Red Worm's Views on Process Safety

Is process safety all about execution?

2012-02-14T10:42:00.003+01:00

Last evening I attended a presentation at the IDA - the Danish Society of Engineers - about the Deepwater Horizon. The presentation was by Graham Bennett from DNV. Unfortunately the full report on DNV's investigation is no longer publicly available. Yesterdays presentation ended with a description of the ongoing effort by authorities both in the US and the EU to create new regulations which aim to prevent another similar event. That has been the modus of operation of authorities since Bhopal, since Piper Alpha, since Seveso. But does it work?
One could argue that the regulation have worked, since the world have not seen another Bhopal - although during the flooding in central Europe in the summer of 2002 we came very close to such an event during a major toxic gas release. In his presentation Graham Bennett also pointed to similarities in the lag of effective emergency management and communication on Piper Alpha and Deepwater Horizon. Both were supposedly designed to survive the type of events they experienced. They did not due to lag of efficient decision making during the initial phases of the emergency.
In his presentation Graham Bennett also mentioned, that in 2006 ExxonMobil was drilling a deepwater well not far from the Macondo formation. That was Blackbeard, which was abandoned at a dept of more than 32000 feet because Exxon drillers felt it was not safe to continue after the rig experienced pressure shocks. At the time the decision to abandon the well escalated to the level of the CEO within hours. The CEO had the guts to make the decision to abandon the well with a loss of almost 200 M$ and not risk employee lives and company image.
I think this is the main difference between companies like ExxonMobil and Dow Chemicals and other major players in the industry: A lag of effective means of escalating a decision to the top level of the company. I base this on my initial chats about OIMS in the 90's. I learned about OIMS during an afternoon patio conversation with a friend from the days at University of Alberta. He explained the basic ideas to me, and through former colleaques at Imperial Oil I got in contact with people who was able to explain OIMS to me both in a research laboratory environment and in the settings of a refinery and chemical plant. At one of these meetings after talking about OIMS for several hours I was told, that the OIMS manual had been declared company proprietary, so I could not have a copy even for teaching purposes, but that BP had a very similar system, and their manual was freely available on that company's website. Therefore my conclusion: The difference is not in the operations management systems - or whatever each company calls them - as such, but in how the execution works in day to day operational decisionmaking throughout all levels of the organisation. It's about the connection between the ground floor and the top floor!

Are you paying attention to Oracle?

2012-02-03T10:51:00.000+01:00

Do you remember that Oracle a few years ago acquired Sun Microsystems? What has happened since and should the process control community pay attention? These questions pupped into my head when I attended "The Extreme Performance Tour" hosted by Oracle at the Thyco Brahe Planetarium here in Copenhagen a few days ago.
A very short time after the take over was legally completed Oracle announced the Exadata - the first end-to-end engineered system to run the Oracle database. However, in my view Oracle was just playing catch up. For years you have been able to buy IBM mainframes custom engineered to run the DB2 database. So the news is that now there is competition on this very special market of large databases with easy access to the data from anywhere. Since then Oracle have also engineered the Exalogic; properly to compete with Websphere. So also here competition have increased.
The process control community is increasing its usage of simulators and modelling. Often these are custom made systems to a particular plant. At least one large user of process control systems, such as those from ABB or Honeywell, have several years ago decided, that they are better off adding hard disk capacity for history data than spending any money on consolidation of these data. However, usually the history data still reside on the process control network. This locations of the process history data to some extend limits the access to the data and the use of the data.
If the process history data resided on a large corporate computer, such as an IBM mainframe or an Oracle Exadata, then controlled access to the data both in-house of for collaborators in engineering companies and universities would be much easier. Even though process control computers today are standard off-the-shelf hardware, and run standard off-the-shelf software, are many user for good reason limiting external access to the process control network.
However, such large process history databases be used? They could be used for example to compare refinery performance over the last two turn-around circles. Retail companies for many years have used so-called business intelligence software to compare sales during the last two Easter periods. Such analysis of process data could reveal periods of improved or degraded performance. Another possible usage of high frequency process history data is development of process models that are fitted to the actual history data from the plant. So I think the process control community should pay attention to Oracle! or their competitors.
Some large companies may already have the necessary data processing capacity in house to explore the information hidden in the process history data. So what are stopping you?

The WTT20YA Syndrome

2011-12-14T15:38:00.001+01:00

Within the last year I have had the opportunity to look at literature in the very different area: Medical science. That was not only exciting from the point of view of learning something new, but also from the point of view of accessibility to information.

Many medical scientific journals, such as for example Blood, allows free access for personal use to all content more than 12 months old, and this for a journal with an impact factor above 10! The European Journal of Haematology, which as an impact factor above 2.5 goes a step further, it makes all content freely available on the internet either as HTML or PDF, on Wiley Online Library. I wonder what impact this free availability of new information in an area has on innovation and usage of new ideas? Wiley Online allow you to easily download and insert figures in your power-point presentation. This makes it extremely easy to use the material in ones own presentations with proper acknowledgement of the source.

Maybe the chemical engineering community and especially the process safety community should implement similar free access to information about process safety in order to advance our common aim: to make our process plants and their products safer both for the people working in the plants and for the communities in which the operate.

Today an engineer working in one of our plants can read the table of content of most engineering journals online, but getting a personal copy of an interesting article can be quite challenging. It may require using his own money to buy the copy online. It may require convincing his manager, that the article, of which he has only read the abstract is relevant and worth investing money in. This may of course require additional paperwork - not something most engineers operating plants really are looking for. In all this sums up to many barriers for using time - evening or weekend - to become more knowledgeable about things relevant for operating the plant. Free access to scientific literature within chemical engineering would help break down some of these barriers. Furthermore, it would allow high school students easier access to information for their science project with the likely side effect, that more of these students choose chemical engineering as a carrier path.

I remember the presence of the WTT20YA syndrome at the facility I worked in more than 20 years ago. It killed many idea from young new and energetic professional. Read more about the WTT20YA syndrome and how it prevents or slow down innovation at Sustainable Plant.

How can you be better than the best?

2011-10-31T20:56:00.002+01:00

The answer is rather simple. If you want to be better than the best in process safety, then you have to learn from the best - and improve on what you learn. It no secret that I admire The Dow Chemical Company for their safety performance and their attitude toward people. And I believe, that it starts with the people attitude. With some companies it starts already when they talk with potential new employees at the campus recruitment center. During the initial conversation to decide whether to offer a young university graduate a second interview and possibly a visit to their facility some companies include questions aimed at understanding the students attitude towards safety. However, it is important to realize, that one can drive a motorcycle, sky dive and perform other recreational activities without being unsafe. It us the attitude with which you approach such activities, that are important.

During a recent fall holiday to Thy in the northwestern part of Denmark I saw surfers at several places along the coast. However, I noticed, that none of them were surfing alone. They also entered the water in a safe way. They seemed to have an agreed upon path, so incomming and outgoing surfers did not collide. There also seemed to friends or others on the beach. Nonetheless, surfing in conditions you see on the picture here is not for beginners. It is for those who have learned from people that are better than them, and want to become better yet.
In a recent article, which by now have been published in several different electronic media, Michael R. Gambrell gives 5 tips on how to improve your company's safety performance. Most recent I have seen the article "Make Safety Second Nature" on www.sustainableplant.com . Here Mr. Gambrell, who is an executive with Dow gives these tips on achieving second to none safety performance:

Make safety the top priority.
Set the tone form the top.
Hold everyone accountable.
Establish bold goals.
Learn and leverage.

I have heard Dupont employees say, that at their company safety is not a priority. It is the basis for being in business. It certainly help if the top guy or gal - the CEO - sets the tone, as the CEO of Dow did with an interview in Harward Business Review in the mid nineties just after the company had published their safety goals for 2005. If this does not happen you may be in for an uphill battle! What happened at Dow in 2005? Some goals were achieved, while others were not. Nonetheless Dow established still bolder goals for 2015. And ever since the first goals set in 1995 annual progress reporting have been published. That is a bold thing. Following the five tips year after year made Dow's safety performance 60% better than the chemical industry average in 2009 - see graph in referenced article.

Then how can you be better than Dow? There is no easy answer. One possibility is to look at your suppliers all the way from were things come out of the ground, and establish relationships with them to build an inherently safer and highly ethical supply chain all the way to the final consumer. Look at areas within social responsibility and customer relations in which others have not yet set goals. And then tell the world how you are working towards your goals, so others can learn too.

Deaths of innocent children - is that allrigth?

2011-10-29T19:48:00.000+02:00

For some time the Chemical Safety Board have investigated deaths near oil and gas exploration and production facilities - especially deaths of innocent children. Two days ago they released a report that found many oil and gas exploration and production facilities to be hazardous to the public and especially to children. The report contained numerous recommendations directed at the US Environmental Protection Agency, the Missisippi State Oil & Gas Board, the Oklahoma Corporation Commission, the Texas Railroad Commission, the American Petroleum Institute and the National Fire Protection Association. I immediately think, that something is severely missing from this list of recipients, but maybe it is just the nature of organisations. Maybe organisations have en tendency to just see those they serve as being other organisations.
Among the technical recommendations are the use of inherently safety tank design features such as flame arrestors, pressure-vacuum vents, floating roofs, and vapor recovery systems. Just this week I saw this demonstrated on a garbage bin for a whole apartment complex - several hundreds of apartments. They had replaced many 400 liter plastic containers with a single large iron bin, where the deposit of garbage worked like those astrays many families had in the fifties and seventies, where you press a button, and the ash disappears below a lid (improved versions of this design is still available at Smell killer ashtray). You could actually throw a burning match into this garbage bin whitout coursing a fire. With the old plastic container they experienced almost a fire a week. This is what the CSB calls for: that lighting a match near a gas or oil exploration or production facility does not cause an explosion and fire.
Unfortunately the CSB in their report does not recommend, that owners and operators of oil and gas exploration and production facilities use inherently safer design at all their sites. Unfortunately the CSB does not tell these owners that implementing such features at their sites often is less costly than a single explosion and fire with its potential for loss - including deadly outcomes.
As a test I wrote on my Google+ stream a public message about this report. In this message I called for the fine in case of deads around oil and gas explorations facilities should be at least equal to the amount of capital saved by not providing adequate access control. Within a short time one person responded, that jail time should be called for. What do you thing?
When I was working in Canada in the eighties there were some problems enforcing the environmental laws. However, that seemed to disappear overnight when the possibility of sending site managers to jail was introduced. I am sad to see the amount of bureaucratic measures needed just because owners and operators of facilities are insufficiently concerned about the safety of their fellow citizens.

What is the difference between the EPSC and the ISC?

2011-10-07T22:12:00.001+02:00

At the special session "Process safety competence - European strength degrading to weakness" at ECCE-8 in Berling this I forthe first time heard about an initiative of the IChemE called theIChemE Safety Center, properly abreviated ISC - see annoncement on EPSC website from 2009.

At the special session a representative fromthe IChemE was scheduled to give a presentation to the special PPScompetence session, but unfortunately this person had an accident ashort time before the event, and the persons doctor recommended, that he or shedid not travel to Berlin. In stead an EPSC employee gave the presentation.

This made me wonder about a coupleof things:

how an employee of the EPSC can represent the IChemE? Or why the IChemE could not have send another IChemE employee?
the similarity of the names of the two organisation European Process Safety Centre and IChemE Safety Centre. For some people the two organisations could easily be confused because of the similarity of the names. Especially since they are located on the same address in Rugby, and the abbreviated name also are similar, ie. ISC og EPSC.

In the brochure about theIChemE Safety Centre distributed to attendees it is further stated that the centre will offerleadership in the so-called six pillars of process safety: knowledgeand competence, process design, systems and procedures, managementand audit, human factors and culture. To me there appear to be anoverlap with the areas where EPSC is active. I suggest, that the EPSCboard should ask the though questions about possible conflicts ofinterest between the European wide organizaton EPSC and the nationalassociation of chemical engineers in the UK called the Institutionof Chemical Engineers.

With the IChemE SafetyCentre offering both public and in-house training course I see apossibility of EPSC finansing the development of courses offered byISC to the chemical industry. I don't know if this is desirable. Atleast the EPSC board should reflect on the issues and ask the thoughquestions about how ISC plan to develop their course offerings?

Maybe the questions have already been asked by the EPSC board. If so, the answers should be communicated to the wondering world in order to clearify the diffence between the aims of EPSC and ISC - both in Rugby.

I think it is importantfor an organisation like the EPSC to be as independent as possible ofnational interest in order to have the necessary influence on theEuropean level and hence serve all process industries in all Europeancountries.

Don't know how to create a great safety culture?

2011-09-20T22:43:00.003+02:00

More and more you read about safety culture these days. Who has a goord safety culture? How do you progress to a good safety culture? How do you sustain a good safety culture? It all starts by hiring the right leaders, and then ensuring their careers and compensation is firmly related to their groups process safety performance.

If you still don't know what to do, then rush over to ChemicalProcessing.com and read Michael Gambrell's article "Making Safety Second Nature". You will get away with 5 tips on how to create and sustain a world class safety culture. One of the tips is measuring the events, that did not occur at your site, i.e. the accidents that did not happen, or the leaks that did not occur because of your safety performance. Making safety second nature was also the theme of a conference I attended at the Mary Kay O'Connor Process Safety Center some years ago.

About 10 years ago I had the opportunity to meet with the then manager of Dow Chemical Canada's Sarnia Site and some of his senior people. The background for the meeting was some remarks in the local newspaper about the safety performance of the companies of Sarnia's Chemical Valley the year before. The visit was just a month after 9/11 and a week after attending the CCPS annual conference in Toronto - the first international conference in North America after the attacks. I still recall what the focus of the safety managers work at the time was. It was enhancing Dow's ability to respond globally to any emergency event at a company site. Implementing the same high emergency preparedness standard worldwide would allow Dow to call upon their experts to respond to events at any one of their sites, and be effective responders from the moment they sat feet on the site. Just because all was done to the same high company standard.

I have never had the opportunity to work for Dow, but I have had the pleasure of having friends who worked for Dow and I have also talked to many Dow People at safety conferences and workshops about safety. However, the story that foremost exemplify the companys attitude to people involve an employee at the Sarnia site on holiday in the Caribian. This employee was unfortunate to have a hearth problem at the end of the vacation. A phone call was made to Sarnia sites doctor, who was informed about the employees situation by a relative of the employee. The doctor believed, that the employee would be better helped in Sarnia than on the holiday island. The doctor therefore called Midland to check on the status of the corporate jet. Fortunately it was available, and within an hour is was on the way with a nurse and doctor on board to the Caribian. Before the end of the day the Sarnia employee was safely in the hands of doctors at a Sarnia hospital.

I could tell other stories about Dow's attitude towards people, but I will let this one stand alone. Nothing than this story better says 'People first = Safety first'.

How serious are you about workplace safety?

