Predicting major hazard accidents in the process industry based on organizational factors: A practical, qualitative approach

(1)

Delft University of Technology

Predicting major hazard accidents in the process industry based on organizational factors:

A practical, qualitative approach

Schmitz, P.J.H.; Reniers, G.L.L.M.E.; Swuste, P.H.J.J.; van Nunen, K.L.L.

DOI

10.1016/j.psep.2021.02.040

Publication date

2021

Document Version

Final published version

Published in

Process Safety and Environmental Protection

Citation (APA)

Schmitz, P. J. H., Reniers, G. L. L. M. E., Swuste, P. H. J. J., & van Nunen, K. L. L. (2021). Predicting major

hazard accidents in the process industry based on organizational factors: A practical, qualitative approach.

Process Safety and Environmental Protection, 148, 1268-1278. https://doi.org/10.1016/j.psep.2021.02.040

Important note

To cite this publication, please use the final published version (if applicable).

Please check the document version above.

Copyright

Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons. Takedown policy

Please contact us and provide details if you believe this document breaches copyrights. We will remove access to the work immediately and investigate your claim.

This work is downloaded from Delft University of Technology.

(2)

ContentslistsavailableatScienceDirect

Process

Safety

and

Environmental

Protection

jo u r n al ho m e p a g e :w w w . e l s e v i e r . c o m / l o c a t e / p s e p

Predicting

major

hazard

accidents

in

the

process

industry

based

on

organizational

factors:

A

practical,

qualitative

approach

Peter

Schmitz

a,b,∗

_,

_Genserik

_Reniers

a

_,

_Paul

_Swuste

a

_,

_Karolien

_van

_Nunen

a,c

a_Safety_and_Security_Science_Group,_Faculty_of_Technology,_Policy_and_Management,_Technical_University_of_Delft,_Jaffalaan_5,₂₆₂₈_BX,_Delft,_the Netherlands

b_{OCI-Nitrogen,}_Urmonderbaan_22,₆₁₆₇_RD,_Geleen,_the_Netherlands c_Research_Chair_Vandeputte,_University_of_Antwerp,_2000,_Antwerp,_Belgium

a

r

t

i

c

l

e

i

n

f

o

Articlehistory:

Received23October2020

Receivedinrevisedform8January2021 Accepted28February2021

Availableonline4March2021 Keywords:

Deliverysystems Safetymanagementsystem Processsafety

Indicator Ammonia

Organizationalfactors

a

b

s

t

r

a

c

t

OCINitrogenseekstogainknowledgeof(leading)indicatorsregardingtheprocesssafetyperformance oftheirammoniaproductionprocess.Thecurrentsub-studyraisesthequestionwhethermajorhazard accidentsintheammoniaproductionprocesscanbepredictedfromorganizationalfactors,alsocalled managementdeliverysystems.Thispaperlinksorganizationalfactorstoaccidentprocessesandtheir barriersystems,usingthebowtiemetaphor.Itisshownthatorganizationalfactorsindirectlyimpact accidentprocessesastheystronglyinfluencethequalityortrustworthinessofthebarriersystems.By puttingtherightfocusonorganizationalfactorsduringauditsorreviews,majoraccidentprocessesget theattentiontheydeserve,andthenecessaryactionsaretakenattherightmanagementlevel.Qualitative andquantitativemonitoringoforganizationalfactorscanprovideapictureoftheiroperationand effi-ciency.Usinganexampleonretrospectivedataitisdemonstratedthatinformationfromorganizational factorscouldhavestoppedthedevelopmentofthenear-accidentprematurely.However,organizational factorsshouldfirstbequalitativelyassessedbeforetheyarequantitativelymonitored.Aquantitative assessmenthasbeenworkedoutforoneofthemanagementdeliverysystemssotoprovidean exam-pleofmanagementindicators.Determiningthese(management)indicatorsfromthresholdvaluesisan intricatematterduetothecomplicatedinfluenceoforganizationalfactorsonaccidentprocesses,and requiresmorefollow-upresearch.

1. Introduction

In2015,severalmajorprocess-relatedaccidentsoccurredata fewsiteusersofChemelot,achemicalindustrialparkinGeleen, TheNetherlands(OVV,2018).Theincreaseinthefrequencyand severityoftheaccidentsmadetheChemelotBoarddecidetohave anexternalinvestigationconducted.Oneoftheconclusionswas thatprocesssafetydidnotreceivethenecessaryattentiondueto anincreasedfocusonpersonalsafety(Crisislab,2016).Apparently, thefocusonoccupationalsafetyissohighthatthepotential haz-ards oftheplantandthechemicalprocessesdonotreceivethe attentiontheydeserve.Inotherwords,thereisinsufﬁcient antici-pationof ¨earlywarnings¨fromthechemicalprocesses.OCINitrogen, oneofChemelot’slargersiteusers,hasfacedseveralseriousprocess

∗ Correspondingauthorat:OCI-Nitrogen,Urmonderbaan22,6167RD,Geleen,the Netherlands.

E-mailaddress:peter.schmitz@ocinitrogen.com(P.Schmitz).

safetyrelatedaccidents,includingthoseatitstwoammoniaplants. Insomeoccurrences,therelevant ammoniaproduction process hadtobeshutdownimmediatelytopreventworsefrom happen-ing.

Themanagement of OCI Nitrogen initiated itsown research ofwhetherprocesssafetycanbemeasuredand monitored.The aimofthisresearchistotaketargetedandtimelymeasuresand therebypreventfuturemajorprocesssafetyaccidents.Thequestion thatarisesiswhichindicatorsprovideinformationconcerningthe developmentofthemajorhazardaccidentsoftheammonia pro-ductionprocesses.Threesub-studieshavealreadybeenpublished concerning’ranking’ofthemostdangerousprocessequipmentof theammoniaproductionprocess(Schmitzetal.,2018),assessing mechanicalfailuremechanisms(Schmitzetal.,2020a,2019)and predictingthelikelihoodofscenariosbasedonthebarrierstatus (Schmitzetal.,2020b).

Thissub-studyinvestigatestheorganizationalfactorswhichare closelyrelatedtomajorhazardaccidentprocessesandanswersthe followingresearchquestion:

https://doi.org/10.1016/j.psep.2021.02.040

(3)

Canmajorhazardaccidentprocessesrelatedtotheammonia pro-ductionprocessbeinﬂuencedbymonitoringorganizationalfactors?

Theassociatedsub-questionstobeinvestigatedare: 1)Whatareorganizationalfactors?

2)Howareorganizationalfactorslinkedtotheaccidentprocesses? 3)Whataretheorganizationalfactorsintheammoniaproduction

processofOCINitrogen?

4)What information can organizational factorsprovide aboutthe accidentprocesses?

5)Howcantheinformationfromtheorganizationalfactorsinﬂuence theaccidentprocessesofOCINitrogen?

Accidentprocessesrelatedtooccupationalsafetythatoriginate fromworkingconditionsareexcludedinthissub-study.Thispaper isexclusivelyconcernedwithpotentialaccidentsrelatedtoprocess safetyand,inaddition,onlythosethataremajororcatastrophic.

Thispaperstartswithdeﬁnitions andexamplesof organiza-tional factorsfromtheliterature,followed bytheirrelationship withthesafetymanagementsystemandtheprocessbarrier sys-temstolinkthemtoaccidentprocesses.Alistoforganizational factorsormanagementdeliverysystemsapplicableforOCI Nitro-gen hasbeen compiled which outlines theirinformation about accidentprocesses.Anexampleshowshowtheinformationfrom someorganizationalfactorscouldhaveinﬂuencedanear-accident. Inahighpressurescenarioexamplethemanagementdelivery sys-temsarenamedwhicharerelevanttomaintainbarriersystem’s quality.

1.1. Organizationalfactors

Theterm“organizationalfactors”hasmanysynonyms.Ithas beenarguedsincethelate1970sthatmajorhazardaccident pro-cessesoftenstartlessconspicuously(Turner,1978;Perrow,1984;

Kletz,1988).Theattentiontolatentfactorsinanorganizationled Turnertointroducehisideaof incubationtime.Incubationrefers tomechanismsinorganizationsthatdenydangersandrisks.Inthe SwisscheesemetaphorofReason(1987,1997),thelatentfactors (“pathogens”) arevisualizedthroughtheholes inbarriers,later elaboratedasbasicriskfactorsoftheTripodmodel(Swusteetal., 2016b,2020a,2020b).

