Building Safety indicators: Part 2 – Application, practices and results

Safety Science 49 (2011) 162–171

Contents lists available at ScienceDirect

Safety Science journal homepage: www.elsevier.com/locate/ssci

Building Safety indicators: Part 2 – Application, practices and results K. Øien a, I.B. Utne b,*, R.K. Tinmannsvik a, S. Massaiu c a

SINTEF Technology and Society, Safety Research, Trondheim, Norway Department of Marine Technology, Norwegian University of Science and Technology (NTNU), Norway c Institute for Energy Technology, Halden, Norway b

a r t i c l e

i n f o

Article history: Received 26 June 2009 Received in revised form 21 April 2010 Accepted 18 May 2010

Keywords: Indicators Safety Risk Risk management

a b s t r a c t Petroleum exploration and production in the Barents Sea is a controversial topic. The Goliat field outside the northern coast of Norway will be the first offshore oil development in this region, with planned production start in 2013–2014. Avoiding major accidents at Goliat is critical; not only to reduce the risks to human lives and the environment, but also to gain political acceptance. Providing early warnings of major accidents for Goliat is one of the main objectives of the research project ‘Building Safety’. The objective of this paper is to describe the development of early warnings in the form of indicators. In addition, the paper includes an overview of current status of early warnings of accidents in other major hazard industries; the nuclear power industry, the chemical process industry, and aviation. Experiences from these industries, including lessons learned from recent major accidents, have been used as important input to the development of early warning indicators. Ó 2010 Elsevier Ltd. All rights reserved.

1. Introduction On September 25th, 1998, an explosion took place at the Esso natural gas plant in Longford, Australia. Two workers were killed and eight injured. The gas supplies to the state of Victoria were severely affected for two weeks, leaving the inhabitants without hot water and gas heating, and disrupting the industry and the commercial sector (Hopkins, 2000). On March 23, 2005, the BP Texas City refinery experienced a catastrophic process accident, one of the most serious US workplace disasters in 20 years. The accident caused 15 deaths and more than 170 injured (Baker et al., 2007). Several reports have been issued investigating the Longford and Texas City accidents. Hopkins (2000, 2002) has shown that the Esso gas plant at Longford in Australia had an impeccable lost-time injury (LTI)1 rate and yet was managing its major hazards quite poorly. According to the Baker report (Baker et al., 2007), BP relied mostly on occupational illness and injury rates to monitor process safety performance, which significantly limited their perception of process risk. Both Hopkins (2000) and Baker et al. (2007) address the need for improved process safety indicators, and pinpoint that neither the refining industry in particular, nor the process industries in general, have developed and implemented consensus process safety performance indicators for prevention of major accidents. * Corresponding author. E-mail address: [email protected] (I.B. Utne). 1 LTI-rate – lost-time injury frequency rate is defined as the number of lost-time injuries per one million hours of work. A lost-time injury is an injury due to an accident at work, where the injured person does not return to work on the next shift (Kjellén, 2000). 0925-7535/$ - see front matter Ó 2010 Elsevier Ltd. All rights reserved. doi:10.1016/j.ssci.2010.05.015

Indicators of major hazard facilities are important topics in safety research. Most of the research has focused on personal safety and not on major accidents. Indicators, such as the LTI-rate, has been used (and abused) in many different industries, as is the case with Esso and BP in the accidents mentioned above. By abused, we mean that indicators on personal safety have been used as a measure of ‘system safety’ or risk of major accidents. Conditions of occurrence of major and minor accidents have been discussed by Hale (2000), who shows that major accidents are of a different nature with other underlying causes than minor occupational accidents. Safety performance indicators represent an important constituent of a safety management system (SMS) involving the establishment, implementation and follow-up of corporate policies, acceptance criteria and goals related to safety. The systematic feedback of experience on accident risks is a cornerstone in any management system for prevention of accidental losses, and includes reactive as well as proactive means (Kjellén, 2000). Follow-up of safety management systems are traditionally performed by tools like safety audit systems, i.e. planned and systematic investigations of the organization and the administrative procedures to control safety. These kinds of tools are outside the scope of this paper. Safety performance indicators can be of a reactive, or a proactive nature, depending of the characteristics of the indicators. Reactive indicators (‘lagging indicators’) are after-the-event type of indicators, while proactive indicators (‘leading indicators’) assume measurements of underlying causes and contributing factors to accidental events, such as (inadequate) training, supervision, etc., and thus providing early warnings. In developing safety performance indicators there will be a balance between on one

K. Øien et al. / Safety Science 49 (2011) 162–171

hand, to concentrate on direct indicators having enough data to be meaningful, and on the other hand, to focus on indirect indicators having enough data and providing early warnings, but with less direct safety relevance. One approach is therefore to focus on indirect indicators only to the extent necessary, e.g. where there is either lack of data or specific need for early warning information. This paper is focusing on the current practices, whether this includes leading, lagging or both types of indicators. To obtain valid leading indicators is a major challenge. Underlying causes and contributing factors may be of such a nature that it is difficult to obtain quantitative measures that are individually valid and collectively have adequate coverage, meaning that all aspects of a given contributing factor are covered by a set of indicators. It is important that operating personnel take part in the identification, evaluation and selection of indicators since this may provide indicators with ‘face validity’. High validity and high reliability are scientific requirements; however, there are also several non-scientific (‘usefulness’) requirements to indicators. The International Atomic Energy Agency (IAEA, 1999) has suggested the following (quality) characteristics for safety performance indicators:  Direct relation between indicator and safety.  Necessary data should be available or capable of being generated.  Able to be expressed in quantitative terms.  Unambiguous.  Significance should be understood.  Not susceptible to manipulation.  Manageable set.  Meaningful.  Able to be integrated into normal operational activities.  Able to be validated.  Able to be linked to the cause of a malfunction.  Accuracy of the data at each level to be capable of quality control and verification.  Local actions able to be taken on the basis of indicators. Evaluation of indicators should be made on the basis of both scientific and non-scientific requirements. The indicators will also change over time, which means that it is necessary to reevaluate them regularly. Building Safety2 is a research project which focuses on safety opportunities and challenges in petroleum exploration and production in the northern regions, with emphasis on the Goliat field in the Barents Sea. One of the main research questions in Building Safety is to develop new models and methods for the establishment of indicators, which can unveil early warnings of major accidents (SINTEF, 2010). Viewed in the light of the Longford and Texas City accidents, and the discussions about major hazard indicators (e.g., Hopkins, 2009; HSE and CIA, 20063; Duijm et al., 2008; Grabowski et al., 2007; Saqib and Siddiqi, 2008; Körvers and Sonnemans, 2008; Osmundsen et al., 2008; Vinnem et al., 2006; Øien, 2001a,b), the objective of this paper is to discuss the development of early warnings for Goliat. In addition, the paper gives an overview of safety and risk indicators applied in the nuclear power industry, the chemical process industry, and in aviation. The practices in these industries provide valuable input to our development of early warnings or leading indicators. The paper is a follow-up of Øien et al. (2010), which constitutes the theoretical foundation for development of indicators as early warnings of major accidents.

