat transfer from the ame to the fuel surface
which also contributes to reducing the vapour evolution.
Consequently, with time, the re size is reduced and
complete extinguishment may result or, if not, sufcient
control achieved that manual re ghting could be safely
undertaken. The effect of deluge on the main tabulated
variables is also presented and tabulated.
3. ELEVATED TEMPERATURE MATERIAL
PROPERTY DATA
The main material property data required for structural re
design are:
Reduction factors for yield strength and stiffness, for
use in a simplied analysis.
Generic equations for stress strain relationships at
elevated temperatures, for use in an advanced analysis.
3.1 Mechanical Properties and Models for
Structural Carbon Steels
3.1.1 Data for Simplied Analysis
Technical Note 6 [5] presented the strength and stiffness
reduction factors for carbon steel which are given in EN
1993-1-2 [6]. They apply to structural steel grades S275,
S355, S420 and S460 of EN 10025 [
14
] and all grades of
Page 325 Page 324
EN 10210 [ ] and EN 10219 [ ]. Material property data
for simplied analysis are provided in terms of reduction
factors, k:
The effective yield strength relative to the yield
strength at 20C (yield strength reduction factor),
k
ye
= f
y
,
e
/f
y
.
The slope of linear elastic range relative to slope at
20C, k
p
,
e
= f
p
,
e
/f
p
The proportional limit relative to the yield strength
at 20C, k
E
,
e
= E
e
/E
where
f
Y
is the yield strength at 20C.
0 is the temperature of the member
f
p
,
e
is the proportional limit at temperature 0
f
p
is the proportional limit at temperature 20C.
E
e
is the Youngs Modulus at temperature 0
E is the Youngs Modulus at 20C = 210,000N/mm
2
Technical Note 6 [5] also collated available material
property data at elevated temperatures for a variety of
other steels used on offshore platforms including the
thermo-mechanically rolled and quenched and tempered
steels including S355M, S420M, S460M, 355EMZ and
450EMZ. The simplied material properties for the above
grades were given in the Eurocode format. No new
data on material properties at elevated temperatures of
these grades have come to light since Technical Note 6
was issued. Note that these grades tend to lose strength
and stiffness more rapidly at elevated temperatures
compared to the standard structural steel grades covered
by EN 1993-1-2 [6].
Note that the M grades (S275M, S355M, S420M and
S460M) are now covered in EN 10025-4[ ]. The EM and
EMZ grade are now covered in EN 10225 [
16
]. For ease
of use by various designers, Table 1 shows equivalent
American Grades.
3.1.2 Data for Advanced Analysis
Material property data for advanced analysis are provided
in terms of a stress strain relationship, divided into four
segments, the limits and characteristics of which vary
with temperature. Figure 1 shows the stress strain
relationship at elevated temperatures as recommended
by EN 1993-1-2 [6] and expressions for each parameter
are given in [5].
Figure 1: Stress strain relationship (without strain hardening)
for carbon steel at elevated temperatures
where
E
p
,
e
is the strain at the proportional limit
E
y
,
e
is the strain at yield
E
t
,
e
is the limiting strain for yield strength
E
u
,
e
is the ultimate strain
Table 1 UK, EU, US Nearest Equivalent Grades
For temperatures below 400C, EN 1993-1-2 [6] allows the use
of an alternative model with strain hardening.
Technical Note 6 [5] presented results of tests for the high
strength steels S355M, S420M, S460M, 355EMZ and 450EMZ
in terms of stress and strain at different temperatures for use in
advanced analysis.
3.2 Thermal Properties for Structural Carbon Steels
Thermal material property data are provided by EN 1993-1-2 for
carbon steel structural grades including S235, S275 and S355
of EN 10025. The data consists of equations and graphs for
the following thermal material property data as a function of
temperature:
Thermal elongation, l/l
Specic heat, c
Thermal conductivity,
No data on thermal properties is given in FABIG Technical Note
6 [5] for the high strength steels S355M, S420M, S460M,
355EMZ and 450EMZ.
3.3 Mechanical Properties and Models for Structural
Stainless Steels
3.3.1 Data for Simplied Analysis
FABIG Technical Note 11 [8] gives strength and stiffness retention
factors, relative to the appropriate value at 20
0
C, for the stress-
strain relationship for grades of stainless steel at elevated
temperatures. These are new data, generated as a result of a
comprehensive review of all isothermal and anisothermal data
available for stainless steel grades [
17
]. These data will replace
the equivalent data given in the Design manual for structural
stainless steel [
18
] and Annex C of EN 1993-1-2 [6]. Simplied
tabulated values at elevated temperatures are provided for the
following parameters:
k
E
,
e
slope of linear elastic range at temperature 0
relative to slope at 20
o
C.
k
0
.
2p
,
e
0.2% proof strength at temperature 0 relative to
design strength at 20
o
C.
ku, ultimate strength at temperature relative to
ultimate strength at 20
o
C.
k2, a parameter used to calculate f
2
e the strength
at 2% total strain at temperature.
where:
E is Youngs modulus at 20C = 200 000 N/mm2
fy is the yield strength at 20C
fu is the ultimate tensile strength at 20C
3.3.2 Data for Advanced Analysis
Annex C of EN 1993-1-2 [6] gives a stress strain relationship
at elevated temperatures for stainless steel; Figure 2 shows the
relationship graphically and reference should be made to the
Eurocode for expressions for the parameters.

Figure 2: Stress strain relationship for stainless steel at elevated
temperatures
where
fu, is the tensile strength
f0.2p, is the proof strength at 0.2% plastic strain
Ea, is the slope of the linear elastic range
Ect, is the slope at proof strength
c, is the total strain at proof strength
u, is the ultimate strain.
3.4 Thermal Properties for Structural Stainless
Steels
Thermal material property data are provided in EN 1993-1-2 [6]
Annex C for austenitic stainless steels. Again, the data consists
of equations and graphs for the following thermal material
property data as a function of temperature
Thermal elongation, l/l
Specic heat, c
Thermal conductivity,
No equivalent expressions are available for duplex stainless
steels.
3.5 Material Properties for Welds and Bolts
Strength reduction factors for bolts and welds are also provided
in FABIG Technical Note 11[8] based on Annex D of EN 1993-
1-2 [6]. The factors for welds are based on tests carried out
on grades Fe430A and Fe510B steel and presumed to apply
to welds for all grades of steel covered by this standard and
extend up to temperatures of 1000C.
4. EUROCODE DESIGN
This section presents simplied calculation models to determine
the re resistance of steel members as permitted by EN 1993-
1-2 [6], clause 4.1. The code recommends that use of a
partial safety factor M, for the relevant material and thermal
property for the re situation; EN 1993-1-2 recommends a
value of 1.0, and this value is also recommended in the UK
National Annex.
Page 327 Page 326
Several simplied methods are available in the code
for the design of structural steel members at elevated
temperatures:
Critical temperature method
Simplied design calculations
4.1 Critical Temperature Method
This is the simplest method of determining the re
resistance of an isolated loaded member in re conditions.
The method can be used only for member types for which
deformation criteria or stability considerations do not have
to be taken into account. This allows its use for tension
members and restrained beams, but precludes its use for
both columns and unrestrained beams. It is only applicable
to steel grades S275, S355 and S460 (and, presumably
other steels with a similar or better strength and stiffness
retention characteristics).
The critical temperature 0
cr
of a member is the temperature
at which failure is expected to occur for a given load level.
Its value is determined from the degree of utilisation 0 of
the member in the re design situation. The procedure is
shown in Figure 3.
Figure 3: Procedure for the critical temperature
calculation
It should be recognised that the critical temperature varies
with the variation in the utilisation ratio. As the utilisation
ratio at ambient temperatures increases, the member can
withstand a lower reduction in its capacity before it fails.
However, for offshore structures which posses a higher
degree of redundancy, load shedding and load transfer will
often occur during a re. Hence, limiting the temperature
to a critical temperature based on the utilisation ratio of
a member at the time of the initiation of a re may be
over-conservative for some members and unconservative
for others.
4.2 Simplied Design Calculations
Clause 4.2.3 of EN 1993-1-2 [6] describes simple calculation
procedures for estimating the resistance of structural
members at elevated temperatures. The procedure is
illustrated in Figure 4. The rst step is to classify the section
and calculate the material strength and stiffness reduction
factors for a specic temperature. The reduced resistance
of the member at that temperature is then calculated. This
approach presumes that a temperature relating to the
desired period of re exposure is already known from a
previously calculated time-temperature history. However,
it is often the case that the time-temperature history of a
member is not known, particularly for protected members
since temperature-dependent material properties of the
re protection material are required to predict the time-
temperature history of the member, and manufacturers of
re protection are reluctant to make this data available. If
this is the case, the designer can use the reduced resistance
expressions to calculate the temperature at which the
resistance equals the loading in re, i.e. when.
E
,
d
,
t
= R
,
d
,
t
For tension members and restrained beams, this is a direct
calculation, but for members susceptible to buckling
instabilities, iteration is required since the expression for the
non-dimensional slenderness is related to temperature.
More details is provided in the technical note on calculating
the following design resistances:
Moment resistance of unrestrained beams,
Moment resistance of unrestrained beams with
non-uniform temperature,
Shear resistance
Lateral torsional buckling resistance
Compression member resistance
Resistance of members subjected to combined
bending and axial compression

Resistance at ambient
temperature according
to fire rules
20 , ,d fi R

Degree of utilisation
0 m
Critical temperature
d cr, q
Find Section Factor
V Am /
and its box value
box m V A ) / (
Iterate temperature q with
time until requ fi t t ,
Building Regulations
requ fi t ,
Is
d cr, q q >
?
Use this unprotected
member
No
Classify member
Action in fire limit state
t d fi E , ,
Select member

Use
protection
?
Yes
Find Section Factor V Ap /
time until requ fi t t ,
No (Reselect member)
Yes
Define protection material
and thickness
Is
d cr, q q >
?
Use this protected
member
No Yes
4.3 implied Design Resistance of Joints
The re resistance of joints must be at least the same as for
the connected members. This means that beam-to-column
joints should be able to transmit the internal forces during the
re. When passive re protection is used on the members,
this requirement is generally considered to be fullled if the
same thickness of re protection is applied to the joints. As
a simplication, a uniform temperature distribution may be
assumed within the joint; this temperature may be calculated
using the maximum value of the section factor (A
m
/V) of the
connected steel members in the vicinity of the joint. It is well
known that joints are not heated to the same degree as other
parts of the structure because they are shielded by the incoming
beams and columns and locally the mass of steel is increased,
and effectively the section factor (A
m
/V) is reduced.
More details are provided in the Technical Note on the re
resistant design of but welds and llet welds.
ACKNOWLEDGMENTS
The paper is based on a Technical Note developed by the
Fire and Blast Information Group (FABIG) in 2009 FABIG and
which included contributions from Nancy Baddoo of the Steel
Construction Institute, Geoff Chamberlain (visiting professor
at Loughborough University), Asmund Huser (DNV) and Fadi
Hamdan (independent consultant).
REFERENCES
1. Interim Guidance Notes for the Design and Protection
of Topside Structures against Fires and Explosions,
The Steel Construction Institute, Publication Number
SCI-P-112, 1992.
2. Blast and Fire Engineering for Topside Structures, Phase

Resistance at ambient
temperature according
to fire rules
20 , ,d fi R

Resistance at design
temperature t d fi R , ,
Find Section Factor
V Am /
and its box value
box m V A ) / (
time until requ fi t t , to give
design temperature d q
Building Regulations
requ fi t ,
Is
t d fi t d fi E R , , , , >
?
Use this unprotected
member
Yes
Classify member
Action in fire limit state
t d fi E , ,
Select member

Use
protection
?
No
Find Section Factor V Ap /
time until requ fi t t , to give
design temperature d q
No (Reselect member)
Yes
Define protection material
and thickness
Is
t d fi t d fi E R , , , , >
?

Use this protected
member
Yes
Resistance at design
temperature t d fi R , ,
No (Reselect protection)
Figure 4: Procedure for the reduced resistance calculation
I, 1991, The Steel Construction Institute.
3. FABIG Technical Note 1, Fire Resistant Design of
Offshore Topside Structures, The Steel Construction
Institute, FABIG, 1993.
4. Blast and Fire Engineering Project for Topside
Structures Phase II, The Steel Construction Institute, 1998.
5. FABIG Technical Note 6, Design Guide for Steel at
Elevated Temperatures and High Strain Rates, FABIG, 2001.
6. ENV 1993-1-2:2003, Eurocode 3: Design of Steel
Structures, Part 1.2: General Rules, Structural Fire
Design, 2003.
7. Oil and Gas UK, Fire and Explosion Guidance, Issue 1,
May 2007.
8. FABIG Technical Note 11, Fire Engineering, The Steel
Construction Institute, FABIG, 2009.
9. Lowesmith BJ, Hankinson J, Acton MR and
Chamberlain GA (2007), An overview of the
nature of hydrocarbon jet re hazards in the oil and
gas industry and a simplied approach to assessing
the hazards, Trans. IChemE Part B, Process Safety and
Environmental Protection, 85(B3), 207-220.
10. Chamberlain GA, Persaud MA, Wighus R, and
Drangsholt G, Blast and Fire Engineering for Topside
Structures, Test Programme F3, Conned Jet and Pool
Fires, Final Report, The Steel Construction Institute,
Report number STF25 F95028, 21 May (1995).
11. Persaud MA, Wighus R, and Chamberlain GA (1997a),
Blast and Fire Engineering for Topside Structures.
Test Programme F3, conned jet and pool res.
Interpretation Report, Steel Construction Institute
(1997a).
12. EN 10025-2:2004 Hot rolled products of structural
steels. Technical delivery conditions for non-alloy
structural steels.
13. EN 10210 1:2006 Hot nished structural hollow
sections of non-alloy and ne grain structural steels
Part 1: Technical delivery requirements.
14. EN 10219 1:2006 Cold formed welded structural
hollow sections of non-alloy and ne grain steels. Part
1: Technical delivery conditions
15. EN 10025-4:2004, Hot rolled products of structural
steels. Technical delivery conditions for
thermomechanical rolled weldable ne grain structural
steels.
16. EN 10225:2001, Weldable structural steels for xed
offshore structures. Technical delivery conditions.
17. Gardner, L., Insausti, A., Ng, K. T. and Ashraf, M. (in
preparation). Elevated temperature material properties
of stainless steel alloys. Engineering Structures
18. 59. Design Manual for Structural Stainless Steel, 3rd
Edition, Euro Inox and The Steel Construction Institute,
2006.
Page 329 Page 328
9
th
ASSE-MEC-2010-45
Technical Considerations in Selection of
Oily Water Separators in the Terminaling Industry
P. Radhakrishnan, BTech ChE, MS ChE, MAIChE
Waddah S. Ghanem, BEng, DipSM, DipEM, MSc, MBA, AMEI

ABSTRACT
The petroleum terminaling business operates in a highly
competitive market making it important to effectively
utilize resources. Hence, drainage systems and Oil Water
Separator (OWS) systems require to be robust, easy to
operate and economical. In order to accomplish this
goal, the drainage system must be properly planned
and designed and the OWS selected based on sound
criteria.
Operations taking place in the terminaling business are
simple and easily categorized. Waste water streams for
normal abnormal and accidental cases are identied and
incorporated into the drainage philosophy. Available types
of oil water separation systems are identied and briey
described stating the advantages and disadvantages.
Theoretical considerations leading to actual separation
of oil from waste streams are discussed and non-robust
systems of treatment are highlighted.
Identication and segregation of various waste streams
at source is stressed and isolation systems for abnormal
and accidental cases are specied. Finally, through a
process of successive elimination, the selection of the
most optimal OWS for the terminalling business is
identied and recommended.
1. INTRODUCTION
The petroleum products terminaling business operates
in a highly competitive market making it important to
effectively utilize manpower. As a result, specialized
Health, safety and Environmental (HSE) and design
personnel are not usually available at the operations
sites. Therefore, pollution prevention equipment design,
selection and installation is of utmost importance.
One such equipment is the Oil Water Separator (OWS)
system which once installed is expected to be robust
operate at any time with minimum maintenance except
for routine cleaning and removal of collected oil and
sediments. Poor selection of the OWS will result in all the
oily water having to be disposed of as hazardous waste
incurring consistent and avoidable operating expenses
and adding unnecessary stress on local hazardous waste
disposal sites. As the employees involved in the removal
and transportation of this hazardous waste are usually
unskilled and unsupervised, additional environmental,
health and safety risks are created.

Design and process engineers used at the project stage
in the Terminalling business often come from reneries
and petrochemical plants. Eliminating secondary and
tertiary treatment and scaling down the remaining primary
treatment is usually used as the basis for OWS design.
Usually the result is a scaled down API separator or a simple
multi compartment gravity separator. These designs fail to
achieve discharge standards and operations are burdened
with the additional costs and risks of disposal.
This paper attempts to describe the sources of oily water,
provide general a general guideline on collection and
drainage of the collected water and recommend criteria
for selection of the OWS.
2. BRIEF OVERVIEW OF OPERATIONS
The main activities in petroleum product terminals are
receiving, storing, blending, transferring and loading of
petroleum products for dispatch. In some terminals, even
break-bulking takes place.
Products are received from ships or rail and road tankers into
storage tanks. Ships berth at jetties and are connected
to marine loading arms and use their own pumps for
pumping the products. Rail and road tankers are connected
using exible hoses and/or loading arms and unloaded
using terminals pumps.
Subsidiary activities that generate oily water include
dewatering of products, washing and cleaning of tanks,
pigging and washing of contaminated oors (especially in
the road and rail tanker gantries), sampling drains etc.
3. DRAINAGE PHILOSOPHY
Oily water generation in terminals can be broadly classed
as continuously oil contaminated (COC), accidentally oil
contaminated (AOC) and contaminated rain water (CRW).
COC refers to efuents generated from routine
operations which are always expected to be oil
contaminated with oil content typically < 10% eg.
from dewatering, washing of small spills etc.
AOC refers to substantial quantities of oil spilled in
containment areas such as pump pits, concrete bunds
etc. due to leaks and ruptures.
CRW is the initial rain water collected from potentially
contaminated areas such as within bund walls, tanker
truck loading areas etc.
The drainage system design should be capable of
transporting all of the COC and CRW to the OWS through
an oily water drains. It should also be so designed as to
divert the rain waters following the CRW to the storm
water drain so that the OWS is not overloaded. AOC
will usually have oil content >50% and is not intended
to be treated in the OWS; hence AOC should not have
any possibility of entering the oily water drains; instead it
should be recovered and reused, recycled or disposed off
as hazardous waste. Refer gure 1 below for the drainage
philosophy.
Figure 1: Drainage Philosophy
Petroleum storage terminals also store and blend fuel
additives such as methyl tertiary butyl ether (MTBE), ethanol
etc. which are water soluble. These tanks do not require
dewatering and the only way of these compounds getting
into the waste water system is through leaks and on rare
occasions tank cleaning. Water contaminated with such
water soluble products need to be collected separately and
disposed off according to local regulations on no account
should this be allowed to go into the OWS as they cannot
be separated by it. The separation of these streams and
toxicity of such products on the receiving water such as
surface or ground water has to be considered in the design
stage itself.
4. OIL WATER SEPARATOR TYPES
OWS invariably rely on density difference between oil
and water to perform the separation. Hence all types of
separators depend on density difference and any oil that
is either soluble in water or has the same density as water
cannot be separated by an OWS; for these, water treatment
systems will be required to eliminate the oil from waste
stream.
The different types of OWS in use for treating waste
water from petroleum terminals are listed below with brief
descriptions:
a. American Petroleum Institute (API) Oil Water
Separator
The API separator is a gravity separator which uses the droplet
rise velocity as the design criteria to achieve separation. The
oil that rises to the top is skimmed off and used either as
fuel or sold as slop. The sediments are removed by a grating
at the bottom and the treated water is normally sent for
secondary and tertiary treatment prior to discharge. A well
designed API separator can typically remove droplets of
sizes > 150 microns and can achieve efuent concentration
of not less than 100ppm [1, 7]; far less that the discharge to
land and sea requirement of maximum 5 ppm.
Figure 2 shows the schematic of a conventional API oil water
separator. The oil removal at the surface is accomplished by
wooden slats running on chain drives that skim the surface
oil into a collection header from where it is pumped to the
slop tanks. The bottom sediments are removed continuously
by a slowly moving grate running along the bottom of the
separator
Page 331 Page 330
Figure 2: API separator schematic [5]
b. Concrete Separation Vault
The concrete separation vault is based on the design of
conventional anaerobic type sceptic tanks. It is a bafed
concrete tank into which the waste stream enters
and executes a series of ows below and above a set
of bafes. These ow patterns are expected to retain
lighter and heavier oils in the different compartments
of the tank. Though these are cheap to construct, the
designs are never good and cannot take care of large
uctuations in ow. If the ow is higher than design ow
even for short period of time, all the oil collected in the
compartments will be washed out into the discharge.
Figure 3 shows the schematic of a conventional sceptic
tank on which, the design of the concrete separation
vault is based. The differences between the OWS and
the sceptic tank are only in the number of compartments
and bafes and that the sealing does not require to be
airtight. The contaminated water enters through the
left and exits through the right. The oil collected on the
surface is manually skimmed off, or in more sophisticated
devices mechanically skimmed and pumped into the
slop tanks or hazardous waste transport tankers. The
discharge from these usually will not meet discharge
standards of < 5ppm and hence would have to be
further treated.
Figure 3: Bafed OWS [9]
c. Inclined Plate Separator
This type of OWS consists of a series of closely spaced
inclined plates facing the incoming ow of contaminated
water. The plates are usually oriented at angles of between
45o and 60o to the horizontal. The entering waste stream
strikes the plates and the velocity at the horizontal velocity
at the plate surface reduces to near zero. From this state,
the oil which is lighter than water is expected to rise up in
favor of moving in the horizontal direction along with the
main water stream.
These type of separators started out originally as clariers
used for settling suspended solids. The solids settled
in these have densities that are usually more than 50%
that of water and hence striking the plates brings them
temporarily to a standstill from where they slowly settle.
Nowadays vendors of these type of separators are offering
it for oil water separation. However, the density difference
between oil and water being only about 20%, and the
fact that the oil is a liquid renders these type of settlers
ineffective in the Terminalling business. Nevertheless, many
terminals are strapped with having installed these type of
separators and are subsequently burdened with continuous
operational costs involved in disposing off the efuents as
hazardous waste.
d. Coalescing Oil Water Separator
These separators are compact and occupy very little space.
They are relatively cheap and capable of removing oil of
up to 0.95 specic gravity to discharge concentrations
of 5 ppm or less and hence can be used in Terminalling
operations; albeit with continuous monitoring of the oil
content at the discharge.
All physical separation systems for removal of oil from
water rely on either stokes law or barrier ltration. As this
type of separator does not use a lter media, it relies on
stokes law (Given below) [2]
The velocity Vt is the velocity of rise of a drop of oil of
diameter D. The parameters that determine whether the oil
will be separated or not are the horizontal velocity of the
moving waste stream and the rise velocity. If Vt is increase or
horizontal velocity decreases, the droplet is much more likely
to be separated and vice versa. The horizontal velocity of the
waste stream is determined by the ow rate of waste water
that is required to be treated and the physical dimensions of
the separator. Larger the vertical cross sectional area of the
separator, lower the horizontal velocity, but with increased
cost of construction and increased space requirement.
Hence, the optimal method of accomplishing separation is
to increase Vt.
Given that the viscosity of the medium (water), density of
water and g cannot be changed, the factors that affect the
rise rate are density of oil and the diameter of the droplet. The
nature of operations of the terminal determines the density
of oil in the waste stream and hence cannot be controlled.
Therefore the best way to accomplish
separation in an optimal manner is by increasing the diameter
of the oil droplets through coalescing. This is what these type
of separators attempt to do.
These separators consist of a coalescing media pack through
which the entire waste water passes. The coalescing media
pack is a honeycomb structure that temporarily retains the
smaller oil droplets. When several small oil droplets are
retained and come into contact with each other on the
media, they coalesce into larger drops which easily rise to
the surface for collection and removal.
Figure 4 and gure 5 show the coalescing media pack and a
schematic of the oil water separator respectively.
Figure 4: Coalescing Media [5]
From the above gure, it can easily be seen that the oil-
water mixture ows upward at an angle of about 45o to 60o
where it has to pass through the coalescing media which
progressively increase the size of the droplets as they move
up. The plates inclined towards the left (from bottom) are
impervious, forcing the stream to go through the media.
Figure 5: Schematic of Coalescing OWS [5]
The schematic of the coalescing OWS shows the waste
stream entering from the right and clean water exiting from
the right. The entire waste stream is forced through the
coalescing media before clean water can exit. Sediments
are settled at the bottom prior to the stream entering the
media as their velocity is reduced to near zero just prior to
entering the media. It can also be seen that the separated
oil can easily be diverted to a collection vessel and used as
fuel or recycled. Usually, sediment removal facilities are also
provided.
These type of separators are capable of removing droplets
in the incoming stream of sizes down to 20 microns and
if properly selected and operated, can consistently achieve
discharge concentrations of less than 5 ppm [5, 7].
e. Coalescing Filter System
Coalescing lter system uses a barrier media to block and
then coalesce oil droplets in the waste stream for separation.
They are capable of removing droplets of sizes down to 5
microns from the waste streams and can achieve discharge
quality of less than 10 ppm.
These type of separators exhibit all the disadvantages
encountered in ltration. They require higher pressure
differentials across the lter media than is usually available
in the drainage and oil water separator systems in oil
terminals (usually gravity). The lter media is easily blocked
by sediments and this can results in increase of differential
pressures across the lter media. Finally, lter media require
to be cleaned often by back-ushing. This ads cost in terms
of time and effort required to accomplish this.
Page 334 Page 332
f. Air Flotation
These systems use air bubbles to oat the oil drops to
the surface. They can be used in combination with other
systems such as the inclined plate and bafed chamber
to increase efciency.
However, whether used alone or in combination with
other techniques, they are unlikely to achieve discharge
quality efuent. The best achievable by this method is
around 50 ppm. This is primarily due the creation of
turbulence in the waste stream from the air bubbles.
This type of system is mainly used for coarse or primary
treatment prior to higher performance treatment;
especially when unstable emulsions are expected in the
waste stream.
Another disadvantage of these systems is that unlike
systems described earlier require a constant stream
of air, adding to operating costs. Maintenance of the
system is also an issue. This is usually used in reneries
that use induced air oatation units as plant air is readily
available through a network.
g. Centrifuges and Hydroclones
Hydroclones and centrifuges impart a circular motion to
the liquid stream. In hydroclones, this is accomplished
by the geometry of the inlet and outlet; whereas in
centrifuges, this is done by giving a rapid spin to the
vessel itself.
It was mentioned earlier in section 4.4 that the only way
to increase Vt in the Stokes equation is by changing either
density of oil or by increasing the droplet size. While this
is true for the case of gravity, in case of centrifuges and
hydroclones, the gravitational acceleration is substituted
by centrifugal acceleration given by:
a =
2
* r
where,
a is the centrifugal acceleration
is the angular velocity
r is the radius of the vessel
Therefore, increasing the angular velocity will result in a
increase in the velocity at which the droplet will move
towards the walls of the vessel. Decreasing the radius
of the vessel by having a conical shape will result in the
droplet having to travel less distance towards the wall
before touching the wall and getting separated from the
water [3].
The ow patterns inside a hydroclone are shown in gure
6 below. The ow enters from the right side very close
to the walls of the hydroclone at high velocity. The entry
velocity is converted to a vortex motion due to the shape
of the hydroclone and the vortex travels downwards. The
exit from the hydroclone is located slightly below the
entry so that the liquid ow does not bypass the vortex
ow through the hydroclone. The lighter oil droplets
travel towards center of the vortex and water travels to
the walls of the hydroclone (due to centrifugal force) and
impinge on the walls. At the walls, the water loses all
their momentum and drops down to the bottom due to
gravity and is sent for discharge. The lighter oil droplets
stay in the center of the vortex, where they may coalesce
and rise to the top where they are separated.
Figure 6: Flow pattern inside a hydroclone [8]
The ow pattern inside a centrifuge is much the same as
that in a hydroclone shown above, except that tangential
entry is not necessary and high inlet velocities are not
required. The difference lies in the method of imparting
the vortex motion, which in a centrifuge is either by rapid
rotation of the vessel itself or by the use of rotating bafes
that send the liquid spinning.
While centrifuges and hydroclones are adequate enough
to separate out droplets and particles heavier than water,
they are not too good with lighter density contaminants. This
is primarily because large quantities of water will be required
to actually transport the separated oil droplets through the
center of the vortex making the recovered oil unusable. The
other disadvantage of these type of separators is that they
are expensive to operate and power consumption is high.
h. Chemical Separation
All of the oil water separators described in sections 4.1 to
4.7 are primarily used for separating non-emulsied oil-
water mixtures. Coalescing lter systems and air oatation
systems sometimes work on oil-water mixture containing
unstable emulsions. Normally, petroleum storage terminals
do not have sources of emulsied water, but nevertheless for
completeness, this type of separator is also covered.
Emulsions of oil in water are formed either due to small oil
droplets acquiring a charge thereby preventing them from
forming larger droplets due to coulomb repulsive forces; or
because the oil droplets are attached to soaps and detergents.
To break down these emulsions, chemical separation is
required.
Emulsion breaking chemicals are added to the efuent and
these either precipitate the soaps or neutralize the electrical
charges on the droplets making them non-emulsied. The
non-emulsied efuent can then be separated out using any
of the types of OWS described in sections 4.1 to 4.7.
Chemical separation is rarely if not never used in terminals as
there are usually no sources of emulsied water. Additionally
removal of chemicals used for de-emulsion poses a further
challenge. The added costs of the chemicals, chemical
dosing systems and maintenance make this sort of system
unattractive and indeed unnecessary for petroleum storage
terminals.
i. Membrane Filtration
Membrane ltration is highly effective in removing emulsied
products. I membrane ltration separators, the feed enters a
lter media pack consisting of oil specic membranes. The oil
is retained on the membranes and the
water ows through and can be discharged. The collected
oil is of high quality and can be reused, recycled or used as
fuel [4].
Membrane ltration type separators are the high end
separators and usually used when ow rates are very low
and for recovery of valuable product or for removal of
highly toxic compounds; petroleum storage terminals do
not fall under this category and hence these are neither
recommended nor used in storage terminal business.
Though effective, these separators do not meet the
requirement for robustness. The membranes are sensitive
and can easily be damaged or fouled. Sediments can block
the membrane pores. Additionally, differential pressures
across the membranes and maintenance are real issues.
5. DRAINAGE DESIGN AND OWS
SELECTION CRITERIA
The oil water separator is not a standalone system and needs
to be integrated with the drainage philosophy before it can
be effective. Hence no discussion of the selection of OWS
is complete without rst describing the steps to effective
drainage design.
a. Drainage Design
The purpose of an effective drainage system are:
to ensure that only identied and selected streams are
collected completely and purposefully enter the OWS;
to ensure that the OWS is not overwhelmed by
unpredictable events such as large spillages and rains;
to ensure that safety is not compromised while
transporting ammable liquid contaminated water to
the treatment system;
to ensure that vapor emissions from the oil oating
on top of the water stream are minimized as far as
practicable;
to ensure that sediments, plastic and other solid
contaminants do not excessively enter the waste
stream and choke the systems up.
The last three points above are easily met by general
design criteria such as installing grating in the ow path
to remove large solids, ensuring outlet pipe elevation from
sumps and collection pits are higher and point upwards to
eliminate sediments, ensuring elevated vents to prevent
pressure build-up, and installing adequate numbers of re
traps to ensure that any re in ammable (class 1) product
contaminated streams do no spread through the drainage
system. For potentially ammable liquid containing streams,
it is recommended that underground piping is used from
the rst re trap after the collection point all the way to
the OWS.
Page 336 Page 335
To ensure that vapor emissions from the drainage system
and the OWS are minimized, United States Environmental
Protection Agency (USEPA) guideline on control of
fugitive vapor emissions from oil water separators can
be used as a guideline. The gist of this guideline is that
all drains, pits, sumps and vessels within a oily water
should be covered in a reasonably air-tight manner and
the covers should be such that solar heating under the
covers is minimized (a light colored non-transparent
cover is best).
Recommendations for the remaining two points above
can be covered in a step-wise manner as follows:
Step 1: Obtain the material data sheets or quality
certicates of all the petroleum products likely to be
stored at the terminal.
Step 2: Identify products that are readily soluble in water
and also products that have specic gravities within
from 0.95 to 1.05. These products cannot be removed
from the waste stream consistently and economically in
a terminal.
Step 3: Identify areas around the storage tanks, pump
houses, pigging stations, manifolds etc. where there is
always going to be contaminated surfaces; usually the
berths and jetties, tanker loading and unloading areas,
concreted areas around the tanks and the bunded area
of the pump-houses and manifolds. These are areas
from where, initial rainwater run-off is going to be
contaminated.
Step 4: Identify storage tanks in which products from
Step 2 are to be stored. Rainwater as well as any water
run-off from these tanks should not be routed to the
OWS. The initial contaminated rainwater from these
areas need to be collected as hazardous waste for
disposal; also any continuously contaminated water
from these such as tank cleaning, dewatering etc. are to
be collected separately for disposal as hazardous waste.
If areas such as pigging station, pump house etc. are
expected to consistently spill products from step 2, treat
these as for products from step 2.
Step 5: Plan and construct suitable storage for storage
of waste water collected in step 4 for disposal. Historical
rainfall data may be used for sizing the storage.
Step 6: For all continuously oil contaminated products other
than products from step 2, provide piping and drainage
ducts with valve pits to select and transport these to the
OWS system. The valves in these systems, except for those
in the truck and rail loading/unloading gantries should be
normally closed and opened only when draining, washing
or dewatering is about to commence.
Step 7: The drain pit valves in the dike walled area around
the tanks should normally be closed. In the event of rain,
these should be opened to the storm water drain. These
valves are in normally closed position to prevent large
accidental spillages from being discharged into the storm
water drains creating both an environmental and re and
explosion risk.
Step 8: Separate holding tanks with outlet valves are
recommended for run off from the tanker/rail loading
gantries and other areas of the terminal. The outlet valves
from these separate holding tanks should normally be open
to the OWS. It is recommended that these tanks should
be equipped with continuous hydrocarbon monitoring
equipment to make a decision as to when the efuent is
suitable to be discharged as storm water. If they are not,
the operator must visually check the quality of the efuent
and if deemed uncontaminated, divert the ow to the
storm water drains (after 15-30 minutes of rain).
Step 9: Large accidental spills as a result of pump leaks,
tank rupture etc. within containment or bunded areas will
either be contained in designated areas or in the holding
tanks before the OWS. The diked area will be so designed
to handle at least one tank rupture; the holding tank
should be so designed as to hold at least one tanker or
railroad tank rupture or a reasonable leakage from the
pumping area. Pipe bursts and ruptures are unusual events
and cannot be handled by the OWS system design; they
need to be addressed through piping design, corrosion
protection and quality control during installation.
The steps described above will take care of all credible
scenarios with respect to the drainage system. It will ensure
that identied streams of contaminated water will reach
the treatment system in quantities that can be treated and
discharged for useful purposes.
b. OWS Selection Criteria
The requirements for an OWS system was stated earlier
as:
Ease of operation by operators and other personnel
who are neither specialized in hydrodynamics nor
in possession of specialize skills other than terminal
operations.
Robustness of the system, so that the OWS can
operate in a exible manner and can resist variable
conditions, breakdowns and failures for a signicant
duration.
Ease of maintenance and removal of collected oil
and water discharged for reuse; and ease of removal
of sediments and solids to prevent clogging.
Cost effective and using up optimal amount of space/
area
In oil storage terminal there is never a case where there is
continuous generation of contaminated water due to planned
normal activities. Abnormal activities can be classied as rain
events and accidental releases. Accidental releases are once
again one off and not continuous. Hence this leaves us with
rain events as the only credible continuous scenario. No OWS
system can be economically designed and operated to treat
all the rain water through the OWS. Indeed it can not even be
designed to treat all the rain water on site even temporarily.
Hence, the design basis for the OWS needs to be treatment
of rain water falling on potentially contaminated areas for a
limited amount of time. Further rain falling on these areas
would be clean water to be discharge directly into storm
drains. Since initial rain for say 15-30 minutes is the only
uncontrolled event, the OWS sizing has to be selected on this
criterion based on historical data.
The second factor involved in selection of the OWS is the
density of potential contaminants. Petroleum storage
terminals typically store and transfer products with specic
gravity less than 0.95. Occasionally fuel oils of higher
densities are stored; however such fuel oils tend to have high
viscosities and are unlikely to lead to contamination of the
efuent waters in a signicant way. So, for the purpose of
this paper, we will only consider specic gravity of less than
0.95.
The nal consideration in selection of the OWS is the
droplet size distribution and the discharge quality required
by regulatory requirements. The regulatory requirements are
straightforward and range between a maximum of 5 to 10
ppm depending on the locality and receiving environment. The
less than 5 ppm case being more stringent will be considered
as applicable for the selection of the OWS. Emulsied waste
water streams are excluded from the selection criteria as such
waste streams are normally not encountered in petroleum
storage terminals.
Typical data on oil droplet size and volume distribution as a
function of droplet size is shown in gure 7 below.
Figure 7: Oil droplet cumulative size distribution [6]
It can easily be seen from the above gure that particles of
around 80 microns constitute about 10% of the total oil
content in the contaminated water. The total percentage of
oil in the contaminated water normally falls between highs
of 5 to 15 %. At the lower end of 5% this means that
the inlet concentration of 80 micron oil droplet is about
7500 ppm. Most of the gravity type separators described in
section 4 earlier, including inclined plate, separation vault
and API separators are incapable of separating droplets of
sizes less than 100 microns with high degree of efciency
and hence can be excluded from the selection criteria.
However, the concrete vault or API separator can be used
as an alternative to a holding tank before entry to the OWS
for complete separation.
Having excluded the gravity type separators, the types of
separators left for selection are the coalescing lter and
media separators, chemical, membrane lter, centrifuges
and air otation types. The membrane and coalescing
lter separators can be eliminated due to difculties in
maintenance and propensity to fouling.