TheJointResearchCentreoftheEuropeanCommissionstarted two projects at thebeginning of this millenniumto develop a structure ofrisk management fortheprocessindustry. ARAMIS (AccidentRiskAssessmentMethodologyforIndustries)andI-Risk (the development of an integrated technical and management risk methodologyforchemical installations)bothexaminedthe positionandinﬂuenceoforganizationalfactors.Inthecontextof ARAMIStheyarecalleddeliverysystems(Haleetal.,2007)and withreferencetoI-Risktheyarenamedmanagementdelivery sys-tems(Guldenmundetal.,2006).Kongsvik,AlmklovandFenstad (2010)refertoorganizationalfactorsasorganizationalsafety con-ditions, Øien et al. (2011) as functional areas and Hassan and Khan(2012)asactivityindicators.Butorganizationalfactorsare alsodescribedassecondarymanagementprocesses(Papazoglou etal.,2003)orsupportsafetybarriers(Bellamyetal.,2007;Ale etal.,2008),emphasizingtheindirectimpactonaccidentprocesses. Deliverysystemsareprincipalmanagementsystemsthatinﬂuence andensurethecontinuousfunctioningofbarriers(Duijm& Mark-ertetal.,inLietal.,2020).Inprofessionalliterature,organizational factorsordeliverysystemscanoftenbeelementsofa(process) safetymanagementsystem(CCPS,2016;OSHA,2021)orpartsofa riskmanagementsystem(HSE,2006).Finally,organizational fac-torscanbeextractedfromresearchmethods,suchasthebasicrisk factorsoftheTripodmodel(Wagenaaretal.,1994).

Inthis paper, inaddition toorganizational factors,theterm “managementdeliverysystems”isalsousedasasynonym.The term“managementdeliverysystems”hasbeenusedmoreoften inthecontextofthisresearch,while“organizationalfactors”are easiertotranslateintopracticalreality.

Table1,a(non-exhaustive)overviewoforganizationalfactors ormanagementdeliverysystems,takenfromreferredliterature 1.2. Safetymanagementsystem

The organizational factors or management delivery systems supporttheoverallmanagementofsafetybarriers(Lietal.,2020). Theyareanintegralpartofthesafetymanagementsystem(Hale, 2005).Theintegrityoftheprimarybarriers(barrierswithadirect inﬂuenceon theaccident process, see Fig.2) is maintainedby thesafetymanagementsystem(Bellamyetal.,2007).The man-agementdeliverysystemsthatsupporttheprimarybarriersare considerednon-technicalbecausetheirworkingmethodisbased onworkprocessesand proceduresinwhichhumanactionsand decision-makingpredominate.

Inordertoreducethenumberofaccidentsitis,accordingto Hale’sconceptofasafetymanagementsystem,necessaryto iden-tifythehazards,determinetherisksandtolowerthembymeansof barriers,managethebarriersusingmanagementdeliverysystems andtoreviewandlearnfromthisprocess(Li,2019).Thispaper pro-videsaguideforthelasttwosteps:whichmanagementdelivery systemsarenecessarytomanagethebarriersystemsandwhatdo theyprovidetopreventfutureaccidents?

Fig. 1 shows the role of the management delivery systems inrisk management(basedonFig.3.1fromLi,2019).In Hale’s concept (2005)the management deliverysystems are incorpo-ratedinthesafetymanagementsystem(SMS),inthiscontextalso referredto asprocess safetymanagement (PSM). Theinﬂuence ofthemanagementdeliverysystemsontheaccidentsand near-accidentsisindirect,meaningviathebarriersystems.Inaddition totheSMSelement“reviewandaudit”,Fig.1showsthree feed-backloopsbasedonwhichthesafetymanagementsystemcanbe improved.

Theinformationfromthethreefeedbackloopscanbeusedto developindicators.Theycanprovideinformationconcerningthe qualityofthemanagementdeliverysystems(loop1)andofthe barriersystems(loop2).Thispaperaimstodeveloptheindicators ofloop1.Theloop2indicators,whichprovideinsightintothe sta-tusandqualityofthebarriersystems,aredescribedinaprevious sub-study(Schmitzetal.,2020b).Theloop3indicatorscanbefound inanalysed(near)accidentprocessesandareaninformative feed-backloopregardinglearningfromaccidentsandthefunctioningof thesafetymanagementsystem.Theloop3indicators,alsocalled laggingindicators,arenopartofthisstudy.

1.3. Barriersystems

Sincethemanagementdeliverysystemsstronglyinfluencethe qualityofthebarriersystems,thequestionariseswherethe influ-enceofthemanagementdeliverysystemsonthebarriersystems takesplace.Andhowbarriersystemsareconstructed.Abarrier systemisasetofbarriersthatarepresenttopreventcausesfrom developinginto consequences (Schmitz etal.,2020b).A barrier consistsofelementsthatdetect,decideoract(Guldenmundetal., 2006).Barrierelementscanbephysicalandnon-physicalor techni-calandnon-technicalbutcanalsobesubdividedashardware(with or without software/logic) and humans (Duijm, 2009; Pitblado etal.,2016;SobralandGuedesSoares,2019;Lietal.,2020).The humanactsasanindividualbasedonhis/herknowledgeand expe-rienceoractsaspartofanorganizationwithitsagreementsand procedures.Inthispaper,theinfluenceofthemanagement

(4)

Table1

providesa(non-exhaustive)overviewofvariousorganizationalfactorsormanagementdeliverysystemsasfoundinthescientiﬁcandprofessionalliterature.Therearesome duplicatedtermsinthetablewheretheorganizationalfactorsormanagementdeliverysystemsareusedinadifferentcontext.

Organizationalfactorsormanagementdeliverysystems Reference

Competence,suitability Hale(2005),HSE254,Kongsviketal.(2010);Øien(2001b);HassanandKhan(2012);Bellamy(2015);

Duijm(2009);Guldenmundetal.(2006)

Commitment,organizationalmanagement Hale(2005);Duijm(2009);Guldenmundetal.(2006);Wagenaaretal.(1994)

Communication,coordinationofteams Hale(2005),HSE254,Kongsviketal.(2010);HassanandKhan(2012);Bellamy(2015);Duijm(2009);

Guldenmundetal.(2006);Wagenaaretal.(1994)

Procedures,rulesandgoals Hale(2005),HSE254,Bellamy(2015);Duijm(2009);Guldenmundetal.(2006)

Technicaldesignandhardware Hale(2005),HSE254,Øien(2001b);Bellamy(2015);Wagenaaretal.(1994)

Interface,ergonomics Hale(2005);Bellamy(2015)

Manpowerplanningandavailability Hale(2005);Bellamy(2015);Duijm(2009);Guldenmundetal.(2006)

Inspectionandmaintenance HSE254,Øien(2001b);HassanandKhan(2012)

Instrumentationandalarms HSE254

Plantchanges HSE254,Kongsviketal.(2010)

Permittowork HSE254,HassanandKhan(2012)

Emergencyarrangements HSE254

Workpractice Kongsviketal.(2010)

Instructionsanddocumentation Kongsviketal.(2010);Wagenaaretal.(1994)

Workloadandphysicalenvironment Kongsviketal.(2010)

Planningandcoordination Kongsviketal.(2010)

Individualfactors(slips,lapses) Øien(2001b)

Procedures,jobsafetyanalysis,guidelines,instructions Øien(2001b)

Planning,coordination,organization,control Øien(2001b)

Inspectionandmaintenancemanagement HassanandKhan(2012);Wagenaaretal.(1994)

Engineeringassessment HassanandKhan(2012)

Operatingperformance HassanandKhan(2012)

Stateofhardware HassanandKhan(2012);Wagenaaretal.(1994)

Plantconﬁgurationandmodiﬁcation HassanandKhan(2012)

Engineeringsafetysystem HassanandKhan(2012);Wagenaaretal.(1994)

Crisismanagement HassanandKhan(2012)

Safetyculture HassanandKhan(2012);Duijm(2009)

Motivation Bellamy(2015)

Conﬂictresolution Bellamy(2015);Duijm(2009);Guldenmundetal.(2006)

Hard/softwarepurchase,build,interface,install Duijm(2009);Guldenmundetal.(2006)

Hard/softwareinspect,maintain,replace Duijm(2009);Guldenmundetal.(2006)

Riskidentiﬁcation,barrierselectionandspeciﬁcation Guldenmundetal.(2006)

Monitoring,feedback,learningandchangemanagement Guldenmundetal.(2006)

Error-enforcingconditions Wagenaaretal.(1994)

Housekeeping Wagenaaretal.(1994)

Incompatiblegoals Wagenaaretal.(1994)

Training Wagenaaretal.(1994)

Fig.1.Theroleofthemanagementdeliverysystemsinthemanagementofrisks(SMS=SafetyManagementSystem).

erysystemsonthebarrierelements(detection,decision,action) isinvestigated.Itisassumedthatbarrierelementsaretechnical ornon-technical,wherebynon-technicalcanbeorganizationalor humanintheformofanactionorabehaviour.