2011-07-22T13:18:00.003+02:00

Two days ago Mike Bacidore over on SustainablePlant.com asked this question in the article "Require Safety Compliance in Your Supply Chain" (login required to read this article!). The sad background for the article was that a major Chinese supplier to American high tech companies such as Apple, HP and Dell had 15 people injured at their Chengdu plant.

When you have a customer-supplier relationship with a company you have some influence over how the products you buy are being made. I experienced this first hand when working for a major integrated Canadian oil company a number of years ago. The site I worked at supplied to rail cars of a particular product to the Ford Motor Company which was at the time so concerned with how we ensured the quality of the product we delivered, that they sent two engineers to visit our facility to check our production process, check our quality control procedure, and talk to our operators and engineers. They were not interested in taking samples. They were interested in how we ensured delivery of a quality product each time. They spent two weeks at our site!

We in the west benefit from a lot of goods manufactured under horrible conditions in developing countries around the world. This has been documented in several newspaper articles, even in my local Danish engineering weekly "ingenøren". However, the best book about the workplace conditions in these third world countries is properly Naomi Kleins "NO LOGO". If you haven't read it yet, you should, and you will understand the type of influence consumers have on the workplace conditions and safety standards products are produced under - if they vote with their money!

I am sure the first technology company which gets serious about work place safety in their supply chain will benefit by increased sales, just like the Dow Chemical Company have benefited from their investments in process safety over the last more than 25 years. An Envy would create more envy if HP could document, that all parts of it was produced under good workplace standards and process safety standards. Maybe US OSHA could expand their photo contest to include cases of supply chain workplace safety, or join EU OSHA in creating a worldwide awareness champaign about workplace safety during the manufacturing of the products we enjoy? what do you think?

The battle in the clouds!

2011-06-22T20:37:00.002+02:00

Yesterday I attended a seminar called "While we are waiting for the cloud" at Skuespilhuset in Copenhagen. The seminar was hosted by the Danish company Scriptor, which provides consultation services around print solutions and document solutions for major corporation in our country.

There were three speakers this morning. The first was sales director Erik Kaae from Microsoft Denmark. He is responsible for selling Microsoft Cloud solutions here. The second speaker was general manager Peter Koch from HP Denmark, and finally Kenneth Fill from Innovation Lab talked about the future. Kenneth's talk was much like those of weather forecasters on the daily news casts: 90% about how it has been lately, and 10% about tomorrows weather.

Erik Kaae explained, that all of Microsofts solutions will be available in the could, but some are not there yet. There are of course one pricing structure for enterprise customers and one for small and medium size enterprices. Those for small and medium sized companies include scaled down version of Microsoft Office, white the interprise versions include the full office package as well as the possibility of using the applications off-line, e.g. in an airplane. The subscription prices for the small package is about 8 US$ per person per month or just about 100 US$ per year per person. And then you need to have at least 5 persons needing the package in your company.

My own former company Safepark Consultancy had only one person employed. That is properly not uncommon for small consulting companies - at least in this country. We signed up for the free version of Google Apps. Today that cost 10 US$ annually for the domain registration. Google Documents and all the other Google products associated with a Google Account are free as long as you are less than 10 persons and no one uses more than about 7 GB storage for e-mail, 1 GB for on-line PDF-files and 1 GB for on-line pictures plus a web-site (which has a storage limit, which I have yet to discover).

Both the Microsoft and the Google solutions use commercial software, but at least to me it appears, that the entry cost for the Google solutions is quite a bit less than for the Microsoft solution. What do you think?

Now, I wonder if Microsoft clould solutions runs faster in Googles Chrome webbrowser than in Microsofts own Internet Explorer. Because clearly visible on the desktop of Erik Kaae was a Chrome browser icon!

Peter Koch in this presentation properly ignored most of HP (that part, which sells personal digital assistants, personal computers and servers). He started by stating, that after the move to the cloud the only thing for the CIO to take care of physically would be the printers. His talk was spiced up with facts about the cost of having people walk to a printer in stead of giving them personal printers. I guess, that I am guilty of that since the church office, at which I am chairman of the council have one large Xerox Multifunction printer for all to share (however, I do have good arguments from a former employee for that solution).

You may ask what this has to do with process safety and / or process operations in general. Not that much, except that possibly you will see companies storing historical plant data, i.e. anything older than one week in the cloud for easy access to these data by analysts and others, e.g. sharing with universities and others for research and other purposes. Just don't forget to also store information about the measurement units in the cloud. Standard cubic feet per hour and kilograms per hour are not quite the same.

Another approach to process safety textbooks!

2011-05-17T13:12:00.000+02:00

The nature of core chemical engineering topics
Most of the core subjects on the chemical engineering curriculum at universities worldwide teach students how to improve things. Such as: How to select a more sustainable route to a given product, how to create a more effective catalyst, how to improve energy utilization in the plant using pinch technology, how to select the best solvent for a separation process. All this somehow translate directly into how to make more profit! Also in the view of most managers.

One core topic - or at least it should be a core topic in my opinion - stands out in this connection. That is process safety. That is all about prevention: Prevention of loss, prevention of injuries, prevention of fatalities, prevention of explosions, prevention of fires, prevention of chemical releases. All this somehow translate directly into expenses! At least in the view of many manager!

Motivating students
How could this be changed?`First textbooks - and fortunately there are not many - in process safety must be drastically changed. Secondly - and I am guilty of this too - we must change the way we start our process safety teaching from attempting to motivate our students with negative head lines from newspapers or dramatic videos of past disasters. People working on action theory, such as professor Morten Lind at DTU-Elektro, will tell you that avoiding some event is much more difficult than achieving something. This is because to avoid something we need to put barriers - i.e. safety systems - on all the possible routes to an event. On the contrary, to achieve something we just need to find one route to the goal. This is the fundamental difference between process safety and all the other subjects we try to teach our chemical engineering students (maybe with the exception of professional ethics).

I believe, that Walt Boyes at SustainablePlant.com with his idea that process safety is all about uptime, is on the right track. All the negative events, which process safety is trying to prevent reduce uptime - if we somehow fail to prevent just one of the routes to them. So let us change things around, and work on improving uptime. Uptime also has the advantage, that it can be easily measured and related to profits. And as Peter Drucker said, what gets measured gets managed!

Starting the change
So how should a text book, which aim at driving home the point, that process safety is all about uptime be structured? Is should take off with a positive message. This could be a quote from an interview with the CEO of the Dow Chemical Company in the middle 90's. To Harward Business Review this CEO stated, that in the last ten years the company had not made a single investment in process safety, which had not contributed positively to the company buttom line.

Then it could go on to say, that if your company's OSHA incidence rate is half the industry average then that is improving your company buttom line by having improved uptime, and reduced cost of insurance, workers compensation, and properly other expenses. At all cost our new textbook should avoid comparing our fatal accident rate by that of motorcycling, coal mining, construction or rock climbing. Such comparisons are completely irrelevant for the safety performance of our industry or your company!

Unfortunately I don't have a finished manuscript. However, what subjects do you think a modern textbook on process safety with positive message should contain? And how should this be delivered to the students?

MPC moving up the control pyramides!

2011-05-07T20:51:00.000+02:00

Thursday I had the oppurtunity to attend a one-day conference on model based control here in Denmark at AutomationDESIGN. The conference was to honor Jim Rawling from Department of Chemical and Biological Engineering at University of Wisconsin, who on Friday received an honorary doctorate degree from the Technical University of Denmark (DTU). There has been close collaboraton between the Deparment of Chemical Engineering at DTU and the sister department at University of Wisconsin in Madison ever since John Villadsen went to Wisconsin to develop the ideas of orthogonal collocation with professor Warren Stewart in the 1960's. Today there is a formalized exchange of teachers between the two departments, and many Ph.D.-students from DTU spends some time in Wisconsin during the doctoral studies.

When I first heard about MPC I was working at Imperial Oils Sarnia Chemical Plant with an excellent group of control engineers. We develeped supervisory control applications for the many different units at the site: Gas Cracker, Polyethylene Plant, Higher Olefins Plant, Lube Oil Plant etc. to take advantage of online analyzers as much as possible. Most - but not all - of this was done on Honeywell Process Control Computers - mainly PMX, on black and white character based terminals. Only the operators had color screens, but these also only had character based graphics.Many of the applications used models. Very simple models. Often just first order with time delay models developed by fitting step responses manually. Nonetheless it was model based control.

MPC is an idea, which came from industry. During a strike by operators at Shell plants in USA engineers was put in charge of running the plants, an two of these engineers came up with the idea, that you could improve control by basing the control action not on a single measurement but on a series of past values of process inputs and outputs. They called the concept Dynamic Matrix Control (DMC), took out a US Patent on the idea and created a company to assist others in implementing it.

Since those early days in 1982 MPC has come a long way. There are many applications running in industry. Some small single loop controllers others control a whole battery of cracking reactors with a single MPC application or a destillation train for purifying ethylene for use in polymerization. As the number of applications grew, and the engineers who developed them moved on in their carriers the ugly question of maintenance appeared.

The title of Jim Rawling's keynote was “Optimizing Process Economic Performance with Model Based Control”. He started by describing predictive control in rather simple one-input one-output open loop problem, and explained that there are two sources of disturbances, which we can't know accurately: process noise and measurement noise – in the state estimation problem. Then he continued to explain optimal control and optimal feedback control. Feedback of course is important due to disturbances and uncertainties. Dynamic programming was applied to industrial systems that are mostly constrained and nonlinear, but practical usefulness was limited.

MPC, said Jim, is a large industrial success story with 800 to 1200 applications in ethylene alone with credits of 500 to 800 M$/year in 2007 (In my first job as a control engineer we also had to calculate on a monthly basis, what the applications had saved the company the previous month. However, few people believed in these numbers, especially not the control engineers. Later is was accepted, that the plant ran more smoothly with supervisory control, and credit calculations was a thing of the past at least at that site). Acccording to professor Rawling
Eastman Chemical has 55-60 applications and claims 30-50 M$/year due to increased troughput. Dow state they use MBC for the money. Praxair has 150 applications with increased profit of 16 M$/year.

Jim also discussed questions such as: Has the application base stopped growing? Is the theory complete? Do we have the tools to solve nonconvex optimization problems online? Do we have tools to decompose large-scale systems into manageable problems? Do we have tools to commission and maintain the controllers? Do we have tools to optimize dynamic economic operations?

Current treatment of economics in industrial practice is two layer structure: a steady state layer and a dynamic layer. Drawbacks are inconsistent models and re-identification of linear model as setpoint change. The time scale of separation may not hold, economics may be unavailable in the dynamic layer. Optimizing economics – what is really desirable?

Past practice is to define a steady-state economic problem, and define a plant profit function. Then find the economically optimal steady state solution, and use that as setpoints for the dynamic layer.
Maybe it would be better to give economic function to the MPC, and consider the questions: What closed loop behavior is desirable? Fast or slow tracking? Asymmetric tracking?
Initial work on this was done by DTU Ph.d.-students John Bagterp and Dennis Bonné in 2000 and 2002. The results were published in 2008. Since then a Lyaponov function discovered, and the technique demonstrated on a non-linear chemical reactor example with enforced convergence.

The keynote ended with a status of economic MPC, and a statement of opportunities and challenges, and a personal story about writting an MPC Research Monograph.

During the Q&A session the following topics were discussed: Current technology assume, that you can generate a candidate solution quickly from which the optimal may be found. This is not necessarily true for all non-convex problems.
The economic MPC needs displays, which the operator and manager can understand. Currently there is no systematic way of deciding when to implement an economic MPC solution or not.
Problems around commissioning and maintenance still remain for normal MPC, modular control structures are prefered due to startup and shutdown issues.

The conference continued with presentation from the three departments active in Model Based Control at DTU: DTU Informatics, DTU Electro and DTU Chemical Engineering. DTU Informatics was involved in among other things automatic feedback control insulin injection.

During the afternoon sessions different Danish companies talked about their involvement in Model Based Control. DONG Energy stated, that they used the technology mainly for analysis, but had jet to implement their first MPC loop. Siemens talked about cooling control of a rooling mill using MPC with just measurement at the start and end available. 2-Control talked about development of a MPC toolbox in C# and .NET (Note, it should be possible to run the toolbox under Linux using the Mono package from Novell, which a now also part of openSUSE).

Some of the issues which the presenters raised during the conference I have some difficulty seeing as issues. Several company presenters talked about lag of computing power for using MPC in realtime control applications. I find it rather strange, that computing power is an issue, when the French used MPC in the tracking control of their exocet missile in the late eighties.

I also have problems with the issues related to scalability. In an industrial setting the operator need to be in charge of deciding what the controller should do, i.e. which constraints should be active and also which process inputs may be manipulated. Hence a manipulated variable, which is suddenly switched to manual simply become a constraint to the MPC solver. Similarly a process output, which is suddenly not available due to either instrument calibration or analyzer maintenance, simply become an unknown disturbance to the MPC controller. In an industrial setting the MPC controller must cope with such structural changes - even if the theory behind implementing them may not be complete. What do you think?

Presentations from the conference will be made available at the AutomationDESIGN web-site within the next couple of weeks.

Is killing 11 employees good safety performance?

2011-04-03T10:18:00.000+02:00

This morning I heard on BBC World, that Transocean execs have received a bonus for good safety performance in 2010. My first thought was: This can't be true. So I googled 'transocean bonus', and payment of the bonus was confirmed by sources such as Business Insider, which qouted WSJ. According to WSJ the bonus was given for "best year in safety performance". Wait a minute. Transocean was the operator and owner of Deepwater Horizon the platform hired by BP, and which failed catastrofically in the Gulf of Mexico killing 11 workers on the drill deck.

So what is the Transocean board saying by giving a bonus to its execs for good safety performance in 2010? In my view they are saying, that a year in which 11 people are killed in company operations is a good year. They are also saying a year with equipment loses in excess of half a billion dollars is a good year. I am chocked, that a company these days can have business plans in which such performance is considered good. Did Transocean really plan on loosing 0.1% of their employees due to accidents in 2010?

I find the statements on the Transocean web-site about the Deepwater Horizon:
"The loss and impacts of the April 20 explosion on the Deepwater Horizon are felt throughout our entire Transocean family, and our thoughts and prayers remain with all who have been affected.

On May 25, Transocean honored the 11 missing crew members in a memorial service in Jackson, Mississippi, and we continue to support the families of those lost and those who survived."
a bit hollow.

The more serious question is who is paying for this? In the first places it is customers for Transocean, i.e. companies such as BP. However, these companies are just in business to discover oil and gas, recover it and sell it to consumers. So indirectly consumers pay at the gas pump or through the heating bill for the safety performance of companies like Transocean. I am beginning to think, that the earlier the consumers realize, that the cost of process accidents are passed on to them, the sooner we will improve process safety around the world.

It is not rocket science!

