evaluating safety in the management of maintenance … · 2014. 12. 30. · evaluating safety in...

PergamonSafety Science Vol. 28, No. 1, pp. 21–44, 1998

q 1998 Elsevier Science Ltd. All rights reservedPrinted in The Netherlands

0925-7535r98 $19.00 q 0.00

( )PII: S0925-7535 97 00061-1

EVALUATING SAFETY IN THE MANAGEMENTOF MAINTENANCE ACTIVITIES IN THECHEMICAL PROCESS INDUSTRY

A.R. Hale a ,) , B.H.J. Heming a, K. Smit b,F.G.Th. Rodenburg c, N.D. van Leeuwen b

a Safety Science Group, Delft University of Technology, Delft 2628 EB, Netherlandsb Faculty of Aerospace, Delft University of Technology, Delft 2500 GB, Netherlandsc Rijnconsult, Velp, Netherlands

Abstract–A study was carried out of the management of safety in maintenance activities in thechemical process industry in the Netherlands. A theoretical model of an ideal maintenancemanagement system incorporating safety was established and tested by peer review in fivecompanies in different industries with high safety risks and requirements and good reputationsfor maintenance management. The model was used to carry out a secondary analysis ofavailable data on maintenance accidents. An audit checklist was derived from the model andused to carry out in-depth assessment of the management systems of eight companies withmajor hazard plants. Finally, the model and audit were used to construct a questionnaire, whichwas sent to 82 major hazard companies, yielding a response of 47 usable replies. The data fromthese sources is analysed to indicate how and where the maintenance management systems inthis industry can be improved. The main shortcomings are found in the support given to middlelevels of management in translating safety policy into an effective maintenance concept and thatinto planning, procedures and resource management which give appropriate attention to safety.Recommendations are made about strengthening these areas with a strong maintenance engi-neering function responsible for coordinating the incorporation of safety into design, into themaintenance concept and planning and for the learning of lessons from incident and breakdownanalysis, a function which can also contribute positively to an economic operation of thefacility. Some general recommendations are made about the regulatory implications of theseconclusions. q 1998 Elsevier Science Ltd. All rights reserved.

1. Introduction

Maintenance in the process industry is connected with a significant proportion of theserious accidents occurring in the industry. Studies by the British Health and Safety ExecutiveŽ .1987 of deaths in the chemical industry showed that some 30% were linked to maintenanceactivities, taking place either during maintenance activities or as a result of faulty mainte-

) Corresponding author.

21

A.R. Hale et al.22

Ž .nance. A study of the chemical accidents stored in the database FACTS Koehorst, 1989found 38.5% of the accidents where dangerous materials were released from on-site plant hadtaken place during maintenance. A study of 900 accidents involving pipe-work failure in

Ž .chemical plants Hurst et al., 1991 found 38.7% to have their origins in the maintenancephase of the plant operations.

These findings led the Dutch Directorate-General of Labour to commission a study of themanagement of maintenance activities in major hazard sites in the Netherlands in order to

Ž .assess the potential for improvement Hale et al., 1993; Heming et al., 1995 .

2. Objectives and conduct of the study

The research had the following objectives, the first two of which are discussed in detail andthe third in outline in this paper.Ø to construct a model of the management of safety in maintenance which could form the

basis for the assessment of the practice in companies.Ø to evaluate the strengths and weaknesses of existing practice in the Dutch chemical

industry and to specify the scope for improvement.Ø to specify the regulatory instruments which could be used directly or indirectly by the

responsible ministries to achieve that improvement.The study was conducted in three parts. In a theoretical part, an ideal model was

constructed of the incorporation of safety into the management of maintenance in all phases ofthe life cycle of a chemical plant. This model was tested in case studies in five companies witha high reputation for maintenance management. In the second part of the study, the theoreticalmodel was used to generate an audit instrument and a questionnaire which were used inassessing the quality of maintenance management in respect of safety in a sample of chemicalcompanies. The model was also used to reanalyse available data on maintenance accidents. Inthe final part of the study, the data about the shortcomings in maintenance managementformed the basis for recommendations to the Ministry about actions they could take orstimulate to improve safety. The results of the first two parts of the study are reported here.Part three is only covered in outline, since it was the least empirical part of the study.

3. Modelling the management of safety in maintenance

The interaction between maintenance and safety goes beyond the simple occurrence ofŽaccidents during the conduct of maintenance work, however, dramatic these may be e.g.

Ž .Phillips in Pasadena 1989—23 dead, Arco in Texas 1990—17 dead Craft, 1991 or DSM inŽ .Rijnmond—7 dead Ministry of Social Affairs and Employment et al., 1991 . The primary

purpose of maintenance is to prevent significant deterioration or deviation in plant functioning,Ž .which can threaten not only production but also safety preventive maintenance and to return

Ž .a plant to full functioning after a breakdown or disturbance corrective maintenance . Ifmaintenance is not carried out soon enough, is incorrectly carried out, or communicationsbetween maintenance and operations staff are not effective, the plant may fail dangerously

Žduring start up or during the normal operations phase e.g. Piper Alpha 1988—165 deadŽ ..Dept. of Energy, 1990 . Maintenance activities can therefore be the cause of deviations

Ž .during normal operations and are identified by techniques such as MORT Johnson, 1980 as

EÕaluating safety in the chemical process industry 23

major contributors to change processes in plants, which need to be the focus of safetyanalyses. The frequency with which maintenance needs to be carried out and the ease andsafety with which it can be done are factors which are determined by decisions made in thedesign and construction phases of the life cycle, such as the choice and reliability of theequipment and instrumentation, the design for shutting down parts of the plant, or theaccessibility of items of plant for maintenance work. Maintenance work is also frequentlyassociated with minor, or even major, modifications to plant, which will alter the plantoperations and, hence, its safety and require plant operators to learn some new operatingroutines. Any modelling of the management of safety related to maintenance must thereforetake account of the whole plant life cycle. There must be both feed-forward loops ofinformation and decisions from earlier to later phases of the life cycle and feedback loops tocommunicate lessons learned, or changes made, to earlier life cycle phases for the existing orfor new plant.

Ž .Models of maintenance management Smit and Slaterus, 1992; IEC, 1992 emphasise thedevelopment of a maintenance concept or plan during the detailed engineering phase of a plantdesign, which specifies when and how each significant part of the plant will be maintained.IEC 706-4 requires that the maintenance concept contains a plan in terms of ‘criteria forchoosing lines and levels of maintenance, policies and requirements for basic maintenance

Ž . Žsupport logistics and criteria for monitoring and test equipment built-in, automatic, monitor-.ing ’. Such a maintenance concept is particularly crucial for safety critical plant. A number of

Ž .statutory and certification regimes e.g. for pressure vessels, lifting gear, passenger liftsrequire explicit preventive maintenance tasks to be executed at pre-defined intervals.

Ž .Fig. 1. Maintenance management model Smit and Slaterus, 1992 .