Occasionallyadistinctionismadebetweenlifecyclesforbarrier systems.Inthissub-study,however,asubdivisionperlifecycleis notmeaningful,becausethispaperconcernsacharacterizationof thevariousmanagementdeliverysystemsandanoverviewofthe activitiesofeachofthem.

1.4. Managementindicators

Whatinformationcanorganizationalfactorsprovideaboutthe accident processes? From scientiﬁc and professional literature manyindicatorscanbelinkedtomanagementdeliverysystems ororganizationalfactors(Swusteetal.,2016a).Indicatorsare mea-suresusedtodescribethestateofabroaderphenomenonoraspect ofreality(Øien,2001a).Accordingtothisdeﬁnition,management indicatorsshouldprovideinformation concerningtheoperation

(5)

Fig.2. Themanagementdeliverysystemsororganizationalfactorsrelatedtothebowtie.

Fig.3.Left-handsideofthebowtieofarupturedpipeduetohydrogenembrittlement(P/T:pressure/temperature;FFS:ﬁtnessforservice;SU/SD:start-up/shutdown).

andefﬁciencyofthemanagementdeliverysystemsor organiza-tionalfactors.

Toassessthequalityofthemanagementdeliverysystems,both qualitativeandquantitativemeasurementsmustbetaken(Nunen vanetal.,2018).Forexample,amanagementindicator,suchasthe numberofemployeeswhohavereceivedsafetytraining,cangive afalseimpressionofthequalityofthetrainingprogram,asitis measuredquantitativelybutdoesnotconsiderthecontent(quality) ofthetraining.Vinnem(2010)citesthepreventivemaintenance programasanexample:ifinspectionintervalsaretoolong,there maybenoinspectionbacklog,whiletheriskmaybeunacceptably high.Ontheotherhand,iftheinspectionintervalsareveryshort, theriskofabacklogmaystillbeacceptable.

Auditsaretheprincipletoolstoassessthequalityof manage-mentdeliverysystems.Broadlyspeaking,therearetwotypesof audits:onefocusedoncomplianceandoneonrisks.

2. Complianceversusrisk-basedaudits

The 2005explosionattheBPTexas Cityreﬁnery is perhaps one ofthebestinvestigatedincidentsand providesa wealthof newinsights.Oneoftheseinsightsis theBaker Panel’sconcern onBP’sprincipalfocusoftheauditsoncomplianceandverifying

thatrequiredmanagementsystemswereinplacetosatisfylegal requirements(BakerReport,2007).Thiswasalsoemphasizedin BP’sown investigationinwhich it wasstated thataudits must includephysicalveriﬁcationoftheworkactivitybeingundertaken toensurethat thepracticematchesthedocumentedprocedure (Mogford,2005).Numerousauditshadbeenconductedatthesite inlinewithregulatoryandcorporaterequirements,buttheyhad generallyfailedtoidentifythesystemicproblemswithwork prac-tices(CSB,2007).However,requiringcomplianceratherthanrisk assessmentspreventsendlessdiscussionsaboutwhethercertain risk mitigation strategies are needed (Hopkins, 2008).There is clearlyadifferenceinauditsthattakeplaceonthebasisof compli-ancewithlegislation,andregulationsandauditswhereriskplays aprominentrole.

Thereisa growinginterestin whatiscalled“scenariobased auditing”(Guldenmundetal.,2006;ZemeringandSwuste,2005). Whereregulatoryinspectionstendtobefocusedatthetechnical level,Hopkins (2008)suggestsanadditionalfocus on organiza-tionalissues.AccordingtoHopkins,rootcausesofmajoraccidents, liketheBPTexas Cityreﬁnery incident, aretobe foundatthe organizationallevelin decisionsmadebysenior managerswho areremotefromtheaccident.Thispaperprovidesawayto con-ductauditsorreviewswhicharebothcomplianceandrisk-based, andwhichfocusonorganizationalfactorsthatinﬂuencethe

(6)

ityofbarriersandthusinﬂuencethemajoraccidentprocesses.By doingso,majoraccidentprocessesgettheattentiontheydeserve, and the necessary actions are taken at the right management level.

3. Methodology

Managementmustensurethatbarriersworkeffectivelyviathe managementdeliverysystems(Guillaume,2011).InFig.2the man-agementdeliverysystemsareindicatedbelowthebowtie,which showstheintegrationwiththeorganizationaccordingtoDeRuijter andGuldenmund(2016).Thebottom-uparrowsinFig.2indicate theinﬂuenceofthemanagementdeliverysystemsontheprimary barriers.Theprimarybarriersaredrawnasthick,verticallinesin thescenario.Theystopthedevelopmentof anaccident process andconsistofbothtechnicalandnon-technicalbarrierelements. Managementdeliverysystemsarenon-technicalinnature.They are workprocessesand proceduresinwhich humanactionand decision-makingpredominate.

Fig.2alsoshowsarrowsthat donotpoint atbarriersbut at scenarios.Therearemanagementdeliverysystemsthatmay pro-moteerrorsandcreatelatent,dangerousconditionsifnotproperly managed. They are called “performance inﬂuencing factors” or “errorproducingconditions”.Theymayhaveageneralinﬂuence onscenariosandimpairtheeffectivenessofthebarriersystems (Sonnemanset al.,2010).Anexampleof thisis communication suchasshift(transfer)reportsandworkagreementsbetweenthe maintenanceandproductiondepartments.

Managementdeliverysystemsprovidesupporttotheprimary barriers.Aplanmustbedrawnuptoguaranteethissupport.The plan may include a courseof action or strategy as wellas the rolesandresponsibilitiesofstaffandthedeploymentofresources. In addition,theplanmaycontainsuccessfactorsandgoals,and addressitemslikebackloginplanning,qualityofthework deliv-ered, follow-upof actions,reporting,qualifications ofpersonnel andevaluationoftheimplementation.Theplanmustbechecked andapproved,knownandaccessible.Thedesignandqualityofthe planinfluencetheresultsoftheimplementation,bothquantitative andqualitative.Theresultsdeterminetheextenttowhichthe pri-marybarriersreceiveandbenefitfromthenecessarysupport.The planmustthereforenotonlybewelldesigned,butalsobeproperly implemented.

Whenmonitoringmanagementdeliverysystems,itshouldbe determinedwhetherandtowhatextenttheydeliversuchan out-putthat1.thebarriersystemscanbeexpectedtobetrustworthy, meaningreliable/availableandeffective(Schmitzetal.,2020b);2. nolatent,dangerousconditionsarecreated.Toassess the man-agementdeliverysystems,boththeplanandtheimplementation shouldbemonitoredqualitativelyaswellasquantitatively. Exist-inglawsandregulations,theapplicableinternalrequirementsand guidelines,current’goodpractices’and’expertjudgment’largely setthestandard.