2 3

http://www.sintef.no/buildingsafety. CIA – Chemical Industries Association.

163

This paper is divided into six sections: Sections 2–4 discuss the status of use and research of indicators within different major hazard industries. Development of early warnings for Goliat is discussed in Section 5. Conclusions are stated in Section 6. 2. Indicators in the nuclear power industry Development and application of indicators in the nuclear power industry have been on the agenda since the Three Mile Island accident in 1979. Indicators have been the subject in several R&D projects, to authorities, such as Nuclear Regulatory Commission (NRC) in the US, to organizations like The World Association of Nuclear Power Plant Operators (WANO) and The International Atomic Energy Agency (IAEA), and to different plant operators in Scandinavia (Øien and Sklet, 1999a). In the nuclear power industry, the assessment of plant safety is conducted by evaluating two areas (Hallbert et al., 2006): 1. Physical system design and performance. 2. Operational system design and performance. The physical system design and performance assessment has evolved since the beginning of the nuclear power enterprise and it is commonly reputed to have achieved a state of maturity and completeness. It is in this area that most safety performance indicators, as well as the quantitative probabilistic safety assessment (PSA) approach have been originally developed, although early research on safety indicators also covered organizational factors (Øien et al., 2010). The operational system design and performance covers the organizational and human contribution to plant safety. Although always recognized as crucial to safety, thorough research in this area started from the early 1980s, under the different names of ‘operational safety’ (IAEA, 1999), ‘human performance’ (INPO, 1999), and ‘safety culture’ (IAEA, 2002). For an overview of early research on safety indicators, including organizational factors effect on safety, see Øien et al. (2010). In all countries, operating nuclear power plants (NPP) adopt indicators to monitor their safety performance. However, there is no unified approach concerning terminology and definition of ‘performance indicators’, ‘safety indicators’, and ‘safety performance indicators’ (SPIs). The most widely applied is the WANO set of performance indicators (10 quantitative indicators reported annually by nearly all NPPs worldwide, in order to monitor the safety and economic performance of NPPs). In many countries the WANO set is complemented by other indicators, and is used by both utilities and regulators. Other indicators are obtained from the IAEA Safety Performance Indicator Framework TECDOC-1141 (IAEA, 2000), and the US NRC Reactor Oversight Process (ROP). Performance indicators are never seen as the only way for assessing plant safety. Both regulators and licensees use safety indicators in addition to other tools, such as regulatory inspections, safety audits, peer reviews, quality assurance and self assessment (quality audits), and PSA to evaluate plant safety (Sandén, 2006). Similar to other industries, the nuclear power industry assumes a distinction between leading and lagging indicators. Leading indicators also referred to as ‘input indicators’ and ‘activity-based indicators’, are most useful as precursors to safety degradation for early management reaction. Lagging indicators are most commonly used to drive plant performance, to monitor, and for benchmarking against similar plants. An EU research program on the use of safety indicators has concluded that ‘most of the existing SPIs are considered as ‘lagging’ indicators, that is, they are expected to show an impact only when a downward trend has already started’ (Chakraborty et al., 2003). As a result ‘one of the most important and challenging issues for

164

K. Øien et al. / Safety Science 49 (2011) 162–171

nuclear plant owners and/or regulators is to recognize early signs of deterioration in safety performance, caused by influences from management, organization and safety culture (MOSC), before actual events and/or mishaps take place’ (Chakraborty et al., 2003). Moved by similar concerns, the US Electric Power Research Institute (EPRI) sponsored a project aimed at developing leading indicators of human performance. This work took the approach of developing two complementary classes of indicators: workplace indicators and management and organizational indicators. The first approach has become known as the Proactive Assessment of Organizational & Workplace Factors (PAOWF) approach, and it has been implemented in several plants in customized forms, but always to provide the management with human performance data without having to undergo events (EPRI, 2000). Data are obtained by performing specialised surveys to technicians, operators, and other concerned parties about what kinds of problems they encounter in performing their work and to what degree these problems disrupt their work. A second approach, less widely adopted, was the development of organizational process indicators, known as Leading Indicators of Organizational Health (LIOH) (EPRI, 2000). These indicators were developed to provide information to senior management about the performance of the systems important to the management of safety. In other words, the LIOH indicators are indicators of management systems performance. Seven issues (known as ‘themes’) were identified from the literature on organizational performance and safety. These are:       

Management commitment. Awareness of human performance. Preparedness for problems. Flexibility built in for responding to problems. Just culture (to promote reporting of errors and failures). Learning culture (to promote fixing of problems). Opacity (or transparency/visibility) of safety performance.

Both the PAOWF and LIOH data are intended explicitly to be used within plants to trend their own performance and no attempt has been made to compare plants. As the LIOH approach clearly shows, leading indicators can be seen as measures of the quality and implementation of safety management processes and programmes (such as competence and staff resources, safety audits, operation management and outages, emergency preparedness, incident investigation, etc.), which, in turn, are generally seen as integral parts of the quality management system. In addition to the challenge of identifying viable leading indicators to inclusion in safety management systems for the detection of early warnings, a second related challenge is to assess the causal links between indicators, the implementation of safety measures, and plant safety. During the last 10 years, a number of studies have attempted to relate indicators directly to safety and risk (IAEA, 2000; Khatib-Rahbar et al., 2000; US NRC, 2002). Two routes have been pursued: the first consisting of reviews of event reports to identify human and organizational causes; the second consisting of reviews of reliability data to identify the PSA parameters that could be the most sensible to human and organizational influences. The PSA is considered the most complete and integrated means available for quantitative assessment of nuclear power plant safety performance.

3. Indicators in the chemical process industry Process accidents, like Longford and Texas City, cause multiple fatalities, substantial economic, property, and environmental dam-