Page 338 Page 337
Chemical separation systems are generally required only
when stable emulsions are present. If these are present,
then chemical separation types can be selected followed
by treatment systems for removal of added chemical
and an OWS for separating the non-emulsied chemical
free efuent.
Hydroclones and centrifuges work well with solids and
contaminants denser than water. They are unlikely to
work well with liquids lighter than water as the discharge
will need to be transported using considerable quantities
of water as the transport media. Additionally, imparting
large centrifugal forces on the efuent will result in
excessive operating costs; and equipment used to keep
the uids in a spin will undergo frequent wear and tear
and maintenance problems.
This leaves the coalescing OWS as the only remaining
alternative for a typical petroleum storage terminal.
These are robust in the sense that they have no moving
or sensitive parts. The sediments are cleanly separated
out the before it enters the coalescing media, eliminating
chances of fouling. The oil is cleanly separated out
and can be collected in a suitable container within the
separator. Sediment collection containers can also be
(and are) installed. These type of separators are usually
of modular construction and hence any damaged
part including the media can easily be removed and
replaced.
The above type of separator is clearly the recommended
choice for oil storage terminals. Additional advantages
include compactness a continuous cleaning capacity of
20 l/s is achieved by an OWS of approximately the size
of a 5000 gal storage tank. There are a large number of
manufacturers who offer these type of separators from
ow rates ranging all the way to 750 l/s.
6. CONCLUSIONS AND
RECOMMENDATIONS
Though several types of OWS are available, due to
consideration related to ease of operations, robustness
and economics, the coalescing type of OWS is the
optimal selection for use in oil storage terminals.
In addition to the actual selection of the OWS, it is
also recommended that careful attention be paid to
developing and implementing the drainage philosophy.
It is recommended that unnecessary loads on the OWS
be avoided and also that all potential sources normal,
abnormal and accidental be identied and addressed
during the design of the drainage system.
7. REFERENCES
1. American Petroleum Institute (1990),
Management of Water Discharges: Design and
Operation of OWS (1st Edition)
2. Batchelor, G K (1967), An Introduction to Fluid
Dynamics Cambridge University Press
3. Lamb H (1994), Hydrodynamics (6th Edition),
Cambridge University Press
4. USEPA (2005), Membrane Filtration Guidance
Manual
5. www.brentw.com
6. http://eerc.ra.utk.edu/divisions/wrrc Tennessee BMP
Manual (2002), Storm water Treatment
7. www.panamenv.com
8. http://www.lenntech.com
9. http://www.mtmdrains.co.uk
9
th
ASSE-MEC-2010-46
Responsible Care-Integrating Security with
QHSE
Tahir J. Qadir, Sabic Terminal Services-SabTank
ABSTRACT
Responsible Care Management System (RCMS 2008) is a
management system developed by American Chemistry
Council. The actual program in the form of Responsible
Care was started by the Canadian Chemical Companies.
Responsible Care Management System is the chemical
industry's commitment to continual improvement in all
aspects of health, safety, security and environmental
(HSS&E) performance and to openness in communication
about its activities and its achievements. The purpose of
the Responsible Care Program is to promote continuous
safety, health, environmental and security performance
improvement in the use, loading, unloading, transportation
and storage of chemicals. The aim of Responsible Care is
to earn public trust and condence through a high level of
Health, Safety, Security & Environmental performance in
order to maintain the RCMS Certication and to continue
to operate safely and securely and with due care for the
interests of future generations.
SabTank started integrating Responsible Care into its
management system in late 2007 culminating in certication
in August 2008 thereby becoming the rst company in the
region to lead this initiative.
This paper has intensively used material published by
American Chemistry Council on its Responsible Care
initiative in order to elaborate on how the Responsible Care
Management System was developed and incorporated into
the SabTank Integrated Management System. Moreover,
the paper will give an insight on the establishment of
security-related goals and objectives, based on Security
Vulnerability Assessment, which is an essential element of
the Responsible Care Management System.
1. INTRODUCTION
Responsible Care is the chemical industrys comprehensive
Environment, Health, Safety and Security-EHSS performance
improvement initiative. Originally conceived in 1984 by the
Canadian Chemical Producers Association, the initiative
was brought to the United States by ACC in 1988 and by
SOCMA in 1990.
In response to a perceived need for ACC member companies
to develop and implement management systems designed
to be protective of the environment, public health and
safety, and to engage in responsible product stewardship, in
1988 ACC adopted Responsible Care to provide guidance
in these areas to its Member Companies. From the outset,
Responsible Care incorporated progressive principles and
exible management practices which allow Members and
Partners to tailor the initiative to most effectively meet
their needs. ACC Members and Partners pledge to manage
their businesses according to ten guiding principles. These
include:
1) Making health, safety and environmental
considerations a priority;
2) Operating facilities in a way that protects health, safety
and the environment;
3) Developing and producing chemicals that can be
manufactured, transported, used and disposed of
safely;
4) Prompt reporting of chemical-related health and
environmental hazards;
5) Counseling customers on the safe use, transportation,
and disposal of chemicals;
6) Responsiveness to community concerns;
7) Working with others to resolve problems created by
past handling of hazardous substances;
8) Conducting and supporting research on the health,
safety and environmental effects of products and
processes;
Figure 5
Page 346 Page 345
7. PERFORMANCE MEASUREMENT,
CORRECTIVE AND PREVENTIVE
ACTION
An organization should measure, monitor and evaluate
its performance. As earlier mentioned, SIMS components
provided a structure upon which RCMS was built. This
structure already took care of the environment, health and
safety management system requirements as mentioned
in the RCMS standard. The only system remaining was
the security management system. In order to address
the security-related requirements, all the processes were
reviewed to incorporate these requirements, as mentioned
in the following Table 2.
ASSE-MEC-2010-46 Responsible Care-Integrating Security with QHSE 8

safety management system requirements as mentioned in
the RCMS standard. The only system remaining was the
security management system. In order to address the
security-related requirements, all the processes were
reviewed to incorporate these requirements, as mentioned in
the following Table 2.
Table 2
WHAT IS REQUIRED BY RCMS WHAT SABTANK DID
1. The organization shall regularly monitor and
measure the key characteristics of its
operations, products and activities that can
have a significant effect on health, safety,
security and the environment. This shall
include the recording of information to track
performance, relevant operational controls,
and conformance with the organizations
Responsible Care goals, objectives, metrics
and targets.
SabTanks procedure Monitoring and
Measuring of SIMS Processes was revised to
include key characteristics affecting security of
the employees and facilities.
2. The organization shall use relevant measures
and records to analyze Responsible Care
performance and trends.
Security related records and measures were
established track the performance in the area
of security management system
3. The organization shall periodically evaluate
its compliance with relevant health, safety,
security and environmental legislation and
regulations.
The already established Legal & Other
Requirements Registry was revised to include
security related legislations.
4. The organization shall periodically evaluate
the effectiveness of its Responsible Care
Management System to determine whether
or not it has been properly implemented and
maintained. Information on the results of
the evaluations shall be provided to
management.
The Business Plan Reviews conducted three
times a year thoroughly evaluates the RCMS.
In addition, the annual Management
Review Meeting evaluates the RCMS
performance on an annual basis.
5. The organization shall conduct reviews of the
Responsible Care performance of carriers,
suppliers, distributors, customers, contractors
and third party providers, commensurate with
risk, for use in qualification reviews.
The reviews are routine activity conducted by
Sabic as well as SabTank.
6. The organization shall regularly evaluate the
effectiveness of its communications programs
with its stakeholders.
SabTanks Internal & External
Communications process is annually
evaluated for its effectiveness.
7. The organization shall identify instances of
nonconformance with the RCMS, address and
investigate those instances, mitigate any
adverse impacts, and initiate and complete
corrective and preventive actions.
Non-Conformance Corrective & Preventive
Action process elaborately identifies the
Non-Conformance instances related to RCMS.
These include the security incidents as well.
8. The organization shall identify and investigate
incidents and accidents, mitigate any adverse
impacts, identify root causes, complete
corrective and preventive actions, and share
key findings with relevant stakeholders.
Under the Incident Reporting &
Investigation process, SabTank identifies and
investigates all EHSS incidents by using the
root cause analysis. The results are
communicated to all the relevant stakeholders
through email and intranet.
9. The organization shall establish and maintain
procedures for the identification,
maintenance, and disposition of relevant
Responsible Care records, including training
records, and results of audits and reviews.
The Control of Records process addresses
the requirements related to Responsible Care
records.
8. MANAGEMENT REVIEW AND
REPORTING
The organizations management should, at appropriate
intervals, conduct reviews of the RCMS to ensure its
continuing suitability. This review should be broad enough
in scope to address the Responsible Care dimensions of its
activities, products or services.
a. Senior Management shall periodically review its
Responsible Care Management System and take
action to ensure its continuing suitability, adequacy and
effectiveness.
b. The organization shall periodically report about the
Responsible Care Management System performance to
stakeholders.
WHAT SABTANK DID
As can be seen from the Figure 8 on the following page,
RCMS requirements are thoroughly reviewed and evaluated
in the annual management review meeting.
Page 348 Page 347
9. CONCLUDING REMARKS
ADVANTAGES OF RCMS
The benets and the advantages are manifold. A few of
these are listed below:
a. RCMS establishment and certication has put
SabTank in a limelight.
b. The whole process has helped in improving
SabTanks performance
c. RCMS Certication has enhance SabTanks
credibility.
d. It has helped SabTank to meet and even exceed our
customer expectations.
e. Certication has helped in building the morale of
the employees.
f. The certication has helped SabTank to earn
trust and condence of community as well as
stakeholders.
REFERENCES
[1] Responsible Care Management System Technical
Specication RC101.03.
[2] Responsible Care Management System (RCMS)
Guide and Template.
[3] SabTank Integrated Management System (SIMS)
Risk is
AUTHORS BIOGRAPHY
Tahir J. Qadir studied chemical engineering at Engineering
University, Lahore Pakistan, and graduated in 1982.
Since then he has worked in the petrochemicals and
chemicals industry in the areas of Operations, Process,
Projects, and Planning. Over the last twelve years he has
worked in the areas of management systems including
Quality, Environment, Health, Safety, Security, and
risk-based audits. He has led a number of initiatives
including, the development and implementation of a
fully integrated management system and, most recently,
the establishment of Responsible Care Management
System in Sabic Terminal Services-SabTank. He joined
SabTank in 1997 and is currently working as Chief
Quality & Audits. Prior to joining SabTank, he worked
as Operation Manager of Hoechst-Celanese plants in
Lahore, Pakistan.
9
th
ASSE-MEC-2010-47
Scheme of World-Class Quality Safety
Yasser M. Al-Mowalad, Yanbu NGL Fractionation Department
ABSTRACT
Establishing a safety program to prevent injuries is not only
the right thing, it is protable too.
Failure to view safety as a competitive advantage will inhibit
the ability of any business to meet the challenges of the
global economy. Research shows that adopting quality safety
programs will positively inuence the business organizations
nancial bottom line with a $4 to $6 return for every $1
invested in safety programs. In line with the strategies of
adopting quality safety programs, this paper addresses the
following:
1. The integration of quality and safety in the Safety
Management System (SMS).
2. The foremost critical success factors in the process of
adopting an SMS.
3. How an SMS might be deployed in a strategic quality
approach.
4. The payback from adopting quality safety on the
business organizations performance.
KEYWORDS
Safety Management System, Strategic Quality
Management, Safety Leadership, Safety Culture
1. INTRODUCTION
Since the beginning of the 21st century, the global business
environment in all industries has experienced the increased
competitiveness in the marketplace, known as "a global
competitive market. This energetic trend has inspired
all industries to pursue new strategies to confront that
competitiveness and uphold their share of the marketplace.
Nowadays there is a keen interest in quality and safety, as
rms seek world-class leverage in penetrating the market
- while at the same time satisfying their businesss internal
and external customers, i.e., the employees who reside
within the business environment, and the individuals in
public who make use of, or receive, the products or services
of a business organization.
In effect safety is well grounded in quality in performing
dealings in all spheres within the business environment.
This fact results in a simple mathematical truth: if quality
goes up, safety will be positively improved and vice versa.
A living proof can be observed in the aviation industry
that has technically complex and critical operations. Yet
when turbulence hits at 25,000 feet, it is comforting to
think about the quality standards that have helped todays
aircraft manufacturing industry achieve a strong safety
record, enabling a skilled pilot to land safely after a mid-
air emergency. We cannot help but think of the rigorous,
quality training that produces such pilots.
Accordingly quality and safety are leading success factors
in todays business environment; their management has
become strategically and tactically important for gaining a
competitive advantage.
2. STRATEGIC AND TACTICAL IMPACI OF
QUALITY AND SAFETY
Quality is reckoned as a competitive weapon in the business
environment. Principally it aims for customer satisfaction,
which is a critical success factor for all industries. Essentially
the customer is regarded as a genuine catalyst for business
improvement while the customers voice can be engaged
in new product development to pinpoint the competitions
technical gaps. Hence business organizations that are
unable to partner with their customers to satisfy their needs
will inevitably undergo a drop in market share,
Page 350 Page 349
have sold assets returned, and in certain sectors, lose their
license to operate. Empirical studies revealed, among
producers who held less than 12% of the market, those
with exceptional product quality averaged Return On
Investment (ROI) of 17.4%, while those with customary
quality averaged 10.4% ROI, and rms with inferior
quality had ROIs of only 4.5%. Quality improvements
enhanced nancial measures of protability through
reductions in cost and enhancement of market share.
This indicates that higher quality can lead to better
business performance.
On the other hand, safety is the state in which all hazards
are eliminated. In reality absolute safety, where there
are no accidents or incidents, can hardly be achieved,
unless serious efforts are applied to be successful. This
is exclusively attributable to the human factor in 80%
of accidents. Indeed despite the best efforts to create
a safe business environment, individuals make errors or
deliberately engage in unsafe behaviour causes violation.
Table No. 1 illustrates the error and violation types versus
the individual performance level.
Table No. 1: Error and Violation Types vs. the Individual
Performance Level
Either error or violation alone may not be damaging -
but the act of violating takes the violator into regions in
which subsequent errors are much more likely to have
bad outcomes. This relationship can be summarized:
Violations + Errors = Injury, Death and Damage
As a bad outcome takes place, it may involve a single
party within the business environment. Stopping at the
indirect cost and lost time for an individual treatment,
results in a bad outcome that still dramatically impacts
the whole business.
According to the National Safety Council, the total cost of
worker compensation for employers in the United States
of America (USA) was $111.9 billion in 1993. To put this
cost in perspective, employer injury bills exceeded $1,250
per covered employee in 1993. This represents about 62
cents per worker per hour. If a company, for example,
earns a 10% net prot on sales, it must sell $12,500 of
goods and services per employee per year simply to cover
its injury costs. Workers compensation programs pay for
lost wages
and medical expenses incurred as a result of work-related
injuries or illnesses.
3. SAFETY MANAGEMENT IN ANCIENT
AND MODERN TIMES
Managing safety is an ancient obligation as established
by the Babylonian King Hammurabi, who incorporated
a provision in his code of laws in the second millennium
BC, ordering the punishment of the mason if the house he
built fell down and killed the owner. That punishment was
death of the mason if the owner died and death of his son
if the owners son died.
Modern safety management is the result of government
regulations that necessitate making technical and human
resource provisions in the name of safety.
Yet, the ancient rules and modern regulations for managing
safety both focus on a practical approach, rather than
a scientic one for accident prevention; since neither
addresses how to manage safety factors.
In the late 1990s, it was argued that satisfying quality,
health and safety as basic life and business values is
attainable with safety management systems (SMSs). In
addition communities across the globe created the social
driving force that resulted in the enactment of rigorous
legislation and standards, in different countries, for
different industries. These varied business needs are now
anchored in international and national safety standards.
In turn many practitioners and researchers underlined
safety management as a mechanism to minimize nancial
loss, comply with legislation, effectively allocate of safety
responsibilities, and promote community goodwill.
4. INTEGRATION OF QUALITY AND
SAFETY IN SMS
Comparing the concepts and techniques which gained
worldwide acceptance for the quality improvement in all
types of manufacturing and service industries under the
name of Total Quality Management (TQM) and the process
used to manage the risky events, would illustrate there is
an obvious relatedness between both approaches while
similar unwanted behavior incriminated in both accident
occurrence and poor quality. Thus integration of TQM
concepts and techniques, as established by the quality
gurus - i.e., Armand Feigenbaum, W. Edwards Deming,
and Philip Crosby - into safety management is the outset
for developing a quality based SMS.
Those TQM philosophies consider total quality as an
organization-wide system approach that nds quality at
the beginning of the manufacturing process and constantly
improves it to meet the customer satisfaction. Also that
philosophies bear out four absolutes, i.e., the denition
of quality is conformance to requirements; the system of
quality is prevention of problems; the performance standard
of quality is zero defects; and the measurement of quality
is the price of nonconformance or the cost of quality. The
development of any quality-based SMS is anchored in the
following seven safety management beliefs:
1. Safety is built at the beginning.
2. All accidents are preventable.
3. All employees are involved in accident prevention.
4. Continuous safety improvement is the objective.
5. Safety is conformance to safety requirements.
6. The goal is zero accidents.
7. Customer satisfaction in safety is the focus.
5. RECOGNITION OF THE SMS
The positive standing of SMS has become well recognized by
governments, employers and workers, while in profoundly
industrialized environments such as Hong Kong - where
the rapid evolution of the manufacturing sector started in
the 1970s - several core industries recognized the public
and government need for setting out effectual SMS as a
proactive scheme to avert industrial accidents.
The SMS has been advocated by the Technical Affairs
Committee of The Institution of Occupational Safety and
Health in the United Kingdom, which declared in 2003
that the developed countries are experiencing a shift from
manufacturing to service industries coupled with new
technologies, globalization, exible work practices and an
ageing workforce. Meanwhile, many developing countries
are shifting from rural to industrial activities. Both scenarios
present changing work patterns and associated hazards.
The multitude of work-related risks requires a systematic
approach to safety management. That organizational
demand for safety standards further stimulated assorted
international and regional standardizing associations - to
establish safety standards for various disciplines - to facilitate
the integration of quality, environmental and occupational
health and safety in organizations.
Toward improving their competitive edge in the marketplace,
manufacturers and service providers worldwide have
commenced development and implementation of their
own SMS manuals in scales that cope with and satisfy their
enterprises demand. For example the U.S. Department
of Transportation Federal Aviation Administration (FAA),
Air Trafc Organizations Safety Services, which set Safety
Risk Management Guidance for System Acquisitions. The
guidance is to dene the scope, purpose, objectives, and
planned activities of the FAAs system safety effort, as it
applies to Safety Risk Management for all system acquisitions
providing air trafc control and navigation services in the
National Airspace System.
As another example is Saudi Aramco, which was accredited
in 2006 as the No. 1 Oil Company in the world for the
18th consecutive year. In 2005 Saudi Aramco began the
implementation of its SMS, although safety has long been
an integral part of Saudi Aramcos culture. The Saudi
Aramco SMS manual is composed of a broad-based set
of expectations governing how safety is managed. And by
addressing each expectation, managers can help achieve
Saudi Aramcos vision of being an industry leader in safety.
6. SMS DEFINITION AND
CHARACTERISTICS
Managing safety is really about risk management, and
it involves judgment, assessing priorities and making
decisions - all of the elements of management in its more
general sense. Likewise the SMS is composed of standards,
procedures and monitoring arrangements that aim at
promoting the health and safety of people at work and
protecting the public from work-related accidents. And they
are mainly intended to dene the scope of work, analyze
hazards, develop and implement controls, and improve
feedback systems. Thus the SMS is dened as;
a systematic approach to managing safety risks, including
the necessary organizational structures, accountabilities,
policies and procedures
The SMS liability is bonded to the corporate management
Page 352 Page 351
that sets out a businesss safety policy and denes how
it intends managing safety as an inbuilt critical success
factor for the overall business. This is because the
management of safety includes a number of elements,
e.g., safety policy, job hazard analysis, and safety and
health awareness; which merely provide guidance for
the enterprise to manage risks and improve safety and
health performance.
A typical industrial SMS concerns four areas: 1)
Government, 2) Public; which are marginal to businesses
since they have very slender promise to directly inuence
them. 3) Installation, and 4) Personnel; which are the
sectors directly managed by business. The installation
and personnel sectors encompass essentials, e.g.,
operations, procedures, training, etc, see (Figure No.
1). While any one essential will pertain to a particular
subdivision, all essentials are indispensable for SMS
adoption.
Figure No. 1: Typical Industrial SMS Areas of Interest
Correspondingly a world-class SMS delivers the following
paradigm elements:
1- Leadership and Accountability
2- Risk Assessment and Management
3- Communications
4- Competency and Training
5- Asset Integrity
6- Safe Operations
7- Contractors, Suppliers, and Others
8- Emergency Preparedness
9- Incident Reporting and Analysis
10- Community Awareness and Off-the-Job Safety
11- Continuous Improvement
These elements are equally important to an effective
and comprehensive quality safety framework that
denes practical and scientic approaches for the
system implementation to accomplish the safety and loss
prevention obligations with respect to the corporate values
and policy. While Saudi Aramcos SMS essentially spells
out how the managers can implement various aspects of
the system - within their areas of responsibility - through
highlighting specic programs, procedures, and processes
required to meet the corporate objectives.
This advancement in safety management within the SMS
takes into account changing the axiom of safety rst,
to safe production, and even at a world-class performer
similar to Saudi Aramco, it has been formulated as safety is
equal. Absolute safety rst has a good resonance, however;
safety should not be considered a discrete issue. Rather,
it must become a basic value of the business. Changing
safety rst, to safe production or safety is equal, becomes
the only standard that emphasizes the idea that it is ne to
produce as hard and as fast as possible, as long as it can
be done safely.
As a general rule the SMS is a businesslike approach to
safety that has at its core the elements of the Deming
wheel: Plan, Do, Check and Act, see (Figure No. 2), which
supports the principle of continual improvement and is
corresponding to all management systems, in terms of
including the business goals, planning, and measuring
performance. Additionally it is woven into the fabric of the
business organizations since it becomes part of the culture
and the way people perform their jobs. Thus the SMS
exclusively emphasizes the 4 Ps:
1. Philosophy
2. Policy
3. Procedures
4. Practices
Figure No. 2: Deming Wheel: PDCD
7. SMS CRITICAL SUCCESS FACTORS

The SMS is a centric and focused management system that
links safety to planning, organizing, directing, and controlling
the business assets, i.e. the people and other properties, for
the benet of a predetermined business vision. Therefore
to accomplish the desired safety outcomes, the main
characteristics of that system include process attributes.
This means that safety requirements must be built in to the
systems design. Those requirements include;
1. Responsibility and authority for accomplishment of
required activities.
2. Procedures to provide clear instructions for the
members of the organization to follow.
3. Controls that provide organizational and supervisory
controls on the activities involved in processes to
ensure they produce the correct outputs.
4. Measures of both the processes and their products.
Success in a business organizations safety performance
depends, to a great extent, on the existence of a positive
safety culture and quality safety leadership, which are
interrelated success factors. The positive safety culture
generally is the way in which the business organization
conducts its activities, and particularly in the way it manages
safety. The culture signicantly adds force to the business
safety performance through holding safety as a main lever
for all the businesss activities. That performance chiey rests
on the shoulders of the business management, because
safety emanates from the communicated principles of
the top management. The result is that all staff exhibits a
safety ethos that transcends departmental boundaries, by
demonstrating quality safety leadership practices. In effect
the safety culture emulates the environment in which the
SMS will work, and the leadership is the control mechanism.
Hence the safety culture resembles the landscape where the
SMS will be situated and the leadership is the key that can
bring the SMS to peak performance.
7.1 Safety Culture

Safety culture within the business organizations can be
described as one of the following:
1. Major constituent values.
2. Not a priority.
3. Safety is unimportant.
The culture of an organization tunes everything in the safety
arena. In the positive safety culture that ponders safety
as a major constituent value, the culture itself says to the
business employees that everything you do about safety is
important. It tolerates all employees participation to shape
and advance the business by saying to the employees; we
want and need your help. Such culture urges creativity
and innovative solutions. As the second type of culture is
swinging, in the latter, almost nothing will work; all the
safety initiatives are seen as boring and a waste of time. In
effect the third culture rejects new ideas even it forces the
employees to never use their brains at work.
The organizational safety culture is a major component
affecting organizational performance, dened as
the product of individual and group values, attitudes,
perceptions, competencies, and patterns of behavior that
determine the commitment to and the style and prociency
of, an organizations health and safety management.
Business organizations with a positive safety culture are
characterized by communications founded on mutual trust,
by shared perceptions of the importance of safety and
by condence in efcacy of prevention measures. When
building a culture of safety, the management must create
the environment that enables safety to be a core value of
the business organization, and more importantly, within the
hearts of the individuals who work there. That environment
can be achieved through the following:
1. Demonstrate that safety is a core value versus simply a
priority.
2. Establish a clear and compelling safety vision.
3. Consistently communicate a strong personal belief in
safety.
4. Create the environment that encourages people
to provide feedback . . . all feedback, not just safety
feedback.
5. Measure, communicate and reward progress in
achieving the companys safety vision.
6. Display the courage to make the difcult decisions
necessary when even a top-producing manager
violates safety.
7.2 Safety Leadership

The safety leader, either at the manager or supervisor
position, bonds the management and employees within
organizational structure top-down or in reverse. Never
underestimate the inuence supervisors have on your
workforce, and in the eyes of the employee, the supervisor
is the company, says Buckingham and Coffman, authors
of First Break all the Rules. Even if the organization has
generous pay and a renowned training program, the
Page 354 Page 353
company that lacks great supervisor leadership will
suffer. Therefore to inspire employees to higher levels
of safety and productivity requires the leader to apply
quality safety leadership. Actual leadership is trouble-
free to explain, but not to exploit, since most leaders
strive for safety but practical day-to-day circumstances,
e.g., time pressures and economic constraints, seem to
conspire against quality safety leadership.
Principally leadership is about behavior rst and skills
second. People tend to follow the good leaders as they are
trustful and respectful, rather than being skillful. Within
the context of Islamic culture, Prophet Mohammad,
Gods prayers and peace be upon him (PBUH) was seen
as a sincere leader as indicated by Thomas Carlyle.
Prophet Mohammad (PBUH) provided the best guidance
for Muslims by being an exemplary leader, e.g., his
modesty, mercy, magnanimity, patience, responsibilities
and leniency. In effect, all of his demeanors show him to
be the greatest leader and inspirer the world had ever
seen, which Michael Hart, a contemporary American
scientist, afrmed in his ranking for the three most
inuential persons in history. Hart placed Muhammad
(PBUH) at the top of his list of one hundred humans.
Theodore Roosevelt said People ask the difference
between a leader and a boss ... The leader works
in the open, and the boss covertly. The leader leads
and the boss drives. Real leadership is different from
management, in addition to having management skills,
safety leadership further relies on the leaders qualities.
Research indicated that theoretical and practical
knowledge, along with consulting over 65 seafarers
and shore managers about everyday safety leadership
challenges, concluded the safety leader ought to master
four patterns with ten qualities:
Condence and Authority
1. Instill respect and command authority
2. Lead the team by example
3. Draw on knowledge and experience
4. Remain calm in a crisis
Empathy and Understanding
5. Practice tough empathy
6. Be sensitive to different cultures
7. Recognize the crews limitations
Motivation and Commitment
8. Motivate and create a sense of community
9. Place the safety of crew and employees above
everything
Openness and Clarity
10. Communicate and listen clearly
8. DEPLOYING THE SMS THROUGH
SQM APPROACH
Safety strategies are critical to world-class
competitiveness, as companies that fail to utilize a
strategic approach to company safety will be less successful
over the long-term. Business success necessitates the
right environment as infrastructure reinforces business
presence and growth in the marketplace. Education,
which Mr. Abdallah S. Jumah, President and Chief
Executive Ofcer (CEO) of Saudi Aramco (1995-2008),
underlined as a key for the future success, can nurture
quality safety as an infrastructure for businesses to excel.
An example was the rst step in bringing Russian quality
management practice up to world levels, when the need
to build educational institutions was raised to facilitate
training in TQM and enable implementing quality
management techniques in the Russian environment.
Similarly, by looking at the qualities of the best-managed
companies in the USA, there are eight qualities found in
these companies. The rst quality is the bias for action,
which necessitates increasing knowledge. The demand
for education calls attention to the need of teaching
quality safety concepts and approaches adopted at the
world-class corporations in the schools, institutions and
training centers. This undertaking characterizes a long-
term strategy that supports not only businesses, but its
inuence extends to benet the nation and individuals at
all levels of society - as todays students are tomorrows
business generation. In addition, both quality and safety
are life concepts, no-one would strive for non- safety or
non-quality.
With regard to business affairs, the adoption of a quality
based SMS as a strategic decision puts emphasis on
the seven strategic quality management (SQM) core
concepts:
1. Customer focus.
2. Leadership.
3. Continuous improvement.
4. Strategic quality planning.
5. Design quality, speed and prevention.
6. People participation and partnership.
7. Fact-based management.
These SQM concepts aim to satisfy the customer,
continuously improve the processes and systems to
increase the quality of products and services and stay
ahead of competition. The quality based SMS is a lifelong
strategic priority, and any drawback in its implementation
capacity may come back to hinder making that vision a
reality. Therefore; embracing the SMS implementation scope
with these pivotal concepts is a must. They can be thought
as spokes in a wheel, which is climbing the quality safety
hill. The basic goals are to improve value for customers and
compete strongly in the marketplace.
9. THE PAYBACK OF ADOPTING QUALITY
SAFETY
A winner of the Baldridge award said Management realized
that the most important assets at the company were the
employees. The decision was made to prioritize safety, the
most important concern of the associates as the rst and
most important measurement category, followed by internal
customer satisfaction, quality and business performance.
Since that time, accidents have decreased by 72%; lost time
due to accidents has decreased by 85%; and lost work days
have gone down by 87%. Customer satisfaction ratings are at
95% and growing, prots are up, and workers compensation
costs have dropped from $92,000 to $13,000.
Within the business environment of Saudi Aramco which
embarked on adopting the SMS in 2005, although safety
has been a part of company tradition since it was founded
in 1933. The Yanbu Natural Gas Liquids (NGL) Fractionation
Department (YNGLFD) is one of the model SMS adopter
organizations. On three occasions the YNGLFD has won
the Exceptional Safety Achievement Recognition Program
award, administered by the Saudi Aramco Loss Prevention
Department, and awarded by the President & CEO. Actually
YNGLFD has heavily engaged in implementing the SMS,
which further dramatically inuenced the departments Key
Performance Indicators (KPIs) as traced from the start of
2005 (the launch of the SMS) to the end of the third quarter
of 2009 all through instituting safety enhancement efforts:
1. Management quarterly safety inspection.
2. Bimonthly supervisory safety meetings.
3. World-class safety workshop for all supervisors.
4. Continuous improvement of safety performance.
5. Promoting safe driving among the communitys
individuals.
6. Conducting self-assessment.
7. Face to face communication.
8. Increasing the management presence in the eld.
9. Being focused in critical jobs.
10. Team safety recognition program.
11. Contractor safety competition program.
12. Setting Performance Management Program goals
related to the SMS.
13. Community safety and health campaign.
Businesses in quest of a competitive edge in the marketplace
should contemplate adopting an SMS as it is too easy in
a demanding business setting to overlook requirements
or repeat mistakes from the past. The quality based safety
management, which is set apart in well recognized SMSs
during the rst decade of the 21st century, facilitates
complying with the legal obligations, whereas these SMSs
are typically systematic, proactive and explicit for managing
safety affairs.
Essentially, the success of that qualitys holistic management
approach in meeting customer satisfaction and the
realization of the most important areas of concern in
advancing safety management, i.e., commitment to safety,
employees accountability for their own safety, and having
safety excellence embedded in the business psyche, have
driven the harmonization of a variety of management
systems, i.e., Quality Management and Occupational health
and safety systems in the SMS as branded schemes of
quality safety benets:
1) Safety: through a quality management approach to
control risk and provide an organizational framework
that supports a quality safety culture, forms the core
of the businesss safety efforts and lends a hand to
the businesss management. In addition, a
detailed roadmap is required for monitoring safety-
related processes. Together these affect the operating
businesss assets in the following ways:
Assure safe practices in operation and a safe working
environment.
Establish safeguards against all identied risks.
Continuously improve the safety management skills
of personnel, including preparing for emergencies
related both to safety and environmental protection.
2) Business: through providing the business
management with a structured set of tools
to meet their legal responsibilities, which
in turn provide signicant benets. The SMS
incorporates internal evaluation and quality
assurance concepts that can result in a
more structured management and continuous
improvement of operational processes, which
accordingly have added value to administering the
business in the following ways:
Avoidance of duplication from multiple individual
systems.
Eliminating the overlap of effort.
Reduction in the fuzzy management boundaries
between individual systems.
Page 356 Page 355
Broadening the horizon beyond the functional level
of any individual system.
Sharing information across traditional
organizational boundaries.
Streamlining paperwork and communication.
10. FINAL WORD
The integration of quality and safety in SMS represents
a Business Excellence (BE) managing model as
depicted in (Figure No. 3). The model includes the key
practices in the BE models, which according to the
European Foundation for Quality Management, are
based on a set of eight fundamental concepts: results
orientation, customer focus, leadership and constancy
of purpose, management by processes and facts, people
development and involvement, continuous learning,
innovation and improvement; partnership development,
and public responsibility.
Emphasizing the importance of educating current and
potential employees and instilling a culture of quality
safety, Mr. Khalid A. Al-Falih, President and CEO of Saudi
Aramco (2009-present), said We need to enforce this
in the employees joining us while we reinforce safety
attitudes of the employees we have today.
The reason why businesses ought to be interested in the
SMS as a scheme of world-class quality safety is that it
is simply a better way of doing work, in a safe manner,
while maintaining quality that produces more for less.
This model shows a positive inuence can manifest
itself in the employees thoughts, feelings, satisfaction,
interaction and affective reactions within the business
environment.
Figure No. 3: Business Excellence Managing Model
REFERENCES
AFS-800 Federal Aviation Administration (2006).
Introduction to Safety Management Systems for Air
Operators. Advisory Circular AC No:120-92.
Al-Bassam S. (2008, September 17). News: Jum'ah:
Education is Key. Saudi Aramco intranet homepage.
Unpublished intranet document.
Al-Jumu'ah (2007). The Prophet's successful leadership
and benevolence during Hajj.
Anderson G. (2008). Creating a Culture of Safety. In
American Society of Safety Engineers - Middle East
Chapter Conference: Vol. 8. Proceedings (pp. 130 -
133). Bahrain: ASSE-MEC
Ansari A. and Modarress B. (1997). World-class strategies
for safety: a Boeing approach. International Journal of
Operations & Production Management, 17 (4), 389-
398.
Aravindan, P., Devadasan, S.R. and Selladurai V.
(1996). A focused system model for strategic quality
management. International Journal of Quality &
Reliability Management, 13 (8), 79-96.
Businessballs (n.d.). Leadership development tips.
Management and leadership theories, models and
gurus.
Bassam S. (2008, June 11). 30 employees set safety
standard. Saudi Aramco: The Arabian Sun, p. 4.
Unpublished intranet document.
Business link (n.d.). Set up a health and safety
management system. Managing health and safety.
Byron B. (2007). Safety Management System.
Civil Aviation Authority (2002). UK Civil Aviation
Authority.
Dale, G. B. (1999) Managing Quality, USA Blackwell
Publisher Ltd.
Dickenson R.P., Rogerson J.H. and Azarov V.N. (2000).
Building an infrastructure for quality management in
Russia. Quality Assurance in Education, 8 (2), 70 - 75.
Facility Safety Management (2004). Leadership What Does
It Look Like? In Team Safety, Inc.
Feyer, A. and Williamson, A. (1998). Occupational Injury:
Risk, Prevention and Intervention (1st ed.) [Electronic
version]. Australia: CRC Press
Forker L. B., Vickery S. K. and Droge C. L. (1996).
The contribution of quality to business performance.
International Journal of Operations & Production
Management, 16 (8), 44-62.
ILO-OSH (2001). Guidelines on occupational safety and
health management systems.
IOSH - Institution of Occupational Safety and Health (2003).
System in focus.
Kuusisto, A. (2000). Safety management systems - Audit
tools and reliability of auditing. Espoo 2000, Technical
Research Centre of Finland, VTT Publications 428 174p. +
app. 48p.
Law, W.K., Chan A.H.S. and Pun K.F. (2006). Prioritizing
the safety management elements. Industrial Management
& Data Systems, 106 (6), 778-792.
Little, D. (2006). Leading For Safety: A Practical Guide For
Leaders In The Maritime Industry.
megan.kemp (2004). Peters and Watermans Eight
Attributes of Excellence.
Pun K. F., Yam R. C.M. and Lewis W. G. (2003). Safety
management system registration in the shipping industry.
International Journal of Quality & Reliability Management,
20 (6), 704-721.
Roughton, J.E., and Mercurio, J.J. (2002). Developing an
effective safety culture: A leadership approach. [Electronic
version].Boston: Butterworth-Heinemann.
Safety (n.d.). In Wikipedia: the free encyclopedia.
Saudi Aramco (2006). In Saudi Aramco: News Room - Year
In Review.
Saudi Aramcos SMS Manual (2005). Saudi Aramco Safety
Management System: by Saudi Aramco Loss Prevention
Department. Unpublished intranet document.
Shaw M. (2003). The Road to Business Excellence. Industrial
Accident Prevention Association IAPA.,
Shen Y. J. and Walker D.H.T. (2001). Integrating OHS, EMS
and QM with constructability principles when construction
planning a design and construct project case study. The
TQM Magazine, 13 (4), 247 - 259.
Transport Canada Civil Aviation (n.d.). What is a Safety
Management System?
U.S. Department of Labor (n.d.). Module 2 - Management
System: Safety & Health Integration.
UK P&I Club (2009). The human element - errors and
violations
U.S. Department of Transportation Federal Aviation
Administration FAA (2007). Safety Risk Management
Guidance For System Acquisitions.
Vanguard (n.d.). The Business Excellence Model: will it
deliver? Systems thinking and Business Excellence.
Why Muhammad.com (2003). Prophethood of Prophet
Muhammad, Gods Prayers and Peace be Upon Him.
International Committee for the Support of the Final
Prophet.
Wikipedia (2007). Business excellence. In the free
encyclopedia.
Wikipedia:customer (n.d.). In Answer.com.
Williamsen M. (2008). Six Sigma Safety Applying Quality
Management Principles to Foster a Zero-Injury Safety
Culture. In American Society of Safety Engineers Middle
East Chapter Conference: Vol. 8. Proceedings (pp. 22 - 31).
Bahrain: ASSE-MEC
Yu S. C. K. and Hunt B. (2002). Safety management
systems in Hong Kong: is there anything wrong with
the implementation? Managerial Auditing Journal, 17
(9), 588-592.
Yu S. C. K. and Hunt B., (2004). A fresh approach to
safety management systems in Hong Kong. The TQM
Magazine, 16 (3), 210-215.
Page 358 Page 357
9
th
ASSE-MEC-2010-48
SH&E Management at West Kuwait Oil
Fields of Kuwait Oil Company, Kuwait
Mr. Kaushik Roy, Sr. Safety Engineer, HSE (West Kuwait).
Kuwait Oil Company
ABSTRACT
Kuwait Oil Company (KOC), one of the premier Oil &Gas
companies in the Gulf region, gives top most commitment
to Health, Safety and Environment (HSE) and considers
HSE as one of the key strategic objectives of its business
strategy and gives top most priority in its endeavor towards
sustainable development. The paper focuses on the HSE
improvements that were brought about after setting up HSE
Team in West Kuwait (WK) Asset in terms of Leading and
Lagging Indicators. The paper also focuses on the process
and methodology of the implementation of various HSE
Management System procedures at West Kuwait Asset,
which are common to entire KOC. The various initiatives
taken which enabled West Kuwait to achieve a substantial
lowering of HSE risks to acceptable level are also discussed.
The paper comprises of the initial steps taken like involving
the Top Management in HSE tours of WK facilities, initiating
and enhancing HSE communication across all levels in the
organization of WK, developing HSE Risk registers for all
the Groups involved in the WK elds, establishing Integrity
Management Committee in the area to focus on reduction
of leaks and spills, the initiatives taken for reducing driving
related injuries/damages, beeng up the HSE organization
of WK etc.
INTRODUCTION
West Kuwait Operations comprises of 4 Gathering Centers,
1 Booster Station ( for Gas compression), 1 Water Injection
Plant and 1 Water Pump house ( for brackish water
pumping), in addition to a large No. of crude oil wells,
water disposal wells, ow-lines, Gas & Crude manifolds
and pig launchers/ receivers located in the desert areas
of West Kuwait. Furthermore, new facilities like a new
Gathering Centre, Booster Station, Gas Compression and
Re-injection stations are being set up and are currently in
the Projects stages.
In the earlier days, till the year 2003, the HSE risks in the WK
eld areas were managed from a team situated at Ahmadi,
which is about 70-80 kilometers away from these elds. It
was soon realized by KOC Management that the HSE risks
could be effectively monitored from closer proximity. With
this realization, KOC Management decided to decentralize
HSE by setting up HSE ofces and hence, HSE Teams in the
desert areas of West Kuwait (WK), North Kuwait (NK) and
South & East Kuwait were set up in the year 2003-04.
THE PROCESS OF CHANGE
Historically speaking.
The attitude towards HSE prior to the formation of the
HSE Team in WK was not encouraging. There was gross
ignorance as well as a pronounced reluctance to follow HSE
related practices and procedures. People employed in these
areas were reluctant to wear PPEs, follow the Permit to Work
procedure and there was always a pressure to nish off
the jobs fast and start operations to minimize the nancial
losses. In an attempt to do so, procedures were bypassed,
shortcuts taken and it was only luck that prevented a major
catastrophe. The concept of Near Miss had not sunk in and
there was no analysis done for them. The avoidance of
incidents/accidents, most of the times, could be attributed to
sheer luck, in the absence of systematic HSE Management.
However, incidents did happen in the year 2002 wherein
fatalities occurred in two separate incidents, one in BS-130
and the other in GC-15 in North Kuwait eld areas.
The above incidents prompted the top management of the
organization to take a fresh look at the HSE organizational
set-up and a decision was made to de-centralize HSE
organization so as to provide adequate coverage to the
eld
ACKNOWLEDGMENT
Sincerest thanks and cordial gratitude are due to the
management team and taskforce of Yanbu NGL
Fractionation Department whose commitment and
dedication to safety was the catalyst for developing this
paper. It was their encouragement and advice that made
this paper possible.

