Safety visualisations and their influences on safety concepts are presented. Visualisations like safety posters show a clear message of fear and guilt. This changes after World War II, due to a more tolerant atmosphere. Latent, organisational factors as decisive elements of accident processes appear in visualisations. An example shows a method to follow accident scenarios in real time.@en

Hazardous events in process plants like the leakage of dangerous substances can result in severe damage, and such an event is often defined as the TOP event of a fault tree analysis (FTA) in a quantitative risk analysis. The TOP event probability can then be calculated if the basic events probabilities are provided. These probabilities are often determined based on generic reliability data which do not necessarily reflect the operational and environmental characteristics of a plant of interest. This paper presents an approach based on Bayesian network (BN) analysis to explicitly include experience data collected during the plant operation to make the generic probabilities more plant specific. The approach is illustrated via a pressure vessel containing a toxic substance in an Ammonia production plant. In this case study, the failure rate distribution in the BN is updated as the new information becomes available during plant operation. The results show that the suggested approach effectively reflects the operating experience of a specific plant.@en

OCI Nitrogen, one of Europe's largest fertilizer producers, is investigating the extent to which it is possible to take targeted measures at an early stage and stop the development of major hazard accident processes. An innovative model has been developed and recently explained and elaborated in a number of publications. This current paper contains a validation of the model by looking at the BP Texas City incident in 2005. The bowtie metaphor is used to visually present the BP Texas City refinery incident, showing the barrier system from different perspectives. Not only is the barrier system looked at from its trustworthiness on the day of the incident but also from the perspective of the control room operator, and from a design to current standards of best practice. The risk reductions of these different views are calculated and compared to their original design. In addition, evidence and findings from the investigations have been categorized as flaws and allocated to nine organizational factors. These flaws may affect the barrier system's quality or trustworthiness, or may act as ‘accident pathogens’ (see also Reason, 1990) creating latent, dangerous conditions. This paper sheds new light on the monitoring of accident processes and the barrier management to control them, and demonstrates that the BP Texas City refinery incident could have been foreseen using preventive barrier indicators and monitoring organizational factors.

@en

OCI Nitrogen wants to gain knowledge of (leading) indicators regarding the process safety performance of their ammonia production process. This paper answers the question whether indicators can be derived from the barrier system status to provide information about the development and likelihood of the major accident processes in the ammonia production process. The accident processes are visualized as scenarios in bowties. This research focuses on the status of the preventive barriers on the left-hand side of the bowtie. Both the quality – expressed in reliability/availability and effectiveness – and the activation of the barrier system give an indication of the development of the accident scenarios and the likelihood of the central event. This likelihood is calculated as a loss of risk reduction compared to the original design. The calculation results in an indicator called “preventive barrier indicator”, which should initiate further action. Based on an example, it is demonstrated which actions should be taken and what their urgency is.

@en

OCI Nitrogen seeks to gain knowledge of (leading) indicators regarding the process safety performance of their ammonia production process. The current research determines the most dangerous process equipment by calculating their effects resulting from a loss of containment using DNV GL's Phast™ dispersion model. In this paper, flammable and toxic effects from a release from the main equipment of an ammonia plant have been calculated. Such an encompassing approach, which can be carried out for an entire plant, is innovative and has never been conducted before. By using this model, it has been demonstrated that the effects arising from an event of failure are the largest in process equipment containing pressurized synthesis gas and ‘warm’ liquid ammonia, meaning the ammonia buffer tanks, ammonia product pumps, and the ammonia separator. Most importantly, this document substantiates that it is possible to rank the most hazardous process equipment of the ammonia production process based on an adverse impact on humans using the calculated effect distance as a starting point for a chance of death of at least 95%. The results from the effect calculations can be used for risk mapping of an entire chemical plant or be employed and applied in a layer of protection analysis (LOPA) to establish risk mitigation measures.