A.R. Hale et al.24

Ž .The maintenance management model of Smit and Slaterus see Fig. 1 distinguishes threelevels, the second of which has two parts: a management level at which objectives, policiesand standards are determined and adjusted on the basis of periodic evaluation; a control levelŽ .planning and procedures level at which the maintenance procedures are kept within the

Žprescribed standard, which has two parts, the development of the required resources spare.parts, trained personnel, methods, facilities and documentation , and the scheduling and work

planning to match the work load to the resources; and an execution level at which theactivities are performed, from plant isolation and hand-over to completion of the tasks andreturn of the plant to the operations personnel. Within the execution level, the life cycle phasesof the plant are visualised.

The concern with a life cycle view of control and the division into three levels ofmanagement are also to be found in the models of safety management developed in DelftŽ .Hale et al., 1997 . These models are based upon a conception of safety management as aseries of interlocking problem-solving cycles focused on the prevention and correction of

Ž .deviations which can lead to harm injury, damage, ill-health . The deviation concept can alsobe found as a central feature in maintenance management. The types of deviations from fullfunctioning of a plant or system, the ease of predicting or detecting them and the dynamics oftheir development play a fundamental role in deciding on the type and frequency ofmaintenance. Fig. 2 illustrates the relationship of the two deviation concepts.

These essential similarities between the models of safety management and of maintenancemanagement enables a combined model to be formulated illustrating the steps and informationflows which should be found in an ideal management system to take proper account of safetyin relation to maintenance. The model is shown in Fig. 3.

Fig. 2. Deviation model.


Fig.

3.Id

ealm

aint

enan

cem

anag

emen

tsys

tem

.

A.R. Hale et al.26

Ž .The activities of dealing with breakdowns or plant failure corrective maintenance and theŽexecution of preventive maintenance inspection, condition monitoring, planned repairs and

.replacements are directed by the maintenance concept. In addition, the maintenance functiondeals with plant modifications for improving functional capabilities, legal compliance, reliabil-ity and maintainability and the reduction of lifetime costs. The same service may beresponsible also for plant design and engineering, but must in any case be involved in thesephases inputting to design reviews such aspects as reliability and maintainability. In this phasealso, the maintenance concept should be developed, making use of feedback from maintenanceexperience and data.

The whole activity is directed and steered by maintenance policy, while each step in eachprocess needs to incorporate safety criteria, derived from the safety policy and shown in Fig. 3as ‘s’ feeding in to each box, to ensure the safe completion of each step as well as the safetyof the output of the step. This latter distinction can be made clearer with an example: the safecompletion of the step ‘execution of maintenance work’ concerns the prevention of accidentsto the maintenance staff and other plant personnel during maintenance; the safety of the outputconcerns the quality of the repair work and its ability to guarantee the safe functioning of therepaired plant once it is back in service.

The box at the right hand side of the figure represents the learning processes which feedinto the continuous cycle for improving safety in all the processes.

4. Field testing of the model

The proposed maintenance management model is derived from theoretical considerations.In order to test whether it could form the basis for an assessment of the effectiveness ofmaintenance management, a small scale study was conducted to subject it to peer review. Fiveorganisations were chosen which have a high reputation for the quality of their maintenance.They all came from industries with major safety risks and well-established safety requirementsrelating to maintenance. Since the model is intended to be a generic one, it was felt to beappropriate to choose the reference companies on their excellence, and not purely on theirmembership of the chemical industry. Moreover, the sponsor was keen to make cross-industry

Žcomparisons. The selection was made in consultation with experts in the field notably two ofthe authors of this paper, Smit and Rodenburg, both with extensive experience of consulting

.and advice on maintenance management in the Benelux Countries to identify companies andoperations where the importance of maintenance for safety was clear and where the record ofthe company was excellent. The industries represented by the five companies were nuclearpower, aircraft operations, railways, oil and gas production and shipping. Each company wasvisited for one day, for discussions with the senior managers responsible for maintenance andsafety. The structure of the model and its implications for policy, activities, responsibilities,supervision, information flow and decision making were discussed with these managers inorder to check whether the management systems of these companies could be mapped onto themodel, whether they recognised and practised all the steps and whether they could identifyother elements which they practised, but were not in the model. As a result of thesediscussions, no fundamental changes in the model were found necessary, though the com-ments did result in modifications to the detailed level of translating the model into a set ofauditing questions.


5. Development of assessment instruments

The model was used in three ways in deriving instruments to assess the quality ofmaintenance management in the chemical process industries: as a template to assess availabledata from reported accidents and incidents; to derive a set of audit questions to make anin-depth evaluation of the management of maintenance in eight case study companies; and toprepare a questionnaire to be sent to all chemical process companies with major hazard sites inthe Netherlands to gain an insight into the management systems of a broader sample ofcompanies.

The strengths and weaknesses of each of the methods are discussed briefly in the separatesections below. They were chosen to complement each other, to provide a triangulation of datafrom which the most robust possible conclusions could be drawn about the state of safety inmaintenance management in the Dutch chemical process industry. Each assessment and itsresults will be discussed in turn.

5.1. Analyses of data on maintenance accidents

Accident data of sufficient detail and depth to make analyses in terms of the steps in themaintenance management process are hard to come by. The data collected by the DutchLabour inspectorate of accidents reported under the Working Conditions law are of insuffi-cient quality to identify with accuracy even whether the accident happened during or as aresult of maintenance, let alone what management factors led to the accidents. The other majorsource of accident data in the Netherlands concerning the chemical industry and accidents with

Ž .dangerous substances is the database of FACTS TNO, 1990 . This was used in a separateŽ .study Koehorst, 1989 to draw conclusions about the importance of maintenance in accidents

Žleading to chemical releases. Data from it on the phase of activity normal operations, start.uprshutdown, maintenance of 700 chemical process industry accidents involving dangerous

substances and on their ‘primary causes’ were available; no further details was available forthis study because of the high costs of consulting the detailed accident descriptions. Nocompany data on maintenance accidents in the Netherlands could be identified and accessedwithin the time and cost restraints of the study. Since the most obvious and potentiallyrelevant data to the Dutch chemical process industry could not be accessed for the study, wesought more widely for data.

In order to gain some insight into the distribution of maintenance accidents in terms of themodel, three main sets of data were subjected to a secondary analysis. These were taken fromthe following sources, only the first of which relates directly to the chemical process industry.However, it was felt that, if such diverse sources were to give a consistent picture of priorities,it would provide a valuable input to the overall objectives of the study.

Ž .1. The British Health and Safety Executive HSE report ‘Dangerous Maintenance’ ofŽwhose 700 maintenance accidents 500 took place on chemical process plant Health and

. Ž .Safety Executive, 1989 . Only ‘primary causes’ categorised by the report’s author s areavailable from this source and only for 294 accidents where the descriptions were detailedenough to permit categorisation.

Ž2. The report ‘Deadly Maintenance’ from the same organisation Health and Safety.Executive, 1987 of 106 fatal accidents during maintenance on machinery and installations in

A.R. Hale et al.28

a wide range of industries. Ninety-nine of the short descriptions gave sufficient detail to allowan analysis of causal factors.