Page 360 Page 359
areas. Hence, the Asset HSE Teams were formed, HSE
(WK) Team being one of them. The Team was made
operational from the year 2004. The Team was entrusted
with a prime objective of supporting WK Directorate in
accomplishing its operations and projects works in a
safe and environmentally friendly manner.
HSE (WK) Team initiated the following activities to
achieve its objective:
1. Beeng up of the HSE Organization
In the year 2004/05 when the HSE Team was rst set up
in West Kuwait elds, the Team was manned by skeletal
staff comprising of 2 relatively inexperienced employees
who had been transferred from Corporate HSE ( known
as HSE Group now in KOC) and 1 employee who was
assigned the responsibility of managing the Teams
operations.
Over a span of 5 years the Team has been expanded to
include personnel with a great deal of experience with
more than 15 years. The Team currently boasts of having
employed 19 employees who are professionals in their
own right; it comprises of a mix of highly experienced
persons and new entrants to the HSE profession. This
beeng up of the organization has enabled HSE (WK)
Team to discharge its operations in a smooth & effective
manner and to suggest and advise proactive changes for
HSE related improvements in WK elds.
The beeng up of the HSE Organization in WK, in
specic, required a lot of ground work which included
the formation of a meaningful organization structure
and to ensure that the right persons were inducted
in the posts that were created. A lot of support was
necessitated of the Human Resources within the KOC
organization, who ably supported the endeavour of
recruiting, transferring/ redeploying employees. The
organization structure, as of now, has been rmed up to
cater to all the future requirements / expansions in the
company specic to WK elds and a current vision till
the year 2012/13 has been formalized. The organization
structure of the Team is reproduced below:
AS OF APRIL -08
HSE TEAM (WK) ORG. CHART
TL HSE (WK)
Sr. Safety
Engineer)
Sr. Safety
Engineer)
INDUSTRIAL
HYGIENIST
(IH)
Safety
Engineer)
Sr. Safety
Officer
Safety
Engineer
Sr. Safety
Officerr
IH (UD)
Secretary.
SNR. ENV.
ENGR.
Eenviro
nment
Enginee
r
Environ
ment
Engineer
Safety
Officer
Technical Asst.
Safety
Engineer
Safety
Officer
Environm
ent
Engineeer
OSSCO
Safety
Engineer
Sr. Safety
Engineer
(OSSCO)
HSE
PLANNING
ENGR
Environmen
t Officer
It is expected that with the completion of all the recruitments
by the year 2012/13, there will be closer monitoring and
follow up in the WK facilities as each facility will be equipped
with a Safety Ofcer to guide, advise and support the site
personnel; hence the HSE (WK) Team will further enhance
its performance as the advisors to the WK Field personnel
on HSE issues.
2. Involving Higher Management in HSE
Tours
One of the initial steps undertaken to improve HSE
awareness, involvement and consciousness in the area
was to develop a system for the visit of WK Directorate
Management to the facilities on a monthly basis with
an objective to focus on HSE related issues in the facility
and boost the morale of the employees working in these
remote areas.
These visits were termed as the Leadership HSE Visits
with the primary purpose of displaying commitment of top
and middle WK Directorate management towards HSE.
The visits started in the year 2005 and went a long way in
improving the HSE culture in the area as the employees of
the area could see some tangible HSE related improvements
occurring in the area. Furthermore, these employees could
highlight the HSE concerns to the management staff who
were proactive and more than willing to assist in such
improvements.
In the following years, these HSE visits were done with higher
degrees of nesse by assigning themes and following up on
the earlier visit recommendations so as to ensure smooth
closure of the same. A behavioral safety tool (called Safety
Observations and Conversations which was implemented
across KOC, in the meantime) was also implemented and
these Safety Observations and Conversations (SOCs) were
also carried out during these HSE visits.
This initiative and the commitment of the leaders to improve
HSE in WK Directorate was a stepping stone for achieving
the highest degree of HSE performance over the years.
3. Implementation of HSEMS Procedures
The process of implementation of the HSEMS Procedures
in WK elds has been one of the key focuses of the WK
management.
The KOC HSE Mission, Vision, Policy statement, System
Elements and Expectations had been laid out in the year
2003. In addition, the KOC 2020 strategy (being revised to
2030 strategy now) has HSE as one of the key elements in
it.
The KOC HSEMS has been split up into 12 elements
which includes the following: Leadership, Commitment
& Accountability, Training, Competency & Behaviour, Risk
Assessment, Risk Management & Compliance, Facilities Design
& Construction, Operations & Maintenance, Management of
Change, ,Crisis Preparedness, Incident Analysis & Prevention,
Interactions with Employees, Stakeholders, Regulators
& Community, Contractor Commitment & Involvement,
Information & Documentation, Auditing, Assurance &
Measurement & Continuous Improvement .
The procedures related to these elements have been clearly
dened and these procedures have been classied in Tiers
as follows:
Tier-1: Mission, Belief, Values and Vision
Tier-2: Description of functional Structure of System
Tier 3: Procedural and Process Documents &
Tier 4: Work Instructions and detailed task descriptions.
The implementation of these procedures was initiated even
before the HSE Asset Teams were functional. A high level
committee was formed in KOC to oversee the implementation
of the procedural requirements.
In line with the above, another committee which was named
as West Kuwait HSEMS Implementation Committee was
set up to oversee the implementation of HSEMS in WK
Directorate.
In the year 2008-09, a company- wide decision was made to
roll-out all the existing procedures for implementation.
Subsequently, HSE (WK) Team initiated a HSEMS Self
Assessment Exercise to gauge and measure the actual
implementation of the procedural requirements within the
Directorate. The gaps were identied by following detailed
checklists which were developed centrally for use in KOC
and subsequently an action plan was developed to close
the gaps. Currently, the implementation of closing out the
gaps is in process and after achieving this, the continuous
improvement loop will be initiated.
4. Campaigns, Trainings and Awareness
A major initiative undertaken by HSE (WK) Team was to
increase the knowledge base on HSE of all the employees in
WK elds with the aim of changing their behavior towards
HSE.
This was done systematically by arranging awareness
sessions, ensuring that training was imparted and organizing
and conducting campaigns on themes which would cause
immediate impact in terms of improvement in HSE.
While awareness sessions were carried out on many
topics including Permit to Work, Gas Testing, Conned
Space Entries, Hazards of Hydrogen Sulde, Incident
Investigations, Defensive Driving, etc., certication trainings
were organized and imparted on Permit to Work, Gas
Testing, Safety Observations and Conversations, etc.
Promotional campaigns were carried out on the Signicance
of Near Miss reporting, Defensive Driving, Prevention of
Leaks and Spills, Permit to Work, Heart for Life ( Health
related on protection of the human heart), Chemical
Handling, Integrity Management to name a few. There have
been proactive participation of WK eld employees in these
campaigns.
These systematic and sustained knowledge base development
amongst the employees had a denite positive impact in
terms of their at-risk behavior, which showed in the bottom
line viz., improvement in HSE related statistics.
The reduction in the Industrial Disabling Injury Frequency
Rate (IDIFR) is depicted below:
Reduction of IDIFR over the years
Page 362 Page 361
While there has been a reduction in IDIFR over the years,
there has been no fatality in WK elds since the year
2005.
The chart below represents the increased Near Miss
reporting in WK after sustained campaigns and
awareness sessions that were conducted in WK:
Increase in No. of Near Miss incidents reported over the
years
5. HSE Support for Projects in WK
HSE (WK) Team has supported various Projects since its
inception. These Projects included the Projects like new
gathering centre (new GC-16), new Booster Station (BS-
171), Gas Compression Project, Gas Reinjection Project,
Air Assisted Flare Stack Project to name a few.
HSE (WK) has supported these Projects at various
stages of its lifecycle from the Concept to Construction
& Commissioning stages. During the past 2 years,
development of an HSE Plan for all Projects have been
made mandatory for all Projects during the Concept
stage and this is developed by the Requesting Team.
HSE (WK) has proactively supported the development
and establishment of these plans.
Besides the support provided to develop these plans the
Team has also participated in various Risk Assessment
studies during the course of the Projects like Hazard
and Operability Studies (HAZOP), Quantitative Risk
Assessment (QRA), Environmental Impact Analysis (EIA),
Project HSE Review (PHSER) at various gate closure
stages of the Projects, etc.
The support provided by HSE (WK) Team has gone
a long way to ensure smooth delivery of HSE related
activities and resolution of HSE issues at various stages
of the Projects.
6. Involving Contractors in HSE
Contractors are the key players in any organization as they
carry out most of the works related to maintenance and
projects delivery. KOC is no exception and neither is WK.
A large number of contractors are employed in the WK
eld areas and they are required to deliver their functions
related to their activities on a routine basis.
HSE (WK) Team engaged the contractors in HSE by
organizing meetings with the Contract Managers and
site safety representatives on a monthly basis to discuss
regarding the HSE issues related to the contracts and assist
the contractors and the respective KOC Controlling Teams
to resolve the issues in a smooth manner.
In the year 2008-09 the Contractors working in WK eld
areas were encouraged to develop HSE related targets on
both leading and lagging indicators and were required to
present their progress on these targets during the monthly
meetings. This helped systematical identication of the
key focus areas related to HSE of all contractors and the
resolution of these issues were followed up closely by HSE
Team.
7. Occupational Health and Hygiene
related improvements in WK
Occupational Health and Hygiene being an emerging eld,
was not provided enough importance till not so long back.
However, once the HSE (WK) Team was set up, Industrial
Hygienists were recruited to initiate activities related to
improvement of Occupational Health and Hygiene in WK
elds.
Various surveys of work place within WK were carried
out which included indoor air quality survey in ofces,
laboratories and control rooms; ergonomic survey in the
ofces and control rooms; noise survey at the facilities
including detailed noise surveys in the high noise areas;
potable water quality testing on a periodic basis;
occupational stress related surveys for all employees
etc. The results of the surveys were analysed to arrive at
necessary recommendations.
As an output of these surveys, various initiatives were
undertaken which included distribution of ergonomically
friendly chairs in the facilities, improving the local ventilation
system in laboratories, displaying signs in high noise areas,
improvement of the quality of potable water by ensuring
regular cleaning of water tankers and the water storage
tanks in the facilities etc.
Furthermore, over the past few years there has been a
substantially improved communication and coordination
between the Industrial Hygienists and the Medical
Practitioners located at the KOC hospital and the local WK
Clinic in relation to occupational health and hygiene issues
like occupational illness. The clinic reports are analysed for
the type of injury/illness and necessary action is taken to
ensure non recurrence of such incidents.
8. Focus on Safe Driving
Road accidents have been the singular most cause of
fatalities and injury incidents in Kuwait in general and KOC,
in specic. A fatal road accident that resulted in 4 deaths
occurred on West Kuwait Roads in the year 2005. Two
major critical factors contributed to these incidents viz., the
condition of the roads and the at-risk driving behaviour of
the KOC employees.
After the HSE Team was set up in West Kuwait, one of
their prime focus areas, hence, was reduction in the motor
vehicle accidents. It was a major challenge, given the fact
that the hardware related to the roads and behaviour of the
drivers were adverse and added to it was the fact that the
WK facilities were located in the remote locations; hence
necessitating very long drives (by Kuwait standards, Kuwait
being a relatively small country necessitating lower distances
to travel) to the eld areas and ofces.
This challenge was taken up by HSE (WK) Team and it did
deliver in no uncertain terms. The hardware was improved
immensely by ensuring wider roads with better conditions
in the entire WK eld areas. Road signs were put up aplenty;
this included the speed limit signs, signs of animal crossings
at critical locations, signs displaying the necessity of using
seat belts, signs displaying what to do in case of fatigue and
signs displaying the demerits of using mobile phones while
driving; cat-eyes were also installed. Solar powered ashers
were set up at critical intersections. Speed breakers were
installed at the critical locations to ensure that motor vehicles
slow down at these intersections.
Speed radar cameras were set up which were installed in
moving vehicles. These cameras started monitoring the
speed of the vehicles driving on KOC roads in general and
WK Roads in specic. This brought about a radical change
as far as the over speeding of the drivers on WK Roads was
concerned. These speed cameras started operating from the
year 2006 and there has been a sharp fall in the No. of trafc
violations over the years. The statistics showing reductions
in the Motor Vehicle Accidents Frequency Rates (MVAFR)
and speed violations since 2006 have been graphically
represented below:
Reduction in MVAFR over the years
Reduction in speed violation over the years
Furthermore, various spot inspections were initiated on
the WK Roads and are still being carried out till date by
the HSE (WK) Teams employees to ensure that the driving
procedure that has already been laid out by KOC is strictly
adhered to. The behavioural safety tool used in KOC, viz.,
Safety Observations and Conversations (SOCs) is used for
drivers who violate the driving procedure with an aim to
bring about an improvement in their driving behaviour.
As a more recent initiative KOC has been encouraging the
use of Speed Monitoring Devices on the company owned
vehicles; these devices were already installed in the vehicles
for the middle and higher management (termed as Circular
Appointed Employees in KOC) earlier and now all other
employees are being encouraged to install these devices.
These devices keep a track record of the speed, use of seat
belts and sudden braking and acceleration a mathematical
model is used to provide a percentage mark to each driver
who installs these devices. Many KOC WK employees have
already installed these devices and more are in the process
of installation; 55 KOC WK employees (other than the
Circular Appointed Employees) have already installed the
SMDs voluntarily; this goes on to show that there has been
a signicant improvement of driving related behaviour of its
employees.
Page 364 Page 363
Hence, it can be concluded that, although, the change
in behaviour is a slow and a long drawn out process, the
KOC WK employees are already on their way to display
a marked change in their driving behavior.
9. Focus on Permit to Work
The Permit to Work system existed earlier, however the
implementation was poor. In late 2005 a new Permit to
Work system was launched across KOC. WK was the
rst asset to implement the same as a pilot in one of its
gathering centres.
Since that time, HSE (WK) Team has been closely involved
in guiding WK work permit issuers and applicants on
improving their understanding; over a period of the last
4 years there has been a drastic change on this front.
While, the permit lling and execution was very poor
years ago, now there is satisfactory compliance to the
system.
This has been achieved through conducting awareness
sessions, organizing training, carrying out promotional
campaigns, doing site inspections and audits on a
periodic basis by HSE (WK) Team.
In October 2009, a new electronic Permit to Work system
will be launched in WK; by successful application of the
same it is expected that there will be 100% compliance
to the system; which will be benecial to the company
in ensuring lower number of incidents.
10. Management of Change
Implementation
Changes related to the process plants were not managed
properly prior to the year 2005. Although an HSEMS
procedure on Management of Change (MOC) was
already existent, the same was not applied.
HSE (WK) Team guided the concerned Teams on
implementation of the procedure; wherein there was a
need of evaluating the changes by assessing the HSE
related risks, documenting the changes in the relevant
operation procedures and provision of training on the
changes to the affected personnel.
Over the years the MOC process has been implemented
completely and now MOC is considered as business as
usual.
Similarly, another HSEMS procedure on Management of
Personnel Change (MOPC) for transfer of personnel from
one stream to another was implemented and now, if any
employee is transferred from one location or stream to
another, the MOPC is applied to ascertain the training
needs to ensure proper levels of competencies.
11. Integrity Management

As Leaks and Spills were one of the highest contributors
towards incidents in KOC; KOC management decided to
focus specically on this and an Integrity Management
(IM) charter was laid out in KOC as a whole and WK in
specic.
The IM implementation was initiated in WK which turned
out to be a fore runner in this aspect. A committee,
comprising of working level experts, was formed in the year
2006 with the experts being drawn out from all relevant
elds like Inspection & Corrosion, Operations, HSE etc.
IM Key Performance Indicators (KPIs) were developed and
tracked on a periodic basis. These KPIs included measures
like identication and management of Safety Critical
Equipment, tests carried out for Emergency Shutdown
levels 1 & 2 in the operating facilities, the No. of Safety
Overrides ( with an aim to reduce unnecessary overrides),
inspection of static equipment ( including Pressure and
Temperature Safety Valves) etc.
In the current year, i.e. 2009, the IM has been set up in
a more systematic way wherein a steering committee
comprising of top and middle management has been
formulated to ensure that more importance is attached to
the IM implementation.
12. Risk Register
In the year 2008, HSE (WK) Team developed HSE Risk
Registers for all the Groups in the Directorate with a focus
on the operational facilities like Gathering Centres, Booster
Station and the Water Injection Plant.
The HSE Risk Register was developed by following the
What-If methodology and comprised of identication of
all the hazards, evaluation and assessment of Risk and
recommending control measures to reduce the risk to As
Low As Reasonably Practicable (ALARP) levels. These Risk
Registers were developed in-house by HSE (WK) personnel
by driving workshops and brainstorming.
Action Plans were developed for each Group based on the
resultant recommendations and currently they are being
tracked for closure while the registers are themselves being
updated periodically to accommodate any operational
changes.
13. Environmental Initiatives
A major initiative undertaken by HSE (WK) Team was to
convert an erstwhile efuent water pit that was used for
disposing off efuent water from a gathering centre, which
was destroyed during the Iraqi invasion, into an oasis.
The contaminated soil was tested for pollutants in
environmental laboratories and were disposed off in an
environmentally friendly manner subsequently. Good soil
was used to ll up the excavated area and this entire area
in due course of time, was converted into a green area
with plantations and a water body that was developed in
between.
In the earlier days there was a lackadaisical approach towards
solid waste management in WK elds. The hazardous and
non-hazardous waste materials were not segregated and were
disposed off in the desert without proper authorization. From
its inception, the HSE (WK) Team started closely monitoring
the waste dumping and disposal in an environmentally
unfriendly manner and managed to reduce such mal practice
substantially. The situation now has improved dramatically,
with the KOCs waste management procedure largely
implemented and requirement of documenting waste
manifest for all types of waste followed.
The other initiatives included the reduction and stoppage
of efuent water disposal to pits over the years. Currently,
the efuent water generated in the gathering centres are
pumped to a water injection plant or to disposal wells to
ensure non contamination of soil.
CONCLUSION
Today the attitude throughout West Kuwait is one of can
do. Problem solving has been made systematic. Issues
are approached in a systematic, meaningful manner. All
recommendations for improvement are tracked to closure
and the lessons learned are shared amongst all concerned
personnel.
The initiatives undertaken by HSE (WK) Team have delivered
far more than just HSE improvement, a boost has been
given to the leadership, commitment and accountability
which is the basis for the performance and improvement
of any other management system. These qualities have
improved the general management effectiveness at all
levels of leadership. It is improving the overall performance
of the organization. The condence level of employees
has improved. Their problem solving ability has improved
considerably. Trends have been set to accelerate the cultural
and behavioural changes which will mark as the foundation
for all improvements.
ACKNOWLEDGMENTS
Ismail Mataqi, Team Leader , HSE (West Kuwait)
Adivi Bala Srikanth, Sr. Safety Engineer, HSE (WK)
Page 366 Page 365
9
th
ASSE-MEC-2010-49
Negligent EmployeesA Personal Journey
Across 5 Continents