age, both inside refineries and to the nearby communities. In general, process safety risks arise from complex systems with a large number of control measures that may be called ‘hard’ or ‘soft’ controls. Hard controls are physical elements within the facility, for example barriers, alarms, and improved system design. Soft controls are internal procedures and best practices, for example standards, operating procedures, training, administrative controls, supervisory oversight, and the experience and knowledge of frontline operators. Process safety relates to the quantity, quality, and variety of controls or protective features that protect people, the environment, and property from process hazards. Thus, process safety management is critical in refining operations (Baker et al., 2007). Many companies have incorporated indicators into their safety management systems to track safety performance, to compare safety performance against the performance of other companies or facilities, and to determine goals for continuous improvement of safety performance. Regulatory agencies, industry groups, and labour organizations have undertaken efforts to develop and improve the use of process safety indicators, and one of the more recent developments is the distinction between leading and lagging indicators (Hopkins, 2009). Leading indicators are related to active safety monitoring, whereas lagging indicators are connected to reactive monitoring. The former gives feedback on performance before an accident or incident occurs, the latter means identifying and reporting incidents and learning from mistakes (HSE and CIA, 2006). Lagging indicators show when a desired safety outcome has not been achieved. One problem with lagging indicators is that they provide hindsight (Baker et al., 2007). According to HSE and CIA (2006), leading indicators may be useful in predicting future process safety performance, even though they are not absolutely predictive. For example, the percentage of equipment that is past due for inspection can be considered a process safety leading indicator because the metric relates to the physical condition of the facility, as well as the effectiveness of oversight systems. Nevertheless, even if equipment inspections are frequent, failures can still occur. This means that effective measuring and evaluation systems utilize both leading and lagging indicators. The HSE4 recently proposed a system of ‘dual assurance’ with both leading and lagging indicators, to provide assurances on the effectiveness of a site’s risk control systems. Another perspective of leading and lagging indicators is held by Hopkins (2009). He claims that the distinction between lead and lag indicators is not at present consistent and useful as it has little consequence to whether a risk control system is effective. According to Baker et al. (2007), personal safety lagging indicators, or injury rates, are prevalent in the refining industry. Injury rates, for example days away from work and recordable injury frequency rate, have become well established and generally accepted measures of safety performance. Companies collect and report these metrics at regular intervals. Additionally, many companies set goals based upon reducing the numerical values of lagging indicators (such as recordable injury frequency rate) below a certain target level, which was the problem at the Esso Longford plant in Australia, also (Hopkins, 2000). Baker et al. (2007) believes that BP’s dependence on lagging indicators disabled their ability to measure, monitor, and detect degraded process safety conditions and performance at the plant in Texas City. The failure to use a set of effective performance metrics, including leading indicators, increased the likelihood that the organization would identify the need for improvements or additional control of risk only after something had gone wrong. BP

4

HSE - Health and Safety Executive.

165

K. Øien et al. / Safety Science 49 (2011) 162–171 Table 1 BP group integrity management metrics (Baker et al., 2007). Leading indicators

Lagging indicators

Number of overdue inspections and tests Completion of major accident risks assessments Closure of major accident risk group recommendations

Number of uncontrolled releases Number of integrity managementrelated major incidents Number of integrity managementrelated high potential incidents

now monitors at the corporate level several leading and lagging process safety metrics, of which some are indicated in Table 1.

4. Indicators in aviation Traditionally, improvements in aviation have mainly been based on statistical analyses and learning from accidents. This approach focused the measurement of safety performance based on lagging indicators, such as accident rates and LTI-rates. However, there is a growing concern that this information does not provide the required insight needed to prevent future accidents. The International Civil Aviation Organization (ICAO) has recommended establishing a Safety Management System (SMS). Many companies have introduced leading and lagging indicators into their Safety Management System to track safety performance. Despite the benefits of a proactive SMS, the aviation industry is still focused on the reactive part of safety management. Australian Transport Safety Bureau (ATSB) has produced Aviation Safety Indicators (ASI) since 1996 (ATSB, 2005). The indicators are divided into four groups: (i) flying activity, (ii) industry, (iii) incident, and (iv) accident indicators. The indicators are produced to provide a benchmark for stakeholders of the safety of Australian aviation, and to highlight broad trends that have occurred in aviation safety. (i) Flying activity indicators show hours flown by categories and major types of operation, aircraft departures, scheduled airline passenger movements, and aircraft movements at major airports and aerodromes around Australia. Flying activity indicators provide contextual information on activity or risk exposure against which trends can be considered. (ii) Industry indicators contain information about the age of Australian registered aircraft, the numbers of flight crew licenses, and the numbers of aircraft maintenance engineer licenses. (iii) Incident indicators show occurrences, other than accidents (Ref. ICAO Annex 13; ICAO, 2001), associated with the operation of an aircraft that affects or could affect the safe operation of the aircraft. Incidents include: 1. Breakdown of separations and airprox incidents. 2. ACAS (Airborne Collision Avoidance System) resolution advisories. 3. Violations of controlled airspace. 4. Runway incursions. 5. Bird strike incidents. (iv) Accident indicators focus on accidents, fatalities and fatal accident rates. These indicators demonstrate the trends that have occurred since 1993. The Accident Investigation Board Norway (AIBN) has presented a study regarding the relation between organizational changes and safety (AIBN, 2005). Included in this study was the development of performance-based indicators for flight safety in order to monitor changes in factors influencing safety over a specific period of time

(Tinmannsvik, 2005). In the study, the following two main categories of safety indicators were discussed: I. Outcome-based indicators (lagging indicators) – O. II. Activity-based indicators (leading indicators) – A. Outcome-based indicators measure the frequency of injuries/ near accidents (injury frequency rate, FAR – fatal accident rate); while activity-based indicators measure efforts to reduce injuries/losses (e.g., backlog in implementing safety measures, frequency of emergency response drills). In the AIBN study, 43 performance indicators for flight safety were put forward; 5 outcome-based and 38 activity-based indicators, respectively. The activity-based indicators were defined within the following main groups: (1) external audits (by authorities); (2) internal audits (company level); (3) emergency; (4) competence, training and experience; (5) work load; (6) maintenance; and (7) economy/investments. The full list of 43 performance indicators were too much to handle, therefore there was a need to distinguish between indicators that were supposed to be (i) very important in monitoring trends in flight safety, (ii) of average importance, and (iii) of minor importance to flight safety. The splitting into three groups according to their expected importance for flight safety was based upon discussions with experienced people in the civil aviation authorities in Norway and Sweden. A selection of the safety performance indicators proposed by Tinmannsvik (2005) was applied to assess the management of

Table 2 Safety performance indicators (lagging) indicators.

aviation maintenance organizations: outcome-based

No

Indicator

Comments

O1

Accident rate: number of accidents per 100,000 flight hours (FH) Deviations rate: number of reported deviations, disturbances per year

This is in accordance with ICAO Annex 13 accident definition (ICAO, 2001) This indicator should be carefully interpreted; it could say something about improvements related to reporting culture

O3

Table 3 Safety performance indicators (leading) indicators. No

aviation maintenance organizations: activity-based

Indicator

Internal and external audits A1 Number of internal and external audits per year Competence, training and experience A4 Number of continuation or recurrent training per technician per year Maintenance program A7 Back-log (Hold Item List) per aircraft type per 100,000 FH Corrective maintenance A8 Minimum Equipment List (MELa) reports per aircraft type per 100,000 FH

Comments Different types of audits; management audits, system audits, and inspections This indicator needs to be interpreted in relation to aviation requirements This indicator should be analyzed together with the amount of dispensations requested per year This indicator should be analyzed together with the amount of dispensations requested per year

a MEL – Minimum Equipment List is a document approved by national civil aviation authorities that contains the conditions under which a specified aircraft may operate, with particular items of equipment inoperative, at the time of dispatch. It provides a time interval for the rectification of the faulty item, relevant to the operational significance of the item; http://casa.gov.au/owners/gmel/index.htm.