3. A data set concerning loss of supply incidents in the electricity supply industry in theŽ .UK, of which 59 were related to maintenance activities Hale, 1969 . Very detailed descrip-

tions of the events surrounding all the incidents were available.Ž .Some further general conclusions could be drawn from the FACTS data Koehorst, 1989

Ž .and available summaries of a further study for the British HSE Crooks, 1985, 1987 .The detailed analysis of the above data sources, together with an assessment of their quality

and of the value which can be attached to the conclusions from them is reported elsewhereŽ .Moll et al., 1994 . Because of the diverse origins and variable quality of the data, it shouldonly be regarded as indicative of the rough importance of different factors.

The accident descriptions from sources 2 and 3 were analysed to annotate all the factorsidentified in the descriptions as being relevant to the accident. For source 1, this categorisationhad already been made and only one primary cause per accident had been allocated. Thesecausal factors were allocated to the levels in the maintenance management model, using thedetailed descriptions of each step found in the paper of Smit and Slaterus, 1992. Because ofthe coarse-grained nature of the data, only the following categories at the planningrproceduresand execution levels could be distinguished: shortcomings in the management of the prepara-

Ž .tion of resources hardware, personnel, facilities, documentation and methods ; shortcomingsin scheduling and work planning of maintenance; shortcomings in the actual conduct of thework; shortcomings in the design of plant and equipment for ease of maintenance; factors

Ž . 1outside the control of the organisation weather, ground, actions of third parties ; andaccidents where the descriptions did not allow for categorisation.

No reliable judgements could be made about the existence or appropriateness of amaintenance policy or concept in the majority of cases, so no conclusions are drawn about thecontribution of this level. The results of the analysis are shown in Table 1.

It is not clear if the differences in percentages across the columns in Table 1 are a featureŽof the physical characteristics of the different industries covered hardware, working environ-

.ment and situation, hazards present or of their competence in maintenance management. Thegeneral picture from all three sources is of a relatively high involvement of the planning andprocedures level relative to execution. This confirms the conclusions drawn by Health and

Ž .Safety Executive 1987 that management was partly or wholly responsible for the circum-stances surrounding 75% of the accidents analysed there. Design for maintainability plays asignificant but relatively minor role.

Ž .From the analyses see Moll et al., 1994 for details , it was possible to estimate thatbetween 30 and 40% of serious accidents in the chemical process industry happen during thecourse of maintenance itself or soon after, with a split of 17% of these in preparing the site formaintenance, 76% during it and 7% during or soon after hand-over to production. At least

Žanother 8% of the chemical process industry accidents happened in other phases start-up,.shutdown or normal operations due to technical failures, such as undetected corrosion and

Ž .wear, which could be put down to an inadequate maintenance concept Fig. 4 .

1These could arguably be seen as failures of planning or scheduling in the sense of anticipation of, or rapidreaction to such external factors.


Table 1Percentage of causal factors allocated to different categories

Category Source of data with number of accidents analyseds N and number of factors categoriseds F

1. Dangerous 2. Deadly 3. Electricitymaintenance maintenance supplyNs294 Ns81 Ns59Fs294 Fs236 Fs203

Resource mgmt. 28 27 26Planrprogramme 18 35 24Execution 30 20 23Design 11 10 10

1External 7 5 15Unknown 6 3 2

5.2. Auditing maintenance management in eight case study companies

The maintenance management model was used to develop a set of questions to be used as achecklist in carrying out a detailed audit of a number of companies in the industry, chosen asrepresentative case studies. Each block of the model in Fig. 3 was turned into a series ofquestions to discover how and by whom the step was carried out and how safety as a set of

Žcriteria was taken account of during each step. Each phase of the life cycle was studied new.construction, modification and direct maintenance , as well as each management level, from

policy, through plans and procedures to execution, in relation to both maintenance and safetyŽ .and their interrelationships. The complete checklist is described by Heming et al. 1995 .

Fig. 4. Distribution of serious accidents in the chemical industry.

A.R. Hale et al.30

The audit was used to collect information in depth in a sample of companies from theindustry. Because of time constraints only 8 companies could be studied in this way. An auditin this depth offers detailed insights into the strengths and weaknesses of the management insuch companies, but can give little indication as to whether these are typical problems for theindustry, given the small number of cases. This issue was addressed in the following part of

Ž .the study see 5.3 .The case study companies were chosen from a list of 90 companies in the process industry

Ž .overwhelmingly the chemical process industry which are subject to the provisions of theDutch law flowing from the Post Seveso directive of the European Union, which requires thesubmission of a Plant Safety Report related to major hazard installations on their sites. Thesites covered therefore represent a significant hazard both to those operating and maintainingthem and to the surrounding area. It was expected that maintenance on these sites wouldreceive more management attention than on lower hazard sites. A list of companies was drawnup covering the geographical regions of the Netherlands, small and large companies and thedifferent branches of the industry. 8 companies of the 13 approached finally agreed to takepart. The companies varied in size from 25 to 1000 employees, three having less than 75employees and 5 more than 200. Three sites were of Dutch parentage, the rest were daughtersof foreign companies. Five companies used predominantly their own personnel for mainte-nance work, two almost entirely contractors and one a mixture. Four companies had their own

Ž .company safety service, the others the four smallest hired in an external service to meet therequirements of the Dutch law for compulsory access to expertise on safety. For reasons ofconfidentiality, no tabulation of this data per company is presented here and the companies arereferred to throughout this paper only by number.

The checklist was used as a guideline for an audit, lasting one to three days depending onthe size of the company, carried out by two of the authors, one a maintenance expert, the othera safety specialist. Interviews were held with 71 managers and employees, from 5 to 14 percompany: 39 staff from maintenance and technical services, 19 from production and linemanagement and 13 from safety. The interview results were checked on a sample basis withcompany documentation, but no physical verification on site was possible within the timeconstraints. Because the project was presented as a learning experience for the companies, andthere was a guarantee that no regulatory consequences would flow from it, the incentive topaint a rosy picture of the situation in the company was minimised. The results of the audit

Ž .were written up an average of 12 pages per company and sent, where possible, to thecompany for checking and correction.

The verified reports were used as a basis for an assessment on a four-point scale relating toeight aspects of the management system drawn from the model. The four-point scale waschosen pragmatically to represent the level of discrimination that the auditors felt able toapply. The overall assessment was the combination of a rating of each aspect on two factors:the presence of a systematic approach for dealing with that aspect of the management, whichcould be described by the respondents and, at least in the larger companies, demonstrated in

Ždocumentation not present, present to a limited degree, all aspects present, all aspects present.and documented ; and the degree to which the systematic approach was applied in practice in

Ž .the company’s maintenance-related activities bad, poor, reasonable, and good .Scores on the two separate ratings were averaged and rounded downwards in the majority

Ž .of cases 56 of the 64 cells . In the remaining cases, the rounding was upwards, because arounding downwards was felt to do injustice to the total picture of that dimension relative toother companies. This usually reflected the size of the organisation and the complexity of its


plant; small organisations with relatively simple maintenance problems were not rated down iftheir systematic approach was not formalised and documented.

The ratings were made by the two auditors independently and then discussed to arrive atthe end result. The rating process was guided by an extensive checklist of points of attention

Ž .for each rating scale linked to the audit checklist Heming et al., 1995 . No major differencesŽ .of opinion between the auditors more than one point occurred. The aspects rated under each

heading were as follows.

