Process Safety Leading and Lagging

Approved Performance Indicators

Guideline

OMV-EP Guideline

Guidelines for Leading and Lagging

Process Safety Performance
Indicators (PSPI)

HSEQ-HQ-08-03-00

Prepared by: Date 23 April 2010

Mir Kazim Ali, Technical Safety Manager

Approved by: Date 23 April 2010

Rod Ritchie, Head EP-HSEQ

Exploration and Production, HSEQ, Vienna Page 1 of 14

HSEQ-HQ-08-03-00
 Process Safety Leading and Lagging
Approved Performance Indicators
Guideline

Contents
1 Scope and Application ..................................................................................... 3

2 Cross-references .............................................................................................. 3

3 Management responsibilities........................................................................... 4

4 Definitions ......................................................................................................... 4

5 Procedure .......................................................................................................... 6

5.1 Tier 1 Process Safety Event – Major Loss of Primary Containment...................... 6

5.2 Tier 2 Process Safety Event – Loss of Primary Containment ............................... 8

5.3 Tier 3 Performance Indicator – Challenges to Safety Systems............................10

5.4 Tier 4 Performance Indicators — Operating Discipline & Management System

Performance .......................................................................................................11

6 Record of revisions .........................................................................................12

APPENDIX A – Lagging/Leading Indicators ..........................................................13

Exploration and Production, HSEQ, Vienna Page 2 of 14

HSEQ-HQ-08-03-00
 Process Safety Leading and Lagging
Approved Performance Indicators
Guideline

1 Scope and Application

This guideline document for process safety performance indicators applies to OMV
Exploration & Production GmbH, all its controlled subsidiaries and OMV Australia Pty Limited
(together “OMV EP Group”). “Controlled” means the ownership directly or indirectly of more
than fifty percent (50%) of the shares or the rights of voting authority in a company,
partnership or legal entity. Where OMV is neither the operator nor holds the majority
shareholding, OMV will seek to have this, or similar, standards adopted for all operations.

This document applies to all facilities (offshore and onshore) that are directly operated by
OMV E&P (or its subsidiaries) and to facilities that are contracted to OMV or subject to a
service operating agreement with OMV.

Process safety hazards are those arising from the processing of oil and gas. These hazards
can result in process incidents such as escape of toxic substances or the release of
flammable material that causes a fire or explosion. Many process safety incidents may
damage the plant and have the potential to cause multiple fatalities, serious injuries and
environmental damage.

Personal safety affects individuals but have no real connection with the processing activity of
the plant. Typically they give rise to incidents such as trips, falls, electrocution, lifting and
vehicle accidents.

Most injuries and fatalities are the result of personal safety hazards rather than process
safety hazards. Therefore monitoring personal safety statistics does not give a good
assessment of how well a production facility is managing process safety hazards.

The other distinction is between lead and lag indicators. Lag indicators are those events that
caused harm to people or damage to equipment. Lead indicators are those that are pre-
cursors to harm or damage. This is discussed in more detail in Appendix A.

2 Cross-references
Management of Technical Integrity Standard, document no HSEQ-HQ-06-04-01 latest
revision

American Petroleum Institute (API), Recommended Practice (RP) 754 Process Safety
Performance Indicators for the Refining and Petrochemical Industries, API RP 754 first
edition 2010

International Association of Oil and Gas Producers (OGP): Asset Integrity – the key to
managing major incident risks. Report No. 415 December 2008

UK Health and Safety Executive: Developing process safety indicators – A step-by-step

guide for chemical and major hazard industries, HSG254, September 2006.

CCPS (Center for Chemical Process Safety) –Process Safety Leading and Lagging Matrices,
publication of CCPS of the American Institute of Chemical Engineers - 2008

Exploration and Production, HSEQ, Vienna Page 3 of 14

HSEQ-HQ-08-03-00
 Process Safety Leading and Lagging
Approved Performance Indicators
Guideline

3 Management responsibilities
The General Manager is responsible for the overall implementation of this Guideline and to
regularly review the effectiveness of the management controls that ensure process safety

The Operations and Engineering Manager is responsible for:

• Developing, recording, monitoring and trend analysing process safety leading and
lagging performance indicators in data base system (CARE or Monitor)
• Ensuring competent process engineering specialists are available to develop and
analyse process safety performance indicator data
• Taking action to improve process safety performance

The senior HSEQ representative in an international venture is responsible for:

• Developing systems to collate process safety performance indicator data on a regular
basis and sending the information to EP-HSEQ in Vienna.
• Independently reviewing the overall effectiveness of process safety management for
the facilities

The EP-HSEQ co-ordinator will collate the data from all the ventures and compile into a
report for the senior management team of OMV EP in Vienna for their review and
assessment of process safety performance. The data will also be forwarded to G-HSE for
overall corporate reporting purposes.