N. Wayne Basson
Enterprise Risk Solutions Group Ltd.

ABSTRACT
Despite improved investigation tools and techniques,
international trends still reect concerns raised since the
early eighties, namely: the limited resources allocated
to High Potential (HIPO) incident investigations. It
appears that there remains a direct quality correlation
determined usually by the actual severity of the
incident, as opposed to the potential severity. Several
organisations proudly record their near miss reporting,
or u/s acts and conditions reporting, behavioural safety
reporting mechanisms etc, yet the quality of reactive and
pro-active investigations have consistently failed to truly
identify the root causes, with corrective actions seldom
providing real solutions to prevent recurrence.
At least half of all (several thousand) Incident
Investigations reviewed in Asia, Pacic Rim, Africa and
South America determine the cause of the incident as
Employee Negligence, with the obvious solution of a)
The employee should be more careful, b) The employee
needs additional safety training, or c) The employee
needs to be sanctioned. Of course none of these in
any way provide any source of comfort with respect
to preventing a similar incident with a potentially more
critical outcome from occurring in the future. The
backward-thinking, reactive organisation will conduct
supercial investigations, treat symptoms, look the
other way and ignore its real problems, and continue
to "work harder, not smarter." Unfortunately, at some
point this approach can lead to a very serious incident,
unnecessary loss of life, wastage of property, a tarnished
reputation and image, damaged morale and in some
cases an organisation can cease to exist.
Most of the organisations sampled were emphatically
clear about their no blame culture. This is usually
quoted right after the Safety First slogan, both of which
are usually disregarded at the rst sign of trouble. This
results in a climate of fear or distrust, since management
says one thing and does another.
Of course we know that we get what we measure. If a
supervisors bonus is linked to a lagging indicator such as
injury rates, then incidents will be forced under the radar,
resulting in minor incidents with serious or catastrophic
consequences not being reported, recorded for trending,
and most signicantly not being adequately investigated
to ensure that proper management system controls can be
implemented/improved.
KEYWORDS
Near-miss, Investigating, KPIs, Enabling reporting, Effective
investigations, High Potential.
1. INTRODUCTION
Despite improved investigation tools and techniques, and
a greater global awareness of Occupational Health and
Safety, international trends still reect concerns raised a
generation ago, namely:
1. The limited attention paid to the need for
effective High Potential (HIPO) incident (near
miss, minor property and / or equipment
damage) and minor injury reporting.
2. And the consequent failure to investigate -
or comprehensively investigate - due to the lack
of awareness regarding future potential.
"Prescription without diagnosis is malpractice,
whether it be in medicine or management"
Karl Albrecht
2. REPORTING
Of the companies reporting their Near Miss statistics,
I found that when subjected to scrutiny, many of these
incidents were usually soft issues (failure to wear PPE)
often generated only to satisfy a management target - and
invariably these incidents were not assessed quantitatively
and were usually deemed to be of insignicant risk and
therefore not investigated.
2.1 INVESTIGATION OUTCOMES
Most of these companies were/are keen to emphasize their
no blame culture and yet, in more than 75% of all the
(thousands) Incident Investigations reviewed in the Middle
East, Asia, Australasia, Africa, USA and South America, I
found that the investigation had determined that the cause
of the incident was due to Employee Negligence (or
similar) with the obvious recommendation
The employee should be more careful.
The employee needs additional safety training.
The employee needs to be sanctioned.
With such punitive ndings is it any wonder then that
organisations struggle to sustain effective near miss/HIPO
reporting?
2.2 MEASURE OUTCOMES
Of course we know that we get what we measure. If a
supervisors bonus is linked to a lagging indicator such as
injury rates, then incidents will be forced under the radar,
resulting in minor incidents with serious or catastrophic
consequences not being reported, recorded for trending,
and most signicantly not being adequately investigated
to ensure that proper management system controls can be
implemented/improved.
Fig 1 Typical Actual Findings
[*1]
2.3 PREFERRED CRITERIA
KPIs need to be based on leading indicators such as-
number of incidents reported.
correct management of incidents.
continuous improvement/quality circles, safety
suggestions reported and implemented etc.
2.4 MOTIVATING & ENABLING REPORTING
The following actions/behaviours are suggested to promote
incident reporting:
Allow employees to report near-misses and, if
necessary, non-injury incidents, anonymously.
Overcome people's fear of reprisal resulting from
reporting.
Educate everyone in the organisation about the
importance of reporting all types of incidents.
Discontinue awards, contests, bonuses, and
promotions which reward people exclusively for not
having incidents, especially accident-type incidents.
Demonstrate the importance of reporting incidents
when they are reported.
Streamline the reporting process to make it as short
and simple as possible user friendly.
Management integrity is vital when faced with
apportioning responsibility w.r.t. incidents i.e. ask not
how the individual failed the company, but rather how
the company may have failed the individual:
Identication of all causes, events, people, equipment,
materials, environmental factors, etc.
Evaluation of common causes, trends, potential losses,
likelihood of recurrence, etc.
Long-term thinking, not short-term xing - in
developing controls, problem-solving, etc.
Showing a balanced concern for employees' health
and safety, environment, production, quality, etc.
Being proactive - acting on information collected to
prevent future incidents, taking corrective actions, etc
2.5 INVESTIGATION PROCESS
Fig 2 Investigation Flowchart
Page 368 Page 367
[*2]
What is missing?
Preliminary reporting barriers / considerations.
Basic HIPO assessment.
Fig 3 Basic Risk Assessment Model [*3]
2.6 SEVERAL PRIOR NEAR MISS INCIDENTS
3. CONCLUSION
We can choose to ignore near misses because we don't
want to commit resources to investigate something that
hasn't cost anything (yet!). This choice is short-sighted
and costly. Near misses are a free opportunity to nd
problems at the no cost stage and prevent them from
hurting us later.
We can even choose to investigate with the goal of
nding someone to blame and punish for the incident.
Another poor choice. When people sense that this is the
real result of investigations, they will not report incidents
unless there's no way to hide them. This allows problems
to fester until they become major, a very costly approach
indeed.
Ideally, we will choose to look at every incident and
identify those with high potential for loss (HIPO) and
professionally and thoroughly investigate to nd the
causes and prevent recurrence. We can show by our
actions that the organisation is intent on xing the
real problems, not just apportioning blame. When
this becomes the culture of a company, its success is
not limited to the area of safety - the entire company
functions more effectively.
REFERENCES AND CITATIONS
[1] Modied from - Bird, Frank E., Jr. and George L.
Germain. Practical Loss Control Leadership.
Revised Edition. Loganville, GA: Det Norske Veritas
(U.S.A.) Inc. 1996.
[2] Partial extract from ERS RCA module
[3] Basic Risk Assessment Model - UK Department for
Transport.
[4] U.S. Chemical Safety and Hazard Investigation
Board BP Texas Oil Renery
9
th
ASSE-MEC-2010-50
The Study of Near Misses and the Knowledge
Management in Mature Industries
Dr. Paolo Bragatto, Dr. Patrizia Agnello, Dr. Silvia Ansaldi, Dr. Paolo Pittigli
ISPESL Italian Institute for Prevention and Safety at Work
ABSTRACT
In mature industries, a terric knowledge about safety is
hidden in regulations, standard codes and good practices, as
well as in proprietary procedures. The study of near misses
may be used to rediscover and to revive this knowledge.
Internal proprietary knowledge and external public domain
knowledge have been discriminated.
For the proprietary knowledge the right pieces of procedures
are searched through a backward path along safety digital
model, which is able to represent all the links between
equipment and safety documents, within the safety
management system.
For the formal external knowledge, a semantic search was
used. Safety matter has been organized in taxonomies used
both to nd the key words in the near miss report and to
match them within the mess of public documents.
KEYWORDS
Near-Misses; Knowledge Reviving; Safety Management
System, Safety Regulation
1. INTRODUCTION
The understanding of accidents and near misses is essential
for an efcient Safety Management System (SMS) in the
process industry. The benets of having a good program for
reporting and analyzing any non conforming events have
been widely demonstrated in many papers [3], [4], [12], [15],
[16], [17], [20].
There are denitely much more near-misses, than severe
accidents. Furthermore near misses are very easy to identify,
to understand, to control.
They are simpler to analyze and to resolve, than real accidents,
where evidences could be obliterated.
In this paper a wider meaning has been assumed for the
word near miss, in order to include every non conforming
event. In such a way it may be early detected any latent
condition, which, given a slight shift in time or distance,
might lead to an accident.
Many enterprises have already systems for internal reporting
dealing with all events, which deviate from normal
conditions and which could have adverse effects on safety,
health, environment or property.
These systems are aimed to learn from experience, but
often they are weak, as the learnt lessons seem to be
forgotten, due the natural personnel turnover. Furthermore
accident experience is useful just in the individual company,
as knowledge sharing is very difcult to be implemented.
In order to overcome these obstacles a new approach is
proposed for mature industries.
In these industries, the most knowledge underlying all
the activities is assumed perfectly dened and formalized.
Accidents very often happen not for lack of knowledge, but
because it has been ignored, or forgotten, or distorted, or
badly applied by the operators.
It is supposed that, in certain type of industry, a structured
and documented Safety Management System (SMS) is
always present. In those establishments where European
major accident legislation is enforced, the SMS is mandatory,
in other cases it is strongly encouraged trough incentives.
The SMS, according to the current regulations and standards,
denes a framework, which organizes the safety issues along
the lifecycle of the plant, including hazard identication and
risk analysis, safety policy and management, operational
procedures, emergency management and periodical safety
audit.
Page 370 Page 369
The rest of the paper is organized as follows. The potential
of retrieving the knowledge sleeping in safety rules and
procedures is discussed in the second chapter.
In the third chapter, a proprietary software tool for the
internal knowledge representation is presented.
In the fourth chapter the search in the external formal
knowledge is discussed. Conclusions are outlined in the
last chapter.
2. NEAR MISSES AND KNOWLEDGE
When there is an event caused by a divergence from
a right procedure, inside an industrial facility, it is a
challenge for the complex knowledge system, which
rules all the activities. In mature industries every technical
issue has been already studied and understood, so that
only few events may happen for a lack of knowledge.
In plant operation, even though hazards are accurately
identied and analyzed and a sophisticated SMS has
been implemented, failures, deviations, losses and other
unexpected events are always usual.
The knowledge stored inside the safety documents
is considerable indeed and may be assumed almost
complete. In case of accident or near miss, it is possible
to nd a specic piece of knowledge, which has been
forgotten or misunderstood or transferred in a bad way,
rather than a real lack of knowledge.
In other words, there is a huge knowledge about safety,
sleeping in dust covered documents. The study of
near misses has the potential to wake up individual
pieces of knowledge and makes them really helpful for
operators.
The SMS may be seen as the system in charge of
managing all the knowledge about the safety of the
individual plant. Even in simpler procedures, a terric
knowledge may be hidden.
2.1 Analysis of a Near Miss
Near misses, failures or deviations provide the operator
with warning before accidents happen. For this reason,
to notify and analyze all weak signals should be
recommended and encouraged.
When a non conforming event is detected, the worker
is usually required to record it, by providing the SMS with
all the information characterizing the event itself. The
report forms vary by rms, but should contain at least
information which answer to the well known four ws,
which are when (occurrence time); where (unit); what
(people, equipment, substance, operation procedure);
why (direct and indirect causes if known).
The reporting activity has to be done directly on the eld
by the worker, who is in charge of lling a report form in.
The next step is to understand whether something about
the reported event may be found in the safety related
documents for retrieving the knowledge contained in
them.
2.2 Internal and External Knowledge
In the process industries, the matter of safety is completely
ruled by a complex system of laws, decrees, regulations,
guidelines, standard codes and good practices, which are
referred in this paper as Regulatory System.
Despite the individual safety management systems, which
hold the site specic knowledge, the safety regulation
holds the general knowledge that has been developed in
decades of industrial experience worldwide.
It has been recognized by a few authors [5] that safety
rules can serve an important function as knowledge
carriers, as they are the result of the knowledge of the
rule-makers.
Both the Safety Regulatory System and the SMS are two
major knowledge carriers about safety.
The two systems, as shown in Table 1, are very different
indeed: the Regulatory System is independent on the
single rm, the SMS, instead, is specic of the rm.
Each type of document that belongs to the Regulatory
System is approved by different authorities and its
amendment needs very long trials to be approved. The
internal rules and procedures, instead, are just approved
by the duty-holder, which is also entitled to change them,
every time it is required.
Table 1. Internal Knowledge vs. External Knowledge
Safety Management System Safety Regulatory System
Ownership of the Knowledge Proprietary Public Domain
Life cycle (typical revision time) 1 year or less 10 years or more
Scope A single rm An entire industry
Based on- Risk Based, Deductive Experience Based, Prescriptive
Structure (reciprocal links) Strong, Hierarchical Weak, Layered, Not conicting
Ratication Internal Approval by the Duty-holder Authorities or Experts Committees
Control Audits Penalties
The present job is aiming to understand how much the
knowledge is usually hidden inside the safety management
documents as well as in safety regulations.
The purpose is to exploit the operational experience, including
accidents, incidents, near misses, losses and failures, to nd
specic parts of knowledge, which have to be renewed,
understood, explained, taught and applied in a better way.
Even though for the internal knowledge, SMS must be
consistent with the external safety, the two systems are
very different each other and, consequently, the problem of
nding and reviving the knowledge about safety has been
divided in two separate issues:
i) Retrieve the documents which are managed by the
SMS and, if needed, update them, according to the
operating experience.
ii) Retrieve knowledge by browsing in the public
Regulatory System, in the technical documentation,
and in the experience repository.
It has to be stressed the documentation may be improved
just in the rst case that is a structured system, resulting
from years of organizational job. It features a low entropy
degree, due the huge work (in thermodynamic sense)
previously done by the safety managers, which wrote the
procedures. Something like a digital roadmap may be
adequate to walk through.
In the second case there is a set of documents, with a much
higher entropy level. Just a little thermodynamic work was
done for layering documents, according their condence
degree (e.g. regulation, standard code, recommended
practice). Advanced knowledge searching tools may be
exploited for faster results.
The study has been split in two separate sections: one
about internal knowledge, Knowledge inside Establishment
(KiE), one about external formal knowledge, Knowledge on
Demand (KoD).
Figure 1. A near-miss may start the search both in proprietary and in public knowledge.
Page 372 Page 371
2.3 KiE and KoD Tools
Two different methods have been developed. The
rst one is aiming to answer questions coming from
non conforming events by nding and updating the
knowledge content in the internal safety documents
and databases.
The second method is expected to answer the same
questions but nding the knowledge content in the
external references, starting from the Regulatory
System.
The peculiarity of the proposed approach consists of
making available, in the same digital format, both of
these two types of knowledge (internal to the SMS and
external toward the regulations), through the digital
equipment representation and, in more details, through
their components.
Each method is implemented by an ad hoc software
tool. For KiE a proprietary software has been developed.
For KoD a powerful search engine, for making higher
level queries and semantic search in the regulation
repository, has been customized.
The search is mainly focused on the component involved
by the non conforming event, and extracts information
and knowledge by all kinds of available documents:
regulations, technical rules and guidelines, good
practices and safety alerts. Of course if the searches in
KiE and KoD domains fail, a deeper study is required.
The general architecture of the proposed solution is
shown in Figure 1.
2.4 Workfow
The two methodologies are distinct. They adopt
different tools and search engines, and may be activated
according to the near miss analysis, not necessarily in
sequence. The workow assumed for analyzing such an
anomaly is the schema illustrated in Figure 2.
The rst issue is to detect a non conforming event,
acquiring all information that characterize the defect or
the failure.
Then a deeper discussion, involving internal and external
knowledge, follows in order to identify the possible steps,
on which further search activities could be performed.
The third phase is to search possible solutions of the
selected problems, by looking at the Regulatory System,
according to and making use of the internal safety system.
After a solution has been chosen, it is implemented.
3. INTERNAL KNOWLEDGE
3.1 Documents in SMS
The search method for extracting knowledge from
the safety management basically consists of backward
running from the single event (failure, near miss or
accident) to the safety system, supported by the plant
representation.
The safety management is mandatory just for Seveso
facilities; but it is highly encouraged for all industries. In
the safety management complex document are required;
but the structure of the documents is dened according
to recognized standard codes too. The most popular
standard for safety management system is OHSAS
18001 [7] Other widely applied good practices for safety
management are ILO/OSH [13], MIL882D [9]. In Italy UNI
10617 [18] and UNI SGSL [19] are widely applied.
The safety management documents include the policy,
the hazard identication and the risk assessment, the
training plan, the competency descriptions, the accident
investigations, the emergency plan.
In Table 2 the safety documents are summarized.
3.2 Safety Digital Model
Safety documents are linked each other and comply with
dened codes or regulations. This inspired the idea to have
a digital safety representation, which could support all
the safety related activities, including the study of near
misses. This idea of a safety digital representation
has been developed step by step. The rst step was the
equipment digital representation, derived by the CAD
system and exploited for hazard identication by pioneer
research as in [21], [9], [22]. The strength of these results
was to use the digital representation of the equipment, as
the backbone of the safety representation.
Table 2. The internal safety documents. The document in bold are considered essential.
Risk Assessment Section
Hazard Ranking And Identication Mond F.E.&T. Index; HAZOP; FMEA
Risk Evaluation Risk Matrix; Event Tree/Fault Tree
Top Event List Of Top Events
Personnel Section
Training Procedure, Plan, Record
Job Description Who Makes What
Operation Section
Operating Procedures Startup, Regular Operation, Shutdown, Emergency
Management Of Change Procedure, Records
Working Permits Procedure, Records
Function Inspection Procedures, Records
Mechanical Integrity Procedures, Records
Control/Revision Section
Audit Procedure, Records
Accident/ Near Miss Procedure, Reports
Emergency Section
Emergency Plan Emergency Plan, Simulation Records
The next step was to have an equipment model without
using CAD models, which are not always available and
are not ruled by recognized standards. As demonstrated
in [6], it was possible exploit plant scrutiny, as required by
hazard identication methods (e.g. Index Methods, FMEA
or HAZOP) to build a simple equipment representation,
suitable for safety representation.
The software tool, named IRIS, for deriving digital
representation from plant scrutiny, is freely downloadable
from the web site www.ispesl.it.
The safety documents have to be stored in digital way,
keeping all the link with the equipment components, in
order to have a complete representation of the safety
system. The major digital documents are risk assessment,
technical procedures and accident reports.
The risk assessment includes the hazard ranking, according
to DOW Fire Explosion Index [2] or MOND Fire explosion
toxicity risk [12], the list of the top events and the sequences
of failures that lead to a top event.
The procedures include both the operation and the
emergency procedures, which are within the emergency
plan. Procedures have individual actions, which are linked
to individual components, devices or instruments, to be
supposed included in the equipment digital representation.
In the accident report the affected pieces of equipment
have to be linked. A synthetic sketch of safety digital
representation is shown in Figure 3.
The link between documents and equipment is implemented
through tags, which have to be inserted inside the safety
documents. The tags point to a single piece of equipment.
It has to be stressed that most documents are short and
inherently easy (e.g. material data sheet and technical
Figure 2. Workow of the Near miss analysis.
Page 374 Page 373
procedures) and the links with equipment component
are quite easy to handle.
A few documents (e.g. risk assessment) may be much
more complex and cannot be quickly examined. To
support the links with equipment they have to be
stored in a smart way. For this purpose they have been
divided into chapters in such a way to have many short
documents, comparable for length and complexity with
the previous ones.
The risk assessment is denitely the most complex
document. Fortunately, the most duty holders adopt
standard formats for the safety documents.
Figure 3. Sketch of the digital safety model.
In case of Seveso establishment, tight formats, with
nested chapters and paragraphs, are provided by
Competent Authorities, as the contents are dened by
the European Directive.
In Italy, the risk assessment format is extremely detailed
and has ve nested levels. The formats provided by Seveso
regulators are perfect a safety digital representation; but
also other formats may be exploited.
In the non Seveso facilities, where the standard codes
provide just basic requirements for risk assessment,
more work has to be done by duty holder, to structure
the risk documents and to tag the individual paragraph,
where a piece of equipment is mentioned.
3.3 Digital Safety Model for Discussing Near
Misses
A software prototype, called NOCE (NOn Conforming
Events analysis), has been developed. It is an application
of the IRIS software, cited above, for the safety digital
representation. Software architecture of NOCE had
been presented by the authors in a couple of previous
paper [1] [7]. In NOCE the analysis of the event may be
done on the light of the safety documentation. The event
is connected to an individual piece of equipment, linked to
an operational procedure.
The component may be referred by some inspection and
emergency procedures too. The component may be also
referred within an event chain leading to a potential
accident in the hazard identication document.
Accident likelihood, if calculated according usual risk
analysis methods, may be also retrieved.
If the event related component has not a direct link to
the safety documents, its parent assembly or unit will be
considered. The system starts looking for the knowledge
hidden inside the risk assessment and management
documents. The single record or sentence in the documents
is automatically highlighted and shown to the user.
The essential result of this continuous trial of reporting any
anomalies, and walks inside the digital plant representation,
is to have the safety documentation with a large number
of notes, or lessons learnt, which should be taken into
account for their periodic review. In Figure 4 an example of
internal document retrieval is shown.
4. EXTERNAL KNOWLEDGE
4.1 System of Safety Rules
The industrial safety, governed by a quite complex system
of rules, basically has a hierarchical structure. The higher
layers of the hierarchy include Directives and Laws, where
founding principles are enunciated.
The intermediate layers include Decrees, Regulations and
technical rules, which translate principles in mandatory
requirements for a specic industry. The lower layers
contain guidelines and standard codes, which individual
duty-holders (or group of dutyholders) comply voluntary
with.
Figure 4. Near-miss report, with referred pieces of safety documents (namely an inspection procedure).
Even though the safety rules, i.e. Regulations and Standard,
are usually perceived as a coercive system, they have a
huge knowledge content. From the knowledge point of
view the higher and intermediate layers hold the basic and
widely shared knowledge. The lower layers, instead, have a
more valuable knowledge content which is the synthesis of
decades of researches, approved by experts.
For many specic issues these documents are also considered
authoritative text.
The quest is arranged in different directions, including: to look
for what the regulation tells about the type of component
(e.g. in terms of safety or maintenance inspections), the type
of dangerous substance; or check best practices, technical
rules and guidelines for nding possible solutions in terms
of adopting different technical measures, other materials.
The purpose of such a search is to nd out those pieces of
knowledge which help to understand better the event and
their causes, and to nd the possible solutions.
4.2 Methodology
The hierarchical structure, used for organizing the standard
and rule documentation, is useful to show the location of a
document, to understand its value (e.g. if it is mandatory)
and the kind of authorities it comes from. For nding and
retrieving the knowledge in such a repository, a semantic
search may be used. The starting point is the identication
of key words in the accident report, which represent the
concepts that address the search in the mess of documents.
These key words are contained into adequately dened
taxonomies.
There are many taxonomies available, but those adopted
take into consideration glossaries and denitions already
content in the ofcial documentation, further to the industrial
sector considered. Safety matter has been organized in the
taxonomies of Machines, People, Materials and Processes.
These taxonomies have been used in a concurrent way, both
to nd automatically the key words in the near miss report
and to match the key words within the public documents.
The taxonomies play a key role in the method proposed
for the semantic search. Indeed, they represent the manner
on which the semantic search develop, moving in the
hierarchical structure from one level to another, or switching
from one taxonomy to another.
The document repository is opportunely organized, it
covers only specic areas of interest, which the taxonomies
are developed on. Furthermore the granularity and the
organization of the documents have to be taken into
account, and depend on the context considered. That
Page 376 Page 375
means that the collection of documents should be done
by occupational safety agencies, which have a wide
and deep knowledge in the sector and therefore may
guarantee that the repository is complete, updated, at
the state of the art. Furthermore, all the documents have
to be in true digital formats. Advanced OCR (Optical
Character Recognition) tools can be used for converting
raster documents, including label in drawings, into
digital formats.
4.3 Adopted technique
Most of the part described in the above section have
been realized by using, in an adequate and efcient way,
some specic tools of document managing and retrieval,
in particular OmniFind Enterprise and Unstructured
Information Management Architecture (UIMA) [11].
The development of some customizations and
applications have been required. Further work around
and alternative strategies have been identied, when
the tools did not match with the expectations. UIMA has
been used for developing analysis engines of documents
for retrieving contents related to taxonomies.
In particular, it has been adopted to extract automatically
key words in the near miss report, as illustrated in Figure
5, where the highlighted key words are not simply
free text, but are referred to the information structure
represented in the taxonomies. In OmniFind Enterprise
[23], concurrent taxonomies, specic for technical
gases, have been dened.
A customized application has been developed in order
to provide the user with tools for browsing into the
public document repository, and accessing through the
hierarchical structures dened by the taxonomies. Moving
along the taxonomy, an automatic search runs for retrieving
all documents relevant to the topic selected. So that, the
search starts from a few key words extracted by the near-
miss report, and follows moving automatically to the key
words in the parent (or relative) nodes. The user has not to
take care about nding out other words.
The possibilities of using different dictionaries and synonym
tools might offer more powerful opportunities for increasing
documents repository, including other languages.
The search may go on through other methodologies in
order to select the appropriate contents. For instance, it
is possible to select element from pre-dened lists, e.g.
possible types of dangers, or to nd a free text, which
should be only the nal step in the search process, when
the range of document has been already limited to a few
documents. Figure 6 illustrates an example of search which
starts by the taxonomy of MACHINES and then activates
other key words (name of substances).
The concurrent taxonomies may be seen as a way to
reconstruct the safety ontology which is in a complex
Knowledge-Space, starting from many simpler knowledge-
spaces. It is something like a tomography where the
ontology is an object in the N-Dimensional Knowledge,
which is reconstructed by means on many taxonomies in
2D planes.
Figure 5. In a near-miss report, an example of automatic extraction of key words.
Figure 6. The search is driven by the taxonomy of MACHINES and then by the other key words.
5. CONCLUSION
Many efforts have been made to develop conceptual models
for reconstructing near misses according to a general accident
theory; but as a consolidated safety knowledge is almost
always available, it is convenient to match it directly.
Some work is anyway required, in order to make it available
for the event discussion.
For internal knowledge the work is required to the safety
manger of the individual facility, to reduce the entropy of
the internal documents, linking documents and equipment,
according to the proposed method.
As the most internal safety documents are aimed to provide
the operators with practical instructions, they cannot contain
all the available knowledge.
The external context is much more generous with knowledge.
It has been improved and updated along many years and
now it is well achievable. To make it available an organized
reference, as described in the previous chapter is essential.
To reduce the entropy in public documents an amount of work
is, anyway, required to the occupational safety agencies.
REFERENCES
[1] Agnello,P Ansaldi,S Bragatto,P Pittiglio,P (2007) The
operational experience and the continuous updating
of the safety report at Seveso establishments Future
Challenges of Accident Investigation 33rd ESReDA
Seminar EC-JRC-IPS
[2] AIChE, (2005) Dow's Fire & Explosion Index Hazard
Classication Guide - Technical manual, AICE, New
York USA
[3] Ashford,N.A. (1997) Industrial safety: The neglected
issue in industrial ecology J. of Cleaner Production 5
(1-2) 115-121
[4] Basso,B. Carpegna,C. Dibitonto,C. (2004)
Reviewing the safety management system
by incident investigation and performance indicators J.
of Loss Prevention 17(3): 225-231
[5] Blakstad,H.C. Rosness,R. Hvden,J. (2009) Revising
rules and reviving knowledge in the Norwegian railway
system Safety, Reliability and Risk Analysis Taylor &
Francis, London.
[6] Bragatto,P. Monti, M. Giannini,F. Ansaldi,S. (2007)
Exploiting process plant digital representation for risk
analysis J. of Loss Prevention in the Process Industry 20
pp. 69-78
Page 1 Page 377
[7] Bragatto,P. Agnello,P. Ansaldi,S. & Pittiglio, P.
(2009) Weak signals of potential accidents
at Seveso establishments Safety, Reliability and
Risk Analysis Taylor & Francis, London
[8] BSI British Standards 2007 Occupational Health
& Safety Management System Requirements
OSHA Series 18001:2007 Bristol UK
[9] Chung,P.W.H. & McCoy,S.A. (2001) Trial of
the HAZID tool for computer-based
HAZOP emulation on the medium-sized industrial
plant, HAZARDS XVI: IChemE Symposium Series
148 pp. 391404
[10] DOD US Department of Defense 2000 MIL-
STD-882D System Safety Program Requirements/
Standard Practice for System Safety Washington
DC USA
[11] Ferrucci,D., Lally,A., (2004), Building an example
application with the Unstructured Information
Management Architecture, IBM System Journal,
43(3), pp.455-475
[12] Hursta,N.W. Young,S Donald,I. Gibson,H.
Muyselaar,A. (1996) Measures of safety
management performance and attitudes to safety
at major hazard sites J. of Loss Prevention 9 (2)
161-172
[13] ICI Imperial Chemical Industries Explosion Hazard
Section (1985) The Mond Index, how to identify,
assess and minimize potential hazards on chemical
plant units. Nortwich (UK)
[14] ILO International Labour Organization 2001,
Guidelines on Occupational Health and Safety
Management Systems (OSH-MS) Geneva CH
[15] Jones,S Kirchsteiger,C Bjerke,W (1999)The
importance of near miss reporting to further
improve safety performance J. of Loss Prevention
12 (1), 59-67
[16] Phimister,J.R. Oktem,U. Kleindorfer,P.R.
Kunreuther,H (2003) Near-Miss Incident
Management in the Chemical Process Industry Risk
Analysis 23 (3) , 445459
[17] Sonnemans, P.J.M. Korvers P.M.W. (2006)
Accidents in the chemical industry: are they
foreseeable J. of Loss Prevention 19 112
[18] UNI Italian Organization for Standardization
1997, UNI 10617 Major hazard process
plants Safety management system
Essential requirements, Milano in Italian
[19] UNI Italian Organization for Standardization
(2001), SGSL guida per un sistema di gestione
della salute e sicurezza sul lavoro, Milano in I
talian
[20] Uth,H.J. Wiese,N. (2004) Central collecting and
evaluating of major accidents and near-miss-
events in the Federal Republic of Germany J. of
Haz. Materials 111, (1-3) 139-145
[21] Venkatasubramanian,V., Zhao,J., & Viswanathan,
V. (2000). Intelligent systems for HAZOP analysis
of complex process plants. Computers & Chem.
Engineering, 24, 22912302.
[22] Zhao,C., Bhushan,M. & Venkatasubramanian,V.
(2005), Phasuite: An automated HAZOP analysis
tool for chemical processes, Process Safety and
Environmental Protection, 83(6 B):509548
http://www-01.ibm.com/software/data/enterprise-
search/omnind-enterprise/.
Please visit AcuTech Consulting Group - Booth 14
Distributors for Saudi Arabia, Kuwait and Bahrain
Hamed Al Qahtani Universal Markets Est.,
P.O. Box 89, Dammam 31411 Kingdom of Saudi Arabia
Tel : +966 3 8442006 Fax: +966 3 8411975
email : [email protected]
HSME_ Dickies Ad:Layout 1 22/12/09 11:15 Page 1
Distributors for Saudi Arabia, Kuwait and Bahrain
Hamed Al Qahtani Universal Markets Est.,
P.O. Box 89, Dammam 31411 Kingdom of Saudi Arabia
Tel : +966 3 8442006 Fax: +966 3 8411975
email : [email protected]
HSME_ Dickies Ad:Layout 1 22/12/09 11:15 Page 1
Page 380 Page 379
ABSTRACT
Near miss incident form base of Heinrichs domino
theory which is free lesson learnt incidents. Reporting
of near miss incidents is an important tool in preventing
accidents and incidents. These are incidents which had
potential but resulted in no injury/ illness, damage,
production loss or harm to company reputation.
An ideal near miss event reporting system includes
voluntary & non-punitive reporting by witnesses. Near
miss reporters are in a position to describe what they
observed about genesis of the event, and the factors that
prevented loss from occurring. The events that caused
the near miss which has high potential are subjected to
root cause analysis to identify the defect in the system
that resulted in the error and factors that may either
amplify or ameliorate the result. Although human error is
commonly an initiating event, a faulty process or system
invariably permits or compounds the harm, and should
be the focus of improvement. The success of near miss
reporting system is sharing of lessons learned.
This paper addresses the various methods being used in
different industries to overcome the barriers in near miss
incidents reporting to enhance the safety factor of an
organization. Importance of feedback on performance,
data collection and analysis and ways to continuously
improve will be addressed in this paper.
KEY WORDS
Near Miss, Lessons Learned, barriers
New Approach to Enhance Near Miss Incident
N. Vasudevan , CSP, B.Sc., B.E., PGDip (Industrial Safety)
Dinesh Kumar Dutta, CSP, B.Sc., B.E., PGDip (Industrial Safety)
9
th
ASSE-MEC-2010-51
1. INTRODUCTION
Modernization and industrialization has led to numerous
challenges which include increasing accidents & incidents.
Numerous incidents occur across industries. These include
personnel accidents, Loss & damage incidents, and Trafc
accidents. The primary objective of any organization should
always be to minimize losses and maximize prots. Incidents
reporting and investigation form a very important tool
for incident prevention. The recommendation generated
and its implementation from incident investigation helps
in preventing similar incidents in future. This can be best
described as a reactive measure from an accident/incident
to prevent similar losses in future. However, Near miss
incidents are free lesson learning opportunity which can
be described as Proactive measure to prevent accidents/
incidents.
Near Miss Incident is an incident which resulted in no injury,
illness, damage, product loss or harm to the company
reputation. The key to learn lesson from a Near Miss Incident
is to properly investigate and implement recommendation
to prevent reoccurrence. Another Important aspect is to
Share the Free Lesson Learned across sites and industries.
Near Miss incidents forms base of incident triangle which
gives glimpses of accident probabilities. Heinrich theory
puts a major incident to 300 near misses, whereas Frank
E. Bird theory puts it to 600 No injury reports to a major
incident.
2. ACCIDENT STATISTICS:
Shown below are two accident pyramids from renowned
study report which highlights the importance of near miss
reporting.

3. FEW TYPICAL EXAMPLES OF NEAR MISS
INCIDENTS:
Employee tripped due to pipeline laid over the platform
grating. There was no injury.
Parked hydraulic crane rolled down, crossed the road
and came to full stop when it hit a re hydrant guard
post
Contractor personnel connected power supply to
stress relieving machine from a welding receptacle in
the process unit caused overload and tripped some
running pumps
Elevator cage of eld elevator over-travelled while
going-up due to upper limit switch did not operate to
600
INCIDENTSWITH NO VISIBLE
INJURYOR DAMAGE
30
PROPERTYDAMAGE
ACCIDENTS
10
MINORINJURIES
1
SERIOUS OR MAJOR
INJURY
SIGNIFICANT ACCIDENT STATISTICS BY FRANK E. BIRD
SUB-STANDARD ACTS
AND CONDITIONS
300
NO INJURY
ACCIDENTS
29
MINOR INJURIES
1
LOST TIME
INJURY
HEINRICH CAUSATION MODEL
stop the elevator.
Pressure Hose getting disconnected without it hitting
/ injuring people working around it
Excursions of processes parameters beyond pre-
established critical control points (from normal
operating conditions/parameters)
Tripping, Activations or Malfunction of Emergency
Shutdowns System (ESD)
Activation of hazard control systems such a safety
protective systems (e.g. Relief valves, blow-down
system, xed water- spray systems, and HALON
systems).
Failure or malfunction of control/safety instrumentation
or equipment provided in the process.
Failure of safety system or process equipment on
demand. (Stand-by pump did not operate when
switched on)
Failure of safety system or process equipment while
running (Running pump failed or stopped)
The above few examples occur in most of industries but
many times goes unnoticed/reported.
4. BARRIERS AND WAYS TO OVERCOME
BARRIERS IN NEARMISS REPORTING:
Many organizations across world face challenge of near
miss reporting. Many near miss incidents go unnoticed/not
reported resulting in a major incident at a later date.
Let us look into various possible barriers resulting in not
reporting of near misses in various industries and ways to
overcome.
4.1 Lack of Understanding-About Near Miss
Many near miss incidents go unnoticed and not reported
due to lack of understanding about near miss amongst the
employees. Employees are not well informed about the
near miss reporting process. Some employees think that
near miss reporting is HS&E personnel area of activity rather
a line function.
Communicate with employees with examples which have
happened in the past. This can be achieved during training
program, conducting special campaigns, by displaying
posters & iers, discussion during SH&E meetings. Some
companies have included Near Miss reporting as part of
Orientation training for new employees.
Near Miss Recall technique is another method by which
Page 382 Page 381
HSE professional interact with eld personnel including
contract personnel and discuss events and try to recall
incidents happened in recent past but not reported.
4.2 Lack of Knowledge of Reporting System:
Sometimes contractor employees are unaware of
incident reporting system at the facility. This could be
due to lack training, communication to contractors or
lack of accessibility to Near miss report forms. Contractor
workforce at times have language barrier.
Hence option of reporting in multilingual forms will help
address such concern and initial orientation apart from
regular training can enhance near miss reporting.
4.3 Fear of Action by Management:
Fear of disciplinary action on employees due to near
miss reporting is a major factor in not reporting of near
miss. Employees dont report fearing action on them or
colleagues due to report.
Though, it is a well known fact that most of the
incident happen because of management weakness.
Hence action against employees who report near miss
is like treating symptoms rather address root cause.
Management commitment will help to overcome such
fears. Management should implement a policy not to
punish employees rather encourage them to report near
miss.
4.4 Lack of Appreciation:
Near miss reporting goes unnoticed by management.
Employees feel discouraged about lack of management
interest in report and tend to stop reporting near miss.
Appreciation by immediate supervisor and managers
will motivate employees to report near miss. Many
corporate have started rewarding near miss with high
potential with appreciation certicates and gifts. Many
a times a word of appreciation works wonders.
4.5 Concern about Reputation and Personnel
Record
Employees fear that reporting near miss will affect their
record and appraisal as they feel that these are negative
events.
Managers and supervisor should educate them and
appreciate their effort in their performance reporting.
CAUTION: Many times appreciation in personal appraisal
lead to false report. This should be discouraged.
4.6 Fault Finding Attitude
Managers and supervisors at times nd fault with
employees action once a near miss is reported. These
tend to scare employees in future reporting.
Instead managers & supervisor should focus on reasons
behind the employees action and correct these issues
which will further motivate all employees to report more
near misses.
4.7 Lack of Management Commitment and
Follow Up
This is probably one of major cause in decreasing trend
in near miss reporting. Many organizations start near
miss reporting process actively. However inaction on
part of management to follow up near miss reports
and implement recommendation lead to employees
frustration. Such scenarios lead to reduction in near miss
reporting and ultimately missing of crucial near miss
which nally leads to a major incident.
A proper investigation of near miss reported and tracking
of recommendation to closure will keep interest of
employees in the process and sustain the commitment of
employees to report in future.
4.8 Lack of Feedback:
Lack of Positive feedback to employees on the near miss
reported and action initiated to prevent occurrence of
incident is a reason for concern.
Feedback on action and following it with closure of
recommendation will encourage the employee and his
peer to further enhance near miss reporting.
4.9 Effort Required To Report
Complicated reporting system discourages employees
to own and implement the process. Near miss reporting
process should be made as simple as possible. Each
employee has a set of his priorities to meet his deadlines
and activities. A complicated reporting procedure will
tend to make employee avoid the process.
Keep the reporting form simple.
4.10 Fear of Embarrassment In Front of Others:
Human in general tend to get embarrassed to admit mistake
in front of other. This leads to hidden near miss incidents
which could have resulted in an incident.
By keeping name as an optional requirement will overcome
this problem.
The above are few barriers experienced in the past in
industries and methods to overcome such barriers.
5. PATH FORWARD AND CONCLUSION:
Path forward is difcult and challenging but achievable.
Foremost challenge of moving forward in any program is
management commitment. Managers need to be visibly
committed to process and all employees need to be involved
and focused. Dene clearly the goal and educate employees.
System should be user friendly and easily accessible and
understood to all employees, especially in the industries
which employs multi lingual work force.
Appreciate good near miss reporting and give feedback to
employees to ensure high level of motivation. Measure the
performance and reward appropriately. Periodic refresher
training with site specic examples helps reinforce the process.
Investigate all near miss incident report and implement
recommendation to sustain employee interest.
REMEMBER: MINIMISING LOSSES MEANS
MAXIMISING PROFITS
LET US STRIVE TO AVOID INCIDENTS
REPORT NEARMISS
REFERENCES
1. Practical loss control leadership, Frank Bird Jr,
2. www.aiche.org
Page 384 Page 383
ABSTRACT
Preventive Maintenance (PM) is performed for its know
advantage in improving the integrity and reliability of
equipment. Such improvement is considered to be
very helpful tool in guaranteeing safety, and that is
why it is performed on critical equipment. Valves are
signicant elements for both operation purposes as well
as safety. Valves PM is essential from safety perspective
as it enhances their integrity, which results in avoiding
emergency shutdown due to valve failures or leaks that
can be a production loss or a potential hazard.
1. INTRODUCTION
Any equipment is subject to an intrinsic degradation that
needs to be rectied and its reliability must be maintained
in order to sustain its integrity. Corrective maintenance,
better referred as REPAIR, involves restoring equipment
to a state in which they can perform the required
functions. On the contrary, preventive maintenance
(PM) is a periodical specic type of maintenance aimed
to keep any equipment in a good condition and extend
its life. PM includes steps like checks, lubrication,
cleaning, adjusting and replacing minor parts, and
overall inspections within a specied interval.
Enhancing Safety Thru Preventive Maintenance
Mousa Rashed Al-Harbi, Valves Engineering Specialist
9
th
ASSE-MEC-2010-52
More complicated PM procedures are sometimes specied
due to the multiplicity of potential causes of failure in
performance of the various components
2. SAFETY URGENCY
PM is usually performed for the foreseen benets such as
conserving the energy and extending life of the equipment,
and also avoiding any impromptu failures that can lead
to emergency shutdowns. Moreover, if we look up the
meaning of the maintenance in any of the contemporary
dictionaries, we will nd denitions that talk about upkeep
of equipment, or extending the life of a machine, yet none
mentioned anything that consider the enhancement of
safety.
On the other hand, the safety aspect of maintenance is
widely considered amongst some of the industrial facilities.
PM is a perfect safety preventative measure i.e., during PM,
the equipment integrity is checked, and all failures that can
lead to disaster can be detected prior to occurrence. Also,
the integrity of equipment to respond to an incident can be
ascertained. PM is a very helpful tool for safety assurances,
especially for equipment that are located in re hazardous
zone (space around equipment handling hazardous
services) inside operating facility. In critical/hazardous
services (such as auto-ignition services, combustible gas or
liquid, ammable liquid or any potentially toxic materials),
equipment must be well maintained such that the source
of re or hazardous release is curbed, thus the need for PM
becomes a necessity. Lack of PM can impose a safety threat.
More than 70% of the unplanned shutdowns are caused
by the safety concerns in an effort to correct a potentially
unsafe status of equipment or a system.

Valves inside the facilities are required to be re-safe so that
they can be reliable under re for continuous 30 min. duration
to allow for evacuation in case of disaster
2.1 Exigency of Valves PM
Equipment such as valves has dual roles that are needed for
operation purposes as well as for safety assurances. Valves
are vital elements in any system that processes a ow of
uids and they are imperative for safety of the whole system.
The safety urge for such equipment can be seen in limiting
the spread of disastrous re, or lethal gaseous leaks such
as H2S or others. Valves primary safety need is perceptible
to fully isolate feedlines in a timely manner in case of pipe
rupture or to prevent re propagation. In most of the Oil and
Gas facilities, it is required to conduct PM for the emergency
isolation valves (EIV) every three months, since such valves
are considered to be the primary isolation of re hazardous
equipment and they are aimed, in an event of re, rupture, or
loss of containment, to go automatically to fail-safe position
to stop the release of ammable or combustible liquids,
combustible gas, or potentially toxic material.
Moreover, safety of operators can be enhanced by assuring
the reliability of the valve when attempting to operate the
valve. Valves failures are imminent during their operation
which imposes a safety concern on personnel who deals
with such equipment. Valves sometime require operators or
craftsmans intervention for on-line servicing which can put
forward safety jeopardy if its integrity is not assured.
Lack of valves maintenance can entail safety burdens. I
was involved in an investigation of several incidents that
resulted in an unplanned shutdown of a hydro-cracker plant
for around two weeks just to repair the externally leaking
valves in an auto-ignition service which was responsible for
starting spontaneous res at the valve packing areas which
could have led to a disaster have the valves not corrected.
The primary cause of those failures was found to be the
lack of PM for 9 years, which resulted in worn out packing
causing external leaks. Valves are very prone to external leaks
around the stem areas, since stems moves from the outside
atmosphere to the inside media environment, it needs to
be maintained periodically and the packing materials along
with the stem surface conditions shall be re-furbished
occasionally. In services, where hydrogen sulde exists,
external leaks are lethal, and it was reported in different
places to be the cause of a number of fatalities.
In Pipeline services, the biggest challenge is the retrieval of
the scraper (poly pig) at the receiver trap which requires the
main line isolation valve to be fully reliable in providing zero
leakage during such operation.
2.2 Pertinent PM Risks
Valves reliability must be maintained at all times.
In contrary, PM has adversary consequences if not performed
properly since the valves PM is usually performed under line
pressure and temperature. Around the industry, it is clear
that there is a strong correlation between maintenance and
safety incidents. Many risks can be faced when performing
PM such as res, gas release, leaks and loose of pressurized
components. Such tasks require well detailed procedures
and very skillful technicians in order to insure the correct
performance and to avoid safety hazards associated with
performing PM on live lines. Most of industrial companies
have special training sessions for conducting valves PM such
that incidents are prevented, and safety can be preserved.
3. CONCLUSION
PM is usually performed to preserve the integrity of
equipment and extend the service life as well. Also, PM has
an additional value which is assuring safety which shall be
considered. Valves PM is essential from a safety point of
view as it improves the integrity of an important equipment
and surely enhances the safety of the whole system.
REFERENCES
Saudi Aramco Standards
Page 386 Page 385
ABSTRACT
Enhanced Oil Recovery (EOR) methods are operations
undertaken to produce remaining oil reserves from elds
which have been considerably depleted by previous
exploitation.
EOR schemes by their nature are expensive and highly
risky. Withdrawal of the remaining petroleum under
EOR operations encounters certain difculties as with
EOR methods it is necessary to treat each well in a
different way. Gas injection is one of the economically
viable methods in EOR projects. All gas injection wells are
specially treated to meet special safety and operational
standards. This paper will elaborate the major challenges
associated with operation of these projects.
KEYWORDS
Enhanced Oil Recovery, Gas Injection, Well Integrity
1. INTRODUCTION
Injection of gaseous working agents into a hydrocarbon
reservoir to displace residual oil in the most common
enhanced oil recovery method in use today; Gases such
as carbon dioxide, natural gas, or nitrogen are injected
into the reservoir[4]. EOR operations encounter certain
difculties as with EOR methods it is necessary to study
the integrity of each well in different way. The outcome
of an EOR project will be subject to some degree
of uncertainty because it is not possible to quantify
deterministically all the detailed interactions between the
chosen EOR technique and the reservoir and facilities.
Well integrity is an integral part of risk assessment,
health, safety, and environment and quality-assurance
programs in the EOR methods. Well integrity is dened
Challenges of Well Integrity Management in Enhanced
Oil Recovery Projects Gas Injection Process (CO2)
Mohammad Amin Shoushtari, Improved Oil Recovery Research, Tehran
9
th
ASSE-MEC-2010-53
by Norwegian Standards; NORSOK D-010, as application
of technical, operational and organizational solutions to
reduce risk of uncontrolled release of formation uids
throughout the life cycle of a well.
2. TECHNOLOGICAL PRINCIPLES OF GAS
INJECTION CO2
Gases such as carbon dioxide, natural gas, or nitrogen are
injected through a number of injection wells uniformly
distributed over the area of the eld and displaces the
residual hydrocarbon towards the surrounding producing
wells within safety and environmental regulations. Thus
each injection well is a centre of higher pressure in the
injection eld around it. Such injection elds with four to
ten producing wells each may be regarded as separate units
in the secondary production of the reservoir. In carrying out
this operation it must be remembered that the difference
between the viscosity of the injected working agent and
that of the formation uid may be great.
As far as possible, the wells selected for CO2 injection
should meet the following requirements:
1. reliable insulation of the productive formation in the
well from all the porous media above it;
2. hermetic sealing of the well casing to preclude
leakage and loss of working agent;
3. Good injectivity.
All injection wells must be specially treated to meet this
last requirement including cleaning out the sand plugs,
parafn and dirt, shooting additional perforations in the
lter, formation fracturing, acidizing and the like.
3. DEFINITION OF WELL INTEGRITY
Well integrity is dened by Norwegian Standards;
NORSOK D-010, as application of technical, operational and
organizational solutions to reduce risk of uncontrolled release
of formation uids throughout the life cycle of a well. Well
Integrity Management (WIM) is an important part of health,
safety, and environment and quality-assurance programs
in the petroleum industry. WIM system consisting of three
factors: preventing leaks, identifying leaks, and stopping
leaks [3].
4. CONSEQUENCE OF CO2 INJECTION ON
WELL INTEGRITY
4.1 Potential Well Bore Leakage Paths
Possible leakage paths through an abandoned well are shown
in gure1.It can be seen from the gure that leakage could
occur due to poorly cemented casing, casing failure and
improper abandonment. Cement that has properly set has
very low permeability. No signicant ow of CO2 can occur
unless the cement has degraded or not set properly. Casing
failure on the other hand could occur due to corrosion,
erosion or improper design.
Possible leakage pathways for CO2 injection wells are the
same as in gure 1 except that there is no cement plug in
place. In addition, as the pressure inside the well bore is
higher than the pressure outside, preferential ow path will
be in opposite direction.
4.2 Effects on Casing
Acidic environments can induce corrosion in different types of
steel. Corrosion of equipment in injection wells will increase,
particularly in the presence of CO2 [2].
4.3 Effects on Cement
Cement containing Ca(OH)2 will react with the CO2 in the
air or water phase. These reactions will create some cracks
inside cement that will result in gas leakage.
5. HAZARDS OF CO2 BLOWOUTS
Local sudden expansion of CO2 (for instance, when
it blowouts) is accompanied by cooling which causes
additional stresses in the walls of the cemented casing. In
view of these special features of CO2 wells considerable
attention must be given to the construction and to the
calculation of the casing strength [1].
Moreover, blowouts of CO2 wells are particularly hazardous
because of the tremendous expansion that can occur when
containment is lost. Near the critical point, even small
pressure drops can produce large volume increases, and
CO2 wells often operate with part of the well near the CO2
critical point.
Therefore, CO2 wells are different from other wells, which
can lead to behavior not expected by eld personnel. With
the rapid expansion of CO2, correspondingly rapid cooling
of the well bore and uid stream occurs. Cooling can reach
the point at which solid dry-ice particles form, providing an
additional hazard at the wellhead. After exiting the wellhead,
the cold CO2 condenses water from atmosphere, creating
a cloud of low visibility and water ice. After a blowout, the
uid accelerates until the pressure drop in the well matches
the pressure drop between the reservoir and atmosphere
pressure, limited by the sonic velocity. The sonic velocity is
the maximum speed that uids may attain.
Figure 1: Possible leakage pathways through an
abandoned WELL [5]
Page 388 Page 387
6. CONCLUSIONS
As a result of the subjects discussed above, the following
conclusions could be drawn:
1. We must ensure that no priority is higher than the
protection of the environment and the safety of
our workforce throughout the development of
CO2 injection projects,
2. Well Integrity Management (WIM) is an important
part of health, safety, and environment and quality-
assurance programs in the petroleum industry,
3. Well integrity management system consisting of
three factors: preventing leaks, identifying leaks,
and stopping leaks.
7. TECHNICAL RECOMMENDATIONS
In order to detect negative effecters of CO2 injection in
good time, and take remedial measures, it is necessary
from very start of the operation to carefully observe
the behavior of all the injection wells and to apply
appropriate measures at the rst signs of gas leakage.
These measures may be:
1. Regulation of injections (and pressure) in the
injection wells in directions where a breakthrough
has been observed, which in some instances may
require temporary shutting-in of the wells;
2. Reduction of the volume of CO2 injected, right
up to converting injection wells to production and
vice-versa.
ACKNOWLEDGMENTS
Authors would like to express their gratitude to the
management of Improved Oil Recovery (IOR) Research
Institute, Tehran, specially the Gas and Gas Condensate
Recovery (GGCR) Group, to our supervisor Dr. Shahab
Gerami and colleagues Habib Valiollahi, Mohsen
Ghanavati, and Amir Taheri.
REFERENCES
[1] Dennis Denny, Numerical Modeling of Pressure
and Temperature Proles Including Phase
Transitions in Carbon Dioxide Wells, SPE 115946,
Denver, 21-24 September 2008
Management of Change
Mahmoud H. Tamer
9
th
ASSE-MEC-2010-54
ABSTRACT
All process plants are designed and operated to be safe, yet
accidents continue to occur. In every case, the fundamental
reason for the accident is that someone, somewhere lost
control of the operation, i.e., they allowed operating conditions
to deviate beyond their safe range. Hence, Management of
Change (MOC) is the foundation of all safety and accident
prevention programs. If change is properly controlled, accidents
will not happen.
1. FUNDAMENTAL ISSUES
Process Safety is a management system that helps achieving
a safe operation by dening safe operating limits, and then
making sure that the process stays within those limits.
Defning Control
Attaining Control
All process plants are designed and operated to be safe, yet
accidents continue to occur because operating conditions
deviated beyond their safe range.
MOC is the foundation of all safety and accident prevention
programs; if change is properly controlled, accidents will not
happen.
2. WHAT IS MOC?
MOC is a documented process to ensure that safeguards are
in place to eliminate the possibility of introducing hazards
because of changes to operations, process parameters, control
parameters, chemicals, plants, facilities and organizations.
MOC is a process to ensure that changes that would take
operating conditions outside the safe range are properly
evaluated, and that appropriate safeguards are implemented.
3. WHAT IS THE PURPOSE OF MOC?
The purpose of MOC is to avoid surprises by:
Evaluating Change
Authorizing Change
Communicating Change
Documenting Change
4. BENEFITS OF MOC?
Improving the companys protability and occupational health
of the work force through:
Evaluating and controlling unseen hazards
Systematically expediting the change
Involving all concerned individuals and programs
Etc.
5. KINDS OF MOC?
5.1 Pro-active
Initiated
5.2 Reactive
Overt
Covert
[2] Preben Randhol et al., Ensuring Well Integrity in
Connection with CO2 injection, Sinteff Petroleum
Research, Norway, 2007
[3] Gunnar Andersen, Well Integrity Management
and Protability, JPT, July 2006
[4] Schlumberger Company, Middle East & Asia
Reservoir Review, Dubai, 2009
[5] Scherer et al., 2005; reproduced from Environmental
Geology, by permission of Springer Verlag.
Page 390 Page 389
5.2.1 Overt Change
Examples of response to overt change:
A pipe tter suggests that a certain nozzle be
made of a higher grade of steel because he notes
that currently there is excessive corrosion, and that
it has to be repaired frequently.
o Failure of the nozzle could lead to a release of
hazardous chemicals.
An operator proposes a new way of starting up a
compressor because the way in which it is currently
done frequently causes electrical surges that upset
operations in other parts of the facility.
5.2.2 Covert Change
A Covert Change is one that is not anticipated. With
regard to the corroding vessel, if no one knew that
corrosion was taking place until the vessel failed
catastrophically, then the change was covert.