2011-04-02T16:11:00.000+02:00

Today at the anniversary of an accident, which killed 7 workers at the Tesoro refinery the Chemical Safety Board chairman has released a video safety message with the following recommendations to the US refining industry:

· Implement a robust mechanical integrity programs with an emphasis on thorough inspections of critical equipment
· Monitor process safety performance using appropriate leading and lagging indicators to measure process safety before major accidents occur
· Maintain an open and trusting safety culture where near-misses and loss of containment incidents are reported and investigated

To me this really is not rocket science. The first recommendation is simple good engineering practice for anyone operating and maintaining a refinery. I recall a remark from our guide during a visit by chemical engineering professors to the ExxonMobil refinery at Baton Rouge at the start of a SACHE Workshop "that the facility was maintained by engineers", i.e. integrity is more important than looks. It is indeed chocking how many times insufficient or improper maintenance has played a part in major negative events in the last decade, e.g. the 2005 explosion and fire at BP's Texas City Refiney, the later the same year the explosion and fire at Buncefield to mention just a couple of events.

The second recommendation is simply following the recommendations of many institutions to implement the recommendations of the Center for Chemical Process SAfety (CCPS) to measure safety performance. Even if you don't like the measures suggested by the CCPS, then you ought to develop your own indicators, as e.g. Bayer told the world about at last years 2010 Loss Prevention Symposium in Bruges, Belgium.

And the third recommendations is a necessity in order to have reliable results of the second recommendation. However, this is properly the most difficult recommendations for manager with an an engineering background to implement, especially if they have not been exposed to a good safety culture during their professional life. If you are new to safety culture, then join the discussion over at LinkedIn about creating a good safety culture. It is in the group for EHS Professionals.

Since it is not rocket science to implement the recommendations, which will prevent negative events such as that at the Tesoro refiney, I suggest that the business cost of these negative events creating serious equipment damage, killing workers and injuring many others must be too low compared with the cost of preventing them. What can we do about this?

zEnterprise - your next process control computer?

2011-03-29T13:29:00.000+02:00

Some may recall that during the nineteenseventies and eighties mainframe computers entered the control rooms of some Northamerican refineries. I recall a visit to Imperial Oils Strathcona Refinery located in Refinery Row while I was studying in the computer process control group at the University of Alberta. We were showed around in the plant and then control room beforea Q&A session, and we were quite amused that the control screens - green text on black background - showed temperatures with four digits after the decimal point. Those were the early days of virtualization on the mainframe. In those days mainframe computers were only available with one propriotary operating system and I seem to recall green characterbased terminal access. Of course this fitted well with the character based lineprinters available at the time.

However, since those days things have changed. I have seen process simulators requiring more than 15 of the most powerfull multicore x86 based personal computers to give a reasonable response to operator console inputs. If you wanted to run the same in simulation mode, then add another 15 computers plus the necessary cabling, routers, network cards etc. All potential points of failure. Properly the company with this simulator also had personal computers for other parts of the business, e.g. process control, maintenance, and of course their business processes. Thus is is not uncommon for a single site to have a significant number of x86 based servers at each plant location. These servers of course require cabling, power, maintenance, updates etc. Maintenance and updtates are potential outtages. What is the MTBF of a single x86 based server? Some say two months if only considering hardware. Then what is the MTBF of our networked system of more than 15 x86 servers?

Now consider the newest mainframe computer zEnterprise 196. A couple of days ago I had the opportunity to attend a siminar titled "Smarter Linux for Enterprise Systems" at IBM Denmark. At this event features of the zEnterprise were demonstrated in live demos and technical presentations plus of course a business presentation about why these boxes would benefit your organisation. The zEnterprise has a MTBF of 30 years (Measure by having 30 systems in one location for a year). The zEnterprise will run hundreds or thousands of instances of the latest linux from either RedHat (RedHat Linux Enterprise Server 6.0) or Novell (SUSE Linux Enterprise Server 11.0) - of course with graphical interface from your laptop or other personal computer. It also comes with mainframe level security - a mainframe is still to be hacked, and it has been around for more than 40 years!

A mainframe system comes with a significant starting cost, but consider: You can run your process control software on one linux instance right on the hardware, and chose to run others systems, such as your similator and maintences systems on top of the hardware virtualization.

I you want further segregation of systems, then you may add one or more blade center extensions, which may run either linux based blade centers or x86 based blade centers. So you could have one x86 based blade center running your current Windows based control software, with another x86 blade center as a hot standby. This is just like in the old Honeywell TDC 2000 control systems, where one box served at a hot standby for seven other boxes on the same control net.

Consider that you get all this without exensive cabling between the servers, and with dedicated high speed link between the zEnterprise 196 and each blade center extension. Even disaster recovery comes cheap. If you need another zEnterprise for disaster recovery, then you only pay a fraction of its list price to have it available at your site.

Beside cost savings due to reduced cabling, increased security in face treaths such as stuxnet, better disaster recovery and testing, there could also be licence cost savings especially if you use commercial x86 databases at your site.

A further benefit is, that all these systems can interface to the same storage system. This allow you to easily give engineers, business analyst and others access to historical process control data on your mainframe based business network.

So next time you are shopping for a process control computer, and a simulator, and a maintenance system, then take a look at the newest mainframe. You may like what you see, and to run it you just need people with linux skils.

NOTE: I have never worked for IBM or any other mainframe company. My only connection with IBM was a user of the IBM 1800 Process Control Computer in the Computer Control Group at the Department of Chemical Engineering at the University of Alberta in the late seventees.

Follow-up on an accident

2011-03-03T08:43:00.002+01:00

During a lunch break an employee left a shovel near a restaurant. Another employee picked up the vehicle and went for a ride. Along the ride this employee picked up to more employees. The ride ended with an accident just outside the site. In the accident all three employees were seriously injured.
Questions that come up are
1. Why did the employee pick-up the vehicle?
2. Why did the employee pick-up other employees for the ride?
3. Is the accident a recordable incident? Does it affect LTI?
4. Should the employees be disciplined? How?
5. Would the workers be eligible for workers compensation for their injuries?
6. Should the company investigate the incident? Or leave it to the police, since it happened on public property?
Generally people working with safety for a company has at least two responsibilities
To ensure that company employees has a safe workplace, and goes home each day as safe as they arrived for work.
To protect the company from lawsuits by ensuring, that the company has the required procedures in place to ensure the employees are capable of performing their duties at work.
These dual responsibilities can of course lead to conflicts.

Accident investigation
The first two questions are clearly part of the accident investigation.
One need to determine the first employees intent when picking up the vehicle, and also his/her reason for picking up the other two workers. Also statements from vitnesses seeing the vehicle on its route from the resturant parking to the place of the accident would be relevant to the investigation of the event. Notice, that this would normally fall outside a police investigation of the accident, since that would only involve immediate causes.
Also outside the police investigation lie questions about whether company procedures for using company assets were followed prior to the accident.

Statistical impact
The third question would clearly depend on the jurisdiction, although one would expect some similarities among Western European countries – especially the EU, or between provinces in Canada, or states in USA. Although appearantly within Australia there are difference among the different states. Many would immediately look for a definition of reportable events in applicable legislation, but many times this is not sufficient. Some will look for definition in standards such as OHSAS 18001.

When working in Sarnia in southern Ontario in Canada many years ago I and a colleague had a vihicle at our disposal for transportation between the site main office and the plant. Since the main office was not located conveniently for public transport we often used this vehicle as part of our transport to and from work. During the night the vehicle was parked on company parking lot which was located conveniently for public transport. Was this use authorized by our manager? Definitely not! We also often used the vehicle to drive to a nearby donut store during lunch. Was this use authorized? Definitely not! Did we ever consider what would happen if we had an accident during these uses of the vehicle? No, it never entered our radar screen. Many other employees used company trucks to drive to the same donut store during lunch time, so at least that was at the time considered acceptable.

Some argue, that the incident is not recordable because it is not site related. However, a few years ago the annual report of Shell UK feature a report of two fatalities – both to subcontractors hired by logistics part of the company, and both occuring far from the site.
At the time I was working at a plant in Sarnia a down stream plant had an unfortunate release of perchloroethylene – a dry cleaning solvent in August 1985. The material quickly settled on the bottom of the St.Clair River, the release was immediately reported to relevant authorities. Somehow Greenpeace got word of the release, and in stead of the companys information about the release and the dangers of the substance released media across Ontario picked up Greenpeace's version of the story about the release. Despite company and authority efforts to analyse the content of the blob and release this information to the media even 20 years later it is Greenpeae's version which the media cites (see e.g. “Canadian petrochemical plants blamed for gender imbalance” by Paul Webster in The Lancet, Volume 367, Issue 9509, Pages 462-463, 11 February 2006, and available on the web-site www.lancet.com ). This shows the importance of not just doing what is legally correct, but that you must also be seen to do the correct thing in the eyes of the public, i.e. the media.

Some even ague, that the recordability of the events depends on whether the employees where payed during their lunch break or not.

The bottom line is, that it is up to the company to define what should be reported and how it should be reported when company employees and/or company assets are involved in an accident. In companies operation multiple site in different jurisdiction company procedures and standards w.r.t. reporting accidents become more relevant, since differences in the legal requirements may make company reporting, e.g. in annual reports to shareholders more difficult.

Penalty impact
Some argue, that the employees involved in accident should be penalized, but that firing them is properly going too far. I am not sure that a penalty will have any positive effect. However, a prudent company would at least record the event on the employee file.

I was once told about a colleague of mine, who had difficulty leaving the liquor bottle alone, and often showed up for work under the influence of alcohol. This employee had been on several courses to get rid of the drinking habit, but it did not seem to help. Finally his supervisor told him, that if showed up for work one more time under influence of alcohol he would be immediately fired. He stopped drinking from that day. Unfortunately he started drinking again right after going on retirement, and within relatively short time managed to drink too much. In his case the treat of a penalty worked as long as the incentive to keep his job was there. After the incentive disappeared the old habits quickly came back.

Compensation impact
The fifth question also would clearly depend on the jurisdiction.
Some argue, that the workers are not eligible for compensation, since they were not performing a work activity. However, at least the first employee could argue, that he/she was just bringing the vehicle back to the site when the unfortunate accident happened, and he should have workers compensation because he/she was bringing an abandoned vehicle back to the company site. The other employees could argue, that they were just attempting to get back to the site faster.
Other correctly points out, that the question about compensation could involve determining whether or not the employees where payed during their lunch break.

Clearly the company is responsible for company assets and the proper use of these assets. If the company has neglected this responsibility by not having appropriate procedures in place to ensure adequate training, then the company would be at risk in some jurisdiction, e.g. in Denmark, of being judged as having failed to take every precaution for the safety of the worker, as the legal language in some jurisdiction define the responsiblity of the employer to provide a safe workplace.

Learning impact
The sixth question would depend on the safety culture at the company.
A company with a well developed safety culture would properly investigate the incident to learn as much from it as possible, so similar event could be prevented in the future. But the event is definitely an opportunity for learning.

If the company has procedures in place for training employees or otherways ensuring employees are training to properly handle company vehicles, which they need to use during their work, then it becomes much easier when an accident happened to decide what to do as a follow up on the event. The lag of such procedures could lead to an implied policy, i.e. in my use of a company car during part of transportation to / from work.

Conclusion
So what can one conclude from the above? One conclusion is, that any accident involving employees and / or company assets should be investigated. Simply because there is an opportunity to learn, and prevent similar events in the future.

My former employer in Sarnia, Ontario actually kept track of injuries sustained by employees in their spare time, that prevented them from comming to work the next day. Based on that information departmental safety meetings were arranged to to cover topics such as proper warm-up prior to exercises such as squash or handball games.

The thoroughness of the investigation should depend on the learning opportunity for the organisation as a whole. Someone need to make that call, and I think it should be the local safety manager.

What do you think about off-site accidents such as this one? Would you take the opportunity to learn, or would you rule it out as not relevant for your business?

Alarm Design Ideas

2011-01-23T20:21:00.000+01:00

In the litterature you find many articles about alarm management. One of the latest is by Nicholas Sands and Donald Dunn in November / December issue of Intech, which you can read online at the Intech web-site. Sands and Dunn headed the effort to get the ISA Alarm Management standard together. But how did we end in a situation were we need a standard for alarm management in the first place?

When I started work as a control engineer a generation ago one of the first lessons I learned was, that you don't implement an alarm to the operator console unless you also come up with guidance to the operator on what to do when that alarm comes in. I also recall, that noisy Decwriters used to print logs of alarms and other console events did not work overtime, except when a compressor or other major piece of equipment had problems. I guess I was lucky to join start at a time, when the efforts that required to implement alarms in the days before computer control had not been forgotten. It appears, that in the decades which followed control engineers discovered how easy it was to implement alarms in modern distributed control systems (DCS), and simply went to far - probably pushed along by equipment suppliers requesting equipment alarms.

Usually when people talk about alarm design, they talk about whether the alarm should just go to the DCS or it should also be displayed on the hardwired annonciator panel. That is the engineering is concentrated on how to display the process situation to the person, who is going to act on it.

However, it appears to me, that the fundamental question of alarm design, i.e. what to be alarmed about and when to be alarmed have not been addressed from an engineering perspective just like the design of other elements of the automation system such as the control loops. The available guides on alarm managements, such as the EEMUA Guide no. 191, seem to focus on the issues after you got to many alarms, and not how you got there.

It is generally recognized that alarms are used to signal to someone, that something is happening in the process, which requires an intervention beyond the capability of the automatic control system, and if you do nothing, then the automatic shutdown system will take over. This means that the ability of the process to do what is has been designed to do by the process engineers are threatened. It cannot reach the goal the designers had in mind. In other words alarms are used to indicate, that a goal cannot be reached.

On the opposite if the goal of the process can be reached then, we don't need to be alarmed. What the is the goal of the process then? Well, that depends on its current state. If the process has been down for maintenance with opening of vessels etc. then it first need to be enabled, i.e. put together again. The goal is to start up the process. Beside enablement, this also involve ensuring the process is ready for start-up, i.e. has been established by connecting the control system and putting valves, pumps etc. in proper state for startup.

If the process is producing, then the goal could be to maintain production, or to change to a different production rate, or to transition to producing a different product. The important thing to note, is that when the goal of the system changes, then what is normal and abnormal also changes, and hence the required alarms changes.

So a process is in the normal state, when it satisfying the goal it was built to accomplish, e.g producing a given amount of product of a given quality with a given time using the avaiable equipment and other resources. When this is the case, then the material and energy balances around the system are also satisfied. This means, that abnormal situations can be related back to significant deviations in material and energy balances for the plant, process unit or piece of equipment. The litterature abound with examples of disasters due to problems with these two fundamental balances, e.g. BP Texas City Refinery explosion and fire in March 2005.