4. Casestudy

Asafeinstallationrequiresarobustdesignbasedon“defencein depth”.Foranybarrierinstalledtopreventadangerousscenario fromdeveloping,theessentialconditionsmustbeidentiﬁedbythe organizationforittowork(Hale,2005).Oncethishasbeen com-pleted,it willthen havetobemonitoredtodeterminewhether theconditionsarealwaysbeingmet.Monitoringcanbedonenot onlyatthelevelofthe(primary)barriers(loop2inFig.1),butalso atthelevelofthemanagementdeliverysystems(loop1,Fig.1). In anycasethereshouldbeafocusonpotentialchanges (Øien, 2001b).Inthisway,managementdeliverysystems,aspartofthe

safetymanagementsystem,contributetothesafemanagementof organizationaltooperationallevel.

4.1. ThemanagementdeliverysystemsofOCInitrogen

InTable2,theorganizationalfactorsfromTable1arecombined intoninemanagementdeliverysystems,whichareabletosupport allprimarybarriersoftheaccidentprocessesatOCINitrogen.They areeachdescribedregardingtheirfunctionandpurpose.A manage-mentdeliverysystemdoesnotnecessarilyhavetobeimplemented byonedepartmentorteam,butcanbedividedwithinan organiza-tion,wherebytheresponsibilitymayliewithseveraldepartments, teamsorroles.Forexample,inspectionsofpressureequipmentare conductedbyanindependentorexternalnotiﬁedbody,whereas thetestingofinstrumentalsafeguardsisdonebyamaintenance department.Trainingandeducationisprovided bya numberof instructors,whoarepartoftheoperationalstaff.Selectionand com-petencemanagementisdonebytheHRdepartmentinconsultation withoperationalmanagement.

Table2alsoprovidesanoverviewofthemainactivitiesofthe ninemanagementdeliverysystems.Theactivitiesaredividedinto actionsrelatedtotheplantoachievethegoalsandtothe implemen-tationoftheplan.Inthenextsections,anumberofmanagement deliverysystemsiselaboratedonthebasisoftwoexamples. 4.2. Anear-accidentasaresultofhydrogenembrittlement

Ammoniawassmelledduringanoperatorroundin2018. Fur-therinvestigationbytheplantoperatorrevealedthattheinsulation shell of a pipe was partially coloured and that synthesis gas andammoniawereleakingout.Theammoniaplantwas imme-diatelystoppedanddepressurized.Aftertheinsulationmaterial wasremoved,acrackcouldbeseenalongaweldofthepipe.As localrepairswerenotpossible,partofthepipeworkwasremoved andreplaced.Thepipewascrackedcircumferentiallyandpartly throughtheentirewallof50mm,indicatinghighstressesinthe pipesystem.Thiswasconﬁrmedbythefactthatallspringhangers ofthepipesystemwereoutofreach.Thepipingsystemis pro-videdwithspringhangerstobalanceslightverticaldisplacements. Ifthespringhangersarenotproperlyadjustedordonotfunction properly,large,localtensionscanariseinthepipesystem.

Metallurgical research has shown that there were no weld defectsand theweld metthestandards. Theconclusion ofthe metallurgicalinvestigationwasthatinternal,highstressescaused thecrackingduetoincorrectmounting,toohighhardnessanda notchingeffectoftheweld.Thefailuremechanismwasclassiﬁed ashydrogenembrittlement,alsoknownasstablecrackgrowth.

Further investigation revealed that this pipe section was replacedin2012whenanewheatexchangerwasinstalled.The springhangersofthepipesystemwerenotﬁxedwhentheoldpipe wasdismantledatthetime,afterwhichthenewpipewasmeasured incorrectly.Inaddition,thebendandthepipewereforciblyaligned beforethepipejointwaswelded.Thisresultedinpermanent,high tensionsatthelocationoftheweld.

Theleftsideofthebowtieofthisaccidentprocess hasbeen drawnupbasedontwointernal,non-publicinvestigationreports (Fig.3).Thispartofthebowtieshowstwo(primary)barriers,of whichtheﬁrstprimarybarrierhasonebarrierelementandthe sec-ondprimarybarrierhasthreeelements.Theﬁrstbarrierconcerns weldingaccordingtoaprocedure,theso-calledgoldenweld pro-cedure.Thegoldenweldprocedureisusedinpipelinesandpiping networkswhere(hydrostatic)pressuretestscannotbeperformed. Thegoldenweldprocedureensuresthatsafety-criticalstepsare taken.Failuretofollowtheprocedureproperlycanleadtoalatent, unsafecondition(Schmitz,2012).

(7)

Table2

DescriptionoftheorganizationalfactorsormanagementdeliverysystemsatOCINitrogenincludingtheassociatedactivitiessubdividedbyplanandimplementation.

Organizationalfactors ormanagement deliverysystems

Description Planand

implementation

Activities

Maintenance The_correctivemanagement_maintenanceofpredictive,_programspreventive_(execution,and planningandregistration)ofallhardwareand softwarestructures,systemsandcomponents.

Plan Preventivemaintenanceplan,correctivemaintenancegoals,

qualitygoals,andstrategyregardingoutstandingactivities Implementation Preventivemaintenancebacklog,correctivemaintenance

completion,qualityofworkandreporting,availabilityofplant equipmentandbackupsystems,andactiontracking Inspectionandtesting The_programsmanagement_(execution,ofthe_planninginspection_andandtesting

registration)ofallhardwareandsoftware structures,systemsandcomponents.

Plan Inspectionplan,qualitygoals,strategyregardingoutstanding

activities,andinspectionandtestprocedures

Implementation Inspection&testingbacklog,qualityofworkandreporting, andactionfollow-up

Trainingand competence

Themanagementofselectionandtrainingof personnelthatguaranteessufﬁcient knowledgeandskillsforthesafeexecutionof thecriticalbusinessprocessesandactivities.

Plan Trainingprogram,traininggoals,andcompetencematrix

includingtasksandresponsibilities

Implementation Knowledgeandskills,educationandtraining,and qualiﬁcationsandcertiﬁcations

Management The_in_whichmanagement_the_followingofacompany_aspects_playororganization_a_role: policy,commitmentandmotivation,goals, planningandavailabilityofpersonnel, workload,safetyculture,conﬂictmanagement, leadership,andcommunicationwiththe workforce.

Plan Planningofwork,availabilityofresources,andproduction,

qualityandsafetygoals

Implementation Stafﬁngofteams,workload,follow-upofHSEactions,order andtidiness,committedandinformedstaff,andsafeand healthyworkingenvironment,andsupervision

Procedures The_workingmanagement_methodsof_andasystem_agreementsinwhich_arerules, describedconcerning,amongotherthings, changesintheplant(MoC,Managementof Change),workpermits(PermittoWork),job safetyanalysis(JSA),lastminuterisk assessment(LMRA),overriding,pre-start-up safetyreview(PSSR),LoToTo(log-out,tag-out, try-out),andspecialrepairandgoldenweld procedures.

Plan Proceduresandworkingmethodsthatarepracticallyfeasible

andthatcomplywithlegislationandregulations Implementation Implementationinaccordancewiththeprocedure

Plantdocumentation The_{documentation}management_includingofplant_operatingrelated instructions.

Plan Reviewplan,andarchivingpolicy

Implementation Readability(clarityandcompleteness),resemblancetothe currentsituation,availability,andaccessibility

Communicationand coordination

Alloralandwrittencommunicationand coordinationbetweenthedifferent departmentsoftheprimarybusinessprocess.

Plan Agreementsaboutcooperation,communication,andreporting

Implementation Workandshifttransfer,cooperationbetweenOperationsand Maintenancedepartment,shiftreporting,projecttransferto theOperationsdepartment,and(near)accidentreporting Plantdesignand

operations

Thetechnicaldesignandoperationoftheplant includingtheman-machineinterface, ergonomicsandphysicalenvironment.

Plan Plantspecbook,operatinginstructions,environmental

permits,andsafetystudiesincludingactionplans Implementation Plantperformance,plantfailure,trustworthinessofsafety

systems(override),plantcontrolsystemperformance(manual mode),useofbackupsystems,design&safetyoperating windows,alarmoverload,permitviolations,andaction follow-upfromsafetystudies

Hardwareintegrity Theconditionofthehardware,includingthe safetycriticalsystems.