4 Definitions
Containment - primary
A tank, vessel, pipe, truck, rail car or equipment intended to serve as the primary container or
used for processing or transfer of material.

Containment - secondary
Exists to contain or control a release from primary containment. Secondary containment
systems include, but are not limited to tank dikes, curbing around process equipment,
drainage collection systems, the outer wall of double walled tanks, etc.

Direct cost
Cost of repairs or replacement, cleanup, material disposal, environmental remediation and
emergency response. Direct cost does not include indirect costs, such as business
opportunity, business interruption and feedstock/product losses, loss of profits due to
equipment outages, costs of obtaining or operating temporary facilities or costs of obtaining
replacement products to meet customer demand.

Loss of primary containment - LOPC

An unplanned or uncontrolled release of material from primary containment, including non-
toxic and non-flammable materials (e.g., steam, hot condensate, nitrogen, compressed
carbon dioxide or compressed air).

Exploration and Production, HSEQ, Vienna Page 4 of 14

HSEQ-HQ-08-03-00
 Process Safety Leading and Lagging
Approved Performance Indicators
Guideline

Process
Production, distribution, storage, utilities or pilot plant facilities used in the manufacture of
petrochemical and petroleum refining products. This includes process equipment (e.g.,
reactors, vessels, piping, furnaces, boilers, pumps, compressors, exchangers, cooling
towers, refrigeration systems, etc.), storage tanks, ancillary support areas (e.g., boiler
houses and waste water treatment plants), and distribution piping under control of the
Company.

Process safety
A disciplined framework for managing the integrity of hazardous operating systems and
processes by applying good design principles, engineering, and operating and maintenance
practices.

Process safety event – PSE

An unplanned or uncontrolled LOPC of any material including non-toxic and non-flammable
materials (e.g., steam, hot condensate, nitrogen, compressed CO2 or compressed air) from
a process, or an undesired event or condition that, under slightly different circumstances,
could have resulted in a LOPC of a material.

Process Safety Near Miss

Process Safety Near Misses may be categorised as lagging indicators and are as follows:
• Any significant release of a hazardous substance that does not meet the threshold
(i.e. a less severe incident) for a “Process Safety Event “
• A challenge (i.e. failure to perform as intended) of, for example, a pressure relief
device (PRD), safety instrumented system (SIS) or process deviation or excursion out
side normal operating parameters; these events do not have to result necessarily in
LOPC.

United Nations Dangerous Goods List - UNDGL

A classification system used to evaluate the potential hazards of various chemicals when
released, which is used by most international countries as part of the product labelling or
shipping information.

Exploration and Production, HSEQ, Vienna Page 5 of 14

HSEQ-HQ-08-03-00
 Process Safety Leading and Lagging
Approved Performance Indicators
Guideline

5 Procedure
All oil and gas processing facilities shall develop, record, monitor and trend analyse process
safety indicators for Tier 1, 2, 3 and 4 Process Safety Events/Indicators. The Tier
categorisation is based on API RP 754 which should be referred to if more guidance is
required.

5.1 Tier 1 Process Safety Event – Major Loss of Primary Containment

A Tier 1 Process Safety Event (T-1 PSE) is a loss of primary containment (LOPC) with the
greatest consequence as defined by this document. A T-1 PSE is an unplanned or
uncontrolled release of any material, including non-toxic and non-flammable materials (e.g.,
steam, hot condensate, nitrogen, compressed CO2 or compressed air), from a process that
results in one or more of the consequences listed below:

• An employee, contractor or subcontractor “days away from work” injury and/or fatality;
or
• A hospital admission and/or fatality of a third-party; or
• An officially declared community evacuation or community shelter-in-place; or
• A fire or explosion resulting in greater than or equal to $25,000 of direct cost to the
Company; or
• A pressure relief device (PRD) discharge to atmosphere whether directly or via a
downstream destructive device that results in one or more of the following four
consequences:
o liquid carryover; or
o discharge to a potentially unsafe location; or
o an onsite shelter-in-place; or
o public protective measures (e.g., road closure); and a PRD discharge quantity
greater than the threshold quantities in Table 1; or
• A release of material greater than the threshold quantities described in Table 1 in any
one-hour period.
Note: Non-toxic and non-flammable materials (e.g., steam, hot water, nitrogen, compressed CO2 or
compressed air) have no threshold quantities and are only included in this definition as a result of their
potential to result in one of the other consequences.