5.2.1. PolicyŽ .1. General safety policy: Box 2 in Fig. 3

Ø presence and use of an explicit policy cycle for formulating, promulgating and evaluat-ing safety policy and procedures dependent on a risk inventory;

Ø degree to which safety inspections, incidents and accidents were registered, analysedand used for improvement.

Ž .2. Safety policy for technical serÕicesrmaintenance: Box 3 in Fig. 3Ø explicit translation of general safety policy to the maintenance activities, both in terms

Žof the safety of the assets product safety from the viewpoint of the maintenance. Ž .department and of the safety of maintenance personnel process safety ;

Ø degree to which breakdowns and incidents in maintenance were reported, analysed andused for improvement.

5.2.2. Planning and proceduresŽ .1. Safety in the maintenance concept: Boxes 6–9 in Fig. 3

Ø explicit attention to the safety of the assets in the maintenance concept;Ž .Ø attention to safety implications including the effect on risk exposure of personnel in

the choice between preventive and corrective maintenance.Ž .2. Safety in resource management: Boxes 12 and 13 in Fig. 3

Ø setting safety criteria for personnel, materials, equipment and documentation;Ø managing those resources to achieve the safety of both the assets and the maintenance

personnel.( ) Ž .3. Safety in engineering new construction and modification : Boxes 5, 10 and 11 in Fig. 3

Ø explicit attention to the safety hazards during the engineering phase and use of thisinformation in planning for maintenance;

Ø use of lessons learned from existing or previous plants for new plant or modifications.

5.2.3. ExecutionŽ .1. Safety in the scheduling and work planning of maintenance: Box 14 in Fig. 3

Ø explicit identification of safety risks in, and interactions between, maintenance tasks;Ø information about safety risks given to maintenance personnel.

Ž .2. Safety in the execution of maintenance: Box 15 in Fig. 3Ø explicit attention to controlling safety before the start and during maintenance work;Ø checking that safety is guaranteed in the return of plant to operations thereafter.

Ž .3. Safety in dealing with breakdowns: Box 15 in Fig. 3Ø explicit attention to hazards in dealing with unplanned repair work following break-

downs;Ø checking that safety is guaranteed in returning plant thereafter to operations.

A.R. Hale et al.32

Table 2Evaluation of maintenance management

Dimension Company

1 2 3 4 5 6 7 8 Total

1. General safety policy 0 2 2 1 2 2 3 1 130r0 2r1 2r2 2r0 3r2 3r2 3r3 1r1 16r11

2. Safety policy maintenance 0 0 1 0 1 1 2 1 60r0 0r0 1r1 0r0 2r1 2r1 2r2 1r1 9r6

3. Maintenance concept and safety 0 1 1 0 2 1 2 1 80r0 1r2 1r2 1r0 2r2 1r1 1r1 1r2 8r11

4. Safety in resource mgmt. 2 2 2 1 2 1 1 1 121r2 1r2 2r2 2r1 2r2 2r1 2r1 1r2 13r13

5. Safety in engineering 0 1 2 0 2 1 2 1 90r0 1r1 1r2 0r0 2r2 2r1 2r2 1r1 9r9

6. Safety in scheduling and work planning 1 1 2 0 1 1 3 2 111r1 1r1 1r2 0r0 2r1 1r1 3r3 2r1 11r11

7. Safety in execution 2 2 2 0 2 2 3 1 142r2 2r2 2r2 1r0 3r2 2r2 3r3 2r1 17r14

8. Safety in breakdown 1 1 2 1 3 2 3 2 151r1 1r1 2r2 1r1 3r3 1r2 3r3 2r2 14r15

Total 6 10 14 3 15 11 19 105r7 9r10 12r15 8r2 19r15 14r11 19r19 11r11

Score Systematic approach Application in practice0 absent bad1 limited presence poor2 all aspects present reasonable3 all aspects present and documented good

The results of the evaluations of the eight companies are given in Table 2. Companies 1 toŽ .3 are the small companies -75 employees , 4 to 8 have 200q employees. The dimensions

are numbered as in the list above. Figures in bold type are the overall assessment; those innormal type are respectively ‘systematic approach’ and ‘application in practice’.

Ž .The theoretical maximum score for a company and for a dimension is 24. This would be aperfect match with the model proposed. Even considering the small size of the sample and theinevitable limitations of scores based on expert judgement, the conclusion can be drawn thateven the best companies fall far short of this ideal. Although the audits in the first and secondparts of the study are not strictly comparable, the auditors concluded that the 8 companies alsofall significantly short of the situation found in the companies used to test the model in thefirst part of the research, particularly in respect of dimensions 4, 5 and 6.

Unfortunately, it was not possible to collect data from the eight companies about mainte-nance-related accidents which was of sufficient quality or comparability to validate the linkbetween the scores on the audit and accident rates, so no external validation of the model oraudit was possible. No correlation was found between overall score on the audit and the size

Žof the company nor with the hazard level of the company a figure which can be taken as anindication of the dangerousness of the process operated by the company, based on the

.calculated fire and toxic hazard of the site reported in the Plant Safety Report . No clearlyinterpretable relationships were found with use of own vs. contractors staff, or use of own vs.external safety services.


The following general points can be made to expand on the data in Table 2 and lead tosome tentative conclusions.

Ž .1. The execution level of the model dimensions 6, 7, 8 is judged the best managed. Thisis particularly so in the large companies where it was often systematically documented,particularly in terms of permit-to-work systems, though sometimes less well-applied inpractice. Explicit attention for safety in scheduling and work planning was the weakest aspect.In the small companies, the shorter communication lines and smaller scale work mean thatpractice can be reasonably well-controlled even without extensive documentation. The weak-est point in the actual execution of maintenance was the process of handing back plant aftercompletion of the work, where safety checks were often judged to be inadequate.

Ž .2. The policy level, as regards general safety policy dimension 1 was well-managed, withan explicit policy system, though application was often weaker, even in the large companies,particularly in making use of the learning loops to improve performance. Smaller companieswere also less good at getting the policy over to their workforce. The explicit translation of

Ž .safety policy to the maintenance departmentrfunction dimension 2 was extremely poor, afactor linked to the following point.

3. The weakest part of the management system was the middle level of the model. Therewas not a single rating reaching the top level in any aspect. In particular, there was the lack ofan explicit maintenance engineering function to incorporate maintainability and safety issuesin new designs and modifications, to establish an explicit maintenance concept with attentionfor safety and to manage the feedback loop from maintenance and safety experience into thosedecisions. Explicit use of risk analysis and maintenance concepts was largely confined to plantwhere that was required by legislation or certification regimes. Resource management was

Ž .well-regulated for materials and equipment, but less so for personnel safety qualificationsand for keeping documentation of plant up to date. The auditors concluded that the weak-nesses in this area were not confined to the management of safety, but were generalweaknesses in control of the whole maintenance process at this level, of which safety was onlyone victim. They represented a failure on the part of senior management to make the necessarytranslations of policy to genuine support for the functioning of middle management.