166

K. Øien et al. / Safety Science 49 (2011) 162–171

safety in five maintenance organizations in Norwegian aviation. Information was gathered from three airlines and two helicopter operators for the period 2000–2004 (Herrera et al., 2006; Herrera and Tinmannsvik, 2006). Indicators supposed to be the most important in monitoring flight safety, are shown in Tables 2 and 3. Conclusions from the AIBN study confirm that the operators have systems in place to follow-up and analyze lagging indicators, but there is still a need to gather information and analyze leading indicators. Brooker (2007) has explored if it is possible to construct simple Air Traffic Management (ATM) safety indicators that correlate with the underlying accident rate for mid-air collisions. A perfect indicator would be an indicator which is simple to comprehend and capable of being calculated by a checklist process. It should not require complex modeling calculations to be carried out to ‘weight’ the data appropriately. It should be ‘obvious’, in the sense that people would quickly agree that it was a sensible thing to measure. Two ATM safety indicators constructed from the performance of Air Traffic Control (ATC) safety defenses were examined: 1. ASB – Actual Separation Breach; counts initiating events that produce a separation breach between airborne aircrafts. 2. INRA – Incident Not Resolved by ATC; counts situations where the ground based part of the system has not resolved an incident; e.g., the number of situations where the Airborne Collision Avoidance System (ACAS) was activated to prevent conflict with another aircraft. Brooker claims that ASB is a useful measure for the frequency of initiating events for incidents, i.e., where full system control needs to be re-asserted. INRA measures the number of times when the system is reliant on its final safety defensive layer, the ACAS. There are good reasons to believe that INRA would be a good indicator of the underlying accident rate. However, there are issues about safety culture in reporting incidents that would need to be addressed, to ensure complete coverage of such incidents. The Civil Aviation Authorities (CAA) in New Zealand developed a prototype for risk indicators in 2000 and made a re-evaluation of the system in 20055. The result of this exercise was the adoption of several new risk indicators, the development of a system to assess as many risk indicators as possible automatically, and the development of ‘word pictures’ to help assess those indicators that are not suitable for automation. A risk profile is designed to highlight aspects of an operation that may involve increased risks. It requires the CAA to assess a client’s organizational culture and internal functioning in many areas and rate performance against a standard scale. Risk profiles may be generated and changed by any staff member having interaction with a client during routine and non-routine surveillance and certification. In addition to this, direct human assessment, routine automatic evaluation of client information is carried out. The risk profile assesses an organization in about 30 areas, and risk indicators are developed for each certificate type. About half of the indicators are assessed by CAA staff during interactions with clients, and the remainder are assessed automatically by the monitoring of changes to the CAA database. The risk indicators are related to attitude to safety and compliance by management, attitude towards risk taking, financial situation that affects safety, risk and quality management systems, fatigue and alertness management, demanding flight schedules or timetables, company experience (e.g. new start-up company vs. experienced), change in company organization, staff turnover, training programme, capability of senior personnel, staff morale, condition of facilities

5

http://www.caa.govt.nz/surveillance_system/the_risk_indicators.htm.

and equipment, multiplicity of aircraft types, maintenance cover, and safety trends. 5. Building Safety indicators for Goliat in the Barents Sea The previous sections have discussed the use of indicators in the nuclear power industry, in the chemical process industry, and in aviation. The theoretical foundation for developing indicators has been discussed in Øien et al. (2010). In the following section, we will discuss the development of early warnings for the oil exploration and production at the Goliat field, but before proceeding to Goliat, we sum up the current status in the oil and gas industry. 5.1. Development and use of indicators in the oil and gas industry Use of indicators is not a novel feature in the oil and gas industry. The development in the oil and gas industry is monitored in different ways by the various operating companies. All companies have in common that they gather information about several conditions (parameters), and monitor these conditions, without necessarily using the indicator concept. In the following section, we discuss development and use of indicators within some companies and the authorities. Elf used indicators for monitoring risk at Frigg (Vinnem, 1998, 1999). The background for the establishment of these indicators was the requirements in the HSE regulations (HSE, 1995). Six technical indicators for risk influencing factors were developed for the Frigg Safety Case in 1995. In 1996 this list was expanded to 11 indicators, based on results from sensitivity analyses, using the Quantitative Risk Analysis (QRA), and subjective evaluations of factors important to keep the personnel risk and risk of material damage under control: 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.

Leak frequency. Control of hot work. Automatic gas detection. Automatic fire detection. Availability of smoke diver team. Unavailability of emergency shutdown valves. Fire water supply. Availability of deluge control valves. Mustering time. Emergency lights at Quarter Platform (QP). Availability of search and rescue.

In 1998, a paramount indicator for major accident risk at Frigg Central Complex was introduced. The purpose was to improve communication about major accident risk and to increase focus on this topic in the same way as for personal injuries (LTA6-indicators). The paramount indicator was established by weighing the 11 indicators in terms of risk influence (based on QRA results) and subjective evaluations. In 2001, Elf became part of Total (Total/Elf, 2007). Key indicators of safety described in the Total 2006 Corporate Social Responsibility Report are total recordable injury rate, LTI-rate, number of fatalities, and percentage of sites presenting technological risks covered by a safety management system compliant with externally-recognized protocols (Total, 2007). In 1992, a decision was made to shut down the Phillips Petroleum’s Ekofisk 2/4-T platform, and to construct new platforms at Ekofisk. In order to maintain risk control in the interim period, a project was initiated to develop a set of indicators for monitoring risk until shut down of the platform (Øien et al., 1995; Undheim, 6

LTA – Lost Time Accident.

167

K. Øien et al. / Safety Science 49 (2011) 162–171

1999). The platform specific QRA was selected as a starting point for the project, because the QRA gave a quantitative measurement of the risk. Only those conditions that might be expected to change in the interim period were considered relevant for indicator development. The project ended up with the following set of indicators: 1. 2. 3. 4. 5. 6. 7. 8. 9.

Number of experienced area operators. Number of persons in total on the platform. Number of critical failures in electric equipment. Total burning time (of hot work) in a given time period. Number of exceeding of allowed burning time in restricted areas. Number of hydrocarbon leaks in a given time period. Number of experienced control room operators. Number of safety critical failures. Number of ageing problems with safety critical consequences.