So one approach to alarm design is to look for indicators of problems with material and energy balances at the equipment, process unit and plant level. Of course a necessary condition for no problems at the unit level is, the equipment balances within the unit are normal. Similarly at the plant level. A different way of stating this is, that when the goal of a process unit is satisfied, then the sub-goals of the process unit, e.g. the goals of the different pieces of equipment within the unit are satisfied. Hence the plant goal in a tree like structure may be related to the process units goals which are again related to the equipment goals.

Modelling such goal structures can be done using functional modelling. Currently work is ongoing at DTU on exactly the problem: What to be alarmed about? When to be alarmed?

Can Smart Grids ever by safe and reliable? Or will they resemble the stock markets?

2010-11-16T14:57:00.000+01:00

Today I attended a half day event at the Technical University of Denmark called “PowerEvent”. It featured several European speakers working on issues related to the future electricity production and distribution grid, which by many is called the “Smart Grid”. Google the term, and you will find it is widely used, although it seamingly remains to be established what is ment with smart.

The first presenter was professor Jacob Østergaard from DTU Elektro, who described a simulator used at DTU PowerLab to simulate the continuous pricing structure needed to integrate renewable energy producers into the electricitet distribution grid. This simulator will also be part of the EU demonstration project on the Danish island of Bornholm. The second presenter was professor Stephen McArthur from University of Strathclyde in Scotland, who talked about the use of agents performing different tasks in electricitet production and distribution. There were different types of agents using known technology, e.g. constraint programming, to solve real problems in the high voltage distribution network. The third presenter was professor Zita Vale, from Polytechnic Institute of Porto, who talked about multiagent approach to electricity market siulation considering virtual power players (MASCEM).

It appears to me that a common underlying assumption about the smart grid, is that the players - also called agents - work for the good of the system. We know from the stock market, that traders not always work for the good of the market. When the fine balance between reasonalbe and unreasonable behavior in the stock market is disturbed we get stock market crashes, from which recovery often is long and slow. The agents of the smart grid can be viewed as the traders in the stock market. However, with one major difference. In the smart grid one company may control several agents, i.e. several electricity producers - even located in different countries. This would allow the company to manipulate the market in the short term, by removing production from the grid, in order to raise prices, so their remaining production units become more profitable. From the stock market we know, that such behavior can make the whole market unstable, and from time to time indeed do. With smart grids using the ideas of independent agents – although several may be controlled by a single market player, i.e. company – a system is created that has surprising similarities to the stock market. Hence the likelyhood of power market crashes similar to stock market crashes will properly not be that rare. We know, that recovery from stock market crashes are slow, but what do we know about power market crashes? Or for that matter power market safety? i.e. stability? or reliability?

Ultimately the end user – consumer - is interested in just one things: a safe supply of electricity. For most users this would mean a highly availabilty quality supply. For electricity availability can be measured by supplied voltage (i.e. if supply fails voltages drops to zero), and quality can be measured by supplied frequency.

Can a system based on game theory with independent agents with possibly conflicting objectives be designed to provide a safe supply of a ressource extremely important for modern society? Or can games be safe?

A new definition of RISK

2010-10-22T11:01:00.000+02:00

Yesterday I received the September/October issue of Intech by snail mail. It contains an article about safety and security, which I think every control engineer should read. The title is "Balancing security and safety with risk", and you can find it online at the ISA website. Of course the article is partly triggered by the Stuxnet virus, which got quite a bit of attention this past summer, but the article also considers the more fundamental problem of the need for control engineers and IT professionals to cooperate at the plant level.

The article contain the following definition of risk:

risk = threat x vulnerability x target attractiveness x consequence

To this date when teaching chemical engineering students and others risk assessment of chemical processes I usually define risk as:

risk = probability of event x consequence

So the question of course is: Is probability of event equal to threat x vulnerability x target attactiveness? I am not sure.
Target attractiveness clearly depends on the attracker and the purpose of this person or organisation. In case of the Stuxnet virus the creaters clearly found Siemens control systems attractive, but not control systems from Yogogawa, Honeywell or others. It clearly relates to external threats, such as terrorist attacks or cyber attacks, and not operational dangers of explosions, fires or toxic releases.

Vulnerability depends on the protective layers of the facility. However, the protective layers which prevents an explosion, a fire or a toxic release from occuring, are not the same as those which prevents a terrorist attack or a cyber attack. Although the process safety related protective layers may reduce the target attractiveness and also the consequences of a terrorist or cyber attack. While safety interlocks, emergency relief valves, emergency shutoff valves, emergency shutdown systems etc. prevent and/or mitigate explosions, fires or toxic releases, you need fire walls, antivirus software etc. to prevent cyber attacks and you need physical site barriers, such as fences etc. to prevent terrorist attacks.

So even though both the control engineer and the IT professional may talk about protective layers the nature of these layers are quite different. The IT professionals protective layers aim to prevent an attacker from reaching a target. The control engineers protective layers prevents the process from operating outside the safe envelope. The IT professionals protective layers protect against an unknown attacker. The control engineers protective layers protect against a known process becoming unsafe.

Finally threat depends also on whether you look at the situation from the view of the IT-professional or the control engineer. To the control engineer the threat or danger of the process becoming unsafe are things like: run away reaction, loss of cooling, etc. To the IT professional the threat is anyone attempting to get unauthorized access to the system - or physically to the site. Again while the words are very similar the focus is quite different. Control engineers and IT professionals should keep this in mind while they need to cooperate about securing the process control system - and hence the plant site from undesired events.

Executive orders - the new way towards safer workplaces?

2010-10-20T17:35:00.000+02:00

Some times working in the process safety area can be really frustrating. Accidents seems to continue to happen - also the ones, which we should have learned from - and regulations seem rather slow to change. Today, however an e-mail from the CSB, hinted at a new an quicker way towards safer workplaces: the executive order.

Following its investigation of the fatal accident at Kleen Energy in Middletown, CT, the CSB called the practice of cleaning natural gas piping in power plant by blowing natural gas through them an inherently unsafe practice. The CSB issued urgent recommendations to OSHA, NFPA and ASME to prohibit and/or change the practice of natual gas blows. As with many other good recommendations from the CSB, we are still waiting to hear from OSHA and NFPA on this recommendation to create safer workplaces.

Governor M. Jodi Rell of the State of Connecticut, where the fatal accident occured appearantly did not want to wait any longer. So the governor has issued an executive order banning the use of natural gas blows during power plant construction in the State of Connecticut. For this the governor should be highly applauded! He took action to prevent any further loss of life in his state from an inherently unsafe practive.

Of-course the CSB would like other state governors to take actions similar to that of the State of Connecticut. I however, find it very disturbing that such executive action is necessary and it certaintly don't make it any easier to find out what you can and cannot do when constructing or operating process plants.

There seem to be little connection between the event at Kleen Energy earlier this year, and the spill of toxic red sludge from an aluminia plant in Hungary earlier this month. That is only on the surface. Both are examples of inherently unsafe practives. The procedure of the Hungarian plant to keep on producing a waste product and just storing it on site is an inherently unsafe operational practice. Likewise the idea of blowing natural gas through buildings during plant construction is an inherently unsafe construction practice.

It is many years since Trevor Kletz published his book outlining the ideas of inherently safer plants. At the same the idea of sustainability in construction as well as production appears everywhere. Companies as well as many internatonal and national association produce statement on sustainability. Universities at the same time create courses on the topic. But can we see the results? Are we creating and operating plant in more sustainble fashion? Or are we as an industry just waiting for the next round of regulations from our governments?

Just like it makes sence for industry to look at internal energy consumption, it also makes sence for companies to look at inherently safer production. So why is it not happening?

What has freedom of choice in computer operating system to do with process safety?

2010-09-09T20:34:00.000+02:00

Today I attended a one day conference in Copenhagen on the open source office productivity suite OpenOffice.org, which is actually owned by Oracle after their acquisition of Sun Microsystem last year. The conference was organized by the Danish Open Source Suppliers Organisation at the Museum of the Carlsberg Brewery in Copenhagen. This museum is normally not open to the public, so your only change to visit is by attending an event there.

The conference started by well published story about how Münich converts 15.000 PC to OpenOffice.org. Not much new here except for their Java based formular extension Wollmux to OpenOffice.org. The step by step approach used by the people in Munich have been described in a whitepaper published by Sun Microsystems a few years ago. Later in the day Oracle gave a presentation partly based on this paper.

Novell's Flemming Stensgaard gave a presentation titled "OpenOffice - and what is then the next steps?" in which he argued, that reading EULA's could pay off well by avoiding CAL payments by switching to open source solutions. His basic theme was, that when you have a domination market share, then you can only grow by finding new revenue sources.

The OpenOffice.org community has just celebrated their 10th anniversary in Budapest during their annual conference attended by about 65 persons. The community have noticed a major difference from the very open approach used by Sun Microsystems to the more closed approach used by Oracle. This was also evident from the days two presentations from Oracle. There appear to be a very tight lid on any news prior to Oracle World in a couple of weeks.

Well, the above is just introductory remarks to my main point: user choice! The final presentation of the day was by IBM Danmark, the main sponsor of the event. They explained how their employees could choose between a Windows PC, a Linux PC or a Mac. They even had the option to bring their own PC to work. And yes, there is a significant number of IBM employees, who do their computer work using an IPad. Freedom of choice drives innovation! - at least at IBM.

Could we make the same happen in process safety? When I worked in the process industry the company I worked for allowed any type of process control system - as long as it was made by Honeywell. We had system engineers which made wonderful things happen with the old PMX I system (no GUI, just a character based CRT).

In process safety we attempt to make every do thing exactly the same way. We perform a job analysis to ensure the job is done according to the written procedure every step of the way. We have done this for years. Has it improved our overall safety performance? I don't think so. But it has properly kept one or two intelligent technicians from suggesting procedure improvements. In other words we have blown away new ideas before they could lit our thinking. Does this make sence?

What do you think? If you have time take a look at connections - social software for a company.

Is CSB on the right track?

2010-07-29T15:40:00.003+02:00

On July 21st the CSB annonced the publication of report on 2009 Explosion at Veolia ES Technicla Solutions, L.L.C. Hazardous Waste Facility. Your can find details under Instigations on the web-page Veolia Environmental Services Flammable Vapor Explosion and Fire including a pdf-file of the report, which the CSB calls a case study.

The facts of the incident on the surface appears rather simple: A flammeable substance was accidentally released to the environment and the vapours found a nearby ignition source resulting in several explosions and a fire plus injuries to a number of workers and damage to nearby residences and businesses. On the surface this sound very much like what happened on March 23rd 2005 at the BP Texas City Refinery. Only difference appear to be that at West Carrollton in Ohio no one was killed, and damage was significantly less than at Texas City.

So what did CSB find? They found that the vent devices (I assume they mean on the feed and product tanks) were not designed to contain or control hazardous and/or toxic vapor. They also found that the ignition source was most likely some gas-fired boilers in an electrically not classified building less than 10 meters south of the process area. Finally the found, that no record of a process hazard analysis (PHA) of building siting was found.

And what does CSB recommend? They recommend that non-essential personal don't have offices in buildings close to process areas, and that a closed relief system be installed at the facility, and a PHA of the facility is conducted. I have absolutely no problem with these recommendations, although I would have put the PHA first, the relief system second, and the occupancy third. Why? I used to work a the operations room at Imperials Oils Sarnia Polyethylene Plant. This one-story building was not much more than 10 meters from the process area and about 30 meters (on the other side) from a benzene extraction unit. I newer felt unsafe in that building. The doors were 20 cm thick steel doors, and the surroundings were landscaped to help a pressure wave pass over this concrete building containing both control room, unit laboratory, offices for engineers and others associated with the unit including secretarial staff. The building was designed for the occupants to survive the worst possible event, e.g explosion of the benzene extraction unit. So buildings can be designed to be safe for the occupants! This is nice if your relief design for some reason fails, as it did at the BP Refiney in Texas City in 2005, or is insufficient, as it was at the Veolia site.

However the CSB does not stop with these 3 recommendations. They also recommend revisions to NFPA 30, revised control room siting guidelines, development of occupancy standards specific to hazardous waste treatment facilities, and development of standardized guidance for hazardous waste processing facilities. The last two recommendation are aimed at Environmental Technology Council, which here in the middle of 2010 have not reacted on two recommendations following a 2006 fire at another hazardous waste facility. All in all this explosion and fire resulted in 7 recommendations from the CSB to 4 different organisations. I wonder what the change is of this leading to safer processes?

Were is the teeth in this? What is going to make all the other operators of hazardous waste processing facilities stop up, do their facility PHA and act on it? Because I do assume, that there are other waste processing facilities without a site PHA. I am also concerned, because in my own country, Denmark, I see tank farms as closely spaced at the ones at Veolia, but with neighboring tanks having different owners.

As an added bonus I learned from reading this case study, that the National Fire Protection Association is an international non-profit organisation. This was confirmed by going to the NFPA web-site and selecting the "About NFPA" bottom. Recently another American organisation went international. ISA formerly known as "Instrument Society of America" after much discussion became "International Society of Automation". I wonder if the NFPA will become the IFPA, and develop standards following ISO instead of ANSI?

Why can safety systems be switched off?

2010-07-12T17:13:00.002+02:00

On May 5th, 2010 Jim Montague's editorial column at ControlGlobal.com ended with a call for safety rules and laws with teeth, and calling the present US enforcement a joke.

On the way to that call Jim stated that "safety measures and guards are still shut off, disabled and circumvented all the time" to meet demands "from all us consumers", and that is "why refineries, chemical plants and coal mines keep blowing up".

This statement made me think: Why is it that we engieers and managers continue to ask people to use machines, which can be run without guards in place? To create a safe workplace we should properly stop doing that right now! I hear argument against this: The machines has the safety features required by law, and it would be costly to retrofit them, so they cannot run without the safe guards. Yes, it will cost money to modify the old machines, and these cost are all carried by the company using the machine. Unfortunately, that is not the case with the cost associated with injuries because the safe guard was not in place while the machine was running. The cost of such injuries are shared among the company, the worker and society.

Why is safe to run a process facility without a safety valve while it is being checked in the workshop? There has for more than 10 years been available dual head safety valve, which allows online switching between two parallel safety valves, so one can be taken to the workshop for testing and calibration of set point etc. Now the safety valve is just one example. One could ask the same question about any safety system, such as an interlock or an emergency shut down system. Such system are added to the process to provide protection against specific undesired events. Then why do we allow them to be designed to be switched off while the events they are to protect against can still occur?

I think it about time we take process operations integrity one step further, and ask engineers to design process facilities with integrated safety, that cannot be disabled while the events they are protecting against can occur. Such an approach would properly require a few extra planned shut downs. However, the price of those would be small compared to the unplanned shut downs of events such as the explosion and fire on the Deepwater Horizon, which occured on the day Jim wrote his editorial column. The cost of that accident is already above 3 billion £, and the value of BP shares has been halfed.