5.3. Questionnaire study

The theoretical model and the audit checklist were used as the basis of a questionnaire togather data from the full range of major hazard chemical process plants in the Netherlands, inorder to complement the in-depth study in the 8 companies. The aim was to collect data froma larger sample of companies, so as to be able to generalise with more confidence from the

Žfindings in the cases discussed above. The questionnaire van Leeuwen, 1995; Heming et al.,.1995 extracted the questions from the audit checklist which were more aimed at factual

information and which would be least likely to be distorted by this form of data collection. Itslevel of detail was also less deep. The questions therefore correspond largely to the assessmentof the systematic approach made in the audit. No conclusions about actual practice should bedrawn from them. As with all self-assessment instruments, there is likely to be a bias towardsa more optimistic picture even of the degree of system which the companies actually operate.

The final questionnaire was made up of 48 main questions, 38 with an additionalsub-question. The questions were posed under the headings, largely derived from the model:general, organisation, safety policy, technical specifications, scheduling and work planning of

A.R. Hale et al.34

Table 3Policy level

%

2 Written general safety policy 89Ž .2 General policy evaluated yearly L 72

2 Maintenance dept. involved in preparation of general policy 852 Written safety job descriptions in the company 94

Ž . Ž .1r2 Company partly ISO 9000 certified L 66Ž .3 Contractors required to be certified for safety cert.rISO L 40

3 Translation to explicit safety policy for maintenance dept. 26Ž .3 Maintenance safety policy evaluated yearly L 33

Ž .3 Written safety job descriptions for maintenance dept. L 78Ž . Ž .3 Maintenance dept. partly ISO 9000 certified L 52

Ž .3 Yearly evaluation of contractors safety policy L 30

maintenance, execution of maintenance, maintenance concept, engineering, new constructionand accident and incident registration.

The questionnaire was sent, addressed by name, to the head of the maintenance function ofall 82 remaining companies on the list of those with major hazard plants which are required to

Ž . Ž .submit Plant Safety Reports leaving out the 8 case study companies . Forty-seven 57%Ž .usable responses were received after one reminder, of which 11 23% of the returns made use

of the opportunity offered to return the questionnaire anonymously. This is a large response byDutch standards, where typical response rates of 30% are found. Ten of the companiesreturning the questionnaire with the name of contact person on it were approached telephoni-cally to check their responses, partly as a reliability check and partly to query possibleanomalies found in the analysis.

Twenty-four responses were received from companies with over 200 employees, 12 with50–200 and 11 with less than 50. The responses were spread representatively over the wholeindustry with respect to primary activity.

Table 4Planning and procedures level

%

Ž .5 HAZOP used in design of new plant not covered by PSR L 72Ž .5 HAZOP used in plant modifications not covered by PSR L 46

Ž .6 Maintenance concept present drawing on maintenance history L 836 Written maintenance concept 72

11 Registration of all safety-critical apparatus 8913 Maintenance of safety-critical apparatus uses only certified parts 8513 Written safety procedures for company in general 98

Ž .13 Periodic safety training of maintenance personnel L 815 Maintenance input to HAZOP 725 Use of historical maintenance data in HAZOP 485 Procedures for updating P and I diagrams etc. 85

Ž .6 Maintenance concept written in design phase S 5213 Inspection programme for nonsafety-critical apparatus 87

Ž .13 Maintenance department has written safety procedures L 8713 Periodic safety training of contractors personnel 52


Table 5Safety in execution of maintenance tasks

%

Ž .14 Formal procedure for work orders L 8714 Formal discussion of work descriptions with maintenance 6314 Safety requirements contained in work descriptions 5914 Checks of safety precautions carried out before start of work 96

Ž .15 Permit-to-work PTW procedure present 9615 Controls carried out to check possession of a PTW 7415 Sanctions imposed for breach of PTW in last year 4515 Periodic controls of personal protective equipment 7215 Checks of maintenance work carried out before plant start-up 91

Ž .14 Formal scheduling of maintenance jobs for yearly stops L 91Ž .14 Formal scheduling of daily maintenance jobs L 72

14 Work descriptions for maintenance sometimes made 83always made 20

14 Written clearance before maintce. work starts 7315 PTW refers to contents of work 9315 Work order refers to PTW 3915 Controls carried out to check compliance with PTW 8315 Periodic controls of safety equipment for own personnel 96 contractors personnel 8715 Checks on p.p.e. own responsibility 2515 Written hand-over of work from maintenance to production 38

The results are summarised in Tables 3–6 in terms of the three levels of the model in Fig.3; the feedback loops are identified separately in this part of the study, rather than being dealtwith under the level to which they feed back. The figures quoted are percentages of

Ž .respondents claiming to have the aspects concerned in their management system. L indicatesŽ . Žquestions where large companies 200q give significantly more positive responses Chi-

. Ž .squared test 5% level than smaller companies; S where smaller give significantly more

Table 6Reporting and feedback

%

Accident reporting system by maintenance work 100All serious accidents analysed and discussed with management 100All accidents analysed 75

Ž .Statistics of all accidents L 76All accidents discussed with management 62All spills reported 76Historical maintenance data used for the maintenance concept 83Yearly evaluation of safety policy of maintenance dept. 33

Ž .Incident reporting system by maintenance work L 90All serious incidents analysed 79All incidents analysed 62Reporting system for breakdowns 85All serious breakdowns analysed 79All serious breakdowns discussed with management 70All breakdowns reported 46Historical maintenance data used in HAZOPs 48

A.R. Hale et al.36

positive response than larger companies. Where no letter is given in brackets the responseswere not significantly different between the categories.

The numbers in front of each item in the tables indicates which box of Fig. 3 the itemrefers to.

5.3.1. PolicyThe results for the policy level of the model are given in Table 3. The gap between general

company safety policy and an explicit translation for the maintenance department, both inpolicy and job descriptions, is marked, as was found in the in-depth studies. The same is truefor the relative lack of evaluation of policy to drive improvement particularly in smallercompanies. Large companies appear to favour certification as a method to assess their ownand their contractors management systems. The two companies who appear to evaluate theirmaintenance safety policy even though they do not have a written policy must be referring togeneral informal reviews.

5.3.2. Planning and proceduresThe results for the middle level of management are shown in Table 4. The telephone

verification process suggested that the figures in Table 4 give a somewhat optimistic picture ofthe prevalence of maintenance concepts, caused perhaps by a lack of clarity among respon-dents as to what this entails. Some companies appeared to consider that an explicit statementof their most prevalent type of maintenance constituted a maintenance concept. Nine compa-nies conducted predominantly corrective maintenance, 15 predominantly preventive and theremaining 25 a 50r50 mixture.

Figures relating to resource management of assets are somewhat higher than those forpersonnel, but the difference is not so marked as in the case studies. Questions were posed

Ž .about designs and modifications to plant not falling under a Plant Safety Report PSR sinceplant which is covered must be assessed. The figures show that the feedback loops are theweakest part of the management system here as in the case studies. It must be rememberedthat the figures in Table 4 are the company’s own estimate of its system and not of how well itis applied in practice.