Plan Policyregardingplantavailabilityandspareparts,legislation andregulations,andhardwareassessmentstudies(FMEA, corrosionandmechanicalfailuremechanisms)including actionplans,maintenanceprograms,andconditionmonitoring Implementation Hardwareconditionincl.safetysystems,availabilityofplant

equipment,backupsystemsandsafetycriticalequipment, integrityoperatingwindow,andactionfollow-upfrom hardwarestudies

Thesecondbarriercomprisesofthreeelements:adifferent

pres-sureandtemperatureimageduringstart-uporshutdownofthe

installation isan indicationthat hydrogencanbecome trapped

inthemetalgrid.Incombinationwithincreasedstresses

(includ-ingstressescausedbyamalfunctioningspringhanger),thismay

leadtohydrogenembrittlementandcracking.Aﬁtness-for-service

analysisand/orastresscalculationcanshowwhetherandwhere

aninspectionornon-destructiveexaminationshouldtakeplace.

Aninspectionornon-destructiveexaminationmayrevealtowhat

extentcrackinghasoccurredandwhetherrepairorreplacementof

theweldisnecessary.

Thisaccidentprocesscoulddevelopbecausethetwobarriers

didnotfunctionorwerenotpresent.Thegoldenweldprocedure

hasbeeninplaceforalongtimeandwasamandatoryprocedureat

thetimeofthenewheatexchanger.Theinvestigationestablished

thattheprocedurewasnot(fully)followed,meaningthattheﬁrst

barrierwasnotreliable/availableand/ornoteffective.Knowledge

regardinghydrogenembrittlementinthispipelinesystemwasonly

acquiredduringtheaccidentinvestigation.Thatmeansthesecond

barrierwasnotpresent.Adeviatingpressure/temperaturepicture

duringthestart-upandshutdownoftheammoniainstallationwas

notreportedbecauseitwasnotdeemednecessary.Thepositionof

thespringhangerswasnotconsideredbecausetheirimportance

hasbeenlostovertime.

Thefourbarrierelementsofthetwoprimarybarrierscanbe

linkedtooneormoreofOCINitrogen’sninemanagement

deliv-erysystems(Table2)asisshowninFig.3fortheﬁrsttwobarrier

elements.Thequestionhereistowhatextentthemalfunctioning ofthemanagementdeliverysystemscontributedtothefailureof thebarrierelements.InTable3,themanagementdeliverysystems ofthebarrierelements ¨goldenweldprocedure ¨and ¨deviatingP/T image ¨areelaborated.

(8)

Table3

In-depthquestionsconcerningmanagementdeliverysystems.

Management deliverysystem

Plan/implementation In-depthquestions

Inspectionand testing

Plan:

• Inspectionplan • Qualitygoals

• strategyregardingoutstanding activities

• Inspectionandtestprocedures

• Whodrewuptheplan?

• Whohascheckedandapprovedtheplan? • Whatisintheplan(selection,planning)? • Arethirdparties,“certiﬁedbodies”involved? • Whatgoalshavebeenset?

• Aretheplanandgoalsknown?

• Isthereaplanregardingoutstandingactivities? • Aretheplan,goalsandstrategyperiodicallyevaluated? • Whatisthequalityoftheinspectionandtestprotocols? • Whohascheckedandapprovedtheseprotocols? • Dotheprotocolsmeetstandardsandlegislation? Implementation:

• Inspection&testingbacklog • Qualityofworkandreporting • Actionfollow-up

• Aretheinspectorssufﬁcientlyqualiﬁed? • Howandtowhomisreported? • Whoassessesandapprovesthereports? • Whatshouldbedoneincaseofdeviations?

• Whoassessesandapprovesrepairsandcorrectiveactions?

• Towhatextenthastheplanbeenimplementedaccordingtoschedule? • Howmanyinspectionsmeetthesetquality?

• Whenistheinspectionbacklogtooextensive? • Howisthefollow-upofactionsarranged?

• Istheimplementationprocessperiodicallyevaluated?

Procedures

Plan:

• Proceduresandworkingmethods thatarepracticallyfeasibleandthat complywithlegislationand regulations

• Aretheproceduresknownandunderstood? • Aretheproceduresaccessible?

• Whatisthequalityoftheprocedures? • Aretheprocedurespracticallyfeasible?

• Dotheprocedurescomplywithlawsandregulations? • Aretheproceduresperiodicallyevaluated?

Implementation:

• Implementationinaccordancewith theprocedure

• Howistheapplicationoftheproceduresmonitored?

• Whoassessesdeviationsintheimplementationoftheprocedures? • Whathappensiftheproceduresarenotappliedorappliedincorrectly? • Whatpercentageoftheproceduresisappliedasagreed?

• Istheimplementationprocessperiodicallyevaluated? Trainingand competence Plan: • Trainingprogram • Traininggoals • Competencematrix

• Whatisthequalityofthetrainingprogram? • Arethegoalsrealisticandachievable?

• Areallrolesaddressedinthecompetencematrix?

• Whohasdrawnup,checkedandapprovedthetrainingprogram,goalsandcompetence matrix?

• Aretheprogram,goalsandcompetencematrixperiodicallyevaluated? Implementation:

• Knowledgeandskills • Educationandtraining • Qualiﬁcations&certiﬁcations

• Isthetrainingprogrambeingcarriedoutaccordingtoplan? • Howareknowledgeandskillstested?

• Whoassessesthesubstantivedepthofthetrainingcourses? • Dothetrainingcoursescorrespondwithpractice? • Arenon-standardsituationsalsotrained? • Isthepracticesupportedbytheory?

• Aremajorhazardaccidentprocessesalsodiscussed? • Whathappensifsomeoneisinsufficientlyqualified? • Whatqualificationsdothetrainershave?

Hardwareintegrity

Plan:

• Policyregardingplantavailability andspareparts

• Legislationandregulations • Hardwareassessmentstudies

(FMEA,corrosionandmechanical failuremechanisms),including actionplans

• Whohasdrawnupthepolicy?

• Whohascheckedandapprovedthepolicy? • Isthepolicyperiodicallyevaluated?

• Arethelatestlawsandregulationsbeingactedupon?

• Havethecorrosionandmechanicalfailuremechanismsbeenidentiﬁed? • Whodidthehardwareassessment?

• Howoftendoesahardwareassessmenttakeplace? • Whatarethestartingpoints?

(9)

Table3(Continued) Management

deliverysystem

Plan/implementation In-depthquestions

Implementation:

• Hardwareconditionincl.safety systems

• Conditionmonitoring • Availabilityandperformanceof

devices

• Availabilityofbackupsystems • Integrityoperatingwindow • Actionfollow-upfromhardware

studies

• Whatisthegeneralconditionofthehardware? • Howmanysafetysystemsareinoperativeandwhy?

• Howoftenistheplantavailabilityduetodeterioratedhardwarecondition? • Whatistheavailabilityofbackupsystems“ondemand”?

• Hasanintegrityoperatingwindowbeendeﬁned?

• Howoftenhastheintegrityoperatingwindowbeenexceeded?

• Whatistheprocedurewhentheintegrityoperatingwindowhasbeenexceeded? • Howisthefollow-upofactionsfromhardwarestudiesarranged?

• Whatisthesizeofthebacklog?

Forthegoldenweldprocedure,themanagementdelivery

sys-tems“inspectionandtesting”and“procedures”playaroleandfor

deviatingP/Timagetheseare“trainingandcompetence”and

“hard-wareintegrity”.Table3showsanon-exhaustivelistofin-depth

questionsregardingtheplanandimplementationofthefour man-agementdeliverysystems,whichcanbeansweredduringanaudit orpeerreview.Inordertobeabletoassesstheplan,questions mustbeaskedthatelaborateonthedevelopmentoftheplan (con-trol,approval),thefamiliarityandaccessibility,thecontent(scope, goals,planning,successfactors,tasksandresponsibilities)andthe evaluation.Inordertogaininsightintotheimplementation, ques-tionsshouldberaisedconcerningtherealizationoftheactivities, thebacklogoftheplanning,thequalityofthework,thefollow-up ofactions,thereporting,thequaliﬁcationsofpersonnel,andthe ﬁnalevaluation.