ConocoPhillips chose to focus on some of these indicators, foremost indicator number 4 (total burning time in a given time period) and number 6 (number of hydrocarbon leaks). A specific procedure for hot work control was introduced, highly reducing the amount of hot work at the platform. According to the ConocoPhillips annual report (ConocoPhillips, 2006a), the results within safety, health and environment (SHE) have improved in 2006. The company continues to focus and improve the SHE area. SHE objectives and indicators are established at many levels in the organization, and are assessed at regular intervals. The company has continued to pursue training in PSI (Personal Safety Involvement), which was introduced in 2004. PSI is based on the precautionary principle, and the main objective is zero accidents. At the company’s global internet pages and in its sustainability report (ConocoPhillips, 2006b), the main safety focus is on personal safety and not major hazards. Two important metrics are presented; The Total Recordable Rate (TRR), which tracks the number of recordable incidents per 200,000 work hours, and Lost Workday Case (LWC), which is the number of incidents resulting in days away from work through occupational injury or illness per 200,000 h worked. Both metrics have improved during the period 2002–2006. SINTEF carried out the ‘Risk Indicator Project’ together with Statoil and the Norwegian Petroleum Directorate with the aim of developing a set of indicators to be used to monitor possible changes in the risk level (Øien and Sklet, 1999b). The fixed offshore installation Statfjord A was used as case. The project resulted in a suggested set of risk indicators for the risk influencing factors with largest potential effect on the total risk (measured as Fatal Accident Rate; the ‘FAR value’7). The proposed indicators cover process accidents and blow out. The risk indicators may be used for monitoring possible changes in risk at the platform in the time period between QRA updates. The proposed indicators are presented in Table 4. The proposed indicators cover only parts of the total risk (the largest contributors to major accident risk with consequences for personnel), but the same approach may also be applied in the development of indicators covering the risk for damage to the environment and loss of material assets. The research was also extended to include organizational factors effect on risk and the development of corresponding organizational risk indicators (Øien, 2001b). One of the important organizational factors identified through thorough studies of a

7 FAR – Fatal Accident Rate is defined as the number of fatalities per 108 working hours.

Table 4 Proposed risk indicators for Statfjord A. Risk influencing factors

Risk indicators

1. Process leak 2. Ignition due to failure in electrical equipment 3. Hot work

Number of all leaks Number of all failures in electrical equipment Number of hot work permits class A and B Number of hours of critical maintenance backlog Number of failures in electrical driving units Number of alarms indicating loss of overpressure Number of days with drilling/ completion activity Number of days with workover Number of trips (i.e., withdrawals of the drillpipe)

4. Ignition due to failure in pumps/ compressors 5. Ignition due to failure in driving units 6. Ignition in neighbour module 7. Drilling and completion 8. Workover (on wells) 9. Blowout

large number of gas leaks was ‘training/competence’, and one of the candidate organizational risk indicators suggested was ‘average number of years experience on this installation for relevant personnel’. Vinnem (2010) has discussed this candidate indicator completely out of context, and referred to it as ‘not intuitively accepted as important’, and even claims that ‘this is a result of the researchers’ inability to come up with intelligent proposals’. Well, to disregard offshore experience and competence as important is perhaps neither a token of intelligence. In Statoil’s annual report of 2006, the safety indicators covering the whole company are personal injury frequency rate, days absent from work due to injuries, and serious event frequency. These indicators are reported quarterly; for Statoil employees, for subcontractors, and for both groups together (Statoil, 2006–2007). October 1st 2007 the merger between Statoil ASA and Hydro ASA (oil and gas operations) was completed (StatoilHydro, 2007). It is reasonable to believe that in the future there will be a common development and use of indicators in the new company. In 1999, The Petroleum Safety Authority Norway, formerly a department within the Norwegian Petroleum Directorate, initiated the development of a method to assess risk level trends in the Norwegian offshore petroleum industry (Vinnem et al., 2006). The ‘Risk Level Project’ evaluates quantitative and qualitative indicators over time. Since there always will be changes in the indicators from one year to another, it is important to identify the cause of these changes with particular attention to any systematic trends. A pilot study report was issued in April 2001, covering the period 1996–2000. Since then, annual updates have been performed. The statistical approach is based on recording occurrence of near misses and relevant incidents, performance of barriers, and results from risk assessments. Safety culture, motivation, communication and perceived risk are covered through the use of social science methods; questionnaire surveys and interviews, audit and inspection reports, as well as accident and incident investigations (Petroleum Safety Authority Norway, 2008). The objectives of the ‘Risk Level Project’ are to assess the impact of SHE-related measures in the petroleum industry, to help identify areas critical for SHE in order to prevent unplanned events and accidents, and to improve the understanding of the possible causes of accidents and their relative significance in the context of risk. The results from the project create a reliable decision-making platform for the industry and authorities, enabling them to direct their efforts towards preventive safety measures and emergency preparedness planning. The work also helps to identify potential areas for making regulatory changes, and for research and development. The project has an important role in the industry, because it

168

K. Øien et al. / Safety Science 49 (2011) 162–171

contributes to a unified understanding of risk levels by the parties involved. The ‘Risk Level Project’ has previously been divided into different phases. Phase 7 (2006) continued the work of previous phases as well as progressing further. In 2005, work commenced on expanding the project to include onshore installations under the jurisdiction of the Petroleum Safety Authority, and in 2007, these results were presented for the first time (Petroleum Safety Authority Norway, 2008). The project focused on risk to personnel and covered major accidents, occupational accidents, and working environment factors. In Phase 7, field studies were conducted on two installations, with the focus on well service operations. In the ‘Risk Level Project’, the risk level is assessed based on statistical analyses and subjective evaluations of risk. The following indicators have been established (Petroleum Safety Authority Norway, 2009):     

Indicators for events related to major accident risk. Indicators for barriers related to major accident risk. Indicators for occupational accidents and diving accidents. Indicators for working environment factors. Indicators for other ‘Defined Situations of Hazard and Accident’ (DSHA).

Here, barriers include technical, operational, and organizational efforts. The statistical risk indicators predict future number of events within a prediction interval, based on historical data. The prediction intervals are also used to reveal trends. Statistical risk is related to major accidents based on indicators for each of the twelve ‘Defined Situations of Hazard and Accident’ (DSHAs), and a paramount indicator that weights the DSHAs according to their potential for causing fatalities. The DSHAs are identified and selected so that they cover all significant types of events that may cause fatalities. The DSHAs in Table 5 are those that may develop into major accidents. The latest fatalities associated with a major accident DSHA happened in 1997, due to the helicopter accident off Brønnøysund. The results for 2008 do not depict any change in the risk level in the petroleum industry, as a whole. There were no fatal accidents, and in recent years the indicators related to major accident risk have shown a positive development. There is a decrease in number of gas leaks, and an increased focus in the industry in general on major accident risk (Petroleum Safety Authority Norway, 2009). The total indicator was amended in 2005, and now shows a rolling 3-year average. This is believed to be a better method suited for identifying any underlying trend. According to Vinnem et al. (2006), the method used in the ‘Risk Level Project’ covers a complete set of event based indicators, which facilitates identification of trends, status and main contributions to the various hazards, as well as important improvement areas. However, the focus is on the total risk of all oil and gas facilities on the Norwegian continental shelf, which may conceal negative developments on one or a few installations. 5.2. Early warning indicators for Goliat The previous discussions in this paper concern known hazards of oil and gas exploration, mainly related to facilities in the North Sea. New challenges and hazards appear with exploration and production in the northern regions, in areas, such as the Barents Sea and Lofoten, due to, for example, a more vulnerable environment and arctic climate conditions. Exploration in the north is a controversial topic of social debate in Norway, particularly because of environmental and fisheries interests. Political acceptance for opening of these prospective exploration acreages depends on public confidence in the ability to produce oil and gas without