5.3.3. ExecutionThe results at the execution level are shown in Table 5. The generally high figures for the

existence of procedures in the execution phase and of checks and controls to see that they arecomplied with confirms the findings of the case studies. The weaker points shown in Table 5are the communication between work scheduling and the personnel who will carry themaintenance work out, the low percentage of work descriptions which make reference tosafety aspects, and the very large gap between the use of written hand-over procedures at the

Ž .start of maintenance work compared to the end of it found also in the cases .

5.3.4. Feedback loopsThe use of reporting and registration systems is summarised in Table 6. All reports would

be generated in block 16 of Fig. 3. Some loops have already been mentioned in Tables 3 and4, but are repeated here for comparison.

ŽThis area is well-managed, particularly in respect of accident reporting systems perhaps.reflecting regulatory compulsion , although it is interesting that the data seem to be seen as

one-off incidents to be discussed and acted on at once, while there is much less systematic


analysis of breakdowns and preventive maintenance findings to discover patterns of data forlearning in the longer term.

6. Discussion and conclusions on strengths and weaknesses in the management of safetyin relation to maintenance

The three sources of information used in this study all point broadly in the same direction;only differences in nuances were found. This gives more weight to the conclusions which canbe drawn from the separate parts which all have individual methodological weaknesses.

The study has shown that accidents related to maintenance in the chemical process industryrepresent a problem, and that the management of safety in maintenance warrants attention andimprovement even in high hazard, and presumably relatively well-managed companies. Bestestimates are that around 40% of serious accidents in the industry are related to maintenance,80% of those occurring during the maintenance phase itself and 20% in normal operations as aresult of deficiencies in maintenance management. A higher proportion of the latter will beloss of containment accidents, since the former contain all the single deaths and seriousinjuries from the construction and heavy physical activities taking place during maintenance.

This finding of the dominance of maintenance accidents serves to confirm the many reportsŽfrom major petrochemical companies of the markedly greater accident risk often more than

. Žfive times higher for contractors personnel compared to their own personnel e.g. Blanton and.Montgomery, 1991; Lode, 1991; Simon and Piquard, 1991 .

All data sources identified the greatest weakness in the middle level of the system, thetranslation of general safety policy objectives into maintenance concepts, designs, planningand procedures and resource management to achieve improved safety. The accident analysesshowed that around half of the causal factors for maintenance accidents which could beidentified lay at this level. The company studies showed that the planning and management oftechnical aspects was relatively better than that of personnel, documentation and workdescriptions. This translation process is the responsibility of senior management to support thefunctioning of middle management.

The in-depth audits suggested that this weakness is as much a weakness in the state ofdevelopment of maintenance management per se, as it is of the failure to incorporate safetyinto existing maintenance management systems. It would appear that both maintenancemanagement and safety management are relative Cinderellas even of high hazard chemicalcompanies, making the combination of the two particularly vulnerable. In particular, thestudies showed the lack in the companies of a strong maintenance engineering function whosetask is to coordinate the information flows between life cycle phases to ensure that thefeedback loops from previous experience function: identify plant items responsible foraccidents, incidents, breakdowns and problems in preventive maintenance; analyse root causesof these events; develop and implement improvements to prevent them by plant modifications,adjustment of their maintenance concepts, training of operators or maintenance staff, etc.; andfeed their experience into the design and engineering of new plant to improve the inherent

Ž .safety and reliability and to develop the most safety and cost -effective maintenance conceptfor it.

There has been a strong tendency in recent years for companies to hive off theirin-company maintenance departments to contractors andror to integrate maintenance into

Žproduction functions through the formation of autonomous task teams lean production, Total

A.R. Hale et al.38

.Quality Management . While this has undoubtedly had its value in developing ownership andempowerment of the workforce, it has often resulted in the degradation of the knowledge baseand managerial quality of maintenance. In situations requiring high levels of plant and worksafety based on integrity and reliability of plant and sophisticated adjustment of maintenanceconcepts based on analysis of experience, this knowledge and management skill is a dominantprerequisite. A strong maintenance engineering and independent plant inspection function canalso contribute significantly from an economical point of view in reducing maintenance costs.The findings of this study in relation to this area are a warning that managements should lookcarefully at the whole life cycle communication on all important criteria such as safety beforemaking major surgery in reducing or hiving off departments. The study found some indicationthat the better companies were realising this fact and drawing more planning, scheduling andmonitoring tasks back from contractors into their own hands.

An explicit maintenance concept incorporating safety forms one key to improvement. Thereare three aspects to this.

1. Achievement of at least the same plant reliability and safety with less maintenance so asto reduce the amount of time when maintenance staff are exposed to the relatively high risksof maintenance work. Better, and more extensive use of reliability centred maintenance

Ž .methods Vucinic, 1994 at the design and engineering stages, coupled with realistic mainte-nance concepts could contribute to this.A balanced trade-off between the safety of the plant,which may be improved by more maintenance, and the safety of maintenance personnel,which is improved by less. The relative number of accidents during the maintenance phase

Ž .compared to those outside it, but related to lack of maintenance, suggests that the balanceseen from the safety viewpoint might move towards the conduct of less rather than moremaintenance. In any case, more explicit methods for making this trade-off in formulatingmaintenance concepts are necessary.

2. An explicit maintenance concept can lead to a larger percentage of the maintenance workbecoming planable, providing the opportunity for safety measures to be prepared in advancerather than having to be improvised under the pressure of breakdowns.

3. Improved design methods and practice, incorporating criteria for maintainability, com-partmentalisation for ease of shut down, safe access, etc. emerges from the study as a factorwhich could be improved significantly. Accident figures suggest that this is an area whichmay, however, yield relatively less results than improved planning and procedures.

The area of general safety policy appears to be quite well-managed in the companiesstudied. It is in translating it to explicit safety policy for maintenance activities that majorshortcomings are present. The safety policy level also falls down in the use of the feedbackand learning loops to produce continuous improvements. Reporting systems and maintenancemanagement information systems are to a great extent in place, but are not used in asystematic and coordinated way to put together data from disturbances, breakdowns, incidentsand accidents and to recognise significant patterns to be fed back into improved design,maintenance concepts, resource planning or supervision of execution.

The evidence from the study is that the execution level, covering the process from plantisolation through the actual maintenance work to hand-over back to operations is relatively thebest managed. This may be a reflection of the very considerable effort which companies haveput into this activity in recent years. It may also reflect the practical orientation of manymaintenance personnel. This means, however, for the companies studied, that there is less tobe gained from still further investment in improvements in direct supervision and controls atthis level than in improving the planning and support for design, maintenance concepts and


resource management. Companies should not be misled by the fact that the majority ofaccidents happen during the execution phase of work into thinking that improvements in theexecution level are the only, or the most effective means of improving matters. It took safetymanagement many years to overcome this fallacy and to turn its attention from workplacestop-gap measures to consideration of design and planning. This lesson must now also belearned for the area of maintenance. This conclusion may only be true of the high hazardous

Žparts of the industry which we have studied and less so of the rest of the chemical process or.other industry, which may be less far advanced in these respects.

The exceptions to this relatively favourable picture of the execution level seem to betwofold.