Thegoldenweldprocedureisawell-knownprocedurewhich importanceandcontentshouldbeunderstoodbytheusers.The procedurehasbeenadjustedattimesbuthasneverbeen thor-oughly evaluated.Too oftentheuseof theprocedurehasbeen supervisedfromthedeskandtoolittleinthefield,whereasthis isstatedintheprocedure.Itreliedonverbalfeedbackratherthan onfieldverification.Thisalsoappliedtotheweldingin2012:the bendandthepipewereforciblyalignedbeforethepipejointwas welded.Hadtheinspectorbeenonsite,theworkwouldhavebeen rejectedbeforeweldinghadevenstarted.Thequestionofhowthe applicationoftheprocedurewassupervised,shouldhaveprovided anindicationthatthemethodusedinpracticedeviatesfromwhat isstatedintheprocedureandmayhaveledtodangeroussituations. Knowledge regardinghydrogenembrittlementplaysa major role in the second barrier. There was no knowledge concern-ing thefailure mechanism and deviating pressure/temperature images werenot reported becausetheirdanger wasunknown. Untilrecently,onlythecorrosionandmechanicalfailure mecha-nismsthatcoulddevelopduringnormaloperationoftheammonia planthadbeenassessed.Itwasonlyveryrecentlythatthiswasalso donefortheoperationalphasesofstart-upandshutdown,which resultedinknowledgeregardinghydrogenembrittlement,and sta-blecrackgrowthinparticular.Thestudiesconductedinthepast hadneverbeenassessedbyan(external)expert.Substantive ques-tionsabouttheresultsandstartingpointsoftheassessmentstudies couldhavediscoveredthisgap.

4.3. Anexampleofanoverpressurescenario

Majorhazard accidentsarepreventedbybarriers,which are dividedintoeleventypesbyGuldenmundetal.(2006).Threeof themostcommonbarriertypesare:“activated-manual,human actiontriggeredbyactivehardwaredetection(s)”,“activated- auto-mated”,and“activated-hardwareondemand”.Asexplainedin section 1.3, barrierelements canbetechnical or non-technical, meaning that theyare either hardware or software related, or

humanororganizationrelated.Thefollowingexampleexamines themanagement delivery systems of a humanbarrier element (activated-manual,humanactiontriggeredbyactivehardware detection(s))andahardwarebarrierelement(activated–hardware ondemand).

Onceammoniaisformed,itiscooledandcollectedinvessel V3304at200bar.Fromthislevelcontrolledvesseltheliquid ammo-niais depressurizedthroughanoriﬁceandcollectedinanother vessel(V3305)atmuchlowerpressure.ThereceivingvesselV3305 maybeoverpressurizedwhentheoriﬁceisnotworkingproperly. ThisisthecasewhenvesselV3304isemptyandisreleasing ammo-niagasinsteadofliquid.Theoverpressurescenarioissafeguarded bytwolowlevelalarms(LAL3045andLAL3046)installedatV3304 followedbyanoperatoractiontoclosebothdrainvalves(LPV3045 andLPV3046),anda(mechanical)pressurereliefvalve(PSV3014) atthereceivingvessel,asshowninFig.4.

Thebarriersystembasicallyconsistsoftwo differentbarrier elements:humanandhardware.Forthebarrierelementhuman (theoperatoraction)themanagement deliverysystemstraining &competence,plantdocumentation,andmanagementcomeinto consideration.Forthehardwarebarrierelements,theseare main-tenance,inspection&testing,procedures,andhardwareintegrity. Theoperatoris,asitwere,theactingbarrierelementofthe alarm.He/sheshouldknowwhattodoaccordingtotheoperating instructions.Theoperatorshouldbetrained,knowhistasksand responsibilities,andhavethemostrecentinformation.The organi-zationshouldmaintainthelevelofknowledgeandensurethatthe operatorsarecompetentandfocusedontheirtasks.The“training &competence”planoutlinedinTable2shouldensurethatthereis atrainingprogramthatreflectsreality,traininggoalsaredefined, andacompetencematrixisinplaceincludingtasksand respon-sibilities.Thedepartmentresponsible formaintainingtheplant documentationalsoplaysanimportantrole.Forexample,notonly shouldoperatinginstructionsberegularlyreviewedtoensurethey areuptodate,buttheyshouldalsobereadilyaccessible.An archiv-ingpolicymustensurethatonlythemostrecentversioncanbe requested.Basedontheplanningandtheavailabilityofresources, managementmustensureaproperworkload,staffingofteams, andsupervisionontheshopfloor.Becauseeveniftheoperatorhas receivedtherightknowledgeandoperatinginstructions, unneces-sarymistakesaremadeunderworkpressureandwhensupervision islacking.

Good maintenance, testing and inspections are necessaryto guaranteethetrustworthinessofthe(hardware)barriers.The hard-wareshouldatleastbemaintainedaccordingtothemanufacturer’s manualsothatthemostcommondefectsareavoided.And ifa barrier fails, it must be determinedin advance with what pri-orityitwillberestored.Themaintenanceregimecanbejudged byitsbacklogofpreventivemaintenanceandthecompletionof correctivemaintenance,butalsobythequalityoftheworkand ultimatelytheavailabilityofthehardware.Inadditiontoproper

(10)

Fig.4.Left-handsideofthebowtieofanoverpressurescenarioofV3305.

maintenance,thetrustworthinessofbarriersmustalsobe guaran-teedthroughtestingandinspection.Aplanmustbedrawnupfor this,wherebytheimplementationtakesplaceaccordingto estab-lishedproceduresunderthesupervisionofqualiﬁedpersonnel.Its implementationcanbecheckedbasedonthemeasuredbacklog, thequalityoftheworkanditsreporting,andtheaction follow-up.Anoverrideprocedureshouldcontrolthebarriers’availability byanestablishedworkingmethodandresponsibilities.Finally,the assessmentofthehardwareconditionprovidesageneralpicture. Useofhardwareunderextremeconditionsmake hardware fail-ures morelikely. Hardwarestudies suchasa failuremodeand effectanalysisandconditionmonitoringcancontributetoa bet-tertrustworthinessofsafetycriticalequipment,includingsafety barriers.

5. Resultsanddiscussion

Fig.1showsthatthereareseveralfeedbackloopsfromwhich informationcanbeobtainedtopredictmajorhazardaccidentsor detectﬂawsintheprocesssafetymanagement.Qualitative infor-mationofmanagementdeliverysystemscanbegeneratedfrom auditsorpeerreviewsthatareconductedonceeverythreetofour years byinternaland/orexternalexperts.Managementdelivery systems canalsobepartlymonitoredbyself-assessmentsona morefrequentbasis,sayannually,byanyonenotbelongingtothe managementdeliverysystembuttotheorganizationand there-forefamiliarwiththeorganizationalissuesandworkprocesses. Quantitativemonitoringonamorefrequentbasisshouldonlybe conductedwhenauditsorpeerreviewsdonotrevealmajor short-comingsorﬁndings.

Inboththenear-accidentandtheoverpressureexample,onlya qualitativeconsiderationofthemanagementdeliverysystemshas beenmade.ThequestionsofTable3areclosedquestions,tobe answeredbyayesorno,orbyastatement.Itisuptotheauditors togivetheirjudgementontheplanandimplementation.Onlyif theyareconﬁdentthatthemanagement deliverysystemisable toguaranteethebarriersystem’squality,itismeaningfulto mon-itorsomecriticalelementsinaquantitativeway.Anexampleof a quantitativeassessmentofthe(activitiesofthe)management deliverysystem“inspectionandtesting”isshownbelow.Notethat thethresholdvalues areindicativeandcanserveasmanagement indicatorsoncetheyareestablished.