Table 5 DSHA – major accidents. No 1 2 3 4 5 6 7 8 9 10 11 12

DSHA description Non-ignited hydrocarbon leaks Ignited hydrocarbon leaks Well kicks/loss of well control Fire/explosion in other areas, flammable liquids Vessel on collision course (towards installation) Drifting object (on collision course towards installation) Collision with field-related vessel/installation/shuttle tanker Structural damage to platform/stability/anchoring/positioning failure Leaks from subsea production systems/pipelines/risers/flowlines/ loading buoys/loading hoses Damage to production facility/pipeline systems/diving equipment caused by fishing gear Evacuation Helicopter event

any harmful spills. Some limited exploration activity is presently taking place in the Barents Sea and further expansion depends on the ability of the involved companies to avoid harmful spills during this initial activity. One way of improving the ability to produce oil and gas, without any harmful spills, is to use early warning indicators. In the Building Safety project, we address this need for developing appropriate early warning indicators for petroleum exploration and production in the northern regions in general, and for operation of the Goliat field in particular. Goliat is located outside the northern coast of Norway in the southern part of the Barents Sea with a sub-arctic climate. Goliat will be the first oil development in the Barents Sea. The field will be developed with subsea installations tied back to a circular Floating Production Storage and Offloading (FPSO) facility. The development and operation are subject to strict environmental requirements (a zero tolerance regime for oil spills) according to the Integrated Management Plan for the Barents Sea, issued by the Norwegian Ministry of Environment (MoE, 2006). Regarding development of early warning indicators in the Building Safety project, it is relevant to ask:  How should we develop early warning indicators? What are the challenges, the requirements, and applicable approaches? Due to the increased focus on the need for measuring process safety (Baker et al., 2007); not to rely on injury rates to monitor process safety performance, we need to focus on potential major accidents. This is also in line with the main public concern, i.e., a major oil spill with detrimental effect on the environment (fish, sea birds, sea mammals, other maritime species and the beach). However, for policy reasons, we also need to cover minor oil spills, because such events may be regarded as ‘proofs of inability’ to operate in a zero tolerance regime. Harsh critique was raised after the Eirik Raude hydraulic leak incident in 2005 by environmental interest groups, and the incident got extensive media attention (Øien, 2008). Although media attention and public concern are directed towards environmental risk, the operator has to manage personnel risk as well, with a particular focus on major accidents, in addition to the traditional focus on occupational accidents. Another trend in the safety research community is development of proactive approaches, i.e., that the indicators should be able to provide signals before the event. In fact, such signals have been present prior to major accidents, e.g., the BP Texas City refinery explosion and fire (CSB, 2007) and the Esso Gas Plant explosion at Longford, Australia (Hopkins, 2000). Such indicators may be termed leading as opposed to lagging indicators, although the distinction is not always obvious and perhaps not important, and can

169

K. Øien et al. / Safety Science 49 (2011) 162–171

even be counterproductive (Øien et al., 2010). For the development of early warning indicators, we need to focus on proactive (leading) indicators, in particular. Finally, we know that within the offshore industry the authorities have introduced various indicators for surveillance of the risk level in the whole industry, as opposed to a system for follow-up of the risk level on individual installations. For the Goliat field development, it is necessary to focus on the individual installation level, although there may arise a future need from the authority perspective for surveillance of the whole region (the northern region). In the Barents Sea, with its zero tolerance for oil spills regime, one minor mistake by one actor may prevent further development in this region, at least for the near future. An average trend for the whole region or industry, as depicted in the ‘Risk Level Project’, is therefore at present of little interest. Integrated operations have been introduced as a future way of operation for the Goliat field, as for other oil and gas field developments on the Norwegian Continental Shelf. There are safety benefits of reducing staff onboard installations (less persons exposed to risk); however, there are also some challenges and uncertainties. One challenge is the potential increase in individual risk for those persons remaining onboard, and there is also concern about the long term consequences for local system knowledge when the staffs are decentralised. According to Hopkins (2000), decentralisation was a contributing cause to the Longford accident. The lessons from Longford show that it is necessary also to be able to understand when assistance (external/remote) is needed. To summarize the above discussion, when we develop indicators for Goliat, we need to:         

The great span in challenges and requirements for the Goliat field development calls for a triangulation approach, i.e., we need to utilize several different approaches and angles in the search for appropriate early warning indicators. The approaches we have pursued in the Building Safety project so far is an incident-based (or incident/accident analysis based) approach and a resilience-based approach. Øien (2008) explored the possibility of developing early warning indicators based on investigation of the hydraulic oil leak from the Eirik Raude drilling rig in April 2005. The barriers, checkpoints and corresponding indicators suggested are shown in Tables 6 and 7. The study was limited to minor unwanted hydraulic leaks, whereas harmful spills may also come as a result of major accidents (e.g., blowout) and discharge of ‘regular’ spills (e.g., overflow of scuppers and drains). Barriers against these kinds of spills need to be controlled, as well. The resilience-based approach uses an operationalization of the concept of resilience, as a starting-point, and utilizes an adapted version of the LIOH method (EPRI, 2000) to develop indicators for the various characteristics of a resilient organization. The new method has been adapted mainly in two ways. First, the factors seen as important to the management of safety (the seven ‘themes’) have been replaced by attributes of a resilient organization (eight ‘contributing success factors’), (Størseth et al., 2009). Secondly, for each of the contributing success factors a set of gen-

Table 6 Barriers and information providing early warning indications of potential hydraulic leaks.

Measure process safety. Focus on potential major accidents. Cover minor oil spills. Cover personnel risk as well as environmental risk. Focus on proactive (leading) indicators. Focus on risk on individual installation level. Focus on individual risk for the remaining offshore personnel. Maintain system knowledge locally. Be aware of, and understand, when (external/remote) assistance is needed.

Different approaches for the development of indicators may be classified into:  Safety performance-based indicators: o Event indicators. o Barrier indicators. o Activity indicators. o Programmatic8 indicators.  Risk-based indicators: o Technical indicators. o Organizational indicators.  Incident-based indicators.  Resilience-based indicators.

8 Programmatic performance indicators (PPIs) are indicators that assist in assessing the quality and performance of various programs, functions, and activities relating to the safety of the plant (see also Øien et al., 2010).

Checkpoint

1. Close off/lock off valves for system isolation 2. Use of standing instructions for system de-isolation 3. Visual inspection of system prior to use

Check depressurization of isolated systems Check use of WPa/SJAb when deisolating Check that visual inspection is carried out Spot check presence of watchman Check/verify that restrictions are followed Check/follow-up PM-program

4. Monitoring of valve operation 5. Use of system under controlled weather condition 6. Inspection of hoses according to PMc program 7. Review of critical overdue maintenance log

The next relevant questions are then:  What are the possible approaches for the development of early warning indicators (EWIs) that can meet the above listed challenges and requirements?