What process safety goals makes sense?

2010-07-05T18:19:00.002+02:00

In the past week there has been a dynamic exchange of views on what the goal of process safety and occupational safety should be in two different groups on LinkedIn: EHS Professionals and People, Safety and Culture.

I all started by Rob Stewart stating "Zero injuries goal - leading edge safety or root cause of catastrophe?", and asking whether this goal is a realistic goal. Since I believe the purpose of process safety is to prevent accidents and the purpose of occupational safety is to prevent injuries, I see zero accidents and injuries as the only goal, which makes sense from a business perspective.

Why is this the case? Any accident with anything more than negligible consequences lead to an investigation. An investigation take time and cost money. That time is taken away from other task, such as optimizing plant performance or training co-workers. The cost take away from company profits, and hence is definitely not in the interest of shareholders. The same holds for injuries, although depending on the type of injuries the cost of investigation could be less.

If you set a non-zero goal for either injuries or process safety accidents, then you could be unlucky enough to achieve the goal you set. Usually achieving a goal is celebrated. However, how proud would you by celebrating the achievement of a goal of 0.2 fatalites/year and/or 5 reportable injuries per year? I don't believe any manager would feel good about celebrating a fatality. Setting a non-zero goal and achieving it really just mean, that you made a lucky prediction.

Now, if you are currently experiencing X reportable injuries per year and Y fatalities per year, would be realistic to achieve zero the following year? I don't thing so. Getting into the heads of the CEO and every other employee that the aim is zero injuries and zero accidents, is a major safety culture change in most companies. So why the aim should be zero you should be realistic about how to achieve this over time.

This is very similar to how countries budget for wars. No politician is going to stand up, and say the goal for the next year is Z dead soldiers. The goal naturally is to win the war, and have everyone return home safely. Nonetheless the people in the budget office have to set aside money for cost associated with soldiers dying at war.

I have always admired the attitude towards safety at Dupont. When I worked in the petrochemical industry in Sarnia's Chemical Valley in the mid eighties, the most talked about effort in most of the companies was quality. This was partly started by Ford's "Quality is No.1" campaign. So most plant managers in the valley those years talked first about quality, and then about other issues facing their company. At Dupont is was different. The local Dupont manager - as usual - first talked about safety, and then about other issues.

So if you want to set business related aims for process safety accidents and occupational safety injuries, then you need to keep your eye on the ball, no matter what changes is happening in the world around you. Let's do it!

Do I want my drugs to be delievered using nanoparticles?

2010-06-15T22:19:00.002+02:00

As you may be aware of there is increased focus on the safety of nanoparticles. Googling 'nanoparticles, safety' will get you get more than ½ million hits. Add the term 'FDA' and this is reduced to just under under 200.000 hits. This and the fact, that my son, who is a Ph.d.-student at DTU-Nano this past weekend told me, that appearantly nanoparticles ones the enter the body don't get out again, is why today I have been attending a one-day seminar on “Polymers in Drug Delivery” arranged at IDA by the Danish Society for Polymer Technology.

The seminar opened with a state-of-the-art presentation by Jean-Francois Lutz of the Fraunhofer Institute for Applied Polymer Research in Germany. He first outlined the avenues of drug delivery: oral, intravenous, transdermal, regulated pumps, aerosols or suppositories. He started by stating, that the first polymer used for drug delivery was discovered in 1929 and during the following 80 years this has resulted in more than 20.000 publications by only 5-6 products on the market. I am talking about PEG or polyethyleneglycol, which is uncharged, water soluble and also soluble in many organic solvents. There are 4 types of ways of using polymers in drug delivery: Prodrugs – polymer drug conjugates of which paclitaxel is a samle product, micelles – no products yet, but a japanese researcher have 10 in clinical trials, capsules – microobjects eg encapsuable ipoprofen crystals, and hybrid nano particles – examples are gold nanoparticles surrounded by citrate. A new area is viral gene carriers – again with no products.

Next Kenneth Howard from iNANO at Århus University toke the stage. He described delivery of gene silencing therapeutics including results of tests on animals using chitosan and siRNA, which self assemble into nanoparticles for treatment of radiation induced flammation (RIF) and rheumatism. There is no know treatment for RIF, and rheumatism often affect women in their early 40's with – as far as I know – just pain relief as a possibility.

Then Michael Stolzenburg was supposed to talk about PLA-PEO vesicles for drug delivery. Shortly after starting his presentation he felt sick and left the room. Quite some time elapsed before the meeting chairman left to see how Michael was doing. However, the audience was not informed about his condition. I guess the message from this seminar management was “the show must go on”, since a colleaque of Michael completed the presentation, at the end of which the chairman remarked 'it is very nice to have a back-up'. I was very happy to chat with Michael during the afternoon coffee break, but a bit asammed, that I did not take action.

During the day I also learned about smart hydrogels for drug delivery, and medical chewing gum (you properly know the once smokers use to stop smoking?). Finally I learned about spray dried siRNA loaded PLGA nanoparticles and supercritical carbondioxde for making silocone based medical devices. Really a very good learning experience about something I did not know much about, and which could possibly affect us all.

Now to the question of the day: Would I take drugs using nanoparticles? Before I give the answer you have to understand, that nanoparticles ones they enter your body does not seem to leave it again. So one shold not overlook the fact, that nanoparticles could accomulate in my body, and that we really have no knowledge of the long term effects. Yes, I properly would take such drugs. If I had RIF and was offered one of the describe drugs I would consider the risk of the drug lower than the risk of untreated RIF. I have taken such decisions before in my life. Some years ago I toke arenesp to stimulate my bone marrow. Unfortunately I was a slow responder, so before my system responded I was taking rather larges doses of arenesp. Unknown at the time was, that large dosis of arenesp increases your risk of blood clouths. Eventually, I got a blooth clouth in my left leg and also in both lungs. I was lucky, and survived. Using modern medicine will always be a tradeoff between the benefits of the drug and its known or unknown side effects. At the time I started taking arenesp the side effect, which hit me was not known.

Process safety is much like deciding whether to take a new drug or not. A differnet chemical route may avoid a very toxic intermediate, but could involve more severe process conditions. Trade offs cannot be avoided.

Loss Prevention 2010 Continues in high Gear!

2010-06-08T23:57:00.000+02:00

The second day of the triannual process safety conference in Bruges started with two plenary presentation. The first titled "Challenges and needs for process safety in the new mellennium" was given by Sam Mannan from Mary Kay O'Connor Process Safety Center at Texas A&M University in USA. He introduced the terms NIMBY - Not In My BackYard and BANANA - Build Absolutely Nothing Anywhere Near Anyone, and immediately rejected both ideas. In stead he argued for continued learning and improved communications. In passing he incorrectly stated, that several layers of protection failed at Bhopal in 1984, which is only true if incorrect management decisions can be considered a failure of a protection layer. He also argued for increased research in process safety and development of technology for deep water drilling. I am not sure that is the correct medicine. If one reviews the major negative events in the process industry over the last quarter century, Then a surprising large number them are caused by some failure of management. This was the case in Bhopal in 1984, when management without proper review removed and/or in other ways disabled 3 systems, which could have mitigated the catastrofic release of MIC. No failure of technology was involved in that watershed event!

The second plenary was by Vincent Tam from Centre for Fire and Explosion Studies at Kingston University in London. His presentation "The Buncefield Accident: Why is the Explosion so Severe?" attempted to give a scientific explanation for the severe explosion damage observed on buildings and cars around the Buncefield Oil Depot after the explosion and fire in December 2005. Both this mornings speakers pointed out, that Buncefield was not a one of a kind event, but had happened before, and also since. This points to the disturbing fact, that learning from accidents are not really taking place unless goverments institute additional regulations.

After the plenaries I chaired another session about human factors and safety management systems. Today with a clear focus on the former. The first presentation by Ronny Lardner from the Keil Centre in Edinburgh described how they had reduced errors in electrical isolation work on one of BP's platforms in the North Sea by looking closely at performance shapping factors, such as no independent review, unnecessary interruption of critical tasks, and workload. They destinguished between intensional and unintensional errors.By removed interruptions during execution of critical task the number of unintensional errrors on the platform was reduced by almost 2/3.
The second presentation titled "Procedural Controls for Major Incident Hazards" and given by Paul Delanoy, who is a chemist and chemical engineer with The Dow Chemical Company at King's Lynn in the UK. This work focused on task decomposition - an idea central to the work on MFM by Morten Lind at DTU-Elektro.
I think these two papers are some of the best I have heard at this years Loss Prevention symposium, and I hope these results will be published to benefit a larger audience.

The mornings third presentation was by Xavier Cricl from Fire Protection Consultants in Antwerpen. It was titled "Unified Emergency Management in the Port of Antwerp", and described a web-based system for communication between different actors at different levels during an emergency. I believe, that such systems take too much for granted. What means of communication do the stakeholders have in an actual emergency, which could include a complete power outtage in the city of Antwerpen? I also did not feel comfortable about their attention to ensuring the availability of communications lines in case of an emergency by daily testing, as is done by CVECO in Sarnia, Canada. I also wonder about where their emergency centers were, and if they had a mobile emergency operations center, as in Sarnia.

Af lunch I gave a short presentation titled "25+ years after Bhopal - Have we learned the lessons? Properly NOT!", The point of the presentation was that governments continue ot create new regulations for the industry, because the industry does proactively do that on its own either through organisations such as Responsible Care or CEFIC or ACC, There was standing room only in the auditorium for this presentation.

Later in the afternoon the Chemical Safety Boards was awarded the EPSC Process Safety Award for their excellent series of free videos produced sinde the BP Texas City explosion. After this the EPSC showed the 7½ minutes management video developed in collaboration with the WP Loss Prevention based on a suggestion from Peter Schmelzer from Bayer 4 years ago.

Many conference attendees finished the day by enjoying a mediaval dinner at a former church in the center of Bruges. The show was impressive and the food was extremely tasteful.

The symposium finish with a half day of presentations tomorrow.

Loss Prevention 2010 off to a Good Start!

2010-06-07T19:57:00.004+02:00

This morning the Loss Prevention 2010 international symposium in Bruges, Belgium opened with a keynote address by J.M. Jaubert from Total titled “Safety Expectations versus Field Achievements: Bridging the Gab”. The background was that Total in 2009 after several good years experienced 4 fatality events. The company board in august of 2009 started a detailed review of process safety, which resulted in many recommendation: 15% of recommendations related to process technology, 40% related to human factors, and 45% related to organizational issues. Total for several years have had a safety culture program. I guess they forgot to audit the quality of the program.

After the presentation the Danish safety expert J.R. Taylor asked if part of the problem was management via a large amount of e-mails. To this question Jaubert responded, that part of the problem was lack of regular visits by management to the plant due to pressures with responding to e-mails and creating presentations. I recall having a manager of the Esso Chemical Canada site at Sarnia, Canada, who spent two mornings a week talking to people in the control rooms and the maintenance shows just to keep in touch. Eddy de Rademaker, the chairman of the symposium organizing committee, beat that by stating that in his first job many years ago he had a manager, who each morning toured his plant before he went to his office. Along the same line a Danish refinery a few years ago found, that contractor performance increased in both safety and quality of work, when they assigned employees to keep contact with them on a daily basis.
A representative from the Health and Safety Executive in the UK raised the issued of the impact of available skills as the result of downsizing and outsourcing activities. I did not hear a direct answer to that question.

The triannual 2½ day Loss Prevention symposium is arranged by the EFCE Working Party on Loss Prevention and Safety Promotion. Previous symposia were in Edinburgh (2007) and Praha (2004), and the next one will be in Firenze (2013). The members of the Working Party, who have been appointed by their national engineering organizations, constitute the technical program committee for the symposium. The current chairman of the Working Party is George Suter from Switzerland, and after this symposium Eddy de Rademaker from Belgium will take over as chairman.

After the morning coffee break I chaired a session on Human Factors and Safety Management Systems at which 4 contributions was presented. The first work “Experiences in Assessment of Safety Management System” was presented by Fabrizio Gambetti from ENI in Italy. Fabrizio graduated from Polytechnic of Milano with an aeronautical engineering degree, and is thus another example, that the initial degree may have nothing to do with your current employtment. He is currently safety manager supporting development of the safety management system for Eni owned and operated refineries. In his presentation he touched upon the different views of operators and management on process safety, issues relating to HSE and contractors, and the need for KPI's. Unfortunately questions from members of the audience kept me from asking if his company would be willing to share values of KPI's for the company as a whole or from individual refineries, as part of their communication with neighbours according to Responsible Care.

The second work was “Process Safety Metrics, Diagnosis and Control – Aspects of a Holistic Approach” presented by Bert Knegtering and co-authered by Professor Emeritus Hans J. Pasman currently working at Texas A&M University. Bert in his presentation touched upon the complexity of organizations, occupational safety – as in Shell's Hearts & Minds program – and process safety, and how different layers of protection may shift with time. I need to re-read his paper – and possibly his thesis – in order to understand the implications of this work.

The third presenter was Steve Tanzi, a chemical engineer with PricewaterhouseCoopers, who has worked with Mike Broadribb from B.P. America on a presentation titled “One Company's Experience with Process Safety Metrics”, which of course is linked to the recommendations of the Baker Committee after the Texas City explosion on March 23rd, 2005. The audiences questions the number of indicators proposed – more then 50, and I asked about who had responsibility for acting on an indicator. Steve explained, that in connection with each measure a person responsible for the quality of the measure was apointed, and another person responsible for acting on the indicator, plus to other with other responsibilities relating to the measure. I still tend to agree with Peter Schmelzer of Bayer, that the number of indicators should be drastically reduced – properly to less than 5 – for SME's to cope with them.

The final and fourth presentation was “Governance of Process Safety within a Global Energy Company” given by Mark McBride, a chemical engineer with Centrica. His presentation focused on three areas: leardership, accountability and stakeholder engagement. He questioned whether safety issues at powerplant that fall under the Seveso II directive was any different, than at those that did not. When questioned after the presentation Mark explained than Centrica HSE Committee consist of both directors and board members. I pointed out, that there are companies, who have committee of the board consisting of non-company employees overlooking safety issues at the corporate level.

A very good start on an excellent conference programme on loss prevention and safety promotion.

Consequences of Deepwater Horizon Explosion...for BP?

2010-05-01T13:11:00.003+02:00

I all started almost innocently with news on April 21st about an explosion on an oil platform of the coast of Louisiana in the Gulf of Mexico, see for example the breking news on the gCaptain site.
Later followed news, that 11 persons were missing, and already on April 23rd news that the rig was sinking sparked pollution fears, see for example the Guardian site.

Today 10 days after the explosion it is clear that a major oil slik is moving towards the coast of Louisianna. Why did the BOP not work? The whole exploration industry and particularly the crew on the sister platform to Deepwater Horizon are of-course waiting for answer to the question: What happened?

