principles and elements of sms a review
DESCRIPTION
Principles and Elements of SMS A Review. Patrick Hudson ICAO/Leiden University. Structure. Why SMS? The principles Shell’s experience Implementation experience Conclusion. Why Safety Management Systems?. Safety is a right for customers and staff - PowerPoint PPT PresentationTRANSCRIPT
April 2006 ICAO Seminar Baku
Principles and Elements of SMS
A ReviewPatrick Hudson
ICAO/Leiden University
April 2006 ICAO Seminar Baku
StructureStructure
• Why SMS?• The principles• Shell’s experience• Implementation experience• Conclusion
April 2006 ICAO Seminar Baku
April 2006 ICAO Seminar Baku
Why Safety Management Why Safety Management Systems?Systems?
• Safety is a right for customers and staff
• Poor safety performance is a sensitive indicator of poor operations
• “If you can’t manage safety, how can you show you can manage anything else?”
• Safety management systems are about getting systematic about the problems
April 2006 ICAO Seminar Baku
Safety Management Safety Management SystemSystem
A framework for Safety A framework for Safety Management Management
Alcohol& Drugs
PolicyAudit Plans
Road Safety Plan
Safety Drills
Security Policy
SafetyPolicy
No Structure Structure
Policy
Process
Task
ContinuousImprovement
Safety (HSE Cases)
Mgt.policy
April 2006 ICAO Seminar Baku
A Pacific Southwest Airlines Boeing 727 as it goes down over San Diego, California after a mid-air collision with a Cessna in 1978. One-hundred-thirty-seven people along with 7 on the ground were killed.
April 2006 ICAO Seminar Baku
Early Safety ManagementEarly Safety Management• Early safety management was an unstructured mixture of ‘good things’
• Progress was based upon response to accidents• Measures were outcome based (crashes etc)• There were no process definitions (how to do it)
• Regulations prescribed exactly what to do (what to do)
• This works very well to start with, but expectations have been raised over the years, now everyone expects that every flight is safe
April 2006 ICAO Seminar Baku
Types of CertificationTypes of Certification• There are three distinct ways of guaranteeing safety
• Type I - Classical ICAO/FAA/JAA certification
• Type II - Safety Cases and SMS• Type III - Safety Culture and Good Practice
• These different approaches are complementary, especially II and III
• Types I and II are Imagination Limited – Can people imagine what might go wrong– Type III involves doing The Right Thing anyway
April 2006 ICAO Seminar Baku
April 2006 ICAO Seminar Baku
April 2006 ICAO Seminar Baku
Why have a Safety Why have a Safety Management System?Management System?
• A number of major disasters in the Petrochemical industry– Flixborough– Seveso– Bhopal
• Nuclear disasters– Three Mile Island– Chernobyl
April 2006 ICAO Seminar Baku
FlixborougFlixboroughh1 June 19741 June 1974
•Modification Control
•Use suitably trained, educated and responsible people
•Know what you don’t know
April 2006 ICAO Seminar Baku
SevesoSevesoJuly 1976July 1976
• Understanding safe state to leave reactions
• Multiple layers of protection
• Automated Reaction stop systems for exothermic systems
April 2006 ICAO Seminar Baku
LongfordLongford25 September 199825 September 1998
Sale
Barry BeachMarine Terminal
Long Island PointFractionation Plant,Crude Oil Tank Farmand Liquids Jetty
LongfordGas & Oil Processing
PortPhillipBay
c
Melbourne
Altona
Monotower
Sub-sea Well Oil Platform
Gas Platform
Concrete Structure
Barracouta Marlin
Snapper
GoodingCompression (GTC)
c
c
• Training needs to impart and refresh knowledge.• Must identify other hazards and provide relevant training.•Corporate knowledge must be captured and kept alive
April 2006 ICAO Seminar Baku
Piper AlphaPiper Alpha• 1988 the Piper Alpha platform was destroyed
• The platform had just been audited by the regulator
• Lord Cullen’s report set up a new regime– Goal Setting– ISO 9000 type management systems– Safety Case to provide assurance - a documented proof that the SMS is both in operation and effective
April 2006 ICAO Seminar Baku