Barrier

a b c

Check the critical overdue maintenance log

WP – work permit. SJA – safe job analysis. PM – preventive maintenance.

Table 7 Early warning indicators.

a b c

Early warning indicators

Data collection frequency

1. Rate of inadequate depressurization of isolated systems 2. Rate of inadequate use of WP and SJA 3. Rate of inadequate visual inspection of system prior to use 4. Rate of inadequate use of a watchman 5. Rate of failure to comply with weather restrictionsa 6. Number of PM work orders for hydraulic hoses in backlog 7. Number of critical CMb work orders in backlogc

Daily Daily/weekly Daily/weekly Daily Daily/weekly Weekly/monthly/ quarterly Weekly/monthly/ quarterly

Given bad weather, i.e., not counting use of hydraulic systems in good weather. Not necessarily restricted to hydraulic hoses. CM – corrective maintenance.

170

K. Øien et al. / Safety Science 49 (2011) 162–171

eral issues has been suggested and accompanied with proposals for early warning indicators. I.e., a list of general issues with proposed early warning indicators has been developed and included as part of the method, which is a deviation from the original LIOH method. In addition, there will be an option for including new general issues and early warning indicators during the workshop sessions in which the method is applied and indicators established/selected (Øien et al., 2010b). The safety performance-based approach uses the ‘dual-assurance’ approach developed by HSE and CIA (2006), as a startingpoint. This is a barrier performance approach focusing on ‘risk control systems’. Particular attention is paid to leading (proactive) indicators, since the type of indicators we are developing are early warning indicators. 6. Discussions and conclusions When Building Safety indicators for the context of oil production in the Barents Sea, we need to fulfil several demands. We need to measure process safety, to focus on potential major accidents and to focus on proactive indicators (lessons from the Texas City accident). Further, we need to focus on risk of individual installations and cover minor oil spills, as well as major accidents (lessons from the Eirik Raude incident). We also need to focus on the individual risk for the remaining offshore personnel, to maintain system knowledge and understand when assistance is needed, since integrated operation is foreseen as the future way of operation (lessons from the Longford accident). This calls for the use of several approaches in the search for appropriate early warning indicators. We have developed and suggested a set of indicators using an incident-based approach (analysing the investigation reports of the hydraulic oil leak from the Eirik Raude drilling rig). However, this study was limited to minor unwanted hydraulic leaks, whereas harmful spills may also come as a result of major accidents (e.g., blowout) and discharge of ‘regular’ spills, which needs to be controlled as well. The incident-based approach has been complemented with a resilience-based approach and a safety performance-based approach (barrier performance). The resilience-based approach starts with the identification of attributes that characterizes a resilient organization, for which we build on previous work performed in the ‘Building Safety’ project (Størseth et al., 2009). Then it proceeds with the establishment of indicators for each of the attributes, utilizing an adapted version of the LIOH method (EPRI, 2000). This new method, called Resilience based Early Warning Indicators (REWI), is described in (Øien et al., 2010b).This part is based on lessons from the Nuclear Power Industry. Regarding the safety performance-based approach, we start with the work performed by HSE on leading and lagging indicators, i.e., the so-called ‘dual-assurance’ approach (HSE and CIA, 2006). This part is based on lessons from the Chemical Process Industry. With this triangulation of methods, we utilize both negative events (failures, incidents, etc.) and positive factors, i.e., factors that create safety, in contrast to factors that threaten safety. In this way, we may avoid the so-called controller dilemma. Acknowledgements The work in this paper has been carried out as part of the research project ‘Building Safety in Petroleum Exploration and Production in the Northern Regions’. Financial support from the Research Council of Norway, Eni Norge AS and TrygVesta is gratefully acknowledged. We also appreciate the valuable comments we have received from Erik Hollnagel, John Wreathall and an anonymous reviewer during the preparation of this paper.

References AIBN (Accident Investigation Board Norway), 2005. Safety in Norwegian Aviation during the Process of Change. Lillestrøm, Norway. ATSB (Australian Transport Safety Bureau), 2005. Aviation Safety Indicators. A Report on Safety Indicators Relating to Australian Aviation. Aviation Research Investigation Report B2005/0046. Baker III, J.A., Leveson, N., Bowman, F.L., Priest, S., Erwin, G., Rosenthal, I., Gorton, S., Tebo, P.V., Hendershot, D., Wiegmann, D.A., Wilson, L.D., 2007. The Report of the BP US Refineries Independent Safety Review Panel. Brooker, P., 2007. Are there good air traffic management safety indicators for very safe systems? Journal of Navigation 60 (1), 45–67. Chakraborty, S., Flodin, Y., Grint, G., Habermacher, H., Hallman, A., Isasia, R., Karsa, Z., Khatib-Rahbar, M., Koeberlein, K., Matahri, N., Melendez, E., Moravcik, I., Preston, J.F., Prohaska, G., Schwaeger, C., Tkac, M., Verduras, E., 2003. Evaluation of Alternative Approaches for the Assessment of Safety Performance Indicators for Nuclear Power Plants (SPI). Final Report (Short Version) EU FP5, FIKS-CT2001-00145. ConocoPhillips, 2006a. Annual Report 2006. ConocoPhillips, 2006b. Sustainable Development Report 2006. CSB (US Chemical Safety and Hazard Investigation Board), 2007. Investigation Report. Refinery Explosion and Fire, BP Texas City, Texas, March 23, 2005. Report No. 2005-04-I-TX, March 2007. Duijm, N.J., Fiévez, C., Gerbec, M., Hauptmanns, U., Konstandinidou, M., 2008. Management of health, safety and the environment in process industry. Safety Science 46, 908–920. EPRI, 2000. Guidelines for Trial Use of Leading Indicators of Human Performance: The Human Performance Assistance Package. 1000647. Palo Alto, CA, USA. Grabowski, M., Ayyalasomayajula, P., Merrick, J., Harrald, J.R., Roberts, K., 2007. Leading indicators of safety in virtual organizations. Safety Science 45, 1013– 1043. Hale, A.R., 2000. Conditions of occurrence of major and minor accidents. Paper at Seminar: ‘Le risque de défaillance et son contrôle par les individes et les organisations.’ 6–7 October 2000. Gif-sur-Yvette, France. Hallbert, B.P., Joe, J.C., Dudenhoeffer, D.D., Blackwood, L.G., Hansen, K., Mahadevan, S., Wreathall, J., 2006. Developing Human Performance Measures. Letter Report JCN Y6843. Herrera, I.A., Nordskag, A., Myhre, G., Halvorsen, K., 2006. Aviation safety and maintenance under major organizational changes, investigating a non existing accident. In: ESREL Conference. 18–22 September 2006, Estoril, Portugal. Herrera, I.A., Tinmannsvik, R.K., 2006. Key elements to avoid drifting out of the safety space. In: Resilience Engineering Conference. Juan Les Pins, France. Hopkins, A., 2000. Lessons from Longford. The Esso Gas Plant Explosion. CCH Australia Limited, Sydney. Hopkins, A., 2002. Special Issue: Lessons from Longford: The trial. The Journal of Occupational Health and Safety. Australia and New Zealand. Hopkins, A., 2009. Thinking about process safety indicators. Safety Science 47, 460– 465. HSE (Health and Safety Executive), 1995. Prevention of Fire and Explosions and Emergency Response on Offshore Installations. Vol. PFEER Regulations, SI 1995/ 743: Health and Safety Executive, UK. HSE and CIA (Chemical Industries Association), 2006. Developing Process Safety Indicators. A Step-by-step Guide for Chemical and Major Hazard Industries. Health and Safety Executive. IAEA (International Atomic Energy Agency), 1999. Management of Operational Safety in Nuclear Power Plant. INSAG -13. International Nuclear Safety Advisory Group, International Atomic Energy Agency, Vienna. IAEA, 2000. Operational Safety Performance Indicators for Nuclear Power Plants. IAEA-TECDOC-1141. IAEA, 2002. Safety Culture in Nuclear Installations, Guidance for Use in the Enhancement of Safety Culture. IAEA-TECDOC-1329. International Atomic Energy Agency, Vienna. ICAO (International Civil Aviation Organization), 2001. Aircraft Accident and Incident Investigation. Annex 13 to the Convention on International Civil Aviation, ninth ed. INPO (Institute of Nuclear Power Operations), 1999. Principles for Effective Selfassessment and Corrective Action Programs, AP-903. Khatib-Rahbar, M., Sewell, R., Erikson, H., 2000. A new approach to development of a risk-based safety performance monitoring system for nuclear power plant. In: Proceedings of the OECD/NEA Specialist Meeting on Safety Performance Indicators. Madrid, Spain. Kjellén, U., 2000. Prevention of Accidents through Experience Feedback. Taylor & Francis, London. Körvers, P.M.W., Sonnemans, P.J.M., 2008. Accidents: a discrepancy between indicators and facts! Safety Science 46, 1067–1077. MoE (Ministry of Environment), 2006. Integrated Management of the Marine Environment of the Barents Sea and the Sea Areas off the Lofoten Islands (Management Plan), Oslo, Norway. Osmundsen, P., Aven, T., Vinnem, J.E., 2008. Safety, economic incentives and insurance in the Norwegian petroleum industry. Reliability Engineering and System Safety 93, 137–143. Petroleum Safety Authority Norway, 2008. Trends in Risk Level, 2007. Norwegian Continental Shelf (in Norwegian). . Petroleum Safety Authority Norway, 2009, Trends in Risk Level, 2008. Norwegian Continental Shelf (in Norwegian). .