No warning that a catastrophic incident is about to
happen until it announces itself - possibly in the form
of a serious accident.
Not possible to put safeguards in place because the
accident is fundamentally unpredictable.
5.2.3 Examples where MOC should be used
Any change
That may impact building modications
To the interface between existing and new facilities
Impacting the environment
Impacting the safety of personnel or the
community
6. CHANGE VS REPLACEMENT IN
KIND
An important concept that everyone must understand is
the difference between change and replacement in
kind.
In-kind
Not in kind
7. THE CHANGE PROCESS

8. MOC VS. REPLACEMENT-IN-KIND
APPLICATIONS
Examples of replacement-in-kind include:
Raise temperature within safe operating window
Repairing equipment or piping
Replacing equipment or piping meeting the same
specication as the original
Painting or coating using the same or equivalent
materials
Update references in procedures
9. TYPE OF CHANGES
Critical
Emergency
Small
Large
Temporary
Infrequent repeat
Organizational
Procedural
Instrumentation
Design
10. IMPACT ANALYSIS
Once it has been documented, its possible to assess the
impact of the change on people and the environment.
These concerns are normally grouped as follows:
Safety concerns: safety equipment impacts, ladders,
and access to facilities
Industrial hygiene concerns: sanitary sewers, lighting,
noise, etc.
Environmental concerns: toxicity, potential for releases,
etc.
Process safety concerns: assessed using a process
hazards analysis
Items 1 and 2 can often be addressed with a checklist,
but items 3 and 4 usually require a more detailed risk
assessment.

11. PROGRAM STRUCTURE
Page 1 Page 391
12. HOLISTIC APPROACH
13. MOC PROGRAM
Any MOC program should incorporate the following
four elements:
1. Dene the safe operating range for key variables
such as reactor temperatures, vessel pressures,
tank levels, and materials of construction.
2. Make sure that all affected personnel know what
these values are.
3. Train plant personnel to respond correctly should
conditions deviate outside this safe range.
4. Ensure that any decision to intentionally move
operating conditions outside the current safe
range is properly evaluated, and that additional
safeguards are installed as needed.
14. CONCLUSIONS
When designing an MOC system it is critical that
it reects the way in which people actually work
and interact with one another. In particular, the
system should recognize that informal discussions
and conversations are a feature of virtually all
aspects of change management, and that these
informal communications should be encouraged
and, where possible, recorded.
There must be a sustained management
commitment to the management of change
program since this may require a change in culture
within many organizations.
Branches:
Riyadh Sales Ofce:
Tel: 01 477 8297, Fax: 01 292 0472
E-mail: [email protected]
Yanbu Sales Ofce
Tel: 04 322 7346, Fax: 04 398 1069
Jeddah Sales Ofce
Tel: 02 614 0042, Fax: 02 657 3286
Jubail Sales Ofce
Tel: 03 263 4792, Fax: 03 362 4792
P. O. Box 3169, Al Khobar 31952,
Kingdom of Saudi Arabia
Tel: +966 3 8121066 Fax: +966 3 8122253
E-mail: [email protected] www.saudileather.com
Comfortable footwear for tough jobs!
Made in Saudi Arabia
Since 1982
All the safety footwear conforms to
EN ISO 20345:2004 & ASTM F 2413-05
Manufacturers of industrial safety
military & men casual footwear.
Light & exible. Sold in Middle
East, Gulf and North Africa.
Made to International Standards.
Page 394 Page 393
ABSTRACT
Process safety is about controlling risk of failures and
errors; controlling risk is primarily about reducing the
risk of human error. All elements of Risk-Based Process
Safety (RBPS) and alternative standards for process
safety (such as US OSHAs standard for Process Safety
Management [PSM] or ACCs Process Safety Code
[PSC]) have many elements, and each of these in turn
helps to reduce the chance of human error or else helps
to limit the impact of human error. But each process
safety standard has some weakness in the control of
human error.
This paper outlines a comprehensive process safety
element on Human Factors and compares the sub-
elements for human factors control with the existing
elements of RBPS, PSC, and PSM. It describes what
belongs in each sub-element of Human Factors and
explains the intent, content, and the benet of each sub-
element. The paper also presents examples of where
Human Factors sub-elements have been properly and
improperly implemented and discusses the problems
faced during implementation. Selected examples
of industry practices for human factors control are
provided.
Human Error Fundamentals
All accidents (or nearly all, if you consider that there
are some natural phenomena that we either cannot
guard against of choose not to guard against) result
from human error. This is because humans govern and
accomplish all of the activities necessary to control the
risk of accidents, including:
Designing of a process
Engineering of a process
Human Factors Elements Missing from
Process Safety Management (PSM)
William Bridges
Process Improvement Institute, Inc. (PII)
9
th
ASSE-MEC-2010-55
Specication of the process components
Receving and installation
Commissioning
Operation of the process
Maintenance, inspection and repair of the process
Troubleshooting and shut down of the process
Prediction of safeguards necessary and sustaining
these safeguards for the life of the process
at the BP Texas City Renery in March 2005. The human
factor deciencies included lack of control of worker fatigue,
poor human-system-interface design, poor communication
by radio/phone, and poor (no) communication between
workers at shift handover. The CSB cited similar issues from
many other accidents and has urged industry and the US
OSHA (the regulator) to pay much more attention to human
factors. As a result, the US OSHA National Emphasis Program
for Reneries recently included human factors as one of the
12 core elements it reviewed in detail across many of the 148
oil reneries in the USA.
Poor human factors leading to accidents is not a new
concept. Nearly all (or all, from a more complete perspective)
of the causes and root causes of major accidents in the past
30 years been the result of poor control of human factors.
This has been cited in many root causes analysis reports and
papers concerning these major accidents.
Denitions for Use in This Paper
This paper will use the term Human Error to mean the errors
that are made during direct interface or direct inuence of
the process.
Human Factors are those aspects of the process and related
systems that make it more likely for the human to make a
mistake that in turn causes or could cause a deviation in the
process or could in some indirect way lead to the increased
probability of an accidental loss.
Management systems are the administrative controls
an organization puts in place to manage the people and
workow related to the process under consideration.
Types of Human Error
In simplest terms, there are only two types of human error:
Errors of Omission (someone skips a required or necessary
step) and Errors of Commission (someone performs the
step wrong). But in addition, these errors occur either
inadvertently or they occur because the worker believes
his or her way is a better way (intentional error, but not
intentional harm). Intentional errors can usually be thought
of an errors in judgment, and some think of these as due
to lack of awareness of the risk, but in actual practice,
the worker who commits an intentional error is well aware
of the risk, but they instead believe they know a better to
accomplish a task or they believe there are already too many
layers of protection (so bypassing one layer will not cause
any harm).
Regardless of type or category of human error, the
organization can and should exert considerable control of
the errors.
Relationship of Control of Human Error to Control of
Risk from an Activity of Process
A process is a combination of the utilities and raw materials
and actions of human (direct action and those who program
the process to accomplish automatic functions). If anything
goes wrong with these Inputs, or if there are basic design
aws or basic fabrication aws in the process, then the
outputs will not be what we desire. The output we want is
acceptable (or high) production rates at acceptable or higher
quality factors with no harm to the humans (long term or
short term) and with no harm to the environment and with
acceptable (or higher) life of our process components.
The negative outcomes resulting from the humans failing
to control the raw material quality, failing to control the
utility levels consistently, making errors directly related to
the operation of the process, or making errors in the care
of the process (such as maintenance) will result in lower
production, lower quality, higher number and severity of
safety-related accidents, and more negative impact on the
environment. The potential (probability) of the negative
outcomes is collectively referred to as business risk more
precisely, the risk is a product of the likelihood of one or
more of these negative outcomes and the severity of each
outcome.
A critically important concept is therefore:
99% of accidental los s es (except for
natural dis as ters ) begin with a human
error (s upported by data from more than 1500
inves tigations )
R oot caus es of accidents are management
s ys tem weaknes s es
(Center for Chemical Proces s S afety, American Ins titute
for Chemical E ngineers , Guidelines for Inves tigating
Chemical Proces s Incidents , 2003) OSHA agrees
Weak Management Systems Human Error Human Error Accidents Accidents
Further, humans inuence other humans in the process, so
that not only do humans cause accidentals (unintentionally)
by errors they make directly related to the process itself,
but they create deciencies in the design and implement
management systems (each of which contains authorities,
accountabilities, procedures, feedback, proof documents,
continual improvement provisions, etc.) that ultimately
govern the error rate of the humans directly contacting or
directly inuencing the process.
Recent major accidents have highlighted the need for
increased focus on Human Factors. The US Chemical
Safety Board (CSB) cited human factor deciencies as
one of the main contributors of the catastrophic accident
Page 396 Page 395
In order to sustainably control the risk of a complex
process (such as an oil/gas operation, renery, chemical
plant, steel manufacturing, automobile manufacturing,
aircraft manufacturing, etc.), the organization must:
Understand the Risk This involves predicting
problems; which in turn includes predicting the risk
of possible accident/loss scenarios and establish the
appropriate design and the right layers of protection to
control risk to a tolerable level
Implement Management Systems to Control
Risk Factors Day-to-Day This involves maintaining
the established layers of protection and controlling
the original design and changes to the design using
integrated management systems
Analyze Actual Problems and Determine
Weaknesses in the System This involves identifying
weaknesses in designs and management systems and
weaknesses in our risk understanding through root cause
analysis of actual problems (losses and near-losses).

Process Improvement Institute, Inc. (2004-2010)
Management systems control the interaction of people
with each other and with processes. They are the high
level procedures we use to control major activities like
management of change, writing operating procedures,
training of employees, evaluating tness for duty, etc. If
management systems are weak, then layers of protection
will fail and accidents will happen.
To reiterate, accidents are caused by human error; and
Process Safety Management (PSM) in general is focused
on maintaining these human errors at a tolerable level:
All accidents happen due to errors made by humans;
including premature failure of equipment. We
put in place a myriad of management systems to
control these human errors and to limit their impact
on safety, environment, and quality/production.
When these management systems have weaknesses,
near misses occur.
When enough near misses occur, accidents/losses
occur.
Observed Lower Limits of Human Errors and Typical
Ways to Reduce Human Error
With excellent management systems and excellent
implementation of management systems, we can begin
to approach the lower limits that have been observed
for human error. The table below shows some of
these observed lower limits of human error rates that
were derived by watching employees in many different
process and sites perform tasks. The sites had excellent
management systems and excellent implementation of
these management systems. The table also includes
some selected improvements that are possible. Most
chemical-industry sites have error rates well above these
lower limits.
As shown in the table just mentioned, the nominal human
error rates can be reduced or increased based on

experience), and stress factors (personal, shift schedules,
response time pressure, severity or magnitude of safety
condition).
Examples of Selected Human Factors Deciencies
Below are examples of the more common human factor
deciencies. These will help illustrate the role of human
factor deciencies in the causing of accidents and losses.
Procedures are decient This is the most prevalent
problem in process industries since procedures have
not traditionally been developed from the perspective
of optimizing human factors; instead, procedures have
been traditionally developed to meet a compliance
requirement to have written procedures. Examples of
procedure deciencies include:
o Incorrect/incomplete/nonexistent (most procedures
we have audited have been only 70-85% accurate
the inaccuracies include missing critical steps,
steps as written are not what needs to be done, or
the steps are out of sequence)
o No/misplaced warnings (for a example, a warning
should Never contain the action to take; it should
instead emphasize the action to take)
o Poor format (crowded text or no line spacing or
complicated line numbering can lead to increases
in errors; there are about a dozen rules related to
how to properly format a procedure to optimize
human factors)
o Inappropriate language (written in engineering
language rather than operator or technician
language)
Miscommunication between workers How much
attention has your company given to ensuring that
appropriate shift overlap occurs? Do you ensure that
verbal instructions are clearly understood? Do you
provide means to compensate for noise interference
of communication? Do you ensure that commands/
instructions are always repeated back? Do you require
the workers to use the same jargon and is the jargon
written down?
Inadequate training of workers Has hands-on
training been sufcient? Do workers understand what
to do when mistakes happen or when operating limits
are exceeded? Other typical deciencies related to
training:
o Workers have no mental model(s)
o Workers have no/rare practice of critical tasks
Motivation or leadership lacking Do workers
perceive conicting interests from management?
For instance, do workers walk on pipe-racks when
management is not around (rather than go down the
ladder, move the ladder, go back up the ladder)?
Human-machine interface needs improvement
Have you performed a human factor engineering
or hardware interface evaluation of your processes
and control rooms? Are components clearly labeled?
Is it easy to select the right device or component?
Do the components or displays violate norms? Are
feedbacks clear and timely? Do workers need to
jumper/bypass interlocks often? Equipment, routes,
etc., are inadequately labeled (includes color coding,
tags, numbers, numbering system, etc.).
o What would you do if you saw this sign at the T
in a hallway and if your life depends on taking the
right action immediately?

o What would you do if you saw this sign at the
door of a building and if your life depends on
taking the right action immediately?

worker-related environmental factors (quality of displays,
control layout and clarity, control area environment,
procedures, access), personnel factors (training,
E ME R GE NC Y
E XI T
KEEP LEFT
Page 398 Page 397
o Equipment is poorly designed for human use
If it is difcult for the mechanic to get to the
last grease port under a gearbox, will they go
to the trouble (knowing that no-one will notice
if they just skip that port)? Other examples of
poor equipment interface designs:

o Labeling is confusing. Which button should
you push? Or, it better with to leave the dust
boot off?

Overview of Process Safety Management and
Where Human Factors Fit
Process safety management (PSM) is a collection of
management systems and their implementation with
the purpose of controlling the risk of major accidents;
and in addition it focuses on preventing the accidents
that originate from process hazards (such as release
and explosion of ammable gases or liquids, release of
toxic, etc.). This differs signicantly from occupational
safety, which is focused instead on preventing personal
injury to workers from activities related to a task (such
as getting particulate eyes, falling objects, fall from
heights, etc.).
Human Factors within Existing PSM Systems
PSM systems have been in place for about 30 years,
with the rst formal industry-wide standard being
issued by the Center for Chemical Process Safety (CCPS,
1985), which is a division of the American Institute of
Chemical Engineers (AIChE). From the start, there was
strong emphasis on human factors, since one of the
12 elements of the original PSM standard was Human
Factors. The CCPS revised their PSM standard in 2007,
renaming it Risk-Based Process Safety (RBPS), and now
instead of one global element on human factors, the
direct control of human factors is spread throughout 5
elements. In some ways this change was a disservice
to the industry since some human factor (such as how
to write effective operating procedures and how to
effectively communicate) span all departments at a
location. In comparison, the PSM standard that was
issued by US OSHA (29 CFR 1910.119) in 1992 (and has
been essentially unchanged since) is devoid of human
factor controls and the only direct reference to human
factors is one mention in paragraph (e), Process Hazard
Analysis (PHA), which states that the PHA team must
consider human factors (presumably in the review of
the causes and the quality of the safeguards). But there
is one other mention that alludes to human factors,
which is that procedures must be written clearly and
understandably and how to do this is following best
practices for human factors as they relate to procedures.
The Figure below compares various standards/systems
for PSM.
Many of the basic Human Factor Control elements are
already part of most companies PSM systems; these
include:
Procedures and Reference Documents for
all aspects on the process/organization, including
operations, maintenance, safe work practices
(Lock-Out/Tag-Out, etc.), lab support, security,
engineering support, etc. As mentioned earlier,
many of these procedures do not follow best
practices for controlling human error, and so
the written procedure actually contributes to
increased error rates. Further, many organizations
are missing guides on how to troubleshoot (what
to do when process deviations occur). The
best practices rules for writing and validating
procedures have been published for many years
(see Bridges, 1997-2000). Below is a checklist
based on the current set of best practice rules for
developing operating, maintenance, and other
work-instructions (procedures)
Issue Response
1
2
3
4
5
6
Is the procedure drafted by a future user of the written procedure? (Engineers
should not author procedures to be used by operators or maintenance staff.)
Is the procedure validated by a walk-down in the eld by another future user
of the procedures?
Is the procedure reviewed and commented on by technical staff (engineers or
vendors)?
Is the procedure checked versus the Page and Step format rules below?
Is a hazard review of step-by-step procedures performed to make sure there
are sufcient safeguards (IPLs) against the errors that will occur eventually
(when a step is skipped or performed wrong)?
Is the content measured using newly trained operators to judge the % of
steps that are missing, steps that are confusing or wrong, and steps that are
out-of-sequence? (A score of 95% accuracy of content is good.)
Procedure Content Checklist
Page 400 Page 399
1
2
3
3
4
4
5
5
7 7
1
8
9
8
10
11
12
9
13
10
14 11
15
6
6
Is the title of the procedure the largest item on the page?
Is the proper level of detail used throughout? This is judged based on:
Who will use the procedures
Same level of detail used in similar procedure steps
Is the procedure title clear and consistent with other titles, and does it uniquely
describes the topic?
Are the document control features the smallest items on the page?
On average, is there only one implied action per instruction? Best practice is to
average 1.2.
Are temporary procedures clearly identied?
Does the procedure indicate when sequence is important?
If sequence matters, each step should be numbered (with an integer or letter)
If sequence does not matter, bullet lists should be used
Is white space used effectively?
Is there one blank line between each step?
Does indentation help the user keep their place?
Are the margins large enough to reduce page congestion?
Are only common words used? Apply education level test (5 grade reading level is best)
Is mixed case used for words of steps, with ALL CAPS used only for special
cases (such as IF, THEN, AUTO, and WARNING)?
Is the step number very simple (single level of number used)? Only an integer? Is the procedure free of steps that require in-your-head calculations?
Values expressed as ranges rather than targets with error bands
Conversion tables, worksheets, or graphs provided where needed Have sections or information not necessary to performing the steps been
moved to the back or to another part of the manual or training guide?
Are section titles bold or larger than the text font? Do sections have clear
endings?
Is the decision on electronic presentation versus hard copy correct? Are
electronic linkages to procedures clear and accurate and easy to use? If paper
is chosen, is the color of the paper appropriate?
Are graphics to the users advantage?
No explanatory paragraphs or lengthy instructions that could be replaced by a picture
No impressive graphics that provide no real advantage
Is the overall page format (such as Outline format or T-Bar format) appropriate
to the use of the procedure?
Are references to the users advantage?
No lengthy explanations or instructions that could be replaced by branching to a
reference
No references to a procedure that references still another
No gaps or overlaps between this procedure and a referenced document
If branching, must branch to a procedure, not to a specic step in a procedure
Are play script features added for tasks that must be coordinated between two
or more users?
Play script is normally used when there are two or more hand-offs of responsibility for
steps.
Are rules followed for writing warnings, cautions, and conditional steps?
No more than 2 per page
No actions within a warning or caution (actions must always be numbered steps)
Warnings and Cautions contain descriptions of potential consequences
Are rules followed for formatting of Warnings, Cautions, and Notes? (See
annotated rules, such as Warnings are for worker safety and Warnings must
clearly standout from rest of page.)
Is type size is 12 pt font or larger?
Do all acronyms, abbreviations, and jargon aid understanding?
Develop a list of such terms for use in procedures and communication.
Use terms that users use (within reason)
Is serif type is used (rather than sans-serif)?
Is each step specic enough? No room left to guess/interpret:
The meaning of a word or phrase (Check vs. Make sure)
The intent of a step or series of steps
A desired quantity or value
To what equipment the step applies
Is serif type is used (rather than sans-serif)?
Page Format Checklist
Step Writing Checklist
2
Page 402 Page 401
For procedures to be effective in ensuring that tasks
are performed correctly, they must be used. There
are a number of reasons that workers may not use
procedures:
Procedures are inaccurate
Procedures are out of date
No procedure has been written for the task
Users cannot nd the procedure they want to
use
Users don't need a procedure because the task
is simple
Users need more information than the
procedures contain
Users see procedures as an affront to their skill
Procedures are difcult to use in the work
environment
Procedures are difcult to understand
So, in addition to the rules for writing procedures that
are shown in the table above, the organization must
also address the reasons that cause the worker not to
use the written procedure.
Training, Knowledge, and Skills This is
of course necessary for general functioning of
management systems and also for task-specic skills
such as how to start up a compressor, how to repair
pump P113A, and how to lead root cause analysis,
how to perform a proper Lock-Out/Tag-Out, etc.
Organizations normally do a good job on training,
including hands-on training. The major weakness
in this category is that training is often lacking on
how to handle process deviations or upsets (how to
trouble-shoot). On the other hand, training is many
times listed as the cause or root cause of an
accident, when in fact the training is adequate and
some other human factor is the major cause.
Tools/Equipment this typically refers to hand
tools or devices, which as general designed with
the user in mind. A big part of human factor
consideration is how to make the equipment and
process operation mistake-proof (to prevent errors
as much as possible). Below are some examples of
error proof in designs and in process/operations:
o Design for unambiguous assembly. Design the
product or device such that the assembly process
is unambiguous (by designing components so that
they can only be assembled one way); i.e., design
matching parts that are easy to insert and align.
For example, use notches, asymmetrical holes,
and stops to mistake-proof the assembly process.
Products that go together in only one way require
less worker training, perform more reliably, and can
be repaired more quickly.
Computer cables are good examples
Gas supply lines in medical facilities with
error-proong (to ensure the proper gas is
used)

Consult workers. Operators, technicians,
and maintenance personnel can pinpoint the
most troublesome areas.
Avoid symmetry. When a particular
orientation is critical to the design, avoid
symmetry. For example, use nonsymmetrical
hole patterns.
Use labels sparingly. Labels tend to come
off equipment too easily and often are
wordy.
Review the environment. Environmental
problems that encourage mistakes include
poor lighting; high/low heat; excess humidity,
dust, and noise anything that distracts
workers.
o Error-proof Operation Design Considerations
Error-proof mechanisms. Error-proof
mechanisms are very powerful in improving
system reliability when incorporated into
the design. These mechanisms, by design,
will not allow a user to perform an illegal
operation. For example, if a user enters a
value that is outside the accepted range of
operation, the control logic will not accept
the value.
Automatic alerts. Automatic alerts immediately
inform the user of an illegal operation to prompt
corrective action. These alerts are particularly
useful in critical operations that allow time
for corrective action before some adverse
consequence occurs. For example, a piping
manifold may be designed such that a warning
alarm sounds if valves are not opened/closed in
the proper, critical sequence, or if a critical valve
is left opened/closed.
Automatic system shutdown. Automatic
system shutdown should be incorporated into
the design when an illegal action is performed
during a critical operation and no time is
available for corrective action. For example, if an
operator uses the wrong sequence in charging a
reactor, the reactor will shut down before other
materials are charged that may lead to critical
temperatures and pressures.
Risk Reviews (PHA/HAZOP, HIRA, JSA, etc.) This
is fundamental for predicting where and why humans
might make mistakes and for determining (qualitatively,
at rst) if the protection layers are sufcient if such errors
occur and if not, what else is needed. Unfortunately,
many organizations do not full analyze for errors during
all modes of operation, and so many (in some cases,
most) of the accidents that start with a human error are
not predicted, as they should be. (see Chapter 9.1 of
CCPS/AIChE, Guidelines for Hazard Evaluation, 3rd
Edition, 2008; and paper by Bridges, LPS/AIChE,
April 2009, Optimizing Process Hazard Analyses)
Incident Investigation/Root Cause Analysis (II/RCA)
This is necessary to learn from mistakes. Although all
companies have an II/RCA system, many companies are
lacking in the awareness of where human factors ts into
accident sequence and so their II/RCA may stop at the
cause (and even root cause) being operator error (their
II/RCA misses the human factors weaknesses that led to
the human error). Many companies also do not get nearly
enough near misses reported (the ratio should be about
20 to 100 near misses reported per actual loss/accident;
see CCPS/AIChE, Guidelines for Investigating
Chemicap Process Incidents, 2nd Edition, 2000; and
paper by Bridges, 8th conference, ASSE-MEC, 2007,
Getting Near Misses Reported).
Supervision Organizations are typically structured to
have sufcient supervision of the job, but many times
the denition between the trainer and the supervisor
roles is blurred. Supervision can and normally does
play a key role in selecting of the right worker for
the job, scheduling of workers to match the required
tasks for the day/week, and generally overseeing the
task execution to ensure policies and procedures are
followed. Supervisors are not always trained on all of
their key roles in support of control of human factors,
such as detecting issues in workers related to tness for
duty or fatigue.
Behavior Control About 15% of human error is due
to acquired habits. Some call these Behaviors, but that
normally carries negative connotations. Many (most)
companies have effective systems for combating bad
habits; these systems normally involve peer-to-peer
observations and feedback (coaching), and these are
many times labeled behavior-based safety management
(which is a trademark phrase belonging to BST), or
behavior-based reliability, or simply job-observations. A
peer-observing-peer system, such as these, can reduce
habit-based errors by about 70%.
Coordination and Control This is a collection
of activities and management systems that control
the coordination of human activities related to the
process. These can include management of change
(MOC) systems, document control systems (if not
within the MOC system), work order control systems,
issuing of operating orders for the day/week, project
management procedures, performance measurement,
auditing, continual improvement, etc. The categories
of Risk Reviews and II/RCA can t under this general
category as well. These activities are normally controlled
directly by management or by a technical department
(such as engineering) or by a safety or loss prevention
department.
Human Factors Sub-elements not addressed in many
PSM systems
Some organizations strive to control all human factors to
reduce human error rates as far as possible (see the US
Nuclear Regulatory Commissions HERA program,
begun in 2008). But, in addition to the human factor
weaknesses mentioned in the PSM elements in the previous
section of this paper, many companies also do not have
elements that address the following human factors:
Fitness for Duty Successful task performance
requires that the capabilities that workers bring to the
task fall within an expected range. Fitness for Duty
Page 404 Page 403
issues include reduction in an individuals mental
or physical capabilities due to substance abuse,
fatigue, illness or stress, increases the likelihood of
errors. Types of possible impairments are:
o Physical attributes strength, reach, eye-sight and
color acuity, hearing,
o Mental attributes drug and alcohol (abuse),
mental stress (on and off the job); fatigue issues
from on the job and off the job (especially control
of hours per work-day and per work-week)
Safeguards to prevent tness-for-duty-related errors
include company programs for the detection and
prevention of potential or actual impairment, as well
as the individual responsibility of workers to decline
assignments if they are impaired for any reason. The
latter safeguard is a weak one, however, because humans
are generally over-condent of their capabilities when
under the inuence of drugs or alcohol, or are stressed,
fatigued or ill. Other factors that may discourage self-
reporting include the fear of poor performance reports
from bosses or having to pay extra overtime. Company
programs that may be implicated in errors caused by
personnel impairment include:
o Fitness-for-Duty Program Company tness-
for-duty programs are primarily responsible for
detecting and preventing impaired personnel from
performing tasks that may affect public health
and safety. Medical evaluations of personnel,
behavioral observation programs, employee
assistance programs and drug and alcohol testing
are used to detect impairment. Weaknesses in this
program may allow impaired personnel to have
access to vital areas in a plant where they could
commit errors.
o Overtime Policies and Practices Most
companies establish limits for work hours to
reduce on-the-job fatigue. Routine authorization
for work hours in excess of those recommended
may result in fatigued workers. Further, a practice
of excluding training or meetings that occur
outside of an individuals normal work schedule
from work-hour limitations will also contribute to
fatigue.
o Shift Scheduling Shift scheduling may also
affect the likelihood that personnel will show
performance decrements due to fatigue. A change
in the assigned shift or a rotating shift schedule
will disrupt circadian rhythms and may increase the
likelihood of errors.
o Safety Culture The effectiveness of self-reporting
and behavioral observation programs depends
greatly upon the safety culture at a site.
Example: If self-reporting of impairment or reporting
an impairment concern about another staff member
even occasionally results in disciplinary action, then
supervisors and workers will naturally be reluctant
to report other staff members who appear to be
impaired. On the other hand, if individuals who
have come to work under some form of stress
are treated fairly and with concern, personnel will
report more frequently. If the companys culture
emphasizes safety over other goals, personnel may
be willing to turn down overtime and monitor
their own fatigue levels, even if turning down the
opportunity results in a loss of income.
Attention and Motivation -- Attention and
motivation are often identied as causes for
error. Inattention to detail, Attitude less than
adequate, and complacency, as examples, are
frequently cited as causal factors in company problem
reports. The evidence supporting these conclusions
is often weak, however. Issues to consider in
controlling attention and motivation include:
o Demonstrated commitment of leadership to long-
term values (trust in leadership)
o Work culture How is behavior rewarded? Is
near miss reporting rewarded? Are short-cuts
rewarded? Are workers involved in peer-to-peer
job observations?
Determining the role of attention or motivation in
a human error is difcult outside of a laboratory or
simulator setting. Attention and motivation are internal
states that cannot be measured directly. In the laboratory,
the experimenter can use sensitive instruments to track
eye movements and record focus times as measures of
attention, for example, or can establish control over the
incentives presented to subjects to manipulate motivation
levels. Recordings of workers thinking aloud as they
perform tasks also provide insights into attention and
motivation. However, in the example of an investigation,
real-time, objective measures of attention or motivation
cannot be obtained because the investigation necessarily
occurs after the fact. As a result, the investigator must
rely on self-reports and inference, which are subject to
biases and inaccuracies.
Attributing accident causes to workers attention, attitudes,
motivations, or traits may be common because it is consistent
with the fundamental attribution error. As mentioned in
other documents, this error is a natural human tendency in
how we explain anothers behavior and appears to be hard-
wired into the human perceptual system. In the absence
of compelling evidence that some characteristic of the work
environment affected the workers actions, investigators may
resort to this default explanation and conclude that the
workers were not paying attention or lacked the motivation
to perform their work correctly. After reviewing more than
1000 accident investigation, we have Not Found Any
cases where the error was attributable to inattention
or lack of internal motivation.
Prevention of errors related to motivation and
attention Many company programs, policies, and practices
are intended to reduce errors associated with attention and
motivation. Some programs directly focus on these potential
causes and contributors to error, such as the human
factors engineering program at a site or a behavior-based
safety program. Others may indirectly affect attention and
motivation during task performance. Company programs
that may be implicated in errors caused by attention or
motivation include:
o Human Factors Engineering Weaknesses in the design
of human-system interfaces, for example, may make it
difcult for personnel to detect changes in important
parameters or to interpret the information displayed
correctly. Difcult-to-use human-system interfaces may
also frustrate personnel and inadvertently communicate
a management message that accurate, timely human
performance is not important.
o Procedures Accurate, accessible and usable procedures
also play an important role in directing attention, and
lack of accurate and easily accessible procedures can
frustrate the worker and degrade their motivation.
o Human Resources Weaknesses in the personnel job
performance evaluation and reward systems also
may fail to communicate management expectations
or may reward behavior that does not meet those
expectations. If disciplinary actions are not perceived
as being administered fairly, employee motivation to
work productively and safely will be reduced.
o Supervision Supervision communicates and reinforces
management expectations and establishes goals and
requirements for task performance. Supervisory
oversight may increase motivation to perform in
accordance with expectations as well as detect
and correct any errors that occur. Weaknesses in
supervision, for example, may cause staff to choose
production over safety goals in their work or to
tolerate workarounds that may lead to errors.
o Problem Identication/Resolution Company
programs for reporting, documenting and resolving
barriers to effective performance maintain staff
motivation levels when problem reports result in
elimination or mitigation of the barriers. Weaknesses
in these programs may not only frustrate personnel,
but also encourage the development of workarounds
that may lead to errors.
o Employee Concerns Employee concerns programs
provide another avenue for personnel to raise safety
issues. Weaknesses in the employee concerns program
will discourage personnel from raising problems when
they fear adverse consequences and will call stated
management expectations into question, resulting in
lower compliance.
o Behavioral Safety Behavioral safety programs focus
on identifying and correcting work behaviors that may
result in adverse consequences through behavioral
observation and feedback from supervisors and peers.
Some programs also emphasize self-checking, such
DuPonts STOP program, FMCs START program, the
Institute for Nuclear Power Operations STAR program
(stop-think-act-review), and PIIs STAR Program (Safety
Task Action Reporting). Focusing on potentially unsafe
acts appears to improve human performance at some
sites.
Stafng is the process of accessing, maintaining and
scheduling personnel resources to accomplish work. An
adequately staffed organization ensures that personnel
are available with the proper qualications for both
planned and foreseeable unplanned activities. Stafng
is a dynamic process in which plant management
monitors personnel performance to ensure that overall
organizational performance goals are met or exceeded.
The result of an effective stafng process is a balance
between personnel costs and the achievement of
broader organizational goals. Issues with stafng
include:
o Selection of right staff for a job
o Avoiding staff overload (but also avoid too many
staff during lulls, when lack of stress will lead to
more errors)
o Rotating staff every 1 hour or less for tasks that
require high vigilance
Page 406 Page 405
Each organization requires the proper amount and type
of expertise to safely and competently operate the plant
under a variety of conditions. The term expertise
includes the attributes of talent, effectiveness,
knowledge, skills, abilities, and experience necessary
to operate and maintain plant systems, structures and
components.
Surges in workload, such as during outages, typically
require staff augmentation as well as longer work hours
for permanent staff. The introduction of contractor
personnel or company personnel from other sites may
increase the likelihood of errors due to unfamiliarity with
the plant, its procedures and hardware, for example.
Longer work hours have the potential to increase fatigue,
which also contributes to the likelihood of error.
Humans are inherently unable to remain alert for signals
that seldom, if ever, occur. Even a sailor whose life is at
stake cannot maintain an effective watch (look-out) for
hostile submarines for more than 30 minutes or so. (The
gure below illustrates the rapid decrease of vigilance
with time.) It is important that control systems be
designed to require regular operator interaction so that
the operator will remain attentive. Placing a worker in
situations requiring extended, uneventful vigilance may
lead to accidents like the ones described below:

Human-System Interface The human-system
interface (HSI) is dened as the technology
through which personnel interact with plant
systems to perform their functions and tasks. The
major types of HSIs include alarms, information
systems, and control systems. Each type of HSI is
made up of hardware and software components
tasks in new ways. Skills that the user developed for
managing workload when using the former design,
such as ways for scanning information or executing
control actions, may no longer be compatible with the
new design. The new HSIs must also be compatible
with the remaining HSIs so that operators can use
them together with limited possibilities for human
error. Also, HSI modications may not be installed
or put into service all at one time, causing the user to
adapt to temporary congurations that are different
from both the original and nal congurations.
Weaknesses in HSI implementation can increase
operator workload and the likelihood of errors.
Task Design A task that is designed with the human
limits in mind is much more likely to work effectively
than one that assumes humans can and will always
do what is written. The task must consider that humans
think and remember and factor in prior data and prior
experiences.

o Complexity of task (procedure-based or a call for
action) If the task is too complex, then humans can
forget their place in the task, fail to understand the
goal of each step or sub-step, or fail to notice when
something isnt going right. Task complexity is a
function of:
number of choices available for making a wrong
selection of similar items (such as number of
similar switches, number of similar valves, number
of similar size and shaped cans)
number of parallel tasks that may distract the
worker from the task at hand (leading to either
an initiating event or failure of a protection layer)
number of staff involved (more staff = more
complex)
number of adjustments necessary to achieve the
goal
amount of mental math required (as a rule, NO
math should be required in anyones head when
accomplishing a standardized task)
how much judgment is required to know when
you have accomplished each goal within the task
For most chemical process environments the
complexity of the task is relatively low (one action per
step), but for response actions (human IPLs) there is
almost always other tasks underway when the out-of-
bounds reading or the alarm is activated. Complexity
is difcult to predict (since it is not known when a
human intervention will be needed), but higher
complexity can increase error rates by 2 to 10 times.
o Error detection and error recovery Is there enough
feedback in the process to allow the worker to
realize (in time) that they made a mistake? Have
they been trained on how to reason through how
to recover from mistakes they or others make?
(Sometimes, doing a step too late is far worse than
Not doing the step at all.)
o Environment where the task is to be performed
(too noisy, too cold, to hot, too distracting):
There are two types of vibration that may cause
errors. The rst is whole-body vibration, in
which vibration is transferred to the worker
from standing or sitting on a vibrating surface.
The second is object vibration, in which a
stationary worker interacts with a vibrating
object in some fashion. The effects of vibration
depend upon its frequency and acceleration.
Frequency is the number of oscillations (cycles)
that occur in one second. Acceleration is the
force, or intensity, of the vibration.
Noise is unwanted sound. Noise can cause
errors in several ways. It may disrupt
communications, affect the ability to perform
tasks and annoy personnel. The effects
of noise on communications are complex.
Even relatively low levels of noise can mask
speech, but only under some circumstances.
For example, speakers naturally raise their
voices when there is background noise and
may be able to overcome some of its effects
on communication. Being able to see the
speaker's face or using standardized phrases
also improves communication in a noisy
environment. The type of background noise
also affects communication. It is easier to
communicate over noise that is steady and
uniform than noise that includes sharp tonal
peaks, such as background speech.
Heat exposure is a common problem in
many areas of a plant, such as the turbine
building when the plant is operating. The
extent to which workers will be affected by
heat depends on many factors. These include
physical characteristics, such as age, weight,
acclimation to heat, physical tness and
dehydration. Other factors that determine
the effects of heat on performance include
airow, humidity, clothing and level of physical
activity.
that provide information displays, which are the
means for user-system interaction, and controls for
executing these interactions. Personnel use of HSIs
is inuenced directly by (1) the organization of HSIs
into workstations (e.g., consoles and panels); (2)
the arrangement of workstations and supporting
equipment into facilities, such as a main control
room, remote shutdown station, local control station,
technical support center, and emergency operations
facility; and (3) the environmental conditions in which
the HSIs are used, including temperature, humidity,
ventilation, illumination, and noise. There are three
important goals to be achieved in the design and
implementation of an HSI. These are:
o Design for operability refers to designing
the HSI to be consistent with the abilities and
limitations of the personnel who will be operating
it. Weaknesses in the design processes can result
in an HSI that is not well suited to the tasks that
personnel must perform to ensure plant safety,
resulting in increased workload, decreased
performance by personnel, and an increased
likelihood of errors.
Example: The relief valve on a low-pressure
separator actuated during apparently normal
operations. Operators veried that the separator
pressure was normal, and in their haste to stop
the release, they blocked-in the "bad" relief
valve before unblocking the parallel relief valve.
The separator immediately ruptured and killed
two operators. The pressure transmitter on the
separator had failed, closing the normal discharge
valve and sending a false signal to the control
room.
o Design for maintainability refers to designing
the HSI and associated plant equipment to ensure
that personnel are able to perform necessary
maintenance activities efciently. Weaknesses
in the design process can result in systems
that impose excessive demands on personnel
for maintenance and, therefore, are prone to
maintenance errors or problems with reliability
and availability.
o Design for fexibility refers to the way that
changes, such as upgrades to the HSI, are
planned and put into use. A new HSI component
may require the user to perform functions and
Page 408 Page 407
Exposure to cold affects the performance
of manual tasks. Decreases in the ability to
control hand movements begin at an air
temperature of approximately 54 F. The
ngers may become numb to pain at this
temperature and touch sensitivity is reduced.
Performance of gross manual tasks, such
as those involving the arms and legs is also
degraded at 54 F. The speed at which
manual tasks can be performed is affected by
the rate of cooling. Slow temperature drops
have a greater negative impact on manual
dexterity than rapid temperature decreases,
during the initial exposure period.
Adequate lighting is required for accurate
performance of nearly every task in a unit
operation.
o The organization must have engineering controls
to help control each factor; but sometimes there
is no other choice but to rely upon administrative
controls.
Communication between workers verbal
and signal communication: Communication
is the exchange of information while preparing
for or performing work. Verbal communication
occurs face-to-face, by telephone, sound-powered
phones or walkie-talkies, as well as over public
address systems. Written communication occurs,
for example, through policies, standards, work
packages, training materials, and e-mail.
Communication involves two sets of behaviors: (1)
creating and sending messages and (2) receiving and
interpreting them. Communication always involves
at least two individuals, the sender and the receiver,
and occurs:
o Between individuals
o Within and among work groups
o In meetings
o In pre-job or pre-evolution briengs
o During shift turnover
Successful communication requires several steps. The
sender rst develops the intention to communicate
either verbally or in writing. The sender then
composes a message that presents the meaning as
clearly as possible. The receiver must pay attention
to the message and then interpret its meaning. If the
communication is successful, the receiver interprets
the message consistently with the sender's intended
meaning.
o Sending Errors
Content wrong
Content inconsistent
Content inappropriate for the job
Content inappropriate for the receiver
Standard terminology not used
Familiar terminology not used
Example: In preparation for construction work, the
plant staff marked the location of an underground
electrical bus with ags on the surface. The backhoe
operator, believing the ags indicated where he was
supposed to dig, cut through the electrical bus and
blacked out half the facility.
Message production inadequate or interfered
with
Example: Unit operators had practiced responding
to an acid vapor leak and devised a system of hand
signals to communicate with personnel responding to
the release in fully encapsulated suits. Unfortunately,
when an actual leak occurred on a calm morning,
visibility was restricted throughout the unit by the
acid-induced fog. Emergency response personnel
could not coordinate their actions with the unit
operators, and attempts to isolate the leak were
initially unsuccessful, resulting in a much larger
release.
Necessary information not sent
Wrong place or person
Wrong time
Sending verication failure
o Receiving Errors
Information not sought
Information not found
Information not used
Receiving verication failure
Message misunderstood.
Example: Each shift normally made an entire batch of
resin, but equipment failures had interrupted the usual
schedule. The arriving shift misunderstood the batch
status and mixed in a second bag of additives. They
realized their error when the agitator motor overloaded.
The entire process had to be disassembled so the solidied
resin could be removed.
Example of Application of Human Factors Consideration
to Risk Reviews
Every risk assessment must consider the likelihood and
effect of human error. Therefore, these assessments must
also consider how well the organization controls human
factors (which in turn greatly control the human error rates).
Human error can initiate an accident scenario (cause an
Initiating Event [IE]) and humans can stop a scenario from
progressing (by participating in an Independent Protection
Layer [IPL]). The table below provides a checklist of human
factors issues for initiating events (IEs) and for independent
protection layers (IPLs).

Page 410 Page 409
Page 412 Page 411
CLOSING
An organization involved in implementing PSM (or similar,
SMS or OSHAS 18001 for occupational safety) must develop
management elements for optimizing human factors to
control human error rates. This is not as much work as it
sounds, except for the problem that most international
standards and government regulations fail to adequately
address human factors (so the organization leaders may ask
Why do we have to control all human factors if the XYZ
standard does not require this?). The exceptions to these
rules are the nuclear power industry, aviation, and certain
military organizations (typically navies and air forces); most
of these larger organizations have excellent systems for
optimizing human factors.
For organizations that must implement process safety (PSM),
there are two main approaches for closing the gap on control
of human factors. These are:
1. Follow some relative weak government PSM regulation,
such as US OSHA PSM or EU and UK COMAH regulations,
and then develop the additional requirements for
strengthening each existing elements control of human
factors and also add a specic global element on human
factors to address:
2.
a. Fitness for duty
b. Attention and motivation
c. Stafng issues
d. Human system interface design
e. Task design
f. Communication between workers
3. Follow the newly released (2007) standard from AIChE,
Risk-Based Process Safety and make sure the elements
that control human factors are fully implemented
(including all advice on human factors given in this
paper), especially for the elements of:
a. Process safety culture
b. Workforce involvement
c. Training and performance
d. Operational readiness
e. Conduct of operations
Page 414 Page 413
Rening Process Safety
Keys to a Successful Program
Andrew P. Bartlett, Rening Safety Coordinator, Saudi Aramco
Thomas R. DiGiacomo, Rening Consultant, Saudi Aramco
9
th
ASSE-MEC-2010-56
ABSTRACT
Process Safety is a 20-year old concept. But unless it
is properly understood and effectively applied, a plant
catastrophe may be looming just around the corner
waiting for the right combination of failures to make its
appearance.
A companys management often feels secure when they
have systems in place that address the many processes
associated with safety. As time passes by without any
major incident, complacency may set in. When loss
occurs, the company decides to take a closer look to
see if systems in place are working in the way they were
designed.
KEYWORDS
Process safety
Catastrophe
Failure
Loss
Incident
Safety Management System
Safety Audit
Subject matter expert
E-mail groups
1. PROCESS SAFETY AS APPLIED IN
SAUDI ARAMCO REFINING
As months and years pass by without any major incident,
these same companies tend to become more and more
complacent with their programs. Its not until something
happens that may claim lives or equipment does the
company decide to take a closer look to see if systems in
place are working in the way they were designed.
Taking a proactive approach, Saudi Aramcos Rening
and NGL Fractionation sector decided to take a closer
look at what may be lacking in its current safety
programs before something happens. Following an
exhaustive review of industrial incidents over the last
decade, a Pareto analysis approach revealed that the
less-than-satisfactory administration of six processes
was responsible for the majority of these events. These
processes include Management of Change (MOC),
Process Safety Information (PSI), Process Hazard Analysis
(PHA), Operating Procedures (OIM), Hot Work (HWP) and
the proper Lock Out/Tag Out of equipment (LOTO).
The presentation details the importance of process
safety, the false sense of security created when a
companys personal safety program is going well, and
the many obstacles that stand in the way of ensuring
that the system works. Without an effective program
for continuous improvement, its only a matter of time
before the system fails.
2.1 RAISING AWARENESS
A team of experienced professionals with Renery and NGL
fractionation process and operational safety backgrounds
from Saudi Arabia, USA, Bahrain and UK was formed.
PowerPoint presentations were prepared by the team on
the key 6 processes: Management of Change, Process
Safety Information, Process Hazard Analysis, Operating
Procedures, Hot Work and the proper Lock Out/Tag Out
of equipment. Executive management support helped to
smooth the acceptance of the program.
The Companys safety management system (SMS) was
analyzed for its references to process safety; an OSHA/
SASMS comparison chart was part of the presentation.
The objective was to show the employees that Process
Safety was embedded in the Saudi Aramco SMS.
The educational presentations developed by the team were
shown to management and employees during site visits to
six facilities.
The presentations used case studies that included 1Texas City,
2Flixborough, 3Piper Alpha and Company internal incidents
to illustrate the effects of process safety failures, using the
4James T. Reasons Swiss cheese model.
2.2 INITIAL AUDIT
The initial review consisted of examining the processes using
a formal audit approach. This included employee interviews,
examination of paperwork both soft and hard, and eld
visits to watch these safety processes in action.
Each of the facilities (three on the Red Sea coast, one in
the Central and two in the Eastern Region of Saudi Arabia)
assigned a subject matter expert (SME) for each process.
To facilitate communications, separate E-mail groups were
formed for each. These proved very effective in promoting
a buy in that the resulting workable processes were
agreeable to all facilities.
The Process Safety Team prepared training modules for each
process, including an e-learning module for Management of
Change, which is now being used Company-wide.
The program was presented to the Companys Executive
Management in January 2008. It achieved endorsement of
the CEO, and was noted in the Company newspaper.
2.3 FOLLOW UP AUDIT
A follow up audit was performed to judge the effectiveness
of implementation, and to focus on passing knowledge from
the core team to the individual facility safety teams. The results
were pleasing: SMEs improved their knowledge of assigned
processes, MOCs are being tracked to completion, the LOTO
program is using crew lock out boxes and personalized
locks, and operating manuals ensure the inclusion of safety
checklists. The e-mail groups have proven very effective;
more than 1000 employees have used the MOC E-learning
during its rst 4 months on line.
2.4 PHASE TWO
Saudi Aramcos Management was pleased with the outcome.
A decision was made to back a Phase 2 initiative, to examine an
additional six safety processes while simultaneously reviewing
the rst six with a focus on continued improvement. Phase
2 includes: Pre-Startup Safety Review, Mechanical Integrity,
Incident Tracking & RCA Investigation, Emergency Planning
& Response, Internal Safety Review, and Critical Task/Job
Safety Analysis.
2.5 SHARING OF BEST PRACTICES
A formal Safety Best Practice program is in place that
documents and shares electronically best practices observed
by the team and submitted for review by the subject matter
experts.
3. CONCLUSION
An efcient and reliable Process Safety program is critical
in ensuring a safe workplace. Process safety engineers and
front line supervision provide key roles in this area, and must
be openly supported by management to succeed.
ACKNOWLEDGMENTS
OSHA Process safety management of highly hazardous
chemicals. - 1910.119
REFERENCES
1. 1Texas City,
http://www.hse.gov.uk/leadership/bakerreport.pdf
2. 2Flixborough,
http://www.savive.com/casestudy/ixborough.html
3. 3Piper Alpha
http://www.fabig.com/Accidents/Piper+Alpha.htm
4. 4James T Reasons Swiss cheese model
5. http://en.wikipedia.org/wiki/Human_error_model
Page 416 Page 415
Case Study for Streamlining Systems and
Establishing a Process Safety Culture With
Current Day Technology
Judy Perry, Dr. Georges Melhem, Henry Ozog
ioMosaic Corporation
9
th
ASSE-MEC-2010-57
ABSTRACT
This paper is to discuss a leading edge information
system that is utilized for process safety management
systems. The paper discusses one plants experience
going fully electronic on all process safety management
systems including a management of change workow
system. Detailed information on hurdles and gains from
implementation are provided. A key client partnered
with IoMosaic Corporation to implement an electronic
system that streamlines the efforts related to process
safety management. In this case study, a large emphasis
was placed on converting an old Lotus Notes system
to a fully automated workow system. The presentation
will focus on a specic example of implementing a very
no-nonsense, practical software solution for streamlining
management of process safety systems.
KEYWORDS
Software Solution
Process Safety
Streamline
ioXpress
Management of Change
1. INTRODUCTION
This paper outlines one organizations efforts on
enhancement of their process safety management
systems. In this case study the original process safety
systems were established to support and drive risk
management and compliance in response to American
Chemical Councils Responsible Care initiatives
preceding U.S. Occupational Safety and Health
Administrations (OSHAs) process safety management
(PSM) and Environmental Protection Agencys (EPA)
Risk Management Plan (RMP). The facility had migrated
away from some of the original baseline expectations
and had not kept current with the performance based
expectations of others in industry (relative to managing
their process safety management systems). Each individual
process safety management system, such as pre-start
up safety reviews, management of change, employee
participation, incident investigations and others were
at different modes of maturity. The facility decided they
were overdue for system upgrades. They had a denite
need to nd a system to centralize all elements of process
safety with a more robust system utilizing current day
technology.
Many organizations are interested in enhancing their
process safety culture. Often this includes upgrading
existing information management systems to utilize
current day technology. Another upgrade interest may
include identifying tools to streamline compliance. One
main goal for all organizations is to ensure resources are
being utilized in an effective, yet efcient manner. A key
qualication when providing IT (information technology)
solutions is to ensure any process safety system is robust
enough to handle a high volume of information. The
system shall be accessible and usable by multiple users.
Consideration should also be given to the disparity in
knowledge at many organizations on understanding
functionality of a computer and the associated software
solutions. Each of these concerns and desires were
addressed in the case study discussed below.
2. OVERVIEW OF THE RESULTS
In this case study many of the existing process safety
systems utilized hard copy les and manual dissemination
of information. Some of the individual components were
managed with the assistance of Lotus Notes, which
is an outdated IBM program. This paper gives a brief
overview on how one facility converted their hard copy les
and semi electronic management of change system to a fully
automated workow system. Multiple system enhancements
were achieved. Examples include the conversion of Process
Safety Information (PSI) from fragmented hard copy les to
a readily assessable central repository. This enhancement
provides easy access of the PSI, in preparation for Process
Hazard Analysis. All PHAs are readily retrievable and organized
for audits. In addition all action items, such as those from
Prestart up Safety Reviews, MOCs, Incident Investigations,
PHAs and Audits are centralized and tracked to ensure
efcient closure. Operating standards and other documents
are readily available which ensure all elements of process
safety management have been included as required by the
appropriate regulation and company standard. In addition
other important systems such as Job Safety Analysis and
Safety walkthroughs have been incorporated into a system
with single point access and multiple security levels.
The result is a culture shift which has enhanced compliance,
provided a robust system, and is a system which is easily
sustainable independent of individuals. The resulting system
streamlined compliance for the ever present resource
limitations that are reective of todays economy. This paper
and presentation is to provide a look at this system that has
changed a culture. As this case study demonstrates, the
ioXpress knowledge management system with the process
safety management modules are a very no-nonsense,
practical solution to a very big challenge for the chemical and
petroleum industry. The following paragraphs provide a brief
overview of the key desires and hurdles experienced during
the development and implementation of new technology at
the case study location. At the case study location, many of
the systems were well established, many were not so well
established, and some had no management system structure
at all. It was obvious major enhancements were needed.
3. RECOGNIZE THE NEED FOR
IMPROVEMENT
In advance of seeking a solution for process safety
management improvements, a process safety audit was
conducted by the site PSM coordinator to identify gaps
and major needs for improvements. Once those gaps were
identied, a major effort was launched to communicate the
results so management and engineers all understood and
agreed there was an urgent need for improvements. As a
result of this on site audit, an action item was generated by the
site PSM coordinator to nd a single system that would help
in all areas for process safety system enhancements. Several
communications, related to the need for improvement was
provided at all levels of the organization. Following these
communications a majority of the site would be better
equipped with knowledge and be ready when changes were
made. This advance communication was key to a successful
launch for a new IT solution, as many individuals develop
anxieties and are very resistant to change.
4. WHAT WAS NEEDED TO ACHIEVE THE
VISION?
To achieve the difcult vision of a major system enhancement
based on an accelerated schedule, the case study facility
partnered with IoMosaic Corporation. The goal was to
develop a system with the facilitys criteria and develop a
plan for the change. The criteria established included the
need to conform to existing company specic work ows,
provide a tool that manages data structure for documents
in multiple formats and be able to make adjustments on the
y. The system needed to be structured so workows and
management of information would save time and money,
while achieving better end results than current systems.
With the facility being in the U.S. there was also a priority
to ensure the system drove compliance with the OSHAs
Process Safety Management Standard [OSHA, 1992] and
EPAs Risk Management Plan [EPA, 1996]. OSHA had rolled
out a National Emphasis Program on PSM in the reneries
in 2008 [OSHA, 2007]. OSHA was also planning the rollout
of a similar program in the Chemical Industry in 2009. The
case study facility wanted to not only improve their systems
and provide solutions, but they also needed a framework
that could be expanded to facilities all over the world. They
set a goal for a fast implementation (weeks), as they also
desired being proactive on ensuring a successful on-site visit
and inspection by OSHA at their U.S. facilities.
5. THE IOXPRESS SOLUTION
The case study facility and ioMosaic were able to quickly
develop a plan and initiate implementation of an IT
solution, as ioMosaics software was already designed
for such applications. The ioXpress software solution is a
technology which has leveraged a mature process safety
knowledge base, incorporated industry best practice
process safety systems and combined each with current
information management technology. The case study
location has implemented a system which is now a business
advantage. The system is a tool to ensure process engineers
time is utilized more efciently, compliance to Responsible
Cares process safety code, PSM and RMP is demonstrated,
and recognized and generally accepted good engineering
practices (RAGAGEPs) are employed.
Page 418 Page 417
In addition to viewing the key management systems
associated with process safety, interest was expressed
by the facility to include other systems which generated
action items. This would enable the facility to have a
single system to handle action item management
regardless of the origination system. A single one stop
system would prevent them from maintaining multiple
systems. For example: In addition to the standard process
safety management system elements (as outlined by
OSHAs PSM Standard) [OSHA, 1992], the facility had an
active job safety analysis (JSA) program that was utilized
to identify key hazards on specic tasks. These JSAs
resulted in follow up actions being requested in order
to provide additional safeguards to reduce risks for the
identied tasks. Additional modules were provided, such
as this JSA module, to simplify action item management
across multiple disciplines.
6. ELEMENTS AT DIFFERENT MODES OF
MATURITY
An effort was launched to understand which process
safety management systems required duplication with
technology, and which systems needed developed from
a starting point of nearly nothing in place. The results
of the on site assessment indicated the core workow
system that was already well established and most
mature, was their management of change process. An
old Lotus Notes system had been constructed to initiate
and track management of change for the process
related changes. An independent change system was
operating in parallel to handle the chemistry changes or
other changes that have the potential to impact product
or raw material quality. To stay on top of follow up
actions and status of changes, the facility had weekly
meetings. All engineers and supervisors were well versed
in management of change and followed this system
faithfully.
Other systems were not so well established. For
example: Pre-start up safety reviews were not being
conducted on signicantly modied processes, incident
investigations were being conducted using a variety of
techniques, however there was no standardization of
causal analysis or no standard nal report form being
utilized. On site audits, including the OSHA PSM Audit,
were documented using Microsofts - Word processing
and placed in le folders. Action items from the audits
were not clearly dened and not properly managed
to completion. As discussed here, each element had
opportunities for enhancement; some systems with more
opportunities than others.
7. WHERE TO START?
Following ioMosiacs initial analysis a team decision was
made to use the management of change workow
system as the starting point for enhancement to the
process safety culture. The system was functional and
well understood, however it had limitations. Most
organizations struggle with change. By selecting the
MOC workow system upgrade, a new system could
be implemented, while minimizing the changes in
functionality and look for the end users. This would be an
opportunity to ensure the process engineers and others
were on board with the IT upgrade as soon as possible.
The key hurdles on the exiting change process, included
the engineers being accustomed to implementing
changes prior to all reviews and authorizations occurring
(when utilizing the old Lotus notes system), as well as
implementing changes prior to action items being closed
or without a pre-start up safety review being conducted.
In addition changes that were being initiated from major
capital projects had not previously been included in the
change control system, therefore major steps such as
PHAs on capital projects were not being scheduled to
enable the designers to implement changes in the nal
design.
A good understanding of the clients existing Lotus Notes
system enabled ioMosaic to construct a ow chart that
outlined the ow path of a change as it progressed from
originator to reviewers to the actual implementation.
An electronic version of this ow chart was developed
with programming rules for each step (or work ow
task) provided. The programming rules were based on
the current facilitys MOC system. This was to ensure a
baseline of familiarity for the users was present; however
enhancements to ensure good functionality as well
as compliance were also incorporated at the time of
programming. In addition, a capital project and PSSR work
ow task was added to the workow path, as they were
both gaps in the existing system. This workow provided
a good visual for the case study site and provided a view
that was an already (mostly) familiar workow for the
end users. Familiarity introduced a good start to a big
change that was underway. Familiarity enabled the end
users to get acclimated to a new way of doing things with
smaller steps rather than larger steps in the beginning. As
an interim step the initial draft workow solutions was
piloted at one Unit in the site. The pilot group utilized the
ioXpress workow solution for one month, in parallel to their
old Lotus notes systems. Any concerns or bugs were easily
xed on the y, as the ioXpress solution was used on web
server. This easy access enabled the programmers to make
any modications suggested by the pilot team at the time
noted. The resulting changes were immediately seen by the
pilot group.
8. AFTER THE PILOT
Once the workow was piloted and a nal design for the
MOC system established, the case study site saw how there
was no longer a need to make multiple phone calls to push
changes nor a need to have weekly meetings to understand
change status. With the new electronic solution the case
study site was seeing how IT solutions, with current day
technology has the potential to make their job easier than
the old systems they were acclimated to. A particular gain
was when process engineers could go on line and view who
in the authorization process was holding up their change.
Another key win was when they realized, with the work ow
system tied to an overall knowledge management system,
all documents associated with the change could easily be
viewed with one or two clicks of the mouse verses the old
way of nding a hard copy le folder or nding multiple
people that could explain what each change was really all
about.
The department managers also appreciated being bypassed
on changes that did not impact their unit. Managers have
so many emails and action items each day, any opportunity
for ltering to lighten the daily to-do list it is a welcomed
function. A set of screening questions, which was developed
by the site, enabled the programmer to direct the workow
process to whom in the process needed to view and authorize
each change, bypassing those that did not need to review a
particular change. In the sites Lotus Notes system each
manager and/or authorizer had to look at every change.
In addition the site process safety coordinator was pleased, as
the work ow tasks that had previously been skipped, such as
PSSRs and review of capital projects were now incorporated
into the system and not easily bypassed. The below gure is
an example view (case study site) on a change in progress.
Figure 1: Example work ow at Case Study Site

In Figure 1 above, the grey boxes indicate the work ow
step could be bypassed as the change had not affected the
group or is bypassed based on type of change. In addition
blue boxes indicated the step was completed, while
the green box indicates that workow step is ready for
authorization and completion. The documents listed at the
left of the gure are the documents tied to this workow
and are direct links to their location. They are led for ready
reference in one of the knowledge management libraries
established by the location within ioXpress.
What was the next key step for enhancing the process
safety management systems?
The next step in the process was to ensure a phased in
approach was utilized for the other modules (each process
safety system is represented by a module in the IT solution
ioXpress). The phase in approach started with utilizing the
sites PHA schedule. An expectation was set to document
all PHAs using the new software system (HAZOPtimizer),
instead of the previous way of documenting in a simple
Microsoft Word le. Also all process safety information
(PSI) supporting the PHA must be uploaded to the ioXpress
Knowledge Management system. In parallel to this effort,
it was expected all information obtained to support any
change (using the new workow system), was to be
uploaded into the new ioXpress Knowledge Management
system. In order for all of these references to be logically led
and readily retrievable, a library system was established in
ioXpress. The case study location decided on a ling scheme
that was simple and logical. Libraries were established for
each individual element within the process safety system
and each library had categories that were appropriate to the
element. For example in Operating Procedures, a category
was established for ling of the actual current procedures,
and another category was established to le the annual
Page 420 Page 419
certications that certify the operating procedures are
current. For the PHA library a category was established
for archived PHAs, and another for current PHA report
led by individual unit. A partial list of the library
organization is displayed in Figure 2 below.
Figure 2: Libraries within ioXpress-Based on PSM
Element

In addition, the case study facility was large enough;
so that at least one major PHA and multiple smaller
PHAs (due to modications or revalidations) were being
conducted monthly. As PHAs are completed they are
recorded using PHA software (HAZOPtimizer) that is
compatible and partnered with their new knowledge
management system. The nal PHA report is uploaded
and the action items imported with an easy one click to
the centralized action item system. This approach was
a logical solution for initiating a major migration for
converting previously fragmented systems to this single
management system. This method was considered
much less burdensome for the site, than a concentrated
migration effort in a short time frame. At the end of a
full year of implementation, there are plans to review
status and then make adjustments in the information
upload schedule as appropriate.
Gathering and ling process safety information for each
high hazard process is typically one of the most daunting
and challenging tasks for the engineers. Migration to
a form which outlines all of the PSI required for each
process, with a supporting knowledge information
management system was key to the success of a new
culture. However when communicating the need for a
change a good visual for the end users, of the different
systems (old and new) was provided as seen in Figures
2 and 3.
Figure 3:Old look of PHAs

Figure 4: New Look of PHA les

9. MORE CHANGES
The rst two systems enhanced (PHA and MOC) were
two of the elements that were in the most mature
modes on site. Another element that was mature from
an application and completion perspective was incident
investigations. However the site had not standardized
on a single form or the method of analysis. A decision
was made that converting to a fully electronic workow
system, had to be a two step process over time for the
incident investigation process. The case study site selected
to delay converting this system to a fully electronic
work ow until they had standardized documentation
methods. Based on this decision the rst step was to
standardize on a form and include causal analysis data
that was expected to be recorded for every incident
investigation. Not until a form is standardized and fully
accepted by the site, can the 2nd step of converting to
a fully electronic workow system occur. An incident
investigation form, based on the Center for Chemical
Process Safetys publication Guidelines for Investigating
Chemical Process Incidents [CCPS, 1992] related to
incident investigations was part of the ioXpress solution.
This same form is a workow module within ioXpress,
however the workow functionality was removed until
step 1 was completed. The case study site felt condent
there was appropriate activity on the investigations;
however other elements did not have appropriate
activities, so other process safety management system
elements became the priority.
10. WHAT NOT TO INCLUDE IN THE
SINGLE IT SOLUTION?
The initial scope of the new culture was to have an IT
solution for all aspects of process safety. One area discussed,
where there was a change in direction is on portions of
Mechanical Integrity. This site, as with most organizations,
had a centralized maintenance management system
(CMMS) that was integral to the work order system for
their repairs and maintenance staff. This single element of
process safety is so complex, and there have been IT CMMS
in existence and use for so many years, it made business
sense to maintain an independent system for maintenance
management and/or mechanical integrity. The ioXpress
solution will be utilized to le mechanical integrity items
that are not stored in the CMMS, such as the Mechanical
Integrity Standard Operating Procedures or other stand alone
documents. The other area where a decision has yet to be
made is on Operator Training. There are multiple stand alone
software systems for documenting Operator Training and
the associated curriculums for job titles. The case study site
has maintained a Yet to Be Determined status on whether
to continue to use their current software for documenting
training programs or migrate all records to ioXpress. Training
documentation required by process safety is just a small piece
of training requirements that exist at most sites today. There
is a multitude of issues that require training, in addition to
the process safety training. Those include items that are
completely unrelated, such as human resource efforts like as
sexual harassment training or routine training efforts such as
fork truck operator training or respiratory protection training
and t testing. The Operator Training Element is in the wait
and see mode at the time of publication of this paper.
11. LEAST MATURE SYSTEM WAS PSSR
One of the sites largest concerns was associated with pre-
start up safety reviews (PSSR). The PSSR system was not well
established, the actual reviews were not occurring as current
industry practice and compliance agencies required. This
large gap fueled the need to make the enhancements to
the PSSR one of the highest priorities, once the engineers
were acclimated to the ioXpress system via the new change
workow rollout. They had a very high energy associated
with xing all aspects related to PSSR and the current culture.
As with any change a communication on the why?
was essential. The Site management team provided audit
ndings to their groups and communicated that conducting
PSSRs was a new minimum expectation on any signicantly
modied or new process. This expectation was established in
advance of the roll out of the new ioXpress system.
The tool to enable management to streamline PSSR was
already within ioXpress as a module. The PSSR module is
based on a dynamic form, which was constructed based
on industry expectations and compliance requirements.
In addition a PSSR form is one of the key work ow tasks
required in the change workow system or module. The
ioXpress programming prevents the management of change
work ow from proceeding to the next work ow task, until
the action item to complete a PSSR is noted as completed
and is available for ready reference in the knowledge
management system. In addition to the actual PSSR form
used to record the PSSR, any action items generated as a
result of the review are entered into the ioXpress action item
management system and noted as pre- or post-startup. As
part of the change workow system, when an engineer
indicates readiness for implementing any change, ioXpress
validates status on any associated action items. These items
are from both the PHA and PSSR. If any action items (that
were noted as completion required before start-up) are still
open in the action item management system, a prompt
box is displayed indicating action items are not closed, and
therefore the change cannot be implemented.
Authorization of the implementation work ow task in
the management of change system is prevented until
the action items are address appropriately. This level of
modication to the PSSR system is a major upgrade. These
changes streamlined the process, so PSSR is not viewed as
a hurdle as much as the old manual system quite often had
been. However since this is a mostly new task, the process
engineers still grumbled on the new expectation, as this
is more work. The expectation had to be set by Sr. Site
management for the enhancement to occur. A software
solution cannot x a system that is fully broken.
12. CENTRALIZED ACTION ITEM
MANAGEMENT
Another major enhancement, which was very easy to
implement however was very critical, was the auditing
function. ioMosaic has ioAuditor, which is a user friendly
PSM/RMP auditing tool that enabled the site to have pre-
populated audit questions and a software solution for
documentation. Previous audits had been captured on
Word processing, with a manual action item follow
up system. ioAuditor has functionality that is similar to
HAZOPtimizer (the PHA tool) the site had selected,
therefore it was very easy to use. As with HAZOPtimizer,
ioAuditor allowed the site to audit, record ndings and with
one click migrate all ndings, and follow up actions into the
centralized action item system in ioXpress. The One Stop

2 Lotus Notes databases,
paper, and Excel
spreadsheets to track PHAs,
PPAs and action items
Page 422 Page 421
Shop concept for all action items, those from audits,
PHAs, PSSRs, JSAs, incident investigations and so on, was
very appealing to the site. Previously there were dozens
of les or old Lotus Notes systems to track these audit
ndings and associated action items. The management
team was very appreciative of the reports they could
generate with ease, to monitor status of action items
in their operating units. As shown in Figure 5 below,
the centralized action item system provides information
on where the item originated (relative to process safety
element), who originated the item as well as priority and
when it is due.
Figure 5: Centralized Action Item Management