@en

Foreseeing or even predicting major accidents is understandably challenging, both for any practitioner involved as for safety scientists and other academics. Understanding these events and trying to prevent them is a primary goal of a safety theory. Major hazard-related accidents rarely occur but when they do, they can cause many casualties and injured, and have major financial consequences due to production loss, material damage to the installation and/or environmental damage. Ultimately, major hazard-related accidents may ruin the company involved. Process safety is becoming more and more important in the process industry and is strongly linked to reliability, quality, productivity, security of supply, and good business....@en

OCI Nitrogen seeks to gain knowledge of (leading) indicators regarding the process safety performance of their ammonia production process. The current sub-study raises the question whether major hazard accidents in the ammonia production process can be predicted from organizational factors, also called management delivery systems. This paper links organizational factors to accident processes and their barrier systems, using the bowtie metaphor. It is shown that organizational factors indirectly impact accident processes as they strongly influence the quality or trustworthiness of the barrier systems. By putting the right focus on organizational factors during audits or reviews, major accident processes get the attention they deserve, and the necessary actions are taken at the right management level. Qualitative and quantitative monitoring of organizational factors can provide a picture of their operation and efficiency. Using an example on retrospective data it is demonstrated that information from organizational factors could have stopped the development of the near-accident prematurely. However, organizational factors should first be qualitatively assessed before they are quantitatively monitored. A quantitative assessment has been worked out for one of the management delivery systems so to provide an example of management indicators. Determining these (management) indicators from threshold values is an intricate matter due to the complicated influence of organizational factors on accident processes, and requires more follow-up research.@en

A Safety Research project was carried out in an ammonia plant of OCI Nitrogen, located at the Chemelot site in Geleen, The Netherlands. This research focused on the development of a method to monitor accident processes in the chemical industry mainly caused by mechanical integrity of static equipment like vessels, tanks and heat exchangers. A significant part of the mechanical integrity failure scenarios originates from material degradation and corrosion mechanisms which may develop over a relatively long-time period, possibly taking months, years or even longer. Mechanical failure scenarios from two process units have been worked out and visualized using a bowtie. The research project shows that the monitoring of early warnings can provide information about the current development of mechanical failure scenarios. In addition, early warnings can be used to initiate inspections if there is a likelihood that the mechanical failure scenario has been activated. Considering the shift from breakdown maintenance to preventive and predictive maintenance and risk-based inspection (RBI), inspections based on early warnings could also be a new step in the field of maintenance efficiency.@en

OCI Nitrogen aims to build up knowledge of (leading) indicators that provide insight in advance into the process safety performance of their ammonia production process. Two sub-studies have already been published in TtA. The first sub-study focused on ranking the most dangerous process units of the ammonia production process. In the second sub-study, the most important static equipment of the ammonia production process was mapped, which are related to mechanical failure mechanisms. This manuscript describes the third part of the research with the question of whether - based on the status of the barrier system – indicators can be derived that provide advance information about the development and likelihood of the major accident processes in the ammonia production process. The accident processes are visualized as scenarios in bowties. This research focuses on the status of the preventive barriers on the left-hand side of the bowtie. Both the quality – expressed in reliability/availability and effectiveness - and the activation of the barrier system give an indication of the development of the accident scenarios and the likelihood of the central event. This likelihood is calculated as a loss of risk reduction compared to the original design. The calculations of this assessment result in indicators called "preventive barrier indicators". They provide an indication of the likelihood of the scenario. This likelihood is not an absolute value, but rather an indication of the change in the status quo which should initiate further action. This manuscript shows what this action must be and what the urgency of the action is. In the presented concept, every technical change of the barrier system is used to determine the current development and likelihood of the scenario. If the quality parameters of the barriers are accommodated in an automated system, the preventive barrier indicator can be calculated and displayed in real time. This is different for non-technical changes: they will have to be entered and processed manually. @en