At the time of the explosion the Deepwater Horizon was under contract to BP Exploration. This mean the explosion is the second double digit fatality disaster to hit BP within the last 10 years. What will be the consequences of this for BP?

At the time of the Exxon Valdez disaster in Alaska, I remember reading a news story, which stated, that only two companies in the world had the economic means of surviewing such a disaster: Exxon and Shell. The current situation in the Gulf of Mexico have already been compared to the Exxon Valdez disaster. So what will happen to BP?

For a summary of the long term impact that the Exxon Valdez diaster had on the environment in Alaska read the report Summary Points: 10 Years of Intertidal Monitoring After the Exxon Valdez Spill from the NOAA, which states that 10 years after the event the causal observer would not see any oil damage. Given the warmer climate in the Gulf of Mexico we can hope for a similar positive outcome from the current disaster.

Once the events just before the explosion on the Deepwater Horizon has been analyzed, and a casue for the explosion determined, than another consequence could well be stricter regulation for exploration off the coast of Norway and off the east coast of Greenland. We have to wait an see.

CCPS Process Safety Beaon - how can we improve it?

2010-03-01T16:42:00.001+01:00

Each month I read the CCPS Process Safety Beacon with great interest. It provide well documented examples of what can go wrong. They are excellent for getting students attention by a short presentation with just one or two presentation slides.

The topic this month is about facility siting, and a simple slide with pictures fra the destroyed BP Texas City Refinery unit quickly get the attention of engineering students, and it is hoped that they then will not locate trailers and other temporary facilities for people close to sources of potential hydrocarbon releases. But do they really understand why? Or do they walk away thinking, that the explosion on March 23, 2005 at BP's facility in Texas City was just a case of poor facility siting?

The Process Safety Beacon usually have two sections. A section, which describe something, that went wrong, and a section about what you can do. This months what-you-can-do-section contain six bullet points requiring the reader to understand, point out, assure and insist - all positive actions. However, one of the middle bullets starts don't!

I think the Process Safety Beacon would be better with fewer bullets and more focused bullets that all are formulated in a positive maner, e.g. know were to seek refuge prior to starting work. Or in stead of "As soon as you become aware of a flammalbe material release which could create a vapor cloud, follow your plant's emergency procedures, including sounding evacuations alarms ot ensure that non-essential personnel evacuate process units and nearby buildings". That is a rather complex task! First the person need to evaluate if the release is flammable oor not. Second the person need to evaluate if the material could form a vapor cloud. Only if both answers are afirmative should the emergency procedures be followed. However in following these the person is further required to consider questions such as: What is non-essential personnel? What are nearby buildings? Nearby to what? I believe the message a) that your plant should have emergency procedures, b) that you should know your plants emergency procedures, and c) that the procedures should be followed for ANY release is completely lass in trying to be specific.

I also think people should be encouraged to go to a web-site such as www.safetybeacon.org or safety.aiche.org for more information - not www.aiche.org/CCPS/Publications/Beacon/index.aspx - and the site web-server should be smart enough to display the index page if the 'index.aspx' is omitted or misspelled.

Furthermore if you manage to find the archive you find yourself at a different place. You are no longer at the AIChE website or the CCPS website, you are at the SAChE website. Maybe there are good historical reasons for this, but the CCPS Process Safety Beacon deserves in my opinion to be presented by professionally than is currently happening.

Who should be Responsible for Proper Pressure Vessel Design?

2009-11-14T12:19:00.002+01:00

I was a bit shocked by the video message I received from CSB Chairman John Bresland late Thursday afternoon. Mr. Breisland was concerned about an increasing number of fatalities and injuries in connection catastrophic failure of pressure vessels in the USA. Appearantly in the USA the responsibility with regulating the design of pressure vessels rest with the individual states. This really chocked me!

First of all, in my view the proper design of pressure vessels is a worker safety issue – and a neighbor safety issue – and should therefore be the responsibility of OSHA and EPA, i.e. national institutions. This is the way it is here in Denmark, and to the best of my knowledge in the U.K. But at least the engineering profession in the USA have got together an defined the ASME Pressure Vessel Codes. Even the Danish national guidelines for construction and production of pressure vessels refer to the ASME codes as suitable approach for design of pressure vessels. These guidelines are issued by our equivalent of OSHA. Therefore, it was a shock to me to learn that individual states are responsible for how pressure vessels are designed in the USA.

How can one expect all these states to hire the necessary expertise to be concerned about pressure vessels? Local politicians properly assume, that pressure vessels are designed properly, and for many this is likely the case. At least all those pressure vessels, which are installed and operated by companies with activities in many states.

To me the logical thing to do with respect to pressure vessels would be for the ASME Pressure Vessel Code become a standard just like ISA SP84, which applied by chemical plants and refineries across all states. But maybe there is something, which I don't understand about the distribution of powers between the federal and state levels in the USA.

References:
1.CSB (2009): “Safety Message: Without Safeguards, Pressure Vessels Can Be Deadly”, CSB Newsroom, November 09, 2009, URL: http://www.csb.gov/newsroom/detail.aspx?nid=293 (viewed 2009-11-13).
2.At (1996): “Konstruktion og fremstilling af trykbeholdere” (Construction and production of pressure vessels), At-anvisning nr. 2.1.2.0-2, December 1996, URL: http://www.at.dk/sw5106.asp (viewed 2009-11-14) (At is the Danish equivalent of OSHA).

Is any learning at all from process incidents really taking place?

2009-10-25T09:17:00.002+01:00

On Thursday October 22^nd, 2009 CSB News [1] reported, that the CSB was dispatching a three person team to Salt Lake City to investigate a fire at the Tesoro refinery in that city. The fire appearantly involved liquid discharge to a flare stack. The discharge resulted in a pool fire around the base of the stack. The fire resulted in no injuries to person inside or outside the refinery. The only public inconvenience was the temporary closure of an interstate highway and a commuter rail line. Equipment damage involved a trailor and other equipment close the base of the flare stack. Refinery and municipal firefigthers extinguished the fire within an hour. Currently no information is available about the quantity of liquid hydrocarbons released in the event. So why this rush to investigate a small fire, which occurred on Wednesday evening?

In their news release the CSB states, that they want to investigate similarities between the fire at the Tesoro Refinery and the March 2005 explosion and fire at BP's Texas City Refinery[2], which also involved discharge of hydrocarbon liquids to a system designed to handle only gaseous discharges. There is also similarities to the explosion and fire at Texaco's Milford Haven Refinery[3] in southwest England more than a decade ago. This event also involved discharge of hydrocarbon liquids to a system designed only to handle gaseous discharges. This event also involved a restart of the refinery after a power outage. Properly there are other similar events.

Earlier in the year CSB [4] dispatched a team to investigate a explosion and fire at another Utah refinery. This event was caused by hydrocarbon vapors escaping through vents in an atmospheric storage tank and creating a vapor cloud in the tank farm. There are striking similarities between this event, and the explosion and fire at Buncefield storage facility in the UK in December 2005 [5].

Therefore it seems reasonable to ask if any learning from accidents in the process industries is really taking place? or if most facilities has an this will not happen here attitude?

After the explosion and fire in March 2005 at BP's Texas City Refinery the reaction of many properly was: Blowdown stacks releasing to the atmosphere? We eliminated them more than 10 years ago. However, this kind of thinking is shortsighted, and eliminates an opportunity to learn from the event. The event at Texas City involved too much hydrocarbon liquids entering a gas-liquid separator, resulting in liquid entrainment in the gas stream from the separator. So learning from BP's Texas City event also involve asking do we have questions such as: Do we have any gas-liquid separators, which cannot cope with the maximum conceivable inflow? Can our flare system handle a flow equivalent to the total feed flow to one or more of our distillation towers? Only be asking though questions about inconceivable events can you learn from accidents experienced by others.

Interestingly, both the event at Texaco's Milford Haven Refinery and the event at BP's Texas City Refinery could have been prevented by a simple mass balance monitoring scheme looking at estimated tower inventory based on measured feed and product flows. Furthermore already the computer control systems of the late 70's and early 80's where sufficiently powerful to implement such monitoring schemes. So why are they rare even in the 21^st century?

It furthermore seem reasonable to ask what mechanisms are in place to learn from events in other parts of the world?

References

CSB News Release (2009): ”CSB to Examine Fire at Tesoro Refinery in Salt Lake City”, October 23^rd, URL: http://www.csb.gov/newsroom/ (viewed 20091023).
BP America (2005): ”Texas City Investigation Reports”, December 9^th, URL: http://www.bp.com/genericarticle.do?categoryId=9005029&contentId=7015905 (viewed 20091025).
HSE (1997): ”The explosion and fires at the Texaco Refinery, Milford Haven, 24 July 1994: A report of the investigation by the Health and Safety Executive into the explosion and fires on the Pembroke Cracking Company Plant at the Texaco Refinery, Milford Haven on 24 July 1994”, ISBN 0 7176 1413 1. See also accident summary on HSE home page http://www.hse.gov.uk/comah/sragtech/casetexaco94.htm
CSB News Release (2009): ”CSB Investigative Team En Route to Utah Refinery Explosion”, January 13^th, URL: http://www.csb.gov/newsroom/ (viewed 20091025).
MIIB (2006): ”Buncefield Investigation Homepage”, URL: http://www.buncefieldinvestigation.gov.uk/index.htm (viewed 20091025).

What is a process safety incident?

2008-10-26T17:25:00.000+01:00

During about 10 years at a major Canadian petrochemicals producer a number of undesired events occured at the plant and at other facilities we had collaboration with. Among them are the following events:

An employee jumps from a 4 feet high platform onto a concrete floor in the packaging area of a polyethylene plant. Unfortunately he don't land on his feet, but falls and breaks his back. He is instantly dead. No chemicals were involved. No process equipment was involved. No acute release took place. It is definitely an undesired event.
During maintenance work on a bulding housing a polyvinylchloride plant a ground operated man lift was used. The bucket controls malfunktioned resulting in an employee in the bucket beeing squezzed to death against some piping on the outside of the building. No chemicals were involved. No acute release took place. It is definitely an undesired event.
Unplanned shut down of a polyethylene reactor is an abnormal process conditions, which leads to the burning of a significant amount of hydrocarbons and an intense heat flux to nearby ground areas - up to more than 100 feet away from the flare. This event is also a quite costly one - properly in excess of $100.000. There are chemicals involved, but they are realased or burned through equipment designed for this event. There is definitely an acute release, but it is through equipment designed for it. It is definitely an undesired event.
During patching of some software on a Honeywell PMX system two constants in the computer system was interchanged. The result was, that valves, which should close did the opposite, i.e. they opened, and valves, which should close did also the opposite, i.e. they closed. The result was significant process deviations and releases through safety valves. This was definitely an undesired event.

Clearly not all undesired events should be counted as process safety events, or maybe they should only be counted as process safety events to some degree. According to the CCPS criteria for a process safety incident none of the above events qualify as a process safety incident. However, they all happened because there was a chemical plant.

Could these events have been prevented? Yes, the fall from the packaging platform could have been prevented by equipping it with a stair in place of the vertical ladder. The squezzing of an employee could have been prevented by installation of a dead-man button in the bucket. The incorrect patching of the control system software could have been prevented by patching during plant downtime and testing before plant startup. Would these events have happened if there was no chemical plant at the site? No. They are linked to the production of chemicals!

All four events were treated by management as major undesired events associated with their facilities. The first two events had significant impact on every engineer at the site they occured at. 3 of the 4 events were treated as significant incidents by management. None of them qualify as process safety incidents according to the CCPS criteria. Why? Could it be that the CCPS purpose is just to count events, which are caused by operations errors in running the process, maintenance errors in maintaining the process, or process design errors? I don't know.

A few years ago Shell UK reported in their annual report, that the had experienced to fatalities the previous year. The fatalities did not involve Shell employees. The fatalities did not involve contractors working at Shell UK sites. The fatalities involved road accidents involving a subcontractor.

If we want to improve performance of our chemical plant, then we need to focus on undesired events, and using our employee skill to understand why they occurred, and how we can prevent them in the future. Whether a particular event is labelled as a process safety indicent or somethingelse really is not that important, as long as we see the event as an opportunity to improve our performance. This approach is what drove the quality movement in Japan after WWII, and what drove Ford and many other companies in the 80's. A clear focus and belief, that we can do better!

CCPS Global Process Safety Metrics - How can they be improved?

2008-10-26T08:23:00.000+01:00

I was quite excited when I read the presentation "Global Process Safety Metrics - Driving Consistency and Improvement" by Tim Overton, who is chief safety engineer at The Dow Chemical Company. These first results of the CCPS Metrics Project weres presented at this years AIChE Spring Meeting and CCPS Conference on April 6th. The goal of the process safety metrics according to the presentation is to help company management answer questions such as

Is our company headed for a major accident?
How is our company's process safety performance compared to others?

and questions more aimed at the general public, such as

Which companies are becoming safer?
Is the chemical industry improving its process safety performance?

The CCPS Metric Project, of which Tim Overton is chairman, was initiated by the CCPS following recommendations in the Baker Panel Report and the CSB Report on the explosion and fire at BP's Texas City Refinery on March 23rd, 2005. Due to the appearant failure of BP's corporate management in monitoring process safety in their plants the Baker Panel recommended that BP should "develop, implement, maintain and periodically update an integrated set of leading and lagging performance indicators for more effectively monitoring the process safety performance". And the CSB recommended, that the API and USW should "create performance indicators for process safety in the refinery and petrochemical industries" and involve relevant scientific organizations and disciplines in this work.

In his presentation Tim Overton state, that the current situation is characterized by process safety metrics, which differ from organization to organization, and are likely based on incident definition that are not well aligned to the actual hazard of the event. This could well be so, but how does this prevent such metrics from being used to drive improvement in process safety performance within the particular company in which they are used?

The aim of the CCPS Process Safety Metrics Project are

Define metrics that focus on process safety as contrasted to personal safety
Define common industry-wide lagging process safety metrics
Define near-miss or other lagging process safety metrics
Define leading indicator process safety metrics.

Therefore it is of course necessary to define what constitutes a process safety incident. In the presentation the criteria for a process safety incident are a) employee / contractor lost time injury, b) fire or explosion resulting in direct damage cost of at least $25.000, c) release from primary containment of quantities greater than chemical release threshold quantities. I see several problems with such a definition. Firstly an event, which just involved first aid but had the potential for large scale injury and / or damage is not counted. Secondly the amount of damage involving a cost of $25.000 will change with time and properly also location. Over time this could influence the historical trend of the metrics. Thirdly defining threshold quantities indirectly define distances of concern as used e.g. in the Dow Chemical Exposure Index. This is very relevant in risk assessment, but in my opinon seems odd in performance monitoring.