• Periodicevaluationoftheplan,goalsandstrategy:theevaluation isontimeandthereportisﬁnishednolaterthantwoweeksafter that;

• Approvalofinspectionandtestprotocols:atleast90%hasbeen approvedbyathirdpartybeforeexecution;

• Protocolsmeetingstandardsandlegislation:atleast75%hasto becompliant;

• Inspectorsqualiﬁcations:nounderqualiﬁedinspectors;

• Reportingapproval:atleast75%ischeckedbyapeerinspector withinthedeadline;

• Reportingquality:atleast75%isrighttheﬁrsttime;

• Inspectionbacklog:90%inspectionsaredoneontimeandright theﬁrsttime;

• Actionfollow-up:noactionsoverduelongerthan1month. Organizational factors or management deliverysystems are non-technicalinnatureandmustberegardedasworkprocesses andproceduresinwhichhumanactionsanddecision-making pre-dominate.Humansare partlyinfluencedbytheenvironment in whichtheyworkandbythesystemswithwhichtheywork,inthe courseofwhichtheywillalwaystryandfindtheeasiestway,even ifitismoredangerous.Itcannotbeassumedthathumansalways actrationally.Onlywhenanorganizationhastheright question-ingattitudeitwillbeabletofindthemechanismsobstructingtheir workprocessesandprocedures.Conductinganauditorpeerreview requiresmorethanjustaskingquestions.AccordingtoHale(2005), safetyauditingisanartwithverylittlescientificbasis.Bothanaudit orreviewandaself-assessmentoftheplananditsimplementation shouldinanycasebesubstantiatedwithsufficientsamples.Itis hardtodirecthowmanysamplesshouldbecheckedfromwhich theauditororassessorcangiveanopinionaboutthefunctioning andqualityofamanagementdeliverysystem.Itmostlydepends ontheauditee’sanswerswhetherfollow-upquestionsarebeing askedornot.

ThequestionsinTable3aremainlyproceduralinnatureand largely ignore interpersonal relationships. Communication and cooperation(notunderstanding,poorcommunication,notbeing informed)arevitalandnecessaryforworkprocessesand proce-durestofunctionproperly.Inaddition,theremaybecontradictory goalsorlimitationsintimeand/orresources,asaresultofwhich choicesmustbemade,makingitnotalwayspossibletofollowthe procedureinfull.Itisuptotheauditortodiscoverthese

(11)

sensitiv-itiesanddeterminetowhatextenttheyhinderthefunctioningof themanagementdeliverysystemsasawhole.

6. Conclusions

Themainquestionofthissub-studyiswhethermajorhazard accidentsrelatedtotheammoniaproductionprocesscanbe pre-dictedbymonitoringorganizationalfactors.Thisquestionhasbeen answeredfromfivesub-questions.A(non-exhaustive) overview hasbeenprovidedoforganizationalfactorsormanagement deliv-ery systemsfrom thescientific and professionalliterature. The relationoftheorganizationalfactorswiththeaccidentprocesses runsthroughthebarriersystems.Organizationalfactorsindirectly impactaccidentprocessesastheystronglyinfluencethequality ortrustworthinessofthebarriersystems.Qualitativeand quanti-tativemonitoringoforganizationalfactorscanprovideapicture oftheiroperationandefficiency.Alistofnineorganizational fac-torsormanagementdeliverysystemshasbeencompiledwhichare applicableforOCINitrogen.Byputtingtherightfocuson organi-zationalfactorsduringauditsorreviews,majoraccidentprocesses gettheattentiontheydeserve,andthenecessaryactionsaretaken at therightmanagement level.Froman exampleon retrospec-tivedataithasbeendemonstratedthattargetedquestionscould haveprovidedsuchaninsightintoseveralorganizationalfactorsor managementdeliverysystemsthatitisconceivablethatfurther in-depthinvestigationwouldhavepreventedthenear-accidentfrom happening.

Malfunctioningmanagementdeliverysystemscanpromotea majorhazardaccidentprocess.Managementdeliverysystemslike management,andcommunicationandcoordinationcouldalsobe consideredas“performanceinﬂuencingfactors”or“error produc-ing conditions”.Theirinﬂuenceonscenarios ismore generalin nature andnot through thebarriersystems, but viapromoting errors and creatinglatent, dangerousconditionsiftheyare not properlymanaged.

Aquantitativeassessmenthasbeenworkedoutforoneofthe managementdeliverysystemssotoprovideanexampleof manage-mentindicators.Butastheexamplesshows,determiningthreshold valuesforwhichactionisrequiredisanintricatematter,because theinﬂuenceontheaccidentprocessesisdifﬁculttodetermine. Moreretrospectiveresearchintoaccidentsisrequiredtovalidate thesethresholdvalues.Oncethresholdvalueshavebeenset, (man-agement)indicatorscanbedeveloped,which aremeasuredata frequencyof,forexample,onceamonthoronceaquarter.

DeclarationofCompetingInterest

Theauthorsdeclarethattheyhavenoknowncompeting ﬁnan-cialinterestsorpersonalrelationshipsthatcouldhaveappearedto inﬂuencetheworkreportedinthispaper.

References

Ale,B.,Baksteen,H.,Bellamy,L.,Bloemhof,A.,Goossens,L.,Hale,A.,Mud,M.,Oh, J.,Papazoglou,I.,Post,J.,Whiston,J.,2008.Quantifyingoccupationalrisk:the developmentofanoccupationalriskmodel.Saf.Sci.46,176–185,http://dx.doi. org/10.1016/j.ssci.2007.02.001.

Bakerreport,Retrievedfrom2007.TheReportoftheBPU.S.ReﬁneriesIndependent SafetyReviewPanel.https://www.csb.gov/bp-america-reﬁnery-explosion/. Bellamy,L.,2015.Exploringtherelationshipbetweenmajorhazard,fataland

non-fatalaccidentsthroughoutcomesandcauses.Saf.Sci.71,93–103,http://dx.doi. org/10.1016/j.ssci.2014.02.009.

Bellamy,L.J.,Ale,B.J.M.,Geyer,T.A.W.,Goossens,L.H.J.,Hale,A.R.,Oh,J.,Mud,M., Bloemhof,A.,Papazoglou,I.A.,Whiston,J.Y.,2007.Storybuilder–atoolforthe analysisofaccidentreports.Reliab.Eng.Syst.Saf.92,735–744,http://dx.doi. org/10.1016/j.ress.2006.02.010.

CCPS,2016.GuidelinesforImplementingProcessSafetyManagement,2nded.John Wiley&SonsInc.,Hoboken,US.

Crisislab,Retrievedfrom2016.ToevalofStructureelIncidentalisme?Negen Inci-dentenUit2015BijChemelotNaderBeschouwd.http://crisislab.nl/wordpress/ wp-content/uploads/2016-06-07-rapport-Chemelot-def.pdf.

CSB,Retrievedfrom2007.Investigationreport,ReﬁneryExplosionandFireBPTexas City.https://www.csb.gov/bp-america-reﬁnery-explosion/.

Duijm,N.,2009.Safety-barrierdiagramsasasafetymanagementtool.Reliab.Eng. Syst.Saf.94,332–341,http://dx.doi.org/10.1016/j.ress.2008.03.031.

Guillaume,E.,2011.IdentifyingandRespondingtoWeakSignalstoImprove Learn-ingFromExperiencesinHigh-riskIndustry.ProefschriftTechnischeUniversiteit, Delft.Oisterwijk,TheNetherlandsBoxpressBV.

Guldenmund,F.,Hale,A.,Goossens,L.,Betten,J.,Duijm,N.J.,2006.The develop-mentofanaudittechniquetoassessthequalityofsafetybarriermanagement.J. Hazard.Mater.130,234–241,http://dx.doi.org/10.1016/j.jhazmat.2005.07.011. Hale,A.,2005.SafetyManagement,whatdoweknow,whatdowebelieveweknow, andwhatdoweoverlook?TijdschriftvoortoegepasteArbowetenschap2005(3), 58–66.

Hale,A.,Ale,B.,Goossens,L.,Heijer,T.,Bellamy,L.,Mud,M.,Roelen,A.,Baksteen, H.,Post,J.,Papazoglou,I.,Bloemhoff,A.,Oh,J.,2007.Modellingaccidentsfor prioritizingprevention.Reliab.Eng.Syst.Saf.92,1701–1715,http://dx.doi.org/ 10.1016/j.ress.2006.09.025.

Hassan,J.,Khan,F.,2012.Risk-basedassetintegrityindicators.J.LossPrev.Process Ind.25,544–554,http://dx.doi.org/10.1016/j.jlp.2011.12.011.

Hopkins,A.,2008.FailuretoLearn.CCHAustraliaLtd.,Sydney,Australia.