K. Øien et al. / Safety Science 49 (2011) 162–171 Sandén, P.-O., 2006. On safety indicators from a regulator perspective: some methodological aspects. In: Svenson, O. et al. (Eds.), Nordic Perspectives on Safety Management in High Reliability Organizations: Theory and Applications. Stockholm University, Sweden. Saqib, N., Siddiqi, M.T., 2008. Aggregation of safety performance indicators to higher-level indicators. Reliability Engineering and System Safety 93, 307–315. SINTEF, 2010. Building Safety in Petroleum Exploration and Production in the Northern Regions. . Statoil, 2006–2007. Annual Report 2006-2007. StatoilHydro, 2007. The StatoilHydro Merger Accomplished. Stock Exchange Report 2007 (in Norwegian). Størseth, F., Tinmannsvik, R.K., Øien, K., 2009. Building safety by resilient organization – a case specific approach. In: Proceedings, of the European Conference on Safety and Reliability – ESREL, September 2009, Prague/Czech Republic. Taylor & Francis. Tinmannsvik, R.K., 2005. Performance indicators of air safety – some results from Swedish aviation. SINTEF, Trondheim, Norway (in Norwegian). Total, 2007. Sharing our Energies 2006. Corporate Social Responsibility Report. Total/Elf, 2007. Our History. Undheim, H., 1999. Practical use of indicators in the safety work at Ekofisk. Presentation at a Reference Group meeting in the Project ‘Risk Analyses in the Operation phase’, 6 October 1999 (in Norwegian). US NRC, 2002. Risk-Based Performance Indicators: Results of Phase 1 Development. NUREG-1753. Vinnem, J.E., 1998. Use of performance indicators for monitoring HSE operating achievement. In: Lysersen, S., Hansen, G.K., Sandtorv, H. (Eds.), Safety and Reliability. Proceedings of the European Conference on Safety and Reliability – ESREL, June 1998. Trondheim, Norway. Vinnem, J.E., 1999. Erfaringer fra etablering og bruk av indikatorer i Elf (In Norwegian). Presentation at a Reference Group Meeting in the Project ‘Risk Analyses in the Operation Phase’, 27 January 1999 (in Norwegian).

171

Vinnem, J.E., Aven, T., Husebø, T., Seljelid, J., Tveit, O.J., 2006. Major hazard risk indicators for monitoring trends in the Norwegian offshore petroleum sector. Reliability Engineering and System Safety 91, 778–791. Vinnem, J.E., 2010. Risk indicators for major hazards on offshore installations. Safety Science 48, 770–787. Øien, K., Rosness, R., Sklet, S., 1995. Indicators for Surveillance of Changes in the Risk Level at Ekofisk 2/4-T. STF75 F95033 (Restricted). SINTEF, Trondheim, Norway (in Norwegian). Øien, K., Sklet, S., 1999a. Application of Risk Analyses in the Operating phase, Establishment of Safety Indicators and Modelling of Organizational Factors’ Effects on the Risk Level – A ‘State-of-the-art’ Description. STF38 A99416. SINTEF, Trondheim, Norway (in Norwegian). Øien, K., Sklet, S., 1999b. Risk indicators for surveillance of the risk level at Statfjord A. STF38 F98435 (Restricted). SINTEF, Trondheim, Norway (in Norwegian). Øien, K., 2001a. Risk indicators as a tool for risk control. Reliability Engineering and System Safety 74, 129–145. Øien, K., 2001b. A framework for the establishment of organizational risk indicators. Reliability Engineering and System Safety 74, 147–167. Øien, K., 2008. Development of early warning indicators based on accident investigation. PSAM 9. In: International Probabilistic Safety Assessment and Management Conference. 18–23 May 2008, Hong Kong, China. Øien, K., Utne, I.B., Herrera, I.A., 2010. Building Safety Indicators. Part 1 – theoretical foundation. Safety Science 49 (2), 148–161. Øien, K., Massaiu, S., Tinmannsvik, R.K., Størseth, F, 2010b. Development of early warning indicators based on Resilience Engineering. Submitted to PSAM10. In: International Probabilistic Safety Assessment and Management Conference. 7– 11 June 2010, Seattle, USA.