Since the managers no longer had to monitor numerous
action item systems, and the engineers no longer received
multiple status reports from numerous systems they could
spend more time on closing action items, and spend less
time meeting and discussing status. Documentation on
closure actions also was now auditable, as ioXpress had
an auditing function that notes all history on each action
item. The history includes changes, as well as who made
the change.
13. WHAT THE FUTURE HOLDS?
With full implementation occurring in mid 2009, there
continues to be a learning curve for the site on all of
the changes. As history and experience has indicated
improving a process safety culture touches numerous
systems and each level of the organization. The above
description did not even touch the surface for explaining
all of the enhancements and the details of the ioXpress
system that provided the enhancements. Any change
that is this complex will take time. The site will continue
to mature each element until each management system
is current with industry practices. With the fully electronic
solution the younger and more technology advanced
engineers appreciate their organization not being behind
the times. Often the new era of engineer nds these
current efforts motivational.
This site understands the importance of knowledge
management and has plans to expand the process safety
modules to include environmental management issues, as
well as consider a capital project improvement workow
module. In addition the system will be rolled out to the
other locations (worldwide) in the next scal year. The web
server based system will be utilized by the Corporate staff
to monitor status of critical issues at every site, to ensure
the corporate values associated with process safety and
compliance are being demonstrated by closure of action
items and proper management of information. Since the
system is very robust and the nature of module and forms
construction is open to the site, there are other modules
and forms that will be added, that the site has not even
considered at this point.
14. CLOSING COMMENTS
As with any change there must be commitment by Sr.
Management to provide the resources and to set the
expectation for the change. Having the proper software
solution, is a key start; however a software solution can
not be a replacement for individuals doing the right
things and making the right decisions. This case study
discovered that ioXpress is a tool that enables a site
to migrate old, fragmented systems to a streamlined
electronic solution. ioXpress achieves the simple task on
assisting the individuals at the site to not forget to do
things they are supposed to do, as it relates to the details
of a successful process safety culture. As many of us have
experienced with incidents in our back yard, the devil is
in the details when considering what could go wrong
with a highly hazardous process. Information Technology
solutions help young and unknowledgeable people do the
right things, at the right time to prevent that catastrophe
we all fear in this industry. As with completing a PHA,
The analysis will only be as good as the PHA team.
Implementation of an IT solution, to streamline a process
safety culture has to be thought of in the same way The
implementation efforts will only be as good as the team
doing the implementing. The key success for this case
study was the dedication by the case study site to make
a change, the dedication by the programmers to make
sure the ioXpress solution t the facility like a glove and the
dedication by the sites engineers and supervisors to ensure a
smooth implementation.
REFERENCES
1. Center for Chemical Process Safety (2003). Guidelines
for Investigating Chemical Process Incidents (2nd
Edition).. Center for Chemical Process Safety/AIChE,
NY, NY
2. Environmental Protection Agency 40CFR68
Accidental Release Prevention Requirements,
http://www.epa.gov/fedrgstr/EPA-AIR/1996/June/
Day-20/pr-23439.pdf
3. Occupational Safety and Health Administration,
29CFR1910.119 Process Safety Management of
Highly Hazardous Chemicals <http://www.osha.
gov/>
4. Occupational Safety and Health Administration,
CPL 03-00-004, Petroleum Renery Process
Safety Management National Emphasis Program,
6/7/2007
Page 424 Page 423
At the Heart of Saving Lives - Shockingly Obvious!
Steve Jelfs, International Marketing Manager, Debrillation
Cardiac Science Corporation
9
th
ASSE-MEC-2010-58
ABSTRACT
Heart disease is the biggest killer in the world. Every
year some 460,000 people die in the USA from sudden
cardiac arrest (SCA). A signicant number die in the
workplace, with co-workers and customers at risk from
SCA. While cardio-pulmonary resuscitation (CPR) is a
vital component in the management of the SCA patient,
the only denitive treatment is early debrillation. For
every minute that debrillation is delayed survival falls
by ten percent.
Conclusion: The placement of automated external
debrillators (AEDS) within the workplace can increase
survival rates and save lives.
KEYWORDS
Heart disease; Sudden cardiac arrest; Cardiopulmonary
resuscitation; Debrillation; Survival.
1. INTRODUCTION
To Heart disease, in general, is the biggest killer in the
modern world. It is a sobering thought that each year;
in particular, sudden cardiac arrest (SCA) causes the
death of 400000 to 460000 people in the USA [1] and
over 700,000 across Europe [2]. Many of these deaths
occur in the workplace as both workers and customers
are vulnerable to this worldwide pandemic. Many of
these deaths are avoidable if the appropriate therapy
and treatment is available within a few minutes of the
onset of SCA. The placement of automated external
debrillators (AEDs) in the workplace can save lives
and allow corporate entities to deliver a Heartsafe
Environment to workers and customers.
Jobs involving shift work, high stress and exposure to
chemicals and electrical hazards increase the risks of
heart disease and cardiac arrest.
When a patient goes into SCA, the heart stops
functioning normally due to the irregular and chaotic
passage of cardiac impulses throughout the heart
typically ventricular brillation (VF), the most common
presenting arrhythmia, or ventricular tachycardia (VT).
Unless these arrhythmias are corrected within minutes
the victim will die as the heart is incapable of pumping
oxygenated blood, necessary for life, around the body
Research has shown that for every minute debrillation is
delayed survival falls by 10% [3]
Current survival rates outside of hospital are around
1-5% [4] which reects the difculty in getting early
debrillation to the patient as recommended by the
American Heart
Association (AHA) and European Resuscitation Council
(ERC) whose guidelines highlight the importance of
getting the rst debrillatory shock into the patient,
outside of hospital, in less than ve minutes [5]. However,
the placement of AEDs in specic public places has proven
that survival rates can be increased signicantly [6].

Fig 1 Survival graph minutes to debrillation v
survival rates)
Unfortunately, even in the best EMS system, it can often
take ten minutes or more to reach a victim in SCA and
while co-workers are generally rst on scene and can be
trained in basic life support skills such as cardio-pulmonary
resuscitation (CPR), a very useful skill that keeps the heart
oxygenated and ready for debrillation; the only effective
therapy for VF is early debrillation. Delays of ten minutes
or more in treating the patient reduces their chance of
survival to almost zero (Fig. 1). For many EMS services there
are specic problems in getting to the workplace SCA victim
quickly. The modern city is often grid-locked by heavy trafc;
many work places are high-rise buildings where security
entrances and elevators have to be tackled before the EMS
crew/doctor arrives at the stricken victims side. Multiple level
facilities can cause problems due to the time it takes to travel
from one level to the next. Some work places have over-
ground and underground facilities while others may have
huge compounds spread over a very wide area. These issues
can all cause delay in getting the SCA victim that important
early debrillatory shock.
2. WHAT IS DEFIBRILLATION?
Debrillation is the controlled application of a direct current
electrical charge to the heart.
This is achieved using an AED and two adhesive pads, the
latter being afxed to the victims chest. An electrical charge
is then delivered which will cause the hearts own natural
pacemaker cells to re-assert control and restore its normal
rhythm and thus ensure that oxygenated blood reaches the
victims brain.
Debrillation is, however, only one piece of the survival
jigsaw. If we are to give the victim of SCA the absolute
best chance of survival then we need to ensure that the
continuum of care is available and consistent.
2.1 The Chain of Survival
The Chain of Survival concept was introduced as a
theoretical treatment chain with four distinct links which, if
applied systematically, gives the SCA victim the best chance
of survival [7]:
Early recognition/Call for Help Recognising that
the victim has suffered a SCA and getting the EMS
unit activated.
Early CPR maintaining the oxygenation of the heart
and brain until debrillation can restore normal heart
function. By commencing CPR immediately survival
degradation has been observed to fall to 3-4% a
minute [8]
Early Debrillation delivering a direct current
shock to the heart to ameliorate the wave-fronts
of VF/VT.
Advanced Care airway control and cardio-active
drugs delivered by the EMS system upon arrival.
Typically, like any chain, it is only as strong as its weakest
link and the weakest link has long been recognised as
early debrillation. This weak link has contributed to
current poor survival rates across the world. Before the
availability of the AED the only place one could nd a
debrillator outside of hospital was in the EMS ambulance
which, for the reasons given previously, was often too late
on scene to help the SCA victim which compounded by the
lack of bystander CPR contributed to poor survival rates.
Considerable research has shown that witnessed SCA,
where early CPR has been initiated, has the best survival
outcome. A major study in the USA reported a doubling of
survival rates where SCA was treated with CPR and AEDs as
opposed to CPR alone [9]
As co-workers are the most likely to come across an SCA
victim in the workplace it makes sense that not only should
they be trained in CPR but also in using an AED.

Fig 2. The Chain of Survival giving the SCA victim the best
chance of survival.
3. AEDs AT THE HEART OF SAVING
LIVES
AEDs are safe, effective life-saving devices that are specically
designed for non-medical people to use the lay rescuer.
Developed over several years they are now becoming a
familiar feature of the work place and public areas such as
railway stations, airports, sports stadia and shopping malls in
the USA, UK and across the world. Where AEDs have been
placed, survival rates have increased considerably. In one
study, reporting on an AED program in Las Vegas casinos,
survival rates are reported at around 74% [10]. This study
highlights that at one casino, where over 200 AEDs have
been placed, there have been some 80 survivors recorded,
including 6 of the companies own employees.
Page 426 Page 425
3.1 How do AEDs Work?
How do AEDs work? How can the lay rescuer be re-
assured that the device is safe to use both for the victim
and the rescuer?
Like the AED itself the answers to these questions
are simple; the AED contains revolutionary software,
including a complex algorhythm, that allows the device
to detect the need for the victim to receive a debrillatory
shock or not.
AEDs are designed to be used on unresponsive victims
who are not breathing normally and the lay rescuer
simply has to open the lid (which acts as an on switch)
and follow the audible and visual voice prompts which
instruct the user to place the two debrillation pads,
attached to the AED, onto the victims chest.
Once attached the AED analyzes the victims heart
rhythm and decides very quickly whether they require
a shock or not. If the patient requires a shock the
device will automatically charge and invite the user to
press the ashing shock button
This action will then deliver a safe electrical shock to
the victims heart at a level determined by a calculation
of trans-thoracic impedance (the amount of resistance
to electrical impulses across the chest) and individually
customised to that victim debrillation is a unique but
very effective therapy that momentarily stops the heart
and allows its natural pacemaker cells to re-start. Should
the AED detect that the victim has a normal heart
rhythm, or any other type of non-shockable rhythm, it
will direct the user to apply the appropriate basic life
support (BLS) procedures, as required. It is impossible
to deliver a shock to a patient who does not require
one. The AED has a very high sensitivity and specicity
rating (the ability to both identify a shockable and non
shockable rhythm respectively) which makes this an
ideal and safe emergency tool for the lay rescuer [11].
The use of a semi-automatic AED in saving lives has
been well documented in the past few years. Recent
technological advances, however, have shown that
introducing fully automatic AEDs can lead to even
quicker debrillation as the number of steps involved
in delivering a shock to the SCA patient is considerably
reduced. Time to shock is fast becoming the current
mantra within the world of resuscitation and the race is
on to produce an AED that can deliver therapy in as few
seconds as possible. Similarly, advances in producing
AEDs with more descriptive voice prompts, allied to
debrillation and CPR, and an in-built metronome to help
with the rate and rhythm during CPR (RescueCoach),
have opened new horizons in respect of providing
resuscitation tools for the minimally trained or untrained
rescuer [12]

Fig 3. Pushing the shock button when prompted by
the AED delivers an electrical shock to the victims heart
4. CHOOSING THE RIGHT AED
The American analyst company, Frost & Sullivan, has
estimated that currently the worldwide AED market
is worth in excess of US$1 billion [13]. Consequently,
many companies are now manufacturing AEDs in order
to capitalise on this rapidly developing global market.
However, purchasers need to be aware of exactly what
they are buying as not all AEDs are the same. For example,
all cars will get the driver from A to B however some
marquees do it more effectively, safely and efciently. The
important issues one should take into account are that
while all AEDs will deliver a shock to the victim it is how
the AED arrives at that point and how clinically effective
the delivery of that shock is.
4.1 Characteristics of an AED
When buying an AED it is important to consider three
main characteristics:
Rescue-Ready Reliability will it work reliably
every time it is needed? This is an absolute
requirement. All AEDs have some form of testing
system however, it is necessary to ensure that all
3 critical components of the AED; the battery,
debrillation pads and the device itself are
automatically self-tested on a daily, weekly and
monthly basis to ensure 100% reliability.
Ease of Use is the device easy to use in a stressful
rescue situation? This is vital for the lay rescuer who
will be under considerable stress while treating a
co-worker, friend or colleague. Under stress the
inexperience rescuer is likely to freeze and forget
rescue protocols if they are too complex. The AED
should have pre-connected debrillation pads which
are interchangeable (and regularly tested for presence
and function) thus simplifying the number of steps for
the lay rescuer to implement. In addition automatic
AED operation means that the rescuer is able to
perform life saving debrillation even quicker.
Technology - having up to date, cutting-edge
technology is absolutely paramount in a life-saving
device such as an AED. The AED should measure the
victims impedance and be capable of delivering a
variable energy shock customized to the individual
patient. If the rst shock is unsuccessful the AED
should be capable of escalating the energy delivery
on the second and subsequent shock. By escalating
the energy the victims debrillatory requirements
can be fully met. In addition the use of automatic
synchronised shock therapy can be very effective
in treating ventricular tachycardia (VT) [14]. Such
technology will allow the most efcacious therapy to
be delivered to the patient suffering SCA.

Fig 4. Choosing the correct AED is paramount
5. IMPLEMENTATION AND TRAINING
5.1 Site survey and Optimum Placement
It is important to dene the correct number of AEDs required
for an individual workplace environment. For example,
placing one AED in a fteen-storey building will not allow
a rescuer to reach an SCA victim within the AHA guideline
of 5 minutes as discussed previously. Given that SCA is
a random event that can occur at anytime, anywhere to
anybody at any age, a site survey should be carried out in
order to determine the optimum number of AEDs required
and their optimum placement. This requires a physical
survey of the site/building to determine how many AEDS are
required and where they should be placed. Normally when
purchasing AEDS the whole package including equipment,
site survey and training can be purchased as a total solution
therefore making the implementation of the AED program
extremely easy and stress-free for the corporation.
5.2 Emergency Response Plan
The next stage is to determine a simple but effective
emergency response program that will dene who will
respond to an incident. Some corporations will direct
specic rst aid trained responders to be the rst line AED
responders while in others several people in a department
or on a oor will be trained to deliver a CPR/AED response.
It is also important to make sure that everyone within the
organisation/building/site knows about the AED(s), where
they are placed and how to react in the event of a co-
worker or customer collapse. The corporation should also
inform the local EMS organization so that they are aware
of the fact that AEDs, along with trained responders, are
based on site.
5.3 Training
Because the technique in carrying out CPR and using an
AED is a simple process a training course consisting of
a four hour program is sufcient for most responders.
Refresher training is very important and should be carried
out once every twelve or twenty-four months based on
local guidelines or legal requirements. In the USA, the law
requires a medical practitioner to advise on setting up the
program, provide medical oversight and issue a prescription
for the equipment. The position in other countries varies
considerably, however it is recommended that medical
advice should be obtained to assist in setting up an AED
program which will help to ensure that the program is as
robust as possible. It is also advisable to implement a data
recording system so that after use the AED rescue data can
be downloaded and proper clinical audit and rescue review
carried out.
Page 428 Page 427
Fig5. Training staff to use an AED is simple and
effective
6. CONCLUSION
Many world-wide studies have shown that early
debrillation saves lives and by placing AEDs in
corporations, workplaces and public places many more
lives could be saved. The Occupational Safety and
Health Administration (OSHA) estimates that 15 percent
of workplace fatalities - more than 400 per year - are
caused by sudden cardiac arrest. Of these victims, it is
estimated that 160 (40 percent) could have been saved
by debrillation within 5 minutes [15]. By making this life-
saving investment corporations can provide a Heartsafe
environment that will protect their most valuable assets
workers and customers from sudden cardiac death.
REFERENCES
[1] American Heart Association. Heart Disease and
Stroke Statistics2005
Update. Dallas, Tex: American Heart Association;
2004.
[2] European Resuscitation Council Guidelines for
Resuscitation, 2005.
[3] American Heart Association, Chapter 4:
Debrillation. In: Cummins RO, ed. Textbook
of Advanced Cardiac Life Support. Dallas, TX:
American Heart Association; 1994:1-2.
[4] Gillum RF. Sudden coronary death in the United
States: 1980-1985. Circulation. 1989; 79:756-
765
[5] Guidelines 2000 for Cardiopulmonary Resuscitation
and Emergency Cardiovascular Care; International
Consensus on Science. Circulation 2000: vol 102:
8: August 22, 2000
[6] Colquhoun M.C et al; A national scheme for public
access debrillation in England and Wales: Early
results. Resuscitation2008; 78:275-280
[7] Emergency Cardiac Care Committee and
Subcommittees. American Heart Association.
Guidelines for cardiopulmonary resuscitation and
emergency cardiac care, I; introduction. JAMA.
1992; 268: 2171-2183.
[8] AHA Guidelines 2005; Part 5; Electrical Therapies;
Automated External Debrillators, Debrillation,
Cardioversion, and Pacing; page IV-35
[9] The Public Access Debrillation Trial Investigators.
Public-Access Debrillation and Survival Out-of-
Hospital Cardiac Arrest. NEJM. Vol 351: number 7:
August 12, 2004.
[10] Terence D Valenzuela et al. Outcomes of Rapid
Debrillation by Security Ofcers After Cardiac
Arrest In Casinos. NEJM. Vol 343: number 17:
October 26, 2000.
[11] Initial Clinical Experience with a Fully Automatic In-
Hospital External Cardioverter Debrillator.
Thomas A. Mattioni et al. Pacing and Clinical
Electrophysiology, Volume 22, No.11, November
1999
[12] Benjamin S Abella; Salem Kim; Alexandra Colombus;
Cheryl L Shea; Lance B Becker :Untrained Volunteers
Perform High Quality CPR When using an Automatic
External Debrillator with a CPR Voice Prompting
Algorithm. Circulation. 2007;116:II_437.
[13] Frost & Sullivan, Western and Eastern European
Markets for External Cardiovascular Debrillators
(B674-54); 2004
[14] I. Turner, S. Turner, A.A. Grace. Timing of
debrillation shocks for resuscitation of rapid
ventricular tachycardia: Does it make a difference
Resuscitation 80 (2009); 183-188
[15] Occupational Safety and Health Administration.
Cardiac Arrest and automated external debrillators
(AEDs). Technical Information Bulletin TIB 01-1217.
A Comparison of Indices for Predicting
Heat Stress in UAE Construction Workers
Dr. John Schneider, Dept of Community Medicine, U.A.E University, Al-Ain,
Graham Bates, School Public Health, Curtin University, Perth, Australia
9
th
ASSE-MEC-2010-59
ABSTRACT
The objective was to compare the predictive capacity of the
Thermal Work Limit (TWL), with the most commonly used
international heat stress index (WBGT) for environmental risk
assessment and to correlate this with physiological responses
of thermally stressed workers.
A prospective longitudinal study was undertaken of building
construction workers in Al Ain. Aural temperature, uid
intake, urine SG and continuous heart rate monitoring
were used to assess the physiological responses to heat
stress. TWL and WBGT were calculated from environmental
measurements and used to assess stress.
All subjects commenced work euhydrated and maintained
this status over the shift. There were no changes in core
temperature or continuous heart rate monitoring, despite
substantial changes in thermal stress.
WBGT calculations indicated that cessation or modication
of work hours was indicated on several work days although
there was no evidence of adverse health indices. TWL readings
were a better indication of the physiological parameters
measured.
KEYWORDS
Heat Stress, Indices, WBGT, Thermal Work Limit.
1. INTRODUCTION
The Gulf States have thousands of expatriate labourers
working in very hostile environmental conditions during
summer, some of harshest in the world. Exposure to these
conditions presents a signicant risk to their health, safety
as well as their productivity, however, little data has been
gathered to better understand the physical strain imposed
on these workers. At present regulatory control of exposure
to heat stress has relied on work bans during certain hours
of some summer months rather than reliance on the use of
physiologically based heat stress indices.
Maintaining a stable core body temperature in the face
of changing environmental conditions and metabolic
workloads allows humans to function in diverse climates
and surroundings. In hot conditions, thermoregulation
depends upon the dissipation of body heat to the
environment. When ambient temperatures exceed the core
body temperature (37o C) heat loss though evaporation of
sweat is the only successful physiological response, as loss
through convection and radiation becomes compromised.
1.1 Hydration
Thermoregulation in this situation is dependant on
sweating. The rate of perspiration varies considerably,
depending upon the climatic conditions, exercise intensity
and clothing worn [1]. Sweat rates between 0.3 and 1.5
L per hr can be expected of workers in hot climates [2]
resulting in large volumes of uid loss over the day. This
can result in dehydration if adequate uid is not replaced.
In thermally stressful conditions, structured rehydration
including drinking at mealtimes is important because eating
encourages uid intake, and electrolytes in food promote
water absorption as well as replacing sweat losses [3].
The major short-term implications of dehydration result from
depleted blood volume and the consequent cardiovascular
strain. Sweat is hypotonic to blood and causes water loss
from both the intracellular and extracellular compartments,
with most signicant effects occurring due to plasma
depletion. The reduced blood volume causes a compensatory
increase in heart rate of around 10 beats.min-1 for every
one percent of body weight lost [4]. Heat causes additional
cardiovascular strain because blood is required for heat
loss as well as maintaining adequate perfusion to working
muscles. Thus evaporative and convective heat loss become
Page 430 Page 429
less efcient when an individual is dehydrated, as
sweating [5] and skin blood ow [6] are both reduced.
Consequentially, core temperature rises, with increases
occurring at 1% hypohydration. Core temperature
continues to rise as dehydration progresses, with no
advantage being conferred by acclimatisation [7, 8].
Core body temperature increases at a greater rate in
hypohydrated subjects, and at the same time, they
exhibit reduced tolerance to elevated temperature [9].
Studies have shown that core body temperature, heart
rate and cardiac output reach certain critical values at the
point of exhaustion [10]. Thus it follows that dehydration,
which elevates both heart rate and core temperature,
causes signicant physical performance decrements.
Water decits of 1-2% of body weight in a moderate
environment results in a 6-7% reduction in physical
work capacity, water loss of 3-4% of body weight in the
same environment causes a reduction of 22% physical
work capacity [11]. The additional cardiovascular strain
imposed by a hot environment means that a 4% body
water loss can cause a physical work capacity reduction
of around 50% [12]. Other factors associated with
dehydration that accelerate fatigue are increased rate
of glycogen depletion, greater metabolite accumulation
and decreased psychological drive for work or exercise
[13].
Dehydration also has marked cognitive effects. At
2% hypohydration performance in intellectual tests is
affected, and becomes progressively worse as water
decit increases [14]. Impaired concentration, reasoning
and mood can occur due to dehydration and the
concomitant increase in core body temperature. Not
surprisingly, workplace accidents are more common in
hot environments, and are often associated with heat
stress and dehydration [15].
More deleterious health effects can occur if dehydration
is allowed to progress, as it increases the likelihood
of heat related illness. A number of conditions are
associated with heat stress and dehydration, namely
heat rash, heat exhaustion, heat cramps, heat oedema,
heat syncope (fainting), and chronic heat fatigue.
Thermoregulatory failure can occur in severe cases of
dehydration and hyperthermia, resulting in heat stroke,
an often fatal condition [16].
Several long-term health consequences of dehydration
have been documented. There is a well-known link
between inadequate uid intake and renal calculi (kidney
stones), and a recent study illustrated a high incidence of
bladder cancer in subjects who had experienced chronic
dehydration [17].
It is therefore imperative for workers performing physical
work in hot conditions to maintain their hydration status
in order to maintain health and prevent accidents
associated with the consequent reduced cognitive
capabilities. The development of dehydration is therefore
a signicant indicator of increasing risk to health resulting
from heat stress.
1.2 Physical Fatigue
Intense or prolonged physical activity especially in the
heat may result in fatigue. Though the causes, symptoms
and performance consequences of fatigue are complex
and variable, physical fatigue can be classied as either
local or systemic. Local fatigue develops when the blood
ow to a working muscle is inadequate, resulting in a
reduced O2 supply and metabolite clearance. As O2
levels drop, the tissue relies increasingly on anaerobic
metabolism with the production of lactic acid. Increased
acidity and the accumulation of metabolites reduce
the efciency of energy production, limiting the work
duration of the tissue. Local fatigue normally occurs in
static or high intensity work. However light to moderate,
long duration work is more commonly associated with
systemic, or whole body fatigue. Systemic fatigue can
be quantied by measuring the heart rate, O2 uptake,
blood pressure, respiration rate, core body temperature,
or perceived fatigue of a worker. Continuous heart rate
recording is the most practical and informative measure,
as it provides information about the total, peak and
specic muscle work loads, the thermal stress of the
environment, the work-rest pattern and the work pace
or mental stress associated with the occupation [18].
Heart rates can be used to provide guidelines for acceptable
work intensities. The World Health Organisation (WHO)
has recommended that an average heart rate over the
duration of a working shift should not exceed 110 beats
min-1. This is somewhat below research ndings that
suggest performance deteriorates when mean working
heart rates exceed 120 beats min-1[19]. An individuals
maximum heart rate can be approximated by subtracting
their age from 220 beats.min-1. Though the physiological
basis for such guidelines is scant, ISO9886 advises that a
persons heart rate should never exceed their maximum
heart rate minus 20 beats.min-1[20].
A useful measure calculated from heart rates is the cardiac
reserve, being the difference between the maximum and
basal heart rates of an individual. When mean working heart
rate is presented as a percentage of the cardiac reserve, this
gives an indication of the sustainability of the workload being
carried out. Percentage of cardiac reserve is approximately
equivalent to % VO2 max, or maximum oxygen uptake [21].
Increments in work intensity will increase heart rate and
oxygen uptake (VO2) proportionally and therefore % cardiac
reserve and % VO2max. Several studies have shown that a
given work load is sustainable if % VO2max doesnt exceed
33-35% [22, 23]. Core body temperature begins to rise if the
% VO2max exceeds about 50%. The type of exercise being
performed also inuences VO2max. Upper body exercise is
more demanding on the cardiovascular system than lower
body work, consequentially the VO2max during arm work is
about 70% that of work performed by the legs [24].
1.3 Central Fatigue
Central fatigue refers to reduced central nervous system
performance, experienced as mental tiredness or exhaustion.
In cases where physical and mental fatigue occur
simultaneously, there is often a perceived increment in the
level of exertion required to complete a given task. Central
fatigue however, often occurs without physical fatigue,
particularly in occupations that are mentally or perceptually
demanding [6].
Lack of sleep is a common cause of central fatigue.
Performance decrements due to sleep loss are greatest in
long duration tasks that are mentally demanding. Reduced
CNS arousal in mentally fatigued subjects has been illustrated
using EEG, which shows diminished electrical activity in the
brain in response to auditory signals. Fatigue due to lack of
sleep can also cause prolonged heart rate recovery periods
after exertion, and increased resting heart rates. There is
also a higher prevalence of sleep deprivation in night-shift
workers [6].
Fatigue can be considered in a broader sense to encompass
the lifestyle, health and welfare implications of working in
a stressful or taxing environment. Industrial workers away
from family and friends in the UAE present a myriad of
psychosocial issues that may exacerbate fatigue.
1.4 Physical Environmental Assessment
Physical labour in a hot and humid environment imposes
considerable physical strain on the workers. In order to
reduce health risks and maximise productivity industrial
operations in hot climates must carry out quantitative heat
stress assessment of the workplace.
The degree of thermal stress imposed by the environment
depends on several variables. These are the dry bulb
temperature, wet bulb temperature (measuring humidity),
wind speed (convection) and radiant heat. However,
calculation of a threshold for safe versus unsafe work
also requires consideration of factors affecting the individual
worker. The work intensity, clothing worn, and the heat
tolerance of the subject will all affect the risk of heat related
illness or injury.
Several indices have been developed in an attempt to
quantify thermal strain. A widely used index has been the
Wet Bulb Globe Temperature (WBGT), which is still the
standard in many industries. It has been used by the National
Institute for Occupational Safety and Health (NIOSH) and
the International Organisation for Standardisation (ISO)
to set work limits and guidelines for work/rest cycling in
thermally excessive environments. Calculated using the
natural wet bulb, dry bulb and globe temperatures, the
WBGT is compared to estimated metabolic work loads for
the task or tasks being performed. From this it is established
whether the environment is excessive given the required
workload. The WBGT is relatively easy to measure and the
instrumentation is not overly expensive, however it has
several shortcomings as a measure of thermal stress. It does
not incorporate direct measure of wind speed, and requires
estimation of metabolic rates metabolic rates, which
can have a margin of error up to 50% [25]. This index is
thought to be too conservative for Gulf conditions, and as
demonstrated by this study, its stringent application could
result in prolonged and unnecessary shutdowns of UAE
construction sites particularly during summer.
Recently developed indices have addressed the inadequacies
of the WBGT to provide more meaningful and useful
measures of environmental heat stress. Of these the
most practical and informative is the Thermal Work Limit
(TWL) [26], developed from published studies of human
heat transfer and established heat and moisture transfer
equations through clothing. The TWL is an integrated
measure of the dry bulb, wet bulb, wind speed and radiant
heat. From these variables, and taking into consideration
the type of clothing worn and acclimatisation state of the
worker, the TWL predicts the maximum level of work that
can be carried out in a given environment, without workers
exceeding a safe core body temperature and sweat rate.
In excessively hot conditions, the index can also determine
the safe work duration, thus providing guidelines for work/
Page 432 Page 431
rest cycling. Sweat rates are also calculated, so the level
of uid replacement necessary to avoid dehydration
can be established. The TWL guidelines have been
implemented in several Australian mines, and have
produced a substantial and sustained decrease in the
number of cases of heat related illness. Measured in
Watts.m-2, the TWL can also be used to calculate loss
of productivity due to thermal stress and compare the
cost of interventions (refrigeration, ventilation) with
the decrement in productivity [26]. The current study
compared TWL and WBGT as thermal stress indices.
2. METHODS
This study was carried out at a building construction site
in Al Ain, UAE, during May (approaching summer).
All participants were volunteers who gave their written
and informed consent to participate in the study,
which was authorised by management and approved
by the Al-Ain Medical District Human Research Ethics
Committee.
At commencement general demographic, health-risk
behaviours, and lifestyle data was obtained by interview,
as was anthropometric data in the form of height,
weight, and BMI for each worker.
A total of 22 subjects (divided into 3 groups - carpenters,
steel xers, and general labourers) were studied, each
group over 3 consecutive days (66 subject/day records
over 9 study days). All were male expatriates employed
by a labour hire company, working 12-hour shifts, 6
days per week. They were provided with air-conditioned
sleeping quarters at the labour camp. Twelve were from
India and ten from Bangladesh.
They were engaged in the construction of a large
concrete water feature outside of a multi-story ofce
building. The nature of the work precluded any provision
of shade other than that offered by the nearby building.
An air-conditioned mess hall was used for the 1-hour
meal break and ample supplies of cool water were readily
available on site, and their consumption encouraged by
the contractor.
The objectives of the study were:
To determine if workers were becoming physically
fatigued during the 12 hr shift and over a 3 day
period, using heart rate monitoring
To compare workplace heat-stress risk assessments
using the Thermal Work Limit and WBGT indices.
2.1 Worker Monitoring
Fluid intake: Fluid consumption was determined by
allocating a separate water container to each worker
participating in the study allowing shift uid consumption
to be calculated. A record was also kept of additional uid
intake in the form of tea, coffee, or soft drinks consumed
during the shift.
Hydration status: This was determined by
measuring the specic gravity (SG) of urine samples
collected from subjects at the start, middle, and
completion of each shift, using a handheld, calibrated,
Atago optical urine refractometer.
Physiological strain: Subjects were tted with Polar S720i
heart rate monitors, providing continuous HR data (1
recording every 30 sec). The data was downloaded at
the end of each shift and used to calculate mean and
maximum working heart rates as well as percentage of
cardiac reserve. Resting heart rates were taken before
the start of the rst shift. The participants each wore the
monitors for 3 consecutive days. Average heart rates for
the morning and afternoon sections of the shift were
calculated to identify physical fatigue developing through
the shift.
Core body temperature measurement was also recorded
at the beginning and end of each shift using tympanic
thermometers.
2.2 Workplace environmental condition
monitoring
In order to quantify the level of environmental heat
stress, the environmental conditions were monitored at
the workplace on 4 occasions (9am, 12md, 2pm and
4pm) during each shift. A Calor Heat Stress meter was
used to determine wet (WB) and dry bulb temperature
(DB), black globe temperature (radiant heat), wind speed,
and barometric pressure and from these measurements
calculations of mean radiant temperature, relative
humidity, WBGT and Thermal work limit (TWL) values
were determined.
3. RESULTS
Figures 1-5 show the breakdown by time of day for the
physiological data obtained.
Figure 1 shows that the core temperature of the workers
(n=22), as monitored by measurement of aural temperature
twice daily, was constant over the 3 days of the study, and
heart rates (gure 2) altered little throughout the shift or
from day to day, despite signicant changes in environmental
thermal stress, suggesting that the workers were not being
physically fatigued during their shift.

Figure 1 - Aural Temperature am & pm
Averages for each day of the study are shown.

Figure 2 - Average Heart Rates
Averages from continuously recorded heart rates for the
morning and afternoon work period of each of the three
study days.
The hydration data, shown in (g 3), represents the average
specic gravity of urine measured at the start and end of
shift and during the lunch break. This indicates that the
workers commenced work well hydrated and maintained
their hydration status throughout the shift and from day 1
to day 3 (n=66).

Figure 3 - Urine Specic Gravity
Environmental conditions were recorded on four occasions
daily. Table 1 shows mean and range for each parameter
over the nine days of the study. WBGT and TWL values
computed from these readings.

Page 434 Page 433
Table 1. Environmental conditions over the study period Table 3. WBGT Interpretation from ACGIH Information (27)
Figure 5- WGBT Catculations
Time
0800
1200
1400
1600
DB
(
o
C)
37.9
(32.5-44.0)
42.5
(40.1-48.2)
44.7
(42.7-49)
41.0
(32.9-46.6)
WB
(
o
C)
21.3
(19.4-24.3)
21.8
(18.4-24.9)
20.6
(17.3-23.2)
19.0
(16.4-22.3)
GT
(
o
C)
44.8
(38.5-51.2)
52.1
(56.5-49.2)
51.8
(47.7-55.5)
44.3
(33.9-53.1)
WS
m.s
-1
1.4
(0.4-2.0)
1.7
(0.8-3.1)
2.0
(1.3-4.6)
2.4
(0.3-6.2)
WBGT
(
o
C)
26.8
(24-30.7)
28.6
(26.9-30.8)
27.8
(26.9-28.9)
26.1
(24.5-27.9)
TWL
W.m
-2
237.7
(179-284)
194.8
(151-225)
189.3
(122-240)
230.6
(187-279)
DB = dry bulb, WB = wet bulb, GT = globe temperature (radiant heat), WS = wind speed, WBGT = Wet Bulb Globe
Temperature, TWL = Thermal Work Limit.
Values are mean (n=9) and range (parentheses)
The environmental stress as measured using the TWL,
altered considerably over the duration of the day.
Figure 4 shows the Thermal Work Limit as calculated on
four occasions per day, and averaged for each of the
three study days. The stress was lower in the morning
and late afternoon readings; whilst midday was harsher
on all 3 days, as indicated by the lower TWL readings.
Despite this there were no signicant differences in
subject variables either within or between days, and TWL
rarely fell below the limit for performance of unrestricted
work by self-paced workers (Table: 2).
Fig. 4 - Thermal Work Limit (TWL)
Table 2. Recommended TWL limits and interventions for self-paced work
In comparison WBGT values consistently exceeded 27.5 oC, the recommended limit for moderate work, especially
during the middle of the day. Table: 3 shows the recommendations for work activity and scheduling as indicated using
WBGT calculations.
TWL Limit (W.m-2)
< 115
115 to 140
> 140
Name of limit/zone
Withdrawal
Buffer zone
Unrestricted
Interventions
No ordinary work allowed. Work only allowed in a safety
emergency or to rectify environmental conditions
Try to improve working conditions
No person to work alone. No unacclimatised person to work.
Figure 5 shows the WBGT indices obtained during the study,
with moderate work effort and 50% work / rest cycling. It
can be seen that although the physiological data indicated
no signs of physiological distress, with this very conservative
assessment, there were still several occasions (10/33, ~30%)
when, using the WBGT indices, additional risk management
intervention was deemed necessary.
WBGT (n 34) Moderate 50%Work 50%Rest = 29.5
23
24
25
26
27
28
29
30
31
32
4. DISCUSSION
4.1 Hydration
Maintaining body uid levels whist working in a hot
environment is essential, not only for the health and safety
of the worker, but also to optimise performance and
productivity.
The results of this study have illustrated good hydration prior
to the commencement of the shift, which was maintained
over the course of the shift. These results supported the
practice on this site of unrestricted access to water facilitated
by the use of a personal water bottle, relled it as necessary
during the shift.