HSE,Retrievedfromhttp://www.hse.gov.uk/pUbns/priced/hsg254.pdf2006. Devel-opingProcessSafetyIndicators,aStep-by-stepGuidefortheChemicalandMajor HazardsIndustries.

Kletz,T.,1988.LearningFromAccidentsinIndustry.Butterworths,London,UK.

Kongsvik,T.,Almklov,P.,Fenstad,J.,2010.Organisationalsafetyindicators:some conceptionalconsiderationsandasupplementaryqualitativeapproach.Saf.Sci. 48,1402–1411,http://dx.doi.org/10.1016/j.ssci.2010.05.016.

Li, Y.,2019. ASystematicand Quantitative Approach to SafetyManagement. ProefschriftTechnischeUniversiteitDelft.Enschede,TheNetherlands:Ipskamp Printing.

Li,Y.,Guldenmund,F.,Aneziris,O.,2020.Deliverysystems:asystematicapproach forbarriermanagement.Saf.Sci.121,679–694,http://dx.doi.org/10.1016/j.ssci. 2017.02.007.

Mogford,J.,Retrievedfrom2005.FatalAccidentInvestigationReport.http://cip. management.dal.ca/publications/ﬁnalreport.pdf.

Nunenvan,K., Swuste, P.,Reniers, G.,Paltrinieri, N., Aneziris,O.,Ponnet,K., 2018.Improvingpalletmoversafetyinthemanufacturingindustry:a bow-tieanalysisofaccidentscenarios.Materials11,1–19,http://dx.doi.org/10.3390/ ma11101955.

Øien,K.,2001a.Riskindicatorsasatoolforriskcontrol.Reliab.Eng.Syst.Saf.74, 129–145.

Øien,K.,2001b.Aframeworkfortheestablishmentoforganizationalriskindicators. Reliab.Eng.Syst.Saf.74,147–167.

Øien,K.,Utne,I.,Herrera,I.,2011.Buildingsafetyindicators:part1–theoretical foundation.Saf.Sci.49,148–161,http://dx.doi.org/10.1016/j.ssci.2010.05.012. OSHA(z.d.).ProcessSafetyManagement.Retrievedfromhttps://www.osha.gov/

Publications/osha3132.html.

OVV,Retrievedfrom2018.ChemieinSamenwerking–VeiligheidOpHet Indus-triecomplexChemelot. https://www.onderzoeksraad.nl/nl/page/4707/chemie-in-samenwerking—veiligheid-op-het-industriecomplex-chemelot.

Papazoglou,I.,Bellamy,L.,Hale,A.,Aneziris,O.,Ale,B.,Post,J.,Oh,J.,2003.I-Risk: developmentofanintegratedtechnicalandmanagementriskmethodologyfor chemicalinstallations.J.LossPrev.ProcessInd.16,575–591,http://dx.doi.org/ 10.1016/j.jlp.2003.08.008.

Perrow,C.,1984.NormalAccidents.LivingWithHigh-riskTechnologies.BasicBooks, NewYork,US.

Pitblado,R.,Fisher,M.,Nelson,B.,Fløtaker,H.,Molazemi,K.,Stokke,A.,2016. Con-ceptsfordynamicbarriermanagement.J.LossPrev.ProcessInd.43,741–746,

http://dx.doi.org/10.1016/j.jlp.2016.07.005.

Reason,J.,1987.TheChernobylerrors.Bull.Br.Psychol.Soc.40,201–206.

Reason,J.,1997.ManagingtheRisksofOrganizationalAccidents.Taylor&Francis, Abingdon,UK.

Ruijter,Ade,Guldenmund,F.,2016.Thebowtiemethod:areview.Saf.Sci.88, 211–218,http://dx.doi.org/10.1016/j.ssci.2016.03.001.

Schmitz,P.,ThesisMoSHEcourse2012.MeerVeiligheidMetMinderRegels. Tech-nischeUniversiteitDelft.

Schmitz,P.,Swuste, P.,Theunissen,J.,Reniers,G.,Decramer,G.,Uijterlinde,P., 2018.Eenaanpakvoorhetbepalenvaneenrealistischerankingvande gevaar-lijksteprocesonderdelenvanhetammoniakproductieproces.Tijdschriftvoor toegepasteArbowetenschap2018(2),42–56.

Schmitz,P.,Swuste,P.,Reniers,G.,Decramer,G.,2019.Eenaanpakvoorhet beo-ordelenvanmechanischefaalmechanismenvanstatischeapparatenvanhet ammoniakproductieproces.TijdschriftvoortoegepasteArbowetenschap2018 (2),34–54.

Schmitz,P.,Swuste,P.,Reniers,G.,Nunenvan,K.,2020a.Mechanicalintegrityof processinstallations:barrieralarmmanagementbasedonbow-ties.Process. Saf.Environ.Prot.138,139–147,http://dx.doi.org/10.1016/j.psep.2020.03.009. Schmitz,P.,Swuste,P.,Reniers,G.,Nunenvan,K.,2020b.Eenpraktischeaanpakvoor hetvoorspellenvanmajeureongevallenindeprocesindustrieopbasisvande barrièrestatusopscenarioniveau.TijdschriftvoortoegepasteArbowetenschap 2020(2),47–66.

Sobral,J.,GuedesSoares,C.,2019.Assessmentoftheadequacyofsafetybarriersto hazards.Saf.Sci.114,40–48,http://dx.doi.org/10.1016/j.ssci.2018.12.021.

(12)

Sonnemans,P.J.M.,Körvers,P.M.W.,Pasman,H.J.,2010.Accidentsin“normal” oper-ation–canyouseethemcoming?J.LossPrev.ProcessInd.23,351–366,http:// dx.doi.org/10.1016/j.jlp.2010.01.001.

Swuste,P.,Theunissen,J.,Schmitz,P.,Reniers,G.,Blokland,P.,2016a.Processsafety indicators,areviewofliterature.J.LossPrev.ProcessInd.40,162–173,http:// dx.doi.org/10.1016/j.jlp.2015.12.020.

Swuste,P.,Gulijkvan,C.,Zwaard,W.,Lemkowitz,S.,Oostendorp,Y.,Groeneweg,J., 2016b.Developmentsinthesafetysciencedomain,intheﬁeldsofgeneraland safetymanagementbetween1970and1979,theyearoftheneardisasteron ThreeMileIsland,aliteraturereview.Saf.Sci.86,10–26,http://dx.doi.org/10. 1016/j.ssci.2016.01.022.

Swuste,P.,Gulijkvan,C.,Groeneweg,J.,Zwaard,W.,Lemkowitz,S.,Guldenmund, F.,2020a.Occupationalsafetyandsafetymanagementbetween1988and2010: reviewofsafetyliteratureinEnglishandDutchlanguagescientiﬁcliterature. Saf.Sci.121,303–318,http://dx.doi.org/10.1016/j.ssci.2019.08.032.

Swuste,P.,Gulijkvan,C.,Groeneweg,J.,Zwaard,W.,Lemkowitz,S.,Guldenmund,F., 2020b.Fromclaphamjunctiontomacondo,deepwaterhorizon:riskandsafety managementinhigh-tech-high-hazardsectors.AreviewofEnglishandDutch literature:1988–2010.Saf.Sci.121,249–282,http://dx.doi.org/10.1016/j.ssci. 2019.08.031.

Turner,B.,1978.Man-madeDisasters.Butterworth-Heinemann,Oxford,UK.

Vinnem,J.E.,2010.Riskindicatorsformajorhazardsonoffshoreinstallations.Saf. Sci.48,770–787,http://dx.doi.org/10.1016/j.ssci.2010.02.015.

Wagenaar,W.,Groeneweg,J.,Hudson,P.,Reason,J.,1994.Promotingsafetyin theoilindustry.TheErgonomicsSocietyLecturePresentedattheErgonomics SocietyAnnualConference,Edinburgh,13-16April1993.Ergonomics37(12), 1999–2013,http://dx.doi.org/10.1080/00140139408964963.

Zemering,C.,Swuste, P., 2005. Voorstelvooreen methode terpreventievan incidenten en rampen in de procesindustrie. Tijdschrift voor toegepaste Arbowetenschap2005(4),79–88.