Exploration and Production, HSEQ, Vienna Page 6 of 14

HSEQ-HQ-08-03-00
 Process Safety Leading and Lagging
Approved Performance Indicators
Guideline

Table 1— Tier-1 Material Release Threshold Quantities

1,3,4
Threshold Material Hazard Classification Threshold Threshold
Release Quantity Quantity
Category (outdoor (indoor2release)
release)

1 TIH Hazard Zone A Materials 5 kg 2.5 kg

(11 lbs) (5.5 lbs)

2 TIH Hazard Zone B Materials 25 kg 12.5 kg

(55 lbs) (27.5 lbs)

3 TIH Hazard Zone C Materials 100 kg 50 kg

(220 lbs) (110 lbs)

4 TIH Hazard Zone D Materials 200 kg 100 kg

(440 lbs) (220 lbs)

5 Flammable Gases 500 kg 250 kg

or (1100 lbs) (550 lbs)

Liquids with Initial Boiling Point < 35 °C (95 °F) and

Flash Point < 23 °C (73 °F)
or
Other Packing Group I Materials excluding strong
acids/bases

6 Liquids with Initial Boiling Point > 35 oC (95 °F) and 1000 kg 500 kg
o
Flash Point < 23 C (73°F) (2200 lbs) (1100 lbs)
or
or or
Other Packing Group II Materials excluding moderate
acids/bases 7 bbls 3.5 bbls

7 Liquids with Flash Point ≥ 23 °C (73 °F) and < 60 °C 2000 kg 1000 kg
(140 °F) (4400 lbs) (2200 lbs)
or
or or
Liquids with Flash Point > 60 °C (140 °F) released at
a temperature at or above Flash Point 14 bbls 7 bbls
or
strong acids/bases
or
Other Packing Group III Materials

It is recognized that threshold quantities given in kg and lbs or in lbs and bbl are not exactly
equivalent. Companies should select one of the pair and use it consistently for all recordkeeping
activities.

Exploration and Production, HSEQ, Vienna Page 7 of 14

HSEQ-HQ-08-03-00
 Process Safety Leading and Lagging
Approved Performance Indicators
Guideline

1
Many materials exhibit more than one hazard. Correct placement in Hazard Zone or Packing Group
shall follow the rules of DOT 49 CFR 173.2a [REF 14] or UN Recommendations on the Transportation
of Dangerous Goods, Section 2 [REF 10]. See Annex B.
2
A structure composed of four complete (floor to ceiling) walls, floor and roof.
3
For solutions not listed on the UNDG, the anhydrous component shall determine the TIH hazard zone
or Packing Group classification. The threshold quantity of the solution shall be back calculated based
on the threshold quantity of the dry component weight.
4
For mixtures where the UNDG classification is unknown, the fraction of threshold quantity release for
each component may be calculated. If the sum of the fractions is equal to or greater than 100%, the
mixture exceeds the threshold quantity. Where there are clear and independent toxic and flammable
consequences associated with the mixture, the toxic and flammable hazards are calculated
independently.

5.2 Tier 2 Process Safety Event – Loss of Primary Containment

A Tier 2 Process Safety Event (T-2 PSE) is a LOPC with lesser consequence than Tier 1. A
T-2 PSE is an unplanned or uncontrolled release of any material, including non-toxic and
non-flammable materials (e.g., steam, hot condensate, nitrogen, compressed CO2 or
compressed air), from a process that results in one or more of the consequences listed
below and is not reported in Tier 1:

• An employee, contractor or subcontractor recordable injury; or

• A fire or explosion resulting in greater than or equal to $2,500 of direct cost to the
Company; or
• A pressure relief device (PRD) discharge to atmosphere whether directly or via a
downstream destructive device that results in one or more of the following four
consequences:
o liquid carryover; or
o discharge to a potentially unsafe location; or
o an onsite shelter-in-place; or
o public protective measures (e.g., road closure); and a PRD discharge quantity
greater than the threshold quantity in Table 2; or
• A release of material greater than the threshold quantities described in Table 2 in any
one-hour period.
Note: Non-toxic and non-flammable materials (e.g., steam, hot water, nitrogen, compressed
CO2 or compressed air) have no threshold quantities and are only included in this definition as
a result of their potential to result in one of the other consequences.