April 2006 ICAO Seminar Baku
April 2006 ICAO Seminar Baku
April 2006 ICAO Seminar Baku
Piper AlphaPiper Alpha
• Cost $1,500,000,000• 167 killed• Occidental UK went out of business in two years
April 2006 ICAO Seminar Baku
The Cullen ReportThe Cullen Report• Cullen investigated the Piper Alpha disaster
• Report was published 1990• Requirement made for every offshore facility to have an SMS in place by November 1992
• Proof by submission of a safety case• If there was no acceptable safety case the operation would be shut down immediately
April 2006 ICAO Seminar Baku
Shell International’s Shell International’s ApproachApproach
• Shell is the largest operator in the North Sea - SMS was made mandatory
• Shell decided to get in first rather than wait
• A considered approach was designed• The requirement for SMS was to be made world-wide for all Shell Group companies
April 2006 ICAO Seminar Baku
Shell’s Approach - Shell’s Approach - don’t do everythingdon’t do everything
• Decision to operate in terms of hazards and a limited set of events to avoid
• Developed the Bow-tie model (next slides)
• Identification of safety critical activities to provide assurance
• Getting in first meant that they wouldn’t have to operate a system foreign to their culture
April 2006 ICAO Seminar Baku
April 2006 ICAO Seminar Baku
April 2006 ICAO Seminar Baku
The Swiss cheese model The Swiss cheese model ofof
accident causation accident causation (Reason)(Reason)
Some holes dueSome holes dueto active failuresto active failures
Other holes Other holes due todue tolatent latent
conditionsconditions
Successive layers of defences, barriers, & safeguardsSuccessive layers of defences, barriers, & safeguards
HazardsHazards
LossesLosses
April 2006 ICAO Seminar Baku
SAFETY MANAGEMENTSAFETY MANAGEMENTBased on the Reason Based on the Reason
ModelModel
Hazard/Risk
Undesirableoutcome
Work &Organisation
Barriersor Controls
World
April 2006 ICAO Seminar Baku
Safety Management Safety Management CycleCycleLeadership and Commitment
Policy and Strategic Objectives
Management Review Corrective ActionAnd Improvement
Organisation, ResponsibilitiesResources, Standards & Documentation
Audit Corrective Actionand Improvement
Hazards and Effects Management
Planning and Procedures Corrective Action
Implementation Monitoring
PLAN
DO
CHECK
FEEDBACK
April 2006 ICAO Seminar Baku
Hazard-based approachHazard-based approach• Construct a generic hazard register• Assess which are relevant for a particular operation
• Use a Business Process Model to identify safety critical processes that allow management of the hazards
• Construct Bow Ties for control and recovery
April 2006 ICAO Seminar Baku
HEMPHEMP• HEMP - Hazard and Effects Management Process
• Identify - What are the hazards?• Assess - how big are those hazards?• Control - how do we control the hazards?
• Recover - what if it still goes wrong?
April 2006 ICAO Seminar Baku
Bow-tie ConceptBow-tie ConceptEvents andEvents and
CircumstancesCircumstancesHarm to people and Harm to people and damage to assets damage to assets
or environmentor environment
HHAAZZAARRDD
CCOONNSSEEQQUUEENNCCEESS
BARRIERS
Undesirable event withUndesirable event withpotential for harm or damagepotential for harm or damage
Engineering activitiesMaintenance activitiesOperations activities
April 2006 ICAO Seminar Baku
Bow-tie ConceptBow-tie Conceptfor a specific threatfor a specific threat
Events andEvents andCircumstancesCircumstances
Harm to people and Harm to people and damage to assets damage to assets
or environmentor environment
HHAAZZAARRDD
CCOONNSSEEQQUUEENNCCEESS
BARRIERS
Undesirable event withUndesirable event withpotential for harm or damagepotential for harm or damage
Engineering activitiesMaintenance activitiesOperations activities
April 2006 ICAO Seminar Baku
RISK ASSESSMENT MATRIXPotential Consequence of the Incident Increasing Probability
Env'ment
0
2
3
4
5
Seriousinjury
Multiplefatality
Singlefatality
Minorinjury
Happened > 3 x in this location
Minordamage <US$ 50K
Localdamage <US$ 250K