1. Some lack of coordination between work scheduling and execution. More explicitlinking of work orders and descriptions with safety precautions and permits-to-work could beadvantageous, with more explicit communication between the planners and those carrying outthe maintenance, for example in work-planning or tool-box meetings and in coordinationmeetings between contractors.

2. The relative lack of formal procedures surrounding hand-over back to production at theend of maintenance work. It may be advisable to have a more distinct and independentcompany inspection service watching over this transition between life cycle phases to guardagainst the pressures of production, on the one hand, to get the plant back on line, and ofmaintenance contractors, on the other hand, to have their work accepted and move on to thenext maintenance contract. An inspection service independent of both groups is suggested,with the same sort of guarantees of its autonomy as are provided by the legislation for working

Ž .conditions services Ministry of Social Affairs and Employment, 1980 .There is no clear indication that large companies are better at managing safety in

Ž .maintenance than smaller ones. When due allowance is made as was done in the audits forthe relatively smaller need for small companies to set up and maintain extensive formalsystems of documented procedures and policy, the scores of the small companies in thesample were not significantly lower than those of the large ones, though it may be that smallcompanies do not have the resources to achieve the higher peaks of excellence which the bestcase-study company was approaching.

7. Implications for regulation

The full implications for the regulation of safety in maintenance and the task of governmentŽdepartments falls outside the scope of this paper see Heming et al., 1995 for a more detailed

.discussion . Some conclusions will, however, be drawn to show how improvements could bemade. This discussion is set within the context of a reflection on the research model.

Section 6 shows the considerable scope for improvement in maintenance managementrelative to the ideal model presented at the beginning of this paper. The model itself receivedstrong support from the study, having good face validity as a description of the system that thebest companies recognised and were striving to achieve and providing a clear and coherentframework for companies less far down the road. It also stood up well as a framework for thedevelopment of audit and questionnaire instruments. The conclusions and recommendationsdid, however, lead to a slight reformulation of the model to emphasise the critical aspects ofthe system. This is presented in Fig. 5.

A.R

.Hale

etal.

40

Fig. 5. Revised maintenance management model.


The model now makes explicit the risk analysis function, feeding into the central areas ofthe maintenance concept, the documentation and resource management aspects of the system.The risk analysis needs to weigh not only the safety of the assets, but also that of themaintenance personnel and the effects on the environment. The role of the inspection functionis also emphasised. The dotted line encompassing all of these central functions indicates thepossible role of a maintenance engineering and internal inspection service. The model retainsits strong emphasis on the updating and learning loops stemming from reporting, recordingand analysis.

In making suggestions for ways that government and other actors can stimulate theimprovements found necessary by this study, we draw on a further aspect of the safety

Ž .management model used here Hale et al., 1997 . This model identifies two crucial aspects ofan effective safety management system: the safety criteria which drive the decisions made at

Ž .each stage represented by the ‘s’s feeding into each box in Fig. 5 ; and the resources,particularly of people and methods used to make those decisions. These are the levers whichboth the company in its own self-regulated system and the outside world, including thegovernment ministries, can use to steer the process.

7.1. Criteria

The model itself provides an overall criterion for assessing safety in a maintenancemanagement system. As such the elements of the model, and the relations between them,could be incorporated into standards for safety management systems which are in existence orare being developed andror the audit systems developed to test compliance with them.Appropriate standards and audits include those given below.

1. The IEC 706-4 guidelines on maintainability, which contain, in section 8 guidance onŽ .maintenance management IEC, 1992 . These currently make no mention of the safety of

maintenance personnel in developing a maintenance concept and only cursory mention of theprocess of maintenance support analysis.

Ž .2. The ISO 9001 standard for assessing the quality management of design ISO, 1987 ,which currently has no explicit requirements for attention to maintenance at the design stage,nor for feedback loops from accident and incident analysis into HAZOPs or design reviewsaimed at protecting the safety of operators and maintenance workers.

3. The proposed practical guideline for interpreting the ISO 9001 standard for maintenanceŽ .management NVDO, 1994 , which does not give as much explicit attention to safety as the

model proposed here.4. Audits being developed for testing management systems under the Directive for the

Ž . ŽControl of Major Hazards Four Elements, 1994 . The draft directive European Commission,.1994 does not pay explicit attention to the area of maintenance management.

Ž5. Existing and draft standards for safety management systems British Standards Institute,.1995; Norwegian Standards Institution, 1994 . These do not contain any systematic identifica-

tion of the maintenance phase as a critical or special area for management assessment andcontrol.

6. Assessment criteria for safety cases, plant safety reports, etc. The Dutch inspectionŽ .method for plant safety reports Ministry of Social Affairs and Employment, 1993 pays

considerable attention to maintenance management, but does not contain explicit concern fordesign for maintainability, development of a maintenance concept or specific feedback frommaintenance experience into HAZOPs and design reviews.

A.R. Hale et al.42

7. The Safety Checklist for Contractors devised for assessing the safety managementŽsystem of contractors in the Europoort area of the Netherlands a major concentration of

. Ž .chemical plants EBB, 1992 is concentrated almost entirely on the execution phase ofŽ .maintenance and does not link it to the rest of the system, not is it used as yet by companies

to assess their own maintenance staff.The regulatory instruments described above vary from statutory requirements to voluntary

standards for use in certification or as prerequisites for contract negotiations. If statutorysupport is felt necessary, to impose the elements defined in the model, two candidates are

Ž .available; the COMAH directive op. cit. for major hazard sites, and the legislation imple-Žmenting the European Directive on Temporary and Mobile Construction Works European

. ŽCommission, 1992 e.g. the Bouwprocesbesluit in the Netherlands; Ministry of Social Affairs.and Employment, 1994 , which requires that designers consider the safety implications of their

design for construction, operating and maintenance and cleaning activities and provide thenecessary documentation and plans to conduct those activities safely.

7.2. Resources

The current study identified the following as potential areas where initiatives are alreadybeing developed or could be encouraged.

7.2.1. Methods and techniquesØ audit techniques as defined above;Ø adaptation of HAZOP and design review tools to consider maintenance explicitly;Ø methods for classifying installations for not only their criticality for the safety of the

installation, but also for the safety of maintenance personnel;Ø techniques for assessing maintainability at the design stage;Ø standard maintenance concepts;Ø standards for the inclusion of safety in work procedures and permits to work.

7.2.2. PeopleIncorporation of the knowledge and approaches contained in the proposed model in the

training of all groups associated with design and maintenance management is recommended.Ø risk analysis and maintainability analysis for designers;Ø integration of safety aspects into the degree courses of university and technical high school

graduates going into the area of maintenance management;Ø consideration of maintenance management in the training for safety experts;Ø inclusion of certified safety courses in the training of maintenance staff and supervisors.

Initiatives in this direction have been taken in the Netherlands in the chemical processŽ .industry EBB, 1992 with the establishment of ‘safety passports’ for those working as

contractors.This necessarily brief review of measures for improving the situation found in the field

study nevertheless indicates how the systematic approach set out in the research model usedhere can be extended to classifying and ordering the ways in which regulators and other actorscan influence the maintenance management system.


Acknowledgements

The research reported in this paper was carried out under contract to the Directorate-Gen-eral of Labour, Ministry of Social Affairs and Employment, NL.