Exploration and Production, HSEQ, Vienna Page 8 of 14

HSEQ-HQ-08-03-00
 Process Safety Leading and Lagging
Approved Performance Indicators
Guideline

Table 2 — Tier-2 Material Release Threshold Quantities

1,3,4
Threshold Material Hazard Classification Threshold Threshold
Release Quantity Quantity
Category (outdoor (indoor2
release) release )

1 TIH Hazard Zone A Materials 0.5 kg 0.25 kg

(1.1 lb) (0.55 lbs)

2 TIH Hazard Zone B Materials 2.5 kg 1.2 kg

(5.5 lbs) (2.8 lbs)

3 TIH Hazard Zone C Materials 10 kg 5 kg

(22 lbs) (11 lbs)

4 TIH Hazard Zone D Materials 20 kg 10 kg

(44 lbs) (22 lbs)

5 Flammable Gases 50 kg 25 kg
or (110 lbs) (55 lbs)

Liquids with Initial Boiling Point ≤ 35 °C (95 °F) and

Flash Point < 23 °C (73 °F)
or
Other Packing Group I Materials excluding strong
acids/bases

6 Liquids with a Initial Boiling Point > 35 °C (95 °F) and 100 kg 50 kg
Flash Point <60 °C (140 °F) (220 lbs) (110 lbs)
or or
or
Liquids with Flash Point > 60 °C (140 °F) released at
or above Flash Point; 0.5 bbl
1 bbl
or
Other Packing Group II and III Materials excluding
moderate acids/bases
or
Strong acids and bases

7 Liquids with Flash Point > 60 °C (140 °F) release d at a 1000 kg 500 kg
temperature below Flash Point (2200 lbs) (1100 lbs)
or
or or
Moderate acids/bases
10 bbl 5 bbl

Exploration and Production, HSEQ, Vienna Page 9 of 14

HSEQ-HQ-08-03-00
 Process Safety Leading and Lagging
Approved Performance Indicators
Guideline

In order to simplify determination of reporting thresholds for Tier 2, Categories 6 and 7 in Tier 1 have
been combined into one category in Tier 2 (Category 6). The simplification is intended to provide less
complicated requirements for those events with lesser consequences.
It is recognized that threshold quantities given in kg and lbs or in lbs and bbl are not exactly
equivalent. Companies should select one of the pair and use it consistently for all recordkeeping
activities.

1
Many materials exhibit more than one hazard. Correct placement in Hazard Zone or Packing Group
shall follow the rules of DOT 49 CFR 173.2a [REF 14] or UN Recommendations on the Transportation
of Dangerous Goods, Section 2 [REF 10]. See Annex B.
2
A structure composed of four complete (floor to ceiling) walls, floor and roof.
3
For solutions not listed on the UNDG, the anhydrous component shall determine the TIH hazard zone
or Packing Group classification. The threshold quantity of the solution shall be back calculated based
on the threshold quantity of the dry component weight.
4
For mixtures where the UNDG classification is unknown, the fraction of threshold quantity release for
each component may be calculated. If the sum of the fractions is equal to or greater than 100%, the
mixture exceeds the threshold quantity. Where there are clear and independent toxic and flammable
consequences associated with the mixture, the toxic and flammable hazards are calculated
independently.

5.3 Tier 3 Performance Indicator – Challenges to Safety Systems

A Tier 3 Process Safety Event typically represents a challenge to the barrier system that
progressed along the path to harm, but is stopped short of a Tier 1 or Tier 2 LOPC
consequence. Indicators at this level provide an additional opportunity to identify and correct
weaknesses within the incident prevention barrier system. There are two generic types of
indicators – demands on safety systems and operating envelope excursions.

Examples for demand on safety system:

• Pressure relief device activation – pressure safety valve, rupture disc, deflagration
vent, explosion suppression system, etc
• Safety instrumented system challenge – compressor anti-surge, level protection,
vibration detection, temperature trip, etc

Examples for safe operating envelope excursions:

• Exceeding temperature alarm settings on heat exchanger tube metal
• Exceeding or not maintaining minimum flow rates
• Exceeding or not maintaining high priority level alarms
• Operation of piping/vessels below minimum wall thickness for design pressure
containment, etc

Type 3 indicators can be detected during operational processing activities or via inspection,
maintenance and testing programs.

Exploration and Production, HSEQ, Vienna Page 10 of 14

HSEQ-HQ-08-03-00
 Process Safety Leading and Lagging
Approved Performance Indicators
Guideline

5.4 Tier 4 Performance Indicators — Operating Discipline & Management

System Performance
Tier 4 performance indicators must reflect facility-specific barrier systems, facility-specific
performance objectives, and the maturity of any existing performance indicators.

The choice of Tier 4 performance indicators should be limited to the meaningful few that are
representative of the barrier systems in place at a particular facility. The indicators should be
those with the highest predictive ability and those that provide actionable information. The
following list of operating discipline and management system performance indicators may be
considered:

1. Process Hazard Evaluations Completion – Schedule of process area retrospective

and revalidation hazard evaluations completed on time by fully qualified teams.