OCI Nitrogen aims to build up knowledge of (leading, proactive) indicators that provide insight into the process safety performance of the ammonia production process. Three sub-studies have already been published in TtA. The main question of this sub-study is whether major accidents in the ammonia production process can be predicted from organizational factors, also called management delivery systems. A detailed example in retrospect shows that this is possible. Qualitative information can be generated from audits or peer reviews conducted by internal and/ or external experts once every three to four years. In case of no major shortcomings or findings, it makes sense to measure quantitatively. Based on established threshold values, (management) indicators can then be determined. However, determining threshold values is not easy because the influence of organizational factors on the accident processes is difficult to determine. Much (retrospective) investigation into incidents is still needed to be able to standardize this.@en

Research was carried out in an ammonia plant of OCI Nitrogen, located at the Chemelot site in Geleen, The Netherlands. It focuses on the development of process safety accident processes in which loss of mechanical integrity is one of the root causes. A significant share of the mechanical integrity scenarios originate from corrosion mechanisms which develop over a relatively long time period, possibly taking months, years or even longer before turning into an event. Based on an example, a failure mechanism is worked out and visualized using a bow tie. Bow-ties have shown a good visual representation of the 'early warnings' and the barriers in place. The monitoring of the 'early warnings' and barriers can provide information about the current probability of the scenario in order to intervene prematurely.@en

Dit artikel laat ontwikkelingen en beperkingen zien van grafische presentaties van veiligheidsconcepten. Veiligheidsposters zijn krachtig en overtuigend met een duidelijke boodschap. De vroege posters spelen in op angst, schaamte en schuldgevoelens. Vanaf de jaren zeventig in een veranderend politiek en sociaal klimaat wijzigt de boodschap en wordt de boodschap neutraal, zonder morele ondertoon. Presentaties van de ontwikkelingen van het veiligheids- domein geven verschillende beelden. Er zijn auteurs met een nadruk op organisatorische factoren, of op gedrag. Dit hangt samen met een verschil in de interpretatie van het concept van veiligheidscultuur. De kosten-batenanalyse, een derde ontwikkeling, genereert rationele argumenten voor de besluitvorming over veiligheidsinvesteringen. Visualisaties van modellen en metaforen laten een groei- end begrip zien van latente factoren van organisaties, als beslissende elementen van ongevalsprocessen. Met een van de metaforen is de ontwikkeling van majeure ongevalsscenario's te volgen, waardoor vroegtijdige preventie mogelijk wordt. @en

In order to control occupational accidents, it is crucial to have a clear view on the potential accident scenarios that are present in a company. The bow-tie method is a way to capture and visualise these accident processes in an integrative way. Included in the bow-tie are safety barriers (both technical as organisational and human) and management delivery systems that can intervene in these accident processes. Once bow-ties are composed, they are an excellent point of departure to assign indicators to the safety barriers and management delivery systems in order to control (i.e. prevent or mitigate) the accident scenarios. Two types of indicators can be distinguished. Firstly, there are general indicators that are linked to management delivery systems interrupting multiple accident scenarios, and which can yield a higher safety gain (as they intervene in multiple accident scenarios). Secondly, there are scenario-specific indicators targeting one specific accident scenario, and which can be valuable as they target a specific safety problem in the company. Some crucial aspects have to be taken into account when using indicators, such as sequentiality in follow-up and prioritization of indicators, and the focus on quality rather than quantity.@en

Monitoring progress of accident scenarios, and effectiveness of control measures is a main goal of safety indicators. From an overview of scientific literature one may conclude that indicators do not logically relate to current safety theories and models, their relation with accident processes is far from perfect, and a ‘silver bullet’ has not been identified yet. Professional literature shows another picture, and divides indicators in leading and lagging. This distinction seems convincing. Not only companies, but also regulations adopted this division. Currently many indicators used in industry generate a number, while the relation with accident processes is questionable at least. In addition, it can be expected that regulators of major hazard companies will ask to identify and implement both lagging and leading indicators, and anchor these indicators in a safety management system. The subject ‘safety indicators’ will remain in the spotlight in the time to come. This presentation will focus on a review of scientific and professional literature. This article is written in ‘praesens historicum’, and based upon recent articles (Oostendorp et al., 2016, Swuste et al., 2010, 2014, 2016 a,b, 2018).@en