Majordamage <US$ 1M
Extensivedamage >US$ 1M
MassiveEffect
Zerodamage
Localised Effect
MajorEffect
Minor Effect
1
Assets
Slightinjury
Slightdamage < US$ 10K
SlightEffect
ZeroEffect
B C D EA
Noinjury
Knownin aviation industry
Happened > 3 x in the Company
No Impact
InternationalI m p a c t
IndustryI m p a c t
N a t i o n a lI m p a c t
Slight Impact
Into
lerable
incorpora
te ri
sk
reductio
n
measure
Unknown but possible in the aviationindustry
Happenedin this company
LocalI m p a c t
ReputationPeopleRating
Manage Thro
ugh
Normal H
SE-MS
procedure
s
April 2006 ICAO Seminar Baku
Hazard Management and Hazard Management and ControlControl
• Bow Ties describe the hazards and the relevant controls
• Controls are provided by elements in the business processes
• Top events are a restricted set of unwanted events, not the final outcomes
April 2006 ICAO Seminar Baku
Bow Ties as StandardBow Ties as Standard
• The Bow Tie is now the standard for the FAA in the USA
• There are a number of computer packages for making and maintaining bow ties
• The information needed can be shared
• Local differences are easily accommodated
April 2006 ICAO Seminar Baku
Shell’s HSE Shell’s HSE MANAGEMENTMANAGEMENT
putting it togetherputting it together
THESISRisk Assessment Matrix CONSEQUENCE INCREASING LIKELIHOOD ABCDE
SeverityPeopleAssetsEnvironmentReputationNeverheard ofin …..industryHeard ofin ….industryIncidenthasoccurredin ourCompanyHappensseveraltimes peryear inourCompanyHappensseveraltimes peryear in alocation0No healtheffect/injuryNo damageNo effectNo impact1Slight healtheffect/injurySlightdamageSlight effectSlight impact2Minor healtheffect/injuryMinordamageMinor effectLimitedimpactManage for continuousimprovement3Major healtheffect/injuryLocaliseddamageLocalisedeffectConsider-able impactIncorporate riskreduction4PTD or 1 to 3fatalitiesMajordamageMajor effectNationalimpactmeasures &demonstrate 5MultiplefatalitiesExtensivedamageMassiveeffectInternationalimpact ALARP Intolerable
Risk AssessmentMatrix
EP 95-0300
HAZOP/ HAZID EIA/SIA/HRA etc.
HSE MS
EP 95000Series
Technical advice
Minimum Expectations
Design standards
Group Guidance
April 2006 ICAO Seminar Baku
HSE MS “in place”HSE MS “in place”
Job Hazard Analysi
s Workplans
Trends/benchmarking
ViolationSurvey
Hazardous SituationUnsafe Act reporting
AuditsReviews
Incident Investigation(Tripod Beta)
Incident Reporting
Contract/Contractor
Management
CompetencyProgrammes
Permit toWork System
HSE SelfAppraisal
Site Visits
Observationtechniques
HSE Standards& Procedures
April 2006 ICAO Seminar Baku
Advantages of an SMSAdvantages of an SMS• The SMS provides a structure for measuring in system audits
• Bow ties provide a structure for operational audits– Are the barriers there?– Are the barriers intact and in operation– Is there sufficient defence- are there single point trajectories where everything relies on a single defence?
• The analysis of barriers and operations also provides a basis for incident investigation that is consistent with the Reason model
April 2006 ICAO Seminar Baku
What does it take?What does it take?• Regulators can force implementation, but it is much easier if you want to do it anyway
• Top management has to be convinced that implementing an SMS is in their interest
• Shell had to implement in the North Sea, but decided to make SMS obligatory world-wide in view of the benefits to Shell group
• BP and ExxonMobil have taken exactly the same approach with GHSSER and OIMS
• You have to do it yourself – Hiring consultants can only be as support– An off-the-shelf SMS will soon fail
April 2006 ICAO Seminar Baku
April 2006 ICAO Seminar Baku
Conclusion Conclusion • Safety management systems turn safety into a systematic process
• Development can be done with sharing of information and experience - you don’t compete on safety
• SMS models can be used to unify management, audit and incident investigation
• SMS does not guarantee everything - to get ahead you need to develop a safety culture as well - tomorrow
April 2006 ICAO Seminar Baku