Well, if we can somehow agree on how process safety incidents are counted, then the following lagging metric can be defined:

Count of Process Safety Incidents (PSI).
Process Safety Indicent Rate (PSR) = Total count of all process safety incidents times 200.000 divided by Total employee and contractor work hours.

Furhtermore by assigning a severity score to each process safety incident, then a Process Safety Severity Rate (PSSR) can be defined as the total severity score for all process safety events times 200.000 divided by Total employee and contractor work hours. The 200.000 hours used in these calculations are of-course 100 employees working 40 hours per week for 50 weeks per year. Using this number create a parallel to the fatal accident rate or FAR. Indirectly, we thus know the count of incidents is for a year.

My concern about the CCPS Metric Project increased significantly after reading the booklet "CCPS Process Safety Metrics". This booklet describe carefully which events are counted as a process safety incident and which onces are not. The different metrics appear to be created by engineers for engineers. Let me give an example. The booklet describe how a release of 933 kg per hour of gasoline is not a process safety incident, because it is below the threshold of 1000 kg defined for this kind of material. How accurate can we in real life situations calculate the amount involved in a release? Can we be certain that this release did not involve 1017 kg per hour of gasoline? This difference, I believe, could be just due to the value of the discharge coefficient used in the estimation or the uncertainty in the level measurement used to calculate the amount.
In my view the ideas of fuzzy logic, which have been used to great advantage in e.g. cement kiln control, should properly be used to decide if a particular event was a process safety incident or not. This could create concepts of how much of a safety incident a particular event is.

The idea of the degree of process safety event could be applied to events, which are currently according to the CCPS booklet not considered a process safety incident. An example is a fire in a laboratory associated with a plant. The laboratory is there only because the plant is, and the laboratory works with the materials it does because of the plant. So in some sence the events in the laboratory occur due to the precence of the plant. Without the plant there would be no need for the laboratory. Therefore in my view undesired events in the laboratory should to some extend be considered as process safety events. By how much need to be defined.

Although I may appear critical of the current results of the CCPS Metric Project, I do believe, that defining common lagging metrics is a step in the right direction. However, without some directions as to how these metrics are to be used inside and outside the companies, which have to calculate them, then I fear they will end being just another administrative burden on the companies. Also the idea of fuzzyfying the criteria for defined a process safety indicent should be explored. Therefore I call upon the CCPS and other involved in process safety such as the EPSC and the EFCE Working Party on Loss Prevention and Safety Promotion to start thinking about how the proposed metrics and other metrics can be linked into the company management system and the actions company management need to take based on whatever metrics they have access to, and how the border between what is a process safety event and what is not a process safety event could be softened.

Leading metrics are much more difficult to define. At the 2007 Loss Prevention Symposium in Edinburgh there was a presentation by Unni Nord Samdal from Norsk Hydro Oil & Energy Research Centre in Porsgrunn on an indicator for technical safety called the T-Rate. This showed how difficult it is even within a single company to create meaningful leading indicators related to process safety performance. The CCPS Metric Project suggest the following as possible leading indicators:

Mechanical integrity inspections done divided by mechanical integrity inspections due.
Number of past due action items divided by total number of action items.
Percent of MOC's satisfying the MOC polity!
Percent of operators trained on schedule.
Survey of safety culture.
Number of activations of safety systems.
Number of activations of relief valves.
Number of deviations outside operating limits.

I am inclined to favour the simpler the better principle. Leading indicators, which are easy to understand and easy to use, are also more likely to be used by management. From the above list this would be number of activations of safety systems, number of activations of relief valves, number of deviations outside operating limits. I would add to this the alarm rate, i.e. number of console alarms per hour or shift.

I once worked in a large Canadian oil company at which the alarm rate in their refineries and chemicals plants was rather low. At the time we had a rather good safety performance in terms of the lagging indicators - first aids, loss time and fatalities - so this has colored by belief, that keeping the alarm rate low by using good process control is a significant step to good process safety performance.

Half a HAZOP!

2008-08-17T15:37:00.000+02:00

Since ICI told the world about its hazard and operability studies in the early 70's HAZOP studies, as they have come to be called, have been one of the prefered tools for risk assessment in the process industries. A HAZOP study uses a systematic team approach to investigate causes and consequences of relevant process deviations from normal operations in order to improve the ability of the process to handle deviations from normal operations.

Over the years the use of this approach have been adopted in many fields outside the process industries. Recently, while looking for references to the early descriptions of the method by ICI, I came across a publication which claimed to describe the use of HAZOP in the study of intelligent traffic system. This article "Application of Hazard and Operability Studies (HAZOP) to ISA and Speed Humbs in a Build-up Area", was presented at the e-SAFETY conference in Lyon, France in September 2002. The paper presents a deviation matrix for two viewpoints on a traffic situation a) that of a singe participant in the situation, and b) the situation as a whole. Already here the parallel to the HAZOP studies, which is known in the process industries appear to be weak. The process analogy to these two viewpoints would be a) that of a single process operator or other process worker (technician, contractor, engineer), and b) that of the process unit or plant. I don't know if these two viewpoints would be relevant to the process industry or not. It could be argued, that the first viewpoint would be a personal safety viewpoint, and the second viewpoint would be a process safety viewpoint.

The mentioned article by Jagtman and Heijer does however limit itself to presenting causes of deviations. For traffic speed adjustment system the parameters considered are speed, direction, location, attention and travel time. The deviations are no (none), too high, too low, wrong, fail of, part of, unknown and unexpected. The matrrix of relevant deviations is relatively sparse with less than 50% of the parameter and deviation combinations considered relevant by the authors. This and the fact, that the article don't consider the consequences of the deviations, make me think, that maybe HAZOP studies is not the best tool for studying this system. Through 10 years of teaching risk assessment to chemical engineering students at a university in Denmark, I have always struggled with explaining to students when the different qualitative and quantitative tools: HAZOP, Whaf-if, FTA, ETA, FMEA and QRA shoud be used, and which tool to start with. Generally I have recommended starting with What-if or HAZOP studies (HAZOP is easier with limited process knowledge - especially if you use a functional approach during study preparation).

However, the analyses of causes of deviations in a traffic control system presented by Jagtman and Heijer indicate, that maybe FTA and ETA would have been better tools. Since the article only present causes of deviations, but not discuss consequences, then it is really only half a HAZOP study. I think a better choice of tool would be Fault Tree Analysis (FTA) approach in which all causes of a top event, e.g. failure of the traffic control system, is the goal of the analysis. ETA or Event Tree Analysis could complete the study by showing possible consequences of particular failures.

Thus is important not to consider HAZOP studies, or any other tool such as layer of protection analsyis, as a universal tool for all risk assessment studies. Rather the tool among the many available, which best serves the purpose of the study should be choosen. Choosing the right tool for a study requires insight both in the system to be studied and in the different tools available for risk assessment.

Equipment to be banned from plants!

2008-08-11T08:23:00.001+02:00

For more than 25 years I have felt, that sight glasses don't belong in chemical plants. 3 years ago the list was expanded with blowdown drums venting directly to the atmosphere. Why? Because there are inherently safer alternatives available.

I would also like to see these kinds eliminated from the textbooks used to educating new engineers at our universities. Maybe authors could introduce a chapter about historical and obsolete equipment in textbooks about chemical unit operations and textbooks about instrumentation.

Recently I was greatly surprised by the article "Level: A visual concept" in the April issue of ISA's InTech. The article appeared in the section automation basics, and was actually based on the book "Industrial Pressure, Level and Density Measurement" soon to be available from the ISA bookstore. My surprise was caused by the fac, that the article appeared to advocate traditional sight glasses with a glas tube in a metal shield for pressures up to a few hundred PSI. My first job was at a Canadian chemical plant in Sarnia, and when I joined in in the early eigthies all sight glasses was already taken out of service. Why? Because sight glasses are a major hazard to the workers, who attempt to use them to determine a drum level. Today alternatives are available using steel tubes - even with remote readout of the level. Such inherently safer alternatives should be used whereever a sight glass was called for 30 years ago.

In the mid 90's a refinery at Milford Haven in southwest England burned for several days, when a blowdown drum was overfilled with liquid, and the gas outlet fractured when due to the liquid head. 3 years ago another blowdown drum overfilled at a refinery in Texas City resulting in an explosion and fire, which killed 15 co-workers. Blowdown drums are necessary to protect our refineries and chemical plants. Usually, you don't want to use them, since anything, which leaves the plant through the blowdown drum is a loss. Therefore it is easy to forget about a piece of equipment, which is not in use during normal plant operations. At Milford Haven the gas pipe from the drum was corroded past its usefull life. Both at Milford Haven and at Texas City the control room operator had no information about the level in the blowdown drum.

This indicates a common problem: Our plants contain equipment, which is only in use during abnormal operational situations. This include flare systems, safety valves, and piping associate with these systems. However, these systems should be maintained as well as the reactor or destillation tower. Only then can we be sure, that they will protect our life and our plant in an emergency situation.

So if you have sight glasses with glas tubes, then replace them with inherently safer more modern sight glasses. If you have blowdown drums in your plant, the ensure, that they are tied to your flare system, and that this equipment is well maintained so it works when needed. Only then can you limit the consequences of process safety events in your plant.

The biggest danger to your plant!

2008-08-10T11:11:00.000+02:00

There has been different efforts at establishing e.g. what is most important. For example the Copenhagen Concensus among economists attempt to decide what is the best investment society can make for the future of mankind. Likewise the British Government have attempted to decide what is the biggest risk to the British society. They find that the biggest risk is not terrorism, but a flu epidemic. The question, which immediately comes to mind is: What is the biggest danger to your plant?

Many facilities especially in North America have since 9/11 performed several security assessment studies of their facilities and reported the results to the ACC and possibly also the Department of Homeland Security. These studies aim to proactively access the likelyhood of a terrorist attack of a particular facility and the potential consequences of such an attack. During a visit to Baton Rouge a few years back I noticed, that the result is an re-inforced perimeter around the plants using e.g. concrete blocks to prevent large trucks from driving through the fence. I have yet to see similar efforts at facilities in my own country. Although the attack on the Glasgow airport a few years ago have already resulted in the establishment of concrete blocks around other airports, such as at Terminals 2 and 3 at the Copenhagen Airport. This indicate, that some security measures spread quicker around the world than others.

Many years ago at a biweekly safety seminar in a major Canadian oil company the engnineer manager asked the audience: What is the most important for the company about you? There was many and varied suggestions. The managers own answer was: Your health!

Without good health you may not be able to go to work. This usually means something will not get done. If a process operator calls in sick, then most companies have in place plans for calling in a replacement, so process safety is not compromised - at least short term. If an engineer calls in sick, then the likely consequences are usually that some development work or some maintenance work gets postponed - at least short term this is not a process safety concern.

Now let us assume, that a flu epidemics stikes your area. Unfortunately current vaccines are not effective against this particular virus, and within a short period a quarter of the population are sick with this flu. Can your company cope with a quarter of your employees being sick at the same time?

So maybe you should be as concerned with employee health as your are with process safety!

Is more regulation the road to better process safety?

2008-08-08T09:07:00.000+02:00

Recently the CSB chairman John Bresland called for OSHA to adopt CSB Recommendations on a comprehensive combustible dust standard. It seems that on both sides of the Atlantic the reaction of politicians and regulators are very quick to suggest more regulation after a process safety indicent, such as the explosion and fire at Imperial Sugar Company in Port Wentworth, Georgia, on February 7th this year.
Is more regulation really the way forward? Does regulation really improve process safety? I don't believe it does. Even companies with excellent process safety systems, such as e.g. the Dow Chemical Company, experience from time to time process safety events, which make employees ask the question: Is it really worth the efforts, when we still experience these accidents?
Increase process safety, in my view, is mostly about using once own common sense. Our as one major Canadian oil company put it: "Safety is the art of working properly".

Nonetheless I read on TMCnet.com an excerpts from an interview with the CEO of Imperial Sugar. In it he says among other things: "We have treated worker safety as our top priority ... and will continue to do so." ´I think, that this focus is completely wrong! On another web-site this CEO seems to claim, that his companys lag of knowledge abou the dangers of dust explosions is due to inadequate federal guidelines on the handling of dust. I think, that indecate missing a point as far as responsibility is concerned! Isn't it the responsibility of the CEO to ensure, that he hire the people with the skills necessary to safety operate his company?

At BP's Texas City Refinery there was also a focus on workers safety prior to the 2005 explosion and fire, which killed 15 people. Both the CSB report and the Baker Panels report (also found on the CSB web-site) on that event seem to indicate, that there should have been more focus on process safety. I completely agree.

A focus on process safety will ensure, that hazardous substances and equipment are operated and maintained in such a way, that workers cannot be injured. The result of failing process safety is that workers can be injured. We need to avoid that possibility!

So in my view the best thing, which can be done for workers safety is to have the CEO focus on process safety. That way the CEO protect the shareholders from losses such as those involved in rebuilding the Port Wentworth plant after the February fires and explosions. That way the CEO also protect the employees from the consequences of fires and explosions, such as injuries and loss of employment, and hopefully he/she also hires the people with the skills necessary for safe operation of his/her facility.

Now, how do we get the CEO to focus on the right thing? The CCPS has created a 10 minutes presentation for CEO's about the importance of process safety. The EFCE WP on Loss Prevention and Safety Promotion is developing a video with the same purpose, and the CCPS are developing seminars with a similar focus according to their web-site. Will this do the job?

I don't know.

What to be alarmed about?

2008-08-07T07:40:00.000+02:00

As a young engineer with a major integrated oil company in Canada I had limited conception of when an alarm was needed and what was required to implement an alarm. However, that situation was quickly corrected by a more experienced instrumentation engineer, whom I worked with on computer applications for an ethylene unit.
At the time more than 20 years ago he told me, that if we generate an alarm, then the operator must act on it. The least he should do would be acknowledge the alarm. However, for good alarms the engineer should also generate suggested responses to the alarm. He then added, if you cannot come up with a suggested response, then forget about the alarm, since all it will do is contribute the operator frustration. So instead of generating alarms or messages to the operator when our advanced computer control applications for some reason could not do, what they were supposed to do, we implemented graceful degradation. That ment, that on failure of the computer control application it degraded transparently to standard Honeywell TDC 2000 control strategies - and they worked all the time.

With this philosophy about alarms this and other unit at the site was able to achieve alarm rates below the EEMUA current recommendations of 1 alarm every 5 minutes. Without any use of the alarm mangement (READ: Alarm filtering / inhibition / removal applications), which has been popular in recent years.
However, there is a fundamental question, which we did not address at the time in the mid eigthies: What should we alarm about in our refineries, petrochemical plants and pharmaceutical plants?
A few studies have adressed special situations. I am thinking of PCA for monitoring batch operations or crude mass balance simulations to discover when we are trying to put too much stuff where it should not be, such as during the startup of the raffinate splitter at BP's Texas City refinery in March 2005.