2. Process Safety Action Item Closure – Percent and/or number of past-due process
safety actions. This may include items from incident investigations, hazard
evaluations or compliance audits.

3. Training Completed on Schedule -- Percent of process safety required training

sessions completed with skills verification.

4. Procedures Current and Accurate -- Percent of process safety required Operations

and Maintenance procedures reviewed or revised as scheduled.

5. Work Permit Compliance -- Percent of sampled work permits that met all
requirements. This may include Permit to Enter, Hot Work, General Work,
lockout/tagout, etc.

6. Safety Critical Element Inspection – Percent of inspections of safety critical

element completed on time. This may include pressure vessels, storage tanks, piping
systems, pressure relief devices, pumps, instruments, control systems, interlocks and
emergency shutdown systems, mitigation systems and emergency response
equipment.

7. Safety Critical Element Deficiency Management — Response to safety critical

element inspection findings. This may include proper approvals for continued safe
operations, sufficient interim safeguards, and timeliness of repairs, replacement, or
calibration changes..

8. Management of Change (MOC) and Pre Start-up Safety Review (PSSR)

Compliance -- Percent of sampled MOCs and PSSRs that met all requirements and
quality standards.

9. Completion of Emergency Response Drills -- Percent of emergency response

drills completed as scheduled.

10. Fatigue Risk Management – Key measures of fatigue risk management systems
may include: percentage of overtime, number of open shifts, number of extended
shifts, number of consecutive shifts worked, number of exceptions, etc.
Tier 4 performance indicators shall include the three dimensions of input, output and quality;
refer to Appendix A for more explanation.

Exploration and Production, HSEQ, Vienna Page 11 of 14

HSEQ-HQ-08-03-00
 Process Safety Leading and Lagging
Approved Performance Indicators
Guideline

6 Record of revisions
None – first approved issue.

Exploration and Production, HSEQ, Vienna Page 12 of 14

HSEQ-HQ-08-03-00
 Process Safety Leading and Lagging
Approved Performance Indicators
Guideline

APPENDIX A – Lagging/Leading Indicators

Lagging indicators are those events that caused harm to people or damage to equipment.
Leading indicators are those that are pre-cursors to harm or damage. This is explained by
referring to Figure 1 below reproduced from UK Health and Safety Executive document no
HSG254:

Figure 1
Leading and lagging indicators set to detect defects in important risk control systems from Managing the Risks of
Organizational Accidents, James Reason, 1997, Ashgate Publishing Limited

The use of the expression risk control system (RCS) is analogous to the concept of ‘barriers’
in Bow-Tie analysis and effectively the two expressions are interchangeable. An important
point to be derived from the diagram above is that not all process safety lagging indicators
have to result in harm. For example, a high level alarm that fails is a process safety lag
indicator, but if the high level shutdown works and no harm occurs then this is also a lag
indicator (i.e. challenge to a safety system). In other words two lagging indicators have
occurred with no harm being caused.

Exploration and Production, HSEQ, Vienna Page 13 of 14

HSEQ-HQ-08-03-00
 Process Safety Leading and Lagging
Approved Performance Indicators
Guideline

In reality Tier 1 and 2 Process Safety Events occur very infrequently and are not very useful
to indicate how well process safety is being managed. Tier 3 and 4 Process Safety Indicators
are much more useful. The selection of these indicators has to be based on collating audit
/review information that has sufficient frequency to enable a trend to be observed about
whether process safety is improving or otherwise. Whether they are defined as lag or lead is
not really important.

Lagging indicators are generated by a process of reactive monitoring, whilst leading

indicators are an outcome of active monitoring. Reactive monitoring tracks undesired events,
such as fires, etc, whilst active monitoring is planned testing and inspection, audits, etc.

Indicators based on active monitoring need to be carefully designed. They have to have
three dimensions: input, output and quality. For example, a measure may be created that
monitors the percentage of safety critical equipment that is tested. This may have a very
good score, however, there may be a high failure rate during the tests. The percentage of
tests completed is an input measure and the percentage of failures is the output from the
activity. Additionally the testing personnel have to be competent to assure that the quality of
the tests is valid.

Similarly, when using performance indicators for active monitoring of management systems,
an indicator that measures percentage completion of planned audits has very little value in
terms of understanding the effectiveness of the risk control system. To be of value all three
dimensions needs to be incorporated within the measure: input, output and quality.

Exploration and Production, HSEQ, Vienna Page 14 of 14

HSEQ-HQ-08-03-00