References

Ž .Blanton, M.L. and Montgomery, E.W. 1991 . Contractor safety: matching owners and contractors. Proceedings ofthe First International Conference on Health, Safety and EnÕironment, pp. 487–496. The Hague. Society ofPetroleum Engineers, Richardson, TX. Paper SPE 23255.

Ž .British Standards Institute 1995 . BS 8800. Guide to Health and Safety Management Systems. BSI, London.Ž .Craft, M.L. 1991 . Implementation of corporate contractor safety guideline. Proceedings of the First International

Conference on Health, Safety and EnÕironment, pp. 457–464. The Hague. Society of Petroleum Engineers,Richardson, TX. Paper SPE 23252.

Ž .Crooks, E. 1985 . Pipework Failures in the Chemical Industry: An Analysis of Accidents and Dangerous OccurrenceReports. Health and Safety Executive, London.

Ž .Crooks, E. 1987 . An Assessment of the Marcode Data Bank. Health and Safety Executive, London.Ž .Dept. of Energy 1990 . The Public Inquiry into the Piper Alpha Disaster. Chairman Hon. Lord Cullen, HMSO,

London.Ž . ( ) ( )EBB 1992 . Veiligheids Checklist Aannemers VCA Safety Checklist for Contractors . Stichting EuropoortrBotlek

Belangen, Schiedam.Ž .European Commission 1992 . Directive 92r57rEEG of the Council of 24 June 1992 concerning the minimum

requirements for safety and health for temporary and mobile construction work. Official Journal of the EuropeanCommunity. L 245r6. 26.8.92.

Ž .European Commission 1994 . Proposal for a directive from the commission concerning the control of danger frommajor accidents where dangerous substances are involved. European Union, Brussels.

Ž .Four Elements 1994 . Managers’ Guide to the Prototype Process Safety Management Audit Technique. FourElements, London.

Ž .Hale, A.R. 1969 . A study of operational switching accidents in the Midlands Electricity Board. Confidential reportto the Electricity Council. National Institute of Industrial Psychology, London.

Ž .Hale, A.R., Heming, B.H.J., Rodenburg, F.G.Th. and Smit, K. 1993 . Onderhoud en veiligheid: Een studie naar deŽrelatie tussen onderhoud en veiligheid in de procesindustrie; fase 1. Maintenance and safety: A study of the.relation between maintenance and safety in the process industry; phase 1 . Report to the Dutch Ministry of Social

Affairs and Employment, Safety Science Group, Delft University of Technology.Ž .Hale, A.R., Heming, B.H.J., Carthey, J. and Kirwan, B. 1997 . Modelling of safety management systems. Safety

Ž .Science 26 1–2 121–140.Ž .Health and Safety Executive 1987 . Deadly Maintenance. HMSO, London.Ž .Health and Safety Executive 1989 . Dangerous Maintenance. HMSO, London.

Ž .Heming, B.H.J., Rodenburg, F.G.Th., Hale, A.R., Smit, K. and van Leeuwen, N.D. 1995 . Veiligheid in onderhouds-Ž .management: Verslag van fase 2. Safety in maintenance management: report of phase 2 . Report to the Dutch

Ministry of Social Affairs and Employment, Safety Science Group, Delft University of Technology.Ž .Hurst, N.W., Bellamy, L.J., Geyer, T.A.W. and Astley, J.A. 1991 . A classification system for pipework failures to

include human and socio-technical errors and their contribution to pipework failure frequencies. Journal ofHazardous Materials 26, 159–186.Ž .IEC 1992 . IEC 706-4. Guide on Maintainability of Equipment: Section 8. Maintenance and Maintenance Support

Planning. International Electrotechnical Committee, Geneva.Ž .ISO 1987 . ISO 9001: Quality Systems: Model for Quality Assurance in DesignrDeÕelopment, Production,

Installation and SerÕicing. International Standards Organisation, Geneva.Ž .Johnson, W.G. 1980 . MORT Safety Assurance Systems. Marcel Dekker, New York.Ž .Koehorst, L.J.B. 1989 . Analyse van een Selectie Ongevallen in de Chemische Industrie uit de Databank FACTS.

Ž .Analysis of a Selection of Accidents from the Database FACTS . SDU, Den Haag.Ž .Lode, T. 1991 . Contractor safety on Ekofisk since 1980: special challenges in 1987. Proceedings of the First

International Conference on Health, Safety and EnÕironment, pp. 473–486. The Hague. Society of PetroleumEngineers, Richardson, TX. Paper SPE 23254.

A.R. Hale et al.44

Ž . ( )Ministry of Social Affairs and Employment 1980 . Arbeidsomstandighedenwet. Working Conditions Law . Staatsuit-geverij, Den Haag.

Ž .Ministry of Social Affairs and Employment et al. 1991 . Procesverbaal Explosie DSM Chemicals Rotterdam B.V.Ž .Official Report into the Explosion at DSM Chemicals Rotterdam B.V.

Ž .Ministry of Social Affairs and Employment 1993 . Handboek AVRIM: Een Inspectiemethodiek Õoor het ArbeidsÕei-( )ligheidsrapport. Handbook AVRIM: An Inspection Technique for the Plant Safety Report . Staatsuitgeverij, Den

Haag.Ž . ( )Ministry of Social Affairs and Employment 1994 . Bouwprocesbesluit. Construction Works Regulation . Staatsuit-

geverij, Den Haag.Ž . ŽMoll, O., Hale, A.R. and Smit, K. 1994 . Preventie van onderhoudsgerelateerde ongevallen Prevention of

. Ž .maintenance-related accidents . Tijdschrift Õoor Toegepaste Arbowetenschap. 7 6 , 79–86.Ž .Norwegian Standards Institution 1994 . Occupational health and safety management system: General management

principles. Proposal for a Norwegian Standard. Norwegian Standards Institution, Oslo.Ž . (NVDO 1994 . Concept Praktijkrichtlijn: Kwaliteitsborging in het Onderhoud. Draft Practical Guideline: Quality

)Assurance in Maintenance SerÕices . Dutch Standards Institute, Delft.Ž .Simon, J.M. and Piquard, P. 1991 . Contractor safety performance significantly improves. Proceedings of the First

International Conference on Health, Safety and EnÕironment, pp. 465–472. The Hague. Society of PetroleumEngineers, Richardson, TX. Paper SPE 23253.

Ž .Smit, K. and Slaterus, W.H. 1992 . Information model for maintenance management. Rijswijk, Netherlands. CapGemini. ISBN 90-71996-56-5.Ž .TNO 1990 . FACTS. Databank for Accidents with Hazardous Materials. TNO, Apeldoorn.

Ž . Žvan Leeuwen, N.D. 1995 . Onderhoud en Veiligheid: Verslag van een Enquete. Maintenance and Safety: Report of aˆ.Questionnaire Study. Faculty of Mechanical and Marine Engineering, Delft University of Technology.

Ž .Vucinic, B. 1994 . MACAD: Maintenance Concept Adjustment and Design. ISBN 90-370-0112-2.

evaluating safety in the management of maintenance … · 2014. 12. 30. · evaluating safety in...

Documents