4.2 Fatigue
Fatigue is a complex process with physiological, psychological
and sociological components and implications. Major
consequences of any type of fatigue are reduced productivity
and increased likelihood of workplace errors and accidents,
and as a consequence, is a signicant concern in industrial
operations such as the construction and oil industry.
Acclimatised Workers (8h/d, 5d/w)
Work Demands
100% Work
75% Work / 25% Rest
50% Work / 50% Rest
25% Work / 75% Rest
Light
29.5
30.5
31.5
32.5
Moderate
27.5
28.5
29.5
31
Heavy
26
27.5
28.5
30
Very Heavy
27.5
29.5
Page 436 Page 435
Continuous heart rate monitoring demonstrated no
signicant change in heart rate between the morning
and afternoon shift periods or from day 1 to day 3,
suggesting that workers were not fatiguing over the
duration of a shift (am vs pm) or from day to day (g 2).
This would suggest that either workers are not becoming
fatigued, or they are self-pacing, that is, slowing down
to avoid over-exertion. The latter seems most likely,
and would appear to be the key factor in avoiding heat
related injury. Other work has shown similar results [28].
The environment (thermal stress) changed signicantly
(g 4) however heart rates remained constant, over the
day and from day to day.
It is not fanciful to suggest that workers if allowed to
self-pace will alter work rate to maintain their heart rate
within a narrow range. These workers varied in tness
level and experience; however they all worked at a
similar heart rate. It is recognized that the number of
subjects (n=22) is not sufcient to conclude that workers
even in harsh conditions (DB temperature reached 53
oC on one occasion and was reaching the mid to high
40s most days) will be safe if they are well hydrated
and allowed to self-pace, however it is good evidence
for promoting a more rigorous study using a far greater
number of workers.
4.3 Environmental Assessment
A risk assessment of the thermal environment at the
construction site was carried out over a 10-day period
during the month of June, using the Thermal Work Limit
(TWL) and WBGT as measures of heat stress.
The workplace was assessed on 4 occasions daily to
identify variation in thermal stress. Though the average
TWL on most occasions was suitable for unrestricted
work, i.e. above 115 W.m-2 (table 2), on occasions
the risk of heat strain on some occasions did become
substantial, reaching TWL levels as low as120 W.m-2
(DB temp >50 oC). This, however was not reected in
the heart rates for that specic time, or the reporting of
symptoms, or deleterious effects, by the workers. By
comparison there were few days during the study when
risk assessment using WBGT would not have required
work to be shut down for at least part of the day. These
ndings reinforce the proposition that self-pacing in the
construction industry is imperative if heat illness is to be
avoided and the importance of good hydration of the
workforce.
5. CONCLUSIONS
The data demonstrate that well hydrated self-paced
workers can work without adverse physiological effects
under conditions deemed too severe by the WBGT. It
was demonstrated that WBGT is too conservative and
inappropriate for practical use in industry. A more
scientically robust index is urgently needed, especially
in hotter parts of the world where manual tasks are
undertaken in very harsh conditions. TWL has been
published and validated in a controlled environment [28,
29]. It measures all needed environmental parameters,
takes into account clothing and provides the metabolic
rate (the output) that people can sustain in a specic
environment (in W.m-2).
The value of these ndings may alter the current local
approach to working in heat, which is to stop work
when a single environmental parameter reaches a
threshold point or the cessation of work during the
middle of the day during summer. These guidelines and
legislative requirements are unscientic and often cause
more problems than they solve (industrial disputes, and
unnecessary production costs and delays). A far greater
push to establish an index that will both protect workers
yet not punish industrial productivity is well overdue.
REFERENCES
[1] Shapiro Y, Pandolf KB, Goldman RF. Predicting
sweat loss response to exercise, environment and
clothing. Eur J Appl Physio., 25:149-152, 1982
[2] Brake DJ, Bates GP., Fluid losses and hydration status
of industrial workers under thermal stress working
extended shifts. Occup Environ Med.,;60(2):90-
96. 2003
[3] Maughan RJ, Leiper JB, Shirreffs SM. Restoration of
uid balance after exercise-induced dehydration:
effects of food and uid intake. Eur J Appl
Physiol., 73:317-325 1995.
[4] Wilson JR, Corlett EN. Evaluation of Human Work.
In: Human Response to Thermal Environments:
Principles and Methods; 539. 1985.
[5] Bittel J, Henane R. Comparison of thermal
exchhanges in men and women under neutral and
hot conditions. J. Physiol. (Lond.); 250:475-489.
1975.
[6] Kenney WL, Tankersley CG, Newswanger DL, Hyde
DE, Puhl SM, Turner NL. Age and hypohydration
independently inuence the peripheral vascular
response to heat stress. J Appl Physiol; 68(5):1902-8.
1990.
[7] Sawka MN, Montain SJ. Fluid and electrolyte
supplementation for exercise heat stress. The American
Journal Of Clinical Nutrition 72(2):564S-572S 2000.
[8] Cadarette BS, Sawka MN, Toner MM, Pandolf KB.
Aerobic tness and the hypohydration response
to exercise-heat stress. Aviat Space Environ Med;
55(6):507-12. 1984.
[9] Marino FE, Kay D, Serwach N. Exercise time to fatigue
and the critical limiting temperature: effect of hydration.
Journal of Thermal Biology 29(1):21-29. 2004.
[10] Gonzalez-Alonso J, Teller C, Andersen SL, Jensen FB,
Hyldig T, Nielsen B. Inuence of body temperature on
the development of fatigue during prolonged exercise
in the heat. J Appl Physiol; 86(3):1032-1039. 1999
[11] Sawka MN, Pandolf KB. Effects of Body Water Loss
on Physiological Function and Exercise Performance.
In: Gisol C, Lamb D, editors. Perspectives in Exercise
Science and Sports Medicine: vol 3, Fluid Homeostasis
During Exercise. Carmel: Cooper Publishing Group;
1-38 1990.
[12] Bates G, Matthew B. A new approach to measure
heat stress in the workplace. In: Aust. Inst. of Occ. Hyg.
15th Ann Conf.; 1996 30 Nov-4 Dec; Perth; 1996
[13] Bruck K, Olchewski H. Body temperature related
factors diminishing the drive to exercise. Can. J. Physiol.
Pharmacol.; 65:1274-1280. 1987
[14] Gopinathan PM, Pichan G, Sharma VM. Role of
dehydration in heat stress-induced variations in mental
performance. Arch Environ Health; 43(1):15-7. 1988
[15] Keneck RW, Hazzard MP, Armstrong LE. Minor Heat
Illnesses. In: Exertional Heat illnesses: Human Kinetics
Publishers Inc. USA; 2003
[16] Donoghue A, Sinclair M, Bates G. Heat exhaustion in a
deep underground metalliferous mine. Occup Environ
Med; 57:165-174. 2000
[17] Michaud D, Spiegelman K, Clinton S, Rimm E, Curhan
G, Willett W, et al. Fluid intake and risk of bladder
cancer in men. New England Journal of Medicine;
340:1390-1397 1999
[18] Rodgers SH. Ergonomic Design for People at Work.
USA: John Wiley & Sons Inc. 1986.
[19] WHO. Health factors in Workers Under Conditions
of Heat Stress, Technical Report Series 412. Geneva:
WHO; 1969.
[20] ISO. ISO9886: Evaluation of Thermal Strain by
Physiological Measurements,: International Organisation
for Standardisation
[21] Evans WJ, Winsmann FR, Pandolf KB, Goldman RF.
Self-paced hard work comparing men and women.
Ergonomics;23:613-621. 1980.
[22] Goldman RF. Standards for human exposure to heat.
In: Mekjavic IB, Banister EW, Morrison JB, editors.
Environmental Ergonomics - Sustaining Human
Performance in Harsh Environments. London: Taylor
and Francis;. 99-129. 1988
[23] Bernard TE, Kenney WL. Rationale for a personal
monitor for heat strain. Am Ind Hyg Assoc J; 55(505-
514). 1994
[24] Rodahl K. The Physiology of Work. London: Taylor and
Francis Ltd.; 1989
[25] Parsons KC. In: Human Thermal Environments.
London: Taylor and Francis Ltd.; 104. 1993.
[26] Brake DJ, Bates GP. Limiting metabolic rate (thermal
work limit) as an index of thermal stress. Appl Occup
Environ Hyg; 17(3):176-186. 2002
[27] ACGIH. Heat Stress. In: TLVs and BEIs: Threshold Limit
Values for Chemical Substances and Chemical Agents.
Cincinnati: ACGIH; 2006.
[28] Miller V, Bates G. The Thermal Work Limit is a simple
reliable heat index for the protection of workers in
thermally stressful environments. Ann Occup Hyg;
51(6): 553-561. 2007.
[29] Bates G, Miller V. Empirical validation of a new heat
stress index. The Journal of Occupational Health and
Safety -Australia and New Zealand; 18(2):145-153
2002.
Page 438 Page 437
A Practical Approach to Heat Stress at ENOCs
Dubai International Airport Refueling Operations
Fraser Lindsay, Senior Industrial Hygienist
Emirates National Oil Company
9
th
ASSE-MEC-2010 60
ABSTRACT
A heat stress and hydration survey was conducted at
ENOC Aviation, Dubai International Airport.
Heat stress was assessed using Thermal Work Limit
(TWL) and compared with Wet Bulb Globe Temperature
(WBGT). New hydration methods were tested against
existing methods, including wearable hydration packs
and commercially available rehydration powder. WBGT
is more complex and too conservative. TWL is a simpler,
more practical approach to apply within the region.
Operators using wearable hydration packs demonstrated
better hydration levels at the end of their shift compared
to existing practices of using water bottles. It was not
possible to determine if there were additional advantages
from using a specic rehydration solution due to the
small number of samples in the current study.
Recommendations for work within reported TWL zones
and managing risks of heat stress are given.
KEYWORDS
Heat stress; WBGT; TWL; thermal; hydration
1. INTRODUCTION
Dubai international airport is an extremely busy airport
operating 24 hours a day. As such there is considerable
demand for ENOC refueling operators, particularly
during peak periods i.e. early morning and late evening.
Refueling operations are planned around aircraft
schedules and there is therefore very little scope to plan
the volume and pace of work of operators. Schedules
can be demanding. Work is predominately outdoors
and therefore operators are subjected to the full range
of weather conditions and extreme summer heat.
Concerns were raised regarding the potential length
of time employees spend outside, especially during
peak summer months where temperatures and relative
humidity are extreme and oppressive. The risks of
heat related illness are high, even with acclimatized
employees, although the options for controlling this risk
are restricted, based on the nature of the work.
A survey was proposed to assess actual physical
environmental parameters during peak summer
operations. In addition, interventions were proposed for
ensuring that employees remain hydrated under such
environmental conditions in order to control the main risk
factor dehydration. A combined survey was conducted
at Dubai International Airport during July 2009.
The main objectives of the survey were to:
Assess and compare physical environmental
parameters using the Wet Bulb Globe Temperature
(WBGT) and a new Thermal Work limit (TWL)
method;
Assess the risk of heat related illness for routinely
exposed refueling operators;
Assess employee hydration levels during their work;
and
Identify alternative hydration methods and compare
with existing hydration practices;
Make conclusions regarding the relevance and
practicality of a different heat stress index to
WBGT
Aviation refueling operators work from the main shared
refueling base within the airport. Employees use service
vehicles to move around the airport and to pump fuel
from the installed fuel hydrant system into aircraft fuel
tanks.
Service vehicles are used in one of two congurations.
The rst is under wing fueling where a small scissor
lift access platform built into the vehicle is raised to connect
hoses to fuel lling points on the underside of aircraft wings.
This method is used for all large aircraft. The second method,
used for smaller aircraft, makes use of the hose on a spindle
on the rear of the vehicle. This is unwound and connected
to the underside of the aircraft wing by climbing ladders or
simply from ground level.
Operators are assigned aircraft by a team of supervisors who
coordinate all refueling operations and requests. Employees
take a service vehicle to the designated area/aircraft stand
within the airport to refuel the aircraft. It is typical for
operators to complete one refueling operation and then
move directly to a second aircraft. In some instances they
may refuel up to four aircraft in a sequence before returning
back to the operations base. This determines their exposure
duration outside in the heat.
Supervisors normally recall operators after a set number of
aircraft (three) so that they may rest and rehydrate, especially
in summer months. However, staff shortages and aircraft
scheduling often mean this may not be practical.
The airport operators are busiest during early morning,
between 6am and 10am and late at night, between 9pm
and 2am. During early morning, most Emirates ghts leave
for long haul destinations and during the evening period
most ights return from worldwide destinations.
The length of time take to refuel an aircraft clearly depends
on the volume of fuel required. This is determined by a range
of factors including the weight of the fully loaded aircraft and
the weather conditions. In general, small aircraft for domestic
or short haul trips take between 30 and 45 minutes. Larger
aircraft, such as those used for short to medium haul, may
take between 45 minutes to 1 hours. The largest aircraft
i.e. the long haul, wide body aircraft may take 1.5 hours or
more.
The existing method of hydration used by refueling
operators at the airport was small, insulated water bottles,
holding 325ml. Employees lled this prior to leaving the
operations base to complete a sequence of refueling jobs.
Most employees only carried one bottle and therefore they
only carried 325ml of water to last between 1 and 4 hours
outside, in peak summer, before returning to the operations
base.
Employees may not necessarily know how many ights they
will do in a sequence of work as supervisors may direct them
while they are out or once they have nished a particular
ight. Therefore, the small amount of water that is carried
must be drunk sparingly in order to potentially last the
period of time that they may be out refueling aircraft.
325ml does not last long in summer conditions, particularly
when out for 3 hours or more which would be a sequence
of three aircraft.
In addition to water many employees often drank sports
drinks or powdered drinks as they assumed these helped
them rehydrate.
Operators can approach aircraft in different ways depending
on the carrier and adjacent vehicles. Operators normally aim
to approach an aircraft to refuel on the side that offers most
shade from the sun but this was not always possible.
During refueling operations an operator must remain outside
his vehicle monitoring the process and operating the dead
mans switch to supply the fuel. The dead mans switch is on
a long cord so they can walk around their vehicle but only
for short distances.
Aircraft which have been positioned at a stand overnight
and therefore have not recently had engines operational are
regarded as on ground aircraft. Aircraft that have recently
arrived and recently had engines operational are referred
to as arrival aircraft. The difference between these is that
arrival aircraft also contribute signicantly to heat exposure
due to radiant heat from engines which remain hot for
sometime after powering down. Employees working in the
vicinity of these engines during refueling are exposed to
this in addition to ambient conditions. Approximately 90%
of aircraft served by refueling operators were on ground
aircraft.

Another signicant additional source of heat was the aircraft
air conditioning exhaust. This is located on the belly of the
aircraft between both wings. When an aircraft is on the
ground and air conditioning is cooling the cabin, the hot air
is exhausted out through the belly, unfortunately in roughly
the same area that the refueling operator must work. This
also contributes to overall heat loading of the operators, in
addition to ambient conditions.
2. METHODS
In many countries, the measurement of environmental
parameters and subsequent assessment of risk of heat
stress/heat related illness is determined using one of many
heat stress indices. These may include Wet Bulb Globe
Temperature (WBGT), Predicted Sweat Rate (PSR), Heat
Page 440 Page 439
Strain index (HSI) and Humidex. The most commonly
used index is WBGT, as developed by the United States
Military.
In the USA, the American Conference of Governmental
Industrial Hygienists (ACGIH) has developed exposure
limits for heat stress based on WBGT, (ACGIH, 2009).
WBGT is composed of wet bulb, dry bulb and globe
thermometer physical measurements. However, this
index has been shown to be very conservative and
inapplicable to environments such as the Middle East
(Miller & Bates, 2007). If recommendations regarding
heat stress were followed by using WBGT as an index
then most employees working outdoors in the Middle
East would be considered to be at extremely high
risk heat related illness, worst case scenario would be
signicant numbers of deaths or from heat stroke, which
are not observed. This suggests a signicant degree of
acclimatization for employees in the region and supports
the fact that the WBGT is simply too conservative for
application in the Middle East (Miller & Bates, 2007).
A revised heat index has been developed by Prof.
Graham Bates et al in the School of Public Health,
Curtin University of Technology, Western Australia. It
was originally devised for use in the mining industry but
his research has since validated its applicability in regions
such as the Middle East (Bates & Schneider, 2008). This
index is known as Thermal Work Limit or TWL and
represents the maximum amount of work (as metabolic
rate, W.m-2) that can be exerted under the specic
environmental conditions.
The survey was designed to assess environmental
parameters and measure the employees TWL in addition
to specically measuring employee hydration levels with
and without interventions. Two interventions were
proposed; commercially available, wearable hydration
packs (CamelBak) and a commercially available soluble
hydration powder (Aqualyte). The study was conducted
over six days; three tests were conducted, over three
paired days.
The hydration tests ran in parallel to measurements of
TWL and were designed as follows:
TESTS 1 and 2
o Employees hydrate using water bottles and water
only (no other drinks)
o Employees hydrate using wearable hydration
packs containing water only
TEST 3
o Employees hydrate using wearable hydration
packs containing water only
o Employees hydrate using wearable hydration pack
containing water AND a specialist, commercial
rehydration product (Aqualyte) added to the
water
Air temperatures are obviously higher during day due
to signicant solar gain and radiated heat. In addition,
the early morning period is also one of the airports peak
operation times. Therefore, the day shift was selected for
the survey.
Each test was completed over two consecutive days
to ensure that weather conditions were comparable
between each day.
As the survey was restricted to day shifts, only employees
working on day shifts were selected. Employees were
selected at random from the team of operators available.
The shift times were 6am to 3pm.
Employees hydration levels were tested before starting
their shift, during (at mid-shift break) and once their shift
ended. Samples were collected in clean, sterile sample
bottles. Hydration testing was done by dip testing the
urine samples using an Atago digital urine refractometer.
This measures the specic gravity of urine.
As employees did not work in one specic area it was
considered most relevant to move the HSM around with
the operators. In addition, on the job observations were
required to validate operators work and environmental
conditions during each test. Therefore the Group EHS
Industrial Hygiene team shadowed operators during their
work in order to make observations and measurements
of environmental parameters throughout their shift. A
CALOR Environmental Instruments Heat Stress Monitor
(HSM) was used to measure the environmental parameters
and calculate the TWL.
The HSM is equipped with thermistor-based sensors to
measure air temperature, wind speed, and solar radiation.
A capacitive polymer-based sensor is used to measure
humidity, and a piezo-resistive absolute pressure sensor is
used for measuring barometric pressure and estimating
altitude.
The HSM simultaneously measures ve parameters: dry
bulb (air temperature), globe temperature (radiant heat),
relative humidity (RH), wind speed and air pressure. The
monitor was set to record measurements every six minutes.
The sensor specications of the HSM are as follows:
Dry bulb = + 0.2 C from 5-55 C
Globe = + 0.2 C from 5-70 C
RH = + 2% from 0-95% non condensing
Wind speed = 0.2 m/sec or 10%,
Whichever is the greater, from 0.1-8.0 m/sec
Pressure = 1.5 KPA from 40-115 KPA
Data are then combined using algorithms derived from
original eld and laboratory studies of the HSM. The output
of the model provides specic guidance on selected features
such as optimal work/rest cycles, the maximum safe duration
of a work shift, and hourly water requirements to replace
sweat loss.
The HSM uses a revised and updated version of the air cooling
power or ACP that uses wind speed in its computation. It is
this revised and altered formulation that has been named the
Thermal Work Limit algorithm (TWL) which is conceptually the
same as air cooling power and uses the same formulation.
The TWL is measured in W.m-2 or Watts of allowable work
in that specic, measured environment.
3. RESULTS
The assessments of environmental conditions, expressed as
Thermal Work Limit (TWL), from each of the HSMs during
each test are displayed on the following charts:
The Thermal Work Limit (TWL) i.e. amount of work (energy)
allowed under the given environmental conditions is
displayed as trend over time. Where the TWL is low, this
means that the amount of work permissible under these
conditions is reduced i.e. the conditions are not favourable
for extensive work and therefore the risk of heat related
injury increase. There are four zones that can be classied
according to risk, based on the TWL. These are as follows:
Restricted zone (< 115W/m)
Cautionary zone (115 140W/m)
Acclimatization zone (140 - 220W/m)
Unrestricted zone (> 220W/m)

Figure 1 Thermal work limit trends on 14th July 2009
Page 442 Page 441
Figure 2 - Thermal work limit trends on 15th July 2009 Figure 4 - Thermal work limit trends on 23rd July 2009
Figure 3 - Thermal work limit trends on 22nd July 2009 Figure 5 - Thermal work limit trends on 30th July 2009
Page 444 Page 443
The horizontal axes of these charts have been deliberately
removed. Each chart is a combination of three separate
HSM sampling trends, each with slightly different
sampling times. However, samples were collected
over the bulk of the shift i.e. between 6am and 3pm.
What is important is the trend of the TWL throughout
the shift as this illustrates the typical TWL zones that
employees worked in during that shift and this gives a
very good indication of their overall risk of heat related
illness. As TWL represent a limit of work rate under the
measured conditions a lower number is worse than a
higher number i.e. lower number means the amount
of work that can be done is less due to the extreme
environmental conditions. To simplify judgments each
of the four TWL zones have been colour coded to easily
identify the TWL zone.
The operators overall TWL trends were similar during
each test and this is primarily because they have similar
work patterns and are exposed to similar environmental
parameters. The TWL trend does show variability for
each employee and this is due to a number of factors.
The most important of these includes the number of
ights refueled by each operator as this dictates their time
outside in the heat. Time between ights was spent in
the operational base which is air conditioned. There is no
single exposure within a specic TWL, instead exposures
varying between all four zones depending on the
employees location and the environmental conditions at
the time. If you were to summarise the TWL trends from
the employees over each test it is possible to see that
the biggest portion of the operators shift is spent within
the acclimatization zone, followed by the unrestricted
zone. There are a number of extended time periods that
occur within the cautionary zone and the restricted
zone. In particular, measurements made on the 22nd
July (Figure 3) were of concern. TWL trends for Kasim and
Sharif showed that they were working in the restricted
zone for a large portion of their shift.
The results of the employee hydration levels are shown in
Figures 7 to 39 Mean values for tests made on different
have been calculated, where data permitted. Results are
organized by employee and the type of hydration used.
Hydration levels were assessed by urine specic gravity. A
specic gravity closer to 1.00 is closest to water i.e. well
hydrated; values greater than 1.00 indicate progressively
more dehydrated.
Figure 7 - Kasims hydration levels, by specic test

Figure 8 - Sharifs hydration levels, by specic test

Figure 9 - Ibrahims hydration levels, by specic test

The changes in hydration throughout the course of the
shift are particularly important. The blue line on all three
gures shows the mean hydration levels when employees
used only their standard issue insulated water bottle. Kasim
and Sharif both started their shift dehydrated, but drank
water throughout their shift and ultimately became more
hydrated by the mid- shift sample. However, by the end of
the shift they were more dehydrated than they were at the
start of the shift. Ibrahim started dehydrated and became
progressively more dehydrated by the end of his shift.
The red trend on each chart illustrates the mean trend for
use of the wearable hydration systems on each employee.
The results on all three employees follow the same trend.
There is evidence of much improved hydration levels at
the time of the mid-shift sample with slightly poorer levels
recorded at post-shift. However, the trend shows that all
three employees using the wearable hydration system were
more hydrated at the end of their shift than at the start of
their shift.
The green trend shows the results of hydration for
employees using the wearable hydration system and the
specialist commercial rehydration powder dissolved in the
water. Kasims trend shows increased hydration by mid
shift, but he actually nished his shift more dehydrated.
However, he did start his shift particularly well hydrated,
so it was likely that following exposure he would become
more dehydrated from being so hydrated. Sharifs trend
shows a similar tend to the test with the wearable hydration
pack and water. He started his shift dehydrated but became
more hydrated by mid-shift. This level of hydration was
largely maintained to the end of his shift. Ibrahims trend
showed that he became more dehydrated towards the end
of his shift when using the wearable hydration pack plus
the rehydration powder. This is actually because he stopped
drinking it in the morning as he did not like the taste of
the rehydration solution. His hydration had improved by the
end of his shift but this was because he was drinking water
again, but without rehydration powder.
4. DISCUSSION
The charts of TWL show the changes in environmental
parameters expressed as the limiting work rate and the
colour coding of TWL zones simplies reporting of typical
conditions and identication of risk, but what would the
equivalent assessment using WBGT?
Lets look at a common example, refueling of a large, wide
body aircraft, the Airbus A380. This can take up to two
hours to fully refuel. Factors relevant for WBGT calculation
are:
Employees were acclimatized.
Clothing worn was light trousers and long sleeve
shirt
Figure 6 - Thermal work limit trends on 31st July 2009
Page 446 Page 445
The work activity level could be regarded as
moderate
Rest periods in between are in air conditioned
ofce
The typical environmental parameters in summer
for this situation taken from this survey are:
o Dry bulb temperature 38C
o Wet bulb temperature 30C
o Radiant (Globe) temperature 42C
The WBGT calculation for outdoors is as follows: WBGT
= 0.7 WB + 0.2 GT + 0.1 DB, where WB = Wet bulb
temperature, GT = globe temperature and DB = dry bulb
temperature.
Based on these parameters the resulting WBGT value is
33C. There is no addition for long sleeve shirt and pants.
Therefore, if we were to allocate the ratio of work to
recovery as 75-100% then the following threshold limits
(TLVs) would apply for moderate work activity; Action
Limit - 25C and TLV - 28C. So at this ratio of work to
recovery (75-100%) we signicantly exceed the TLV of
25C as our calculated WGBT value is 33C.
If we drop the allocation of work to recovery to 0 -
25% then the Action Limit becomes 29C and the
TLV becomes 31.5C.The calculated WBGT value still
exceeds the TLV, so we would have to conclude that
work would not be permitted under these conditions
due to an unacceptable high risk of heat related illness.
In contrast, the same situation as calculated as TWL
would give a mean TWL of 130 W.m-2, which classes
it within the cautionary TWL zone. The relevance
of this is that work is not stopped; instead specic
recommendations must be implemented. These include
improving ventilation (where possible), redeploying
workers (if possible), maintaining supervision, excluding
non-acclimatised workers from work and ensuring
workers remain adequately hydrated. Employees
should carry at least two litres and hydration testing is
recommended.
When working in the unrestricted TWL zone, there is no
need for additional control measures or work restriction.
However, as the TWL drops down to the acclimatization
zone, through the cautionary zone to the restricted
zone, the requirements for work restriction and
additional control become extremely important in order
to reduce the risk of heat related illness.
Employees thermal environment was not uniform as
they work between an air conditioned operational base,
inside their vehicle cab when driving and outside during
refueling operations. Therefore their TWL trend was
variable. A signicant part of each employees shift fell
within the unrestricted zone, but the largest percentage
appears to be within the acclimatisation zone. The
main requirement for this zone is that employees must
be acclimatised to the local environmental conditions
before starting work. Non-acclimatized workers, such as
new arrivals or workers returning from vacation, should
be given time to acclimatize, normally 5-7 days. Non-
acclimatised workers can work but must be supervised
at all times.
Although large parts of the shift can be classed in the
unrestricted and acclimatisation zones signicant
periods were observed in the cautionary and restricted
zones for all operators. A range of control measures are
normally considered in order to reduce the risk of het
related illness or improve the environmental conditions
and therefore the TWL.
One such recommendation would be to allow workers
to self pace and cool down at a pace comfortable to
them. Unfortunately this is not possible in the airport
environment as ight refueling is done to a strict schedule
in order to ensure ights meet their departure times and
ight schedules.
Engineering controls are also commonly implemented in
order to improve environmental parameters, for example
moving air over employees, enclosing employees in air
conditioned areas, shading employees with structures
and insulation. None of these methods are practical for
airport refueling. Shade is provided by aircraft wings in
most cases, but not always. It is not practical to blow air
over employees during refueling operations as this would
require transport or portable fans or air conditioning
units which would also require power at the point of use.
Simply using fans to blow warm air at employees is not
acceptable as the air temperature is normally above the
temperature of skin. This actually increases heat loading
and therefore heat exposure of the employee.
Currently work schedules are planned by senior operators
and rest breaks are factored in to this. Employees do
receive some respite from hot conditions when travelling
in air conditioned service vehicles (although not all have
operational air conditioning) or at the operational base.
However, while at aircraft they must remain outside during
refueling and therefore other control solutions have to be
considered to reduce risk and keep employee comfortable.
One of the biggest risk factors associated with heat related
illness is dehydration. This is relatively simple to control and
improvements were required at the airport. The existing
standard issue, insulated ask was too small and held only
325ml of cooled water. Given the dominant environmental
conditions and potential long periods outside completing a
sequence of refueling, the amount of water that this water
bottle holds is simply not sufcient. This results in employees
becoming dehydrated. Improvements in hydration were
observed in the middle of the shift. These were mainly due
to rehydration back at the operational base during breakfast/
lunch breaks. Employees were more dehydrated at the end
of their shift than the start of their shift when using the
insulated water bottle. This conrmed that they were not
adequately hydrating throughout their shift.
The proposed solution to the hydration problem was the use
of wearable water reservoirs. The high visibility version which
was sourced held 1.5 litres of water, which is less than the
minimum 2 litres recommended, but was sufcient for trial
purposes. A exible drinking tube from the reservoir is used
to draw water on demand by the employee. Results from
the trial show that the use of wearable hydration actually
improved employee hydration throughout their shift when
compared to the standard issue water bottle. All operators
were more hydrated at the end of their shift than at the
beginning of their shift, in stark contrast to the insulated
water bottle. This is not unexpected as employees were
carrying more water and the water was more conveniently
accessed i.e. worn on their back plus it encourages more
frequent drinking. It is well known that drinking little and
often is far more efcient at hydrating a person.
The only disadvantage to this approach was that the water
contents of the reservoir became warmer quicker than the
water in the insulated water bottle. This was countered by
reducing the quantity of fresh liquid water and adding a top
up quantity of water as ice. This melted over time keeping
the water cooler. Irrespective of this, the fact that employees
have more water, even though it may be warm, is better than
having insufcient or no water when working in extreme
heat.
Other advantages with the wearable hydration packs are
that employees hands remain free at all times enabling them
to continue to work while drinking. This includes all refueling
tasks but also when driving around the airport.
One other common recommendation given alongside the
recommendation for sufcient drinking water is the use of
electrolyte replacement drinks. These were also assessed
during this survey during one test, with mixed results.
Aqualyte powder was dissolved into each operators
hydration pack. Ibrahim only lasted until mid morning
with his hydration pack and rehydration powder before
abandoning it due to the taste of the solution. He went back
to bottled water. Kasim kept his solution and used it all day
but strangely, nished his shift more dehydrated than when
he started. It was not due to the environmental parameters
as Kasim remained within the acclimatisation zone on this
day. Interestingly, Sharif started his shift dehydrated and
nished more hydrated when using the hydration pack and
rehydration powder, although the difference in hydration
pre and post shift was actually more signicant i.e. more
hydrated, when he used plain water with his hydration
pack.
It is difcult to come to rm conclusions regarding the use
of the rehydration powder due to the very low number
of samples and mixed results. Additional tests would
be required in future in order to make rm conclusions
regarding its applicability as a useful control.
5. CONCLUSION
TWL calculated via a single instrument, incorporating wind
speed is quicker and simpler than the WBGT method. In
addition, the easy classication of risk zones by the TWL
makes conclusions regarding risk and control simpler
to understand and, for this workplace scenario, is less
restrictive than WBGT. The TWL approach is more practical
to implement, especially for persons that are not familiar
or necessarily fully experienced with the WBGT method i.e.
supervisors and operators on the ground.
The WBGT method involves more complex calculations and
results in action limits and threshold limit values that cannot
be practically enforced in typical summer conditions within
the region, perhaps because it is too conservative.
In general, TWL trends show that the refueling operators
at the airport spend the majority of their shift within the
acclimatization zone.
However, although employees could be considered to be
within the acclimatization zone there were extended
Page 1 Page 447
periods of the shift classed within the cautionary and
restricted zones for all operators. Both zones have
specic recommendations which become essential
when working within the restricted zone. Work within
this zone should be avoided or strictly controlled at all
times.
Employees were more dehydrated at the end of their
shift than the start of their shift when using the standard
issue insulated water bottle. This conrms that their uid
intake was inadequate using current working practices.
All operators using wearable hydration packs
(CamelBak) were more hydrated at the end of their shift
than at the beginning of their shift, in stark contrast
to the insulated water bottle. This is not unexpected as
employees were carrying more water and the water was
more conveniently accessed allowing them to drink on
demand, little and often.
The use of a specic rehydration solution was
inconclusive. One operator did not like the taste, one
operator was slightly more hydrated at the end of their
shift and one operator was slightly more dehydrated at
the end of their shift. However, sample numbers too
low to make any rm conclusions and future tests are
recommended before concluding on the applicability of
these products in the airport environment.
6. RECOMMENDATIONS
Recommendations for work within the relevant TWL
zones and managing the risk of heat related illness at
the airport were aggregated below:
Purchase and distribute personal issue, wearable
hydration systems for employees. Employees that
do not wish to use/wear a hydration pack should
be provided with larger capacity water bottles i.e.
2 litres.
Install an ice machine to enable employees to
extend cooling of their hydration pack.
Ensure that rest breaks are incorporated in to the
work schedule and are not accumulated.
Encourage users to drink and hydrate sufciently
prior to starting their shift.
Unacclimatized persons are not permitted to work
during the hot months.
o An acclimatized person is one who regularly
works in conditions where the TWL is 140 to 220
W.m-2).
o Employees must be acclimatised to the local
environmental conditions before starting work.
o Non-acclimatized workers, such as new arrivals or
workers returning from vacation, should be given
time to acclimatize, normally 5-7 days.
o Non-acclimatised workers can work but must be
supervised at all times.
Ensure employees are adequately trained in how to
recognize signs and symptoms of heat stress and control,
including rst aid, rehydration and the importance of
acclimatization.
ACKNOWLEDGMENTS
Nasser Ali, Industrial Hygienist
Katherine Victorino and Katrina Respicio, Occupational
Health Nurses
Shanmugam Ilango, Training Superintendent, ENOC
Aviation
ENOC Aviation, Operators Kasim, Ibrahim and Sharif
ENOC Aviation Management
REFERENCES
American Conference of Governmental Industrial
Hygienists (ACGIH) (2009) Threshold Limit Values for
Chemical Substances and Physical Agents & Biological
Exposure Indices. American Industrial Hygiene Association
(ACGIH). ISBN: 978-1-882417-79-7.
Bates, G. P and Schneider, J. (2008) Hydration status and
physiological workload of UAE construction workers: A
prospective longitudinal observational study. Journal of
Occupational Medicine and Toxicology Vol. 8, No. 21.
Miller, V. S. and Bates, G. P. (2007) The Thermal Work
Limit is a Simple Reliable Heat Index for the Protection of
Workers in Thermally Stressful Environments. Annals of
Occupational Hygiene, Vol. 51, No. 6, pp553-561.
Page 1 Page 1
The origins of the Saudi Binladin
Group (SBG) date back to the formation of the
Mohammad Binladin Organization by the late
Sheikh Mohammad Awad Binladin in 1931.
This company was established as a general
contracting company around the time of the
formation of the Kingdom of Saudi Arabia and
has taken its part in the major infrastructure
developments such as roads, bridges, airports,
tunnels, housing, hotels, hospitals, universities,
power plants and desalination plants that have
transformed that country.
The newly titled Saudi Binladin Group
was formed when it was recognized that the
scope of works being undertaken by the
original company had outgrown its
management structure thus the company was
reformed into a total of ten autonomous
operating divisions each capable of carrying
out projects in their own right or co-ordinating
with other divisions to bid for the truly major
projects which have become the hallmark of
the Saudi Binladin Group. The operation of
these divisions is overseen by a corporate
structure based in the group headquarters in
Jeddah, Kingdom of Saudi Arabia

Of the many prestigious projects
completed by the Group the most notable was the
extension of the Two Holy Mosques in Makkah
and Madinah on behalf of the Custodian of the
Two Holy Mosques King Fahd Ibn Abdul Aziz
Al Saud in which Saudi Binladin Group was able
to utilise its design and build capability to its
fullest extent in using innovative solutions to
provide an air-conditioned environment for the
pilgrims at Madinah and at both locations to
install the highest quality finishes such as
marbles, granites and other decorative finishers
from its own factories.
The latter operation where material is
taken from SBGs own production facilities
shown a broadening of the normal main
contractors approach where the SBG has
established its own factories for the production of
marble and granite, artificial stone, metal art
work, gypsum and glass reinforced concrete,
joinery, drapery and conventional precast
concrete. This means that SBG can meet the
extremely tight timescales dictated by our clients
and at the same time feel comfortable about the
quality of product supplied. Where SBG needs to
go outside the group for materials, a network of
procurement offices has been established either
through local offices, subsidiary or affiliated
companies to enable a world wide search for the
particular materials and systems specified for
each project. Similarly, materials when procured
from outside sources and delivered by a network
of integrated freight forwarding and transport
companies to ensure the least possible delays in
the delivery process. The whole of the
procurement / delivery procedures is co-ordinated
through the main offices in Jeddah, K. S. A

Proceeding 2

Uploaded by

Copyright:

Available Formats

Proceeding 2

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Proceeding 2

Uploaded by

Copyright:

Available Formats

Page 247 Page 246

What information will be used to dene

You might also like