Fundamentally an alarm should be generated, when an operator action is needed because a system goal cannot be achieved or as M.Sc. student Tolga Us the Technical University of Denmark recently expressed it, when the goal is under treath. So to decide when to generate alarms we need to look at the goal of our system or subsystem, and specifically when there is a danger or chance, that this goal cannot be fulfilled.
So let us look at the application of this principle to a type of unit, which I am somewhat familiar with: an ethylene gas cracker. The purpose of the ethylene gas cracker is to convert X kg/hr ethane to Y kg/hr ethylene. Notice the quantification! Without quantification we cannot define deviation from a goal - this of course also applies to power plants generating electricity.

So the purpose of our gas cracker is to convert X kg/hr of ethane rich natural gas to Y kg/hr of almost pure ethylene and of course some by-products. This process is essentially two connected processes: the gas cracking furnace, in which the actual chemical conversion is performed, and the so-called light-end, in which the compounds from the furnaces are separated into pure or almost pure compound streams.
One of the by products of the gas cracking process is coke. Coke builds up on in the furnace tubes, and if there is too much coke in the tubes they could block, and conversion will cease. So one way the goal of conversion could be prevented is by too much coke in the furnace tubes. The amount of coke generated depends among other things on the temperatures in the furnace. Hence wrong temperatures in the furnace could also prevent the conversion process by speeding up coke creation in the furnace tubes. So some things to be alarmed about in the conversion process are too much coke in the furnace tubes and incorrect furnace temperatures.
What does this mean in terms of goal fulfilment? If the coke build-up in the cracking furnace is too high, then the ethylene production goal is treathened. However, if the furnace temperature deviate from normal, then the ethylene production goal could be treathened in the future.

In practice the coke build-up is monitored by monitoring the pressure drop over the transfer line heat exchanger at the end of the cracking tube. If this pressure drop exceed a certain value, which depends on many factor such as feed composition, cracking severity, etc. then the operator should be alerted, that a de-coke is called for. Similarly, if the temperature(s) deviate from normal then the operator properly should be alerted, so the situation does not develop into a coke build-up situation. Possible interventions could be adjustment of the secondary air flow to the furnace or adjustment of the gas-feed firing ratio.

So in conclusion: We need to be alarmed about situations, which treathens the fulfilment of one or more system goals, such as production goals. I believe, that this would limit the number of alarms configured on a particular system, and hence some features of alarm management systems may not be needed.

What does it take to survive a double digit fatality event?

2008-08-06T08:44:00.000+02:00

Recently the The ChronicleHerald reported, that disaster still looms at the BP Texas City refinery. (unfortunately the story is no longer available online - not even cached by Google!). This made me think about other companies, which have experienced double digti fatality events.

The first which comes to mind is Union Carbide. After the 1984 Bhopal disaster the company struckled for some years before the remains was bought by the Dow Chemical Company. Another, that comes to mind is Nupro Ltd, the owner / operator of the plant that exploded at Flixborough ten years earlier. I seem to recall, that the company initially attempted to relocate production to Eastern Europe, but eventually the effort was abandoned.

Then there is the Phlips 66 polyethylene plant explosion in Pasadena, Texas, on October 23rd, 1989 which killed 23 persons. Among them most of the perssons knowledgeable about the facility. At the 2003 SACHE Workshop for professors at ExxonMobil's Baton Rouge facility Angela Summers of SIS-TECH reported, that eventually the follow-up on the 1989 explosion in Pasadena, and other explosions at the site during the nineties involves more than 3,300 action items. Among that a complete new management at all levels at the plant. The result appear to be a culture change, but it has certainly taken some time: more than 10 years.

Then there is BP's Texas City refinery, where the Associated Press story reported by the ChronicleHerald.ca wants us to believe, that another disaster is just around the corner. Could that really be true? Within half a year of the event in 2005 the BP board had removed all but one person in the command line from the manager of the refinery to the CEO of the company. BP has also started a world-wide education programme in process safety for all their employees.

From reading of the many exellent reports about the BP Texas City refinery, such as BP's Accident investigation report, the OSHA report on the event, the CSB report on the event, and the Baker Panel report, is seems clear, that a culture change was called for at BP's Texas City refinery. I don't believe, that a culture change at a major refinery is easily accomplished. However, I recall a report from a Canadian company at the CCPS conference in Toronto about a month after 9/11. In this report the company reported, that before a new CEO arrived they were experiencing many small fires and explosions in their facilities. Then a new CEO arrived, who demanded to have a report on his desk every day before 10 AM about any fires or explosions the previsous day - no matter how small. This action by the CEO put focus on what most considered nuissance events, and within a relatively short periode of time - less than six months, I believe - these small fires and explosions had been virtually eliminated. That was a quick culture change.

To me it appears, that a similar culture change is called for within BP. BP is much larger than the Canadian company mentioned above. Some would argue, that it would be impossble to implement a similar reporting system within the BP organization, and that it would take CEO time away from other important bussiness issues. However, the CEO is responsible for the survival of the company, and many people believe, that BP would not survive another event like the March 2005 explosion at Texas City. The CEO must put focus on process safety, and by demanding quick reporting on process safety related events on his desk every day he does exactly that!

As did the CEO of the Canadian company!

Cyber Security or Process Safety?

2008-08-03T12:08:00.000+02:00

Recently ISA's InTech magazine printed the article "Peril in the pipeline" with subtitle "Cyber security could have precluded gasoline rupture at Washington pipeline" (InTech June 2008). The backgroup for the article was the rupture of a 16-inch burried pipeline through Whatcom Falls Park in Bellingham, Washington, on June 10, 1999. The rupture resulted a fireball travelling 1½ miles downstream from the rupture location and killed 3 people.
Since pipeline are classified as a transportation activity the accident was investigated by the NTSB, who on October 8, 2002 issued the pipeline accident report "Pipeline Rupture and Subsequent Fire in Bellingham, Washington June 10, 1999". If you read just the InTech article you could easily be left by the impression, that the accident was coursed by the pipeline owner performing development work on its SCADA system without adequate protection of the running system from the development activities, and that on the day of the pipeline rupture this development work has resulted in degraded responsiveness of the pipeline monitoring system. Unless you read the InTech article very carefully you are left with the impression, that "the accident resulted form the database development work that was done on the SCADA system" on the day of the accident.
Wait a minute! This can't be. One cannot design a pipeline such, that the only protection form an overpressure event is a remote SCADA system? There must be independent protective systems, which protect a pipeline from an overpressure event! Actually, if one digs into the NTSB report, it is discovered, that the database development work is just the 5th probable cause of the accident listed. The other 4 are:

damage done to the pipe during water treatment plant modification project and inadequate inspection work during the project;
inaccurate evaluation of inline pipeline inspection results, which led to the companys decision not to excavate and examine the damaged section of pipe;
failure to test,under approximate operating conditions, all safety devices associated with a products facility before activating the facility, and
failure to investigate and correct the conditions leading to the repeated unintended closing of an inlet block valve to the products facility.

In my view these four probable causes of the pipeline rupture all fall under the heading: Process Safety. Clealy the pipeline owner did not have adequate process safety procedures in place, and that resulted in pipeline rupture event. The cyber security issuse, i.e. the SCADA system degradation on the day of the event, was just a contributing factor, which prevented operators to intervene in a situation, were automatic systems should have prevented the event.

Nonetheless, it is not good practice to perform systems development work on an operating SCADA or BPCS, especially when this is done without the benefit of the security features built into systems such as the VAX multiuser operating system. Development of system software or even key applications should not be done on operating SCADA or BPCS systems without a prior assessment of the risk using established MOC procedures.

openSUSE 11.0 Install Experience

2008-07-11T14:30:00.000+02:00

Yesterday I decided to vipe away the Windows XP Home partition at the computer at Slangerup Church Council. This computer has for more than a year been running openSUSE, and only on a few rare occations has Windows XP been booted.

The system is a 4 year old 2.x GHz celeron with 512 MB ram and a 75 GB HD plus a Tandberg Data tape drive and a DVD RW drive and 5 USB slots (2 on the front). Windows including recovery and backup partitions consummed about half of the 75 GB.

Some weeks ago I had already downloaded openSUSE 11.0 GA, so a bootable DVD was burned using the existing openSUSE 10.3 installation. Prior to install all data - about 3.8 GB - was saved to a DVD. The system was then rebooted using the install DVD. Install was selected, and Danish selected for the language, since the system will be used by Council members, who are not very proficient in English.

In order to do away with the Windows partitions I had to select the expert partitioning tool. I had no problem getting rid of the old partitions. But how do you partition 75 GB for a new install? I decided on just two partions '/' of 20 GB, and '/home' of 50 GB. The system also have an old 9.4 GB IBM HD, and this was set op as '/backup'. It would have been nice with some suggestions for partitioning a fresh HD.

During the install I selected every possible package except for 'Cell development', since I don't have access to a Cell processor. This only consumed 5.6 GB of my root partition. Unfortunately I selected 'Automatic Configuration' at the end. This gave a lot of problems connecting to our wireless network after the install finished, so I re-installed and choose manual configuration.

Again I have problems connecting to our router during the install (I did not have these problems with the install of openSUSE 10.3 last year). Eventually I just by-passed the updating during the install.

While playing around with the network setting after the initial install, and also changing to NetworkManager I finally got a wireless connection. Then the fun started.

I did not know, that I would be unable to access YOU if I had activated scheduled patch download.
When I finally got YOU to work it insisted on updating the package handler several times, and each time a re-boot was required.

Am I pleased with openSUSE 11.0? Yes! Was it worth the trouble? Yes! Since I had been playing around with a number of things on the old openSUSE 10.3 installation (openVPN, openLDAP, Samba, KnowledgeTree, Amanda, Rdiff-backup and a few other things).

I have now decided not to use KnowledgeTrre, since I think it is overkill for our small organisation. I have decided to use Rdiff-backup for local disk to disk backup of documents. I have decided to used Samba for file access inside our local church office. I also plan to support openVPN access at a future date.

What I would like to see:

Some advice about the different file systems available. I choose ext3 just because I used that before.
That NetworkManager is installed by default on the status line.
An option to install Adobe Reader during the initial install with creation of relevant links to Firefox.
Some more info during test of network connection. Mine seemed just to sit there for a long long time.

So on a scale of 0 to 10 I would rate this install experience as a 9!

Linux Day in the Danish Parliament

2008-05-29T17:15:00.000+02:00

Yesterday was Linux Day in the Danish Parliament. The talk of the day where arranged along 4 themes: political and ethical interests, commercial interest, everyday usage and perspectives. All subjects, which I would consider important for increasing the usage of Linux in the Danish public sector.

A brief opening talk by the chairman of the Parliaments committee on science and technology emphasized the fast pace of change in our times, and the reluctancy of some 68'ers to avoid using new technology, such as mobile phones and computers (One of my high school class mates still refuse to get an e-mail account. I don't understand how he can get by without one!).

I left the seminar early quite disappointed with the ability of the open source or Linux community to arrange a professional event at which all actors take full advantage of the opportunity to sell the open source idea and the commercial products, which builds on it.

It is clear, that getting people involved in very different aspects of Linux, such as lawyers involved in issues around licencing of in-house used and developed software in connection with a business takeower, people involved in re-use of computers in developing countries, and commercial vendors trying to sell a product, to participate in a Linux Day. And on top of that deliver a clear message to the politicians.

The licensing talk left some unanswered questions. If I download a MySQL database and connect it to my commercial electronic laboratory notebook, does that mean the notebook is suddenly also covered by the open source license? My filling is no! Only the software, which I create to make the open source and commercial software work together is covered, but I am not certain.

The talk about re-use of computers in developing countries clearly showed, that using Linux on a computer could extend the life of the hardware by 2 or more years. Such extension of course have very significant impact on the CO2-footprint of a company. So maybe it is time to create such use cases showing how a company can become greener by deploying Linux.

During the commercial breaks I talked with a single person company, which promotes the usage of Linux in schools by using techology such as PXE, FreeNX or NoMachine servers, and NoMachines client software. Given a modern network card you can start openSUSE or another Linux distro from the server using PXE. This ensure, that student files are left on the server. Furthermore my using remove access tools such as FreeNX and NoMachine servers the student get the same experience whether connecting at the school or from the Windows PC at home. And as a side benefit Mom and Dad get exposed to Linux! I went right home, and installed the FreeNX server and the NoMachine client on an computer at our local church office on our 4 year old hardware. Startup is rather slow over a wireless link, but performance after start up is quite acceptable for task such as loking at or copying a small document. The beauty of this solution, is that is expand to the internet with little effort - except security! Thus church council members can be provided with electronic access to all incomming mail instead of making list of incomming mail and distributing these.

Why did the event lag professionalism? First of all the agenda was written in such a way that it was not clear when there were breaks and how lang the lasted. Secondly the announcement indicated, that a sandwich would be served at lunch time. I turned out that only the people exhibiting were supposed to get a sandwich. Thirdly if you are selling professional Linux based software, then make a professional presentation using a tool such as Impress with screen shuts. In these days were most Linux distros have tools for this build in I expect a bit more than bullet points in black text on a white background in a presentation.

Questions from the participants also indicated, that the organizing associations: DKUUG, SSLUG and KLID had no idea what the outcome of the day should be. I guess most of the participants either had played around with Linux or were using Linux as their main OS platform.

Beside the hopefully incorrect impression of the professionalism of the local Linux community I got home from yesterdays seminar with 3 live CD / DVD distros. One is MandrivaOne 2008.1 Sprig. Another is Ubuntu 8.04 (Hardy Heron), and a third is Keldix Linux 20080329. MandrivaOne and Hardy Heron you properly know if you have been around Linux for a short period of time. But Keldix is properly unknown to most people outside Denmark. This is lacal Danish distro based on PCLinuxOS, but with added features for watching our local national TV station: DR TV. All three distros are of course in Danish. This is examples of a new trend in the Linux community: Local influence fingerprints on the distros (DR TV) and a focus on national languages.

In this country like in many other computers are not as widely used among pensioners as among pre-schoolers and schoolers. If we want to interest pensioners in computers a national language Linux distro is a most. After it is installed. Updating not just of the OS, but of all application can be completely automated. This is not the case with the software, which normally comes with a PC in this country. Even if you add software to you Linux system, the automatic updating also takes care of those new applications.

Maybe it is the ease of maintenance, which is the reason behind 125.000 PC's at Russian post offices being switched to Linux these days? Or is the fact, that Russian post office can itself correct spelling mistakes in any messages the system generates? Maybe it is for the same reasons 9000 PC's at schools in the Geneve area is being switched to Linux?

I am writing this on a computer at our local church office, which is running openSUSE 10.3. I do quite a bit of install and remove of software as I learn more and more about Linux. However, since 10.3 was installed last fall I have not worried about maintenance. There is an application,which continuously monitor if updates are available from the sources I have selected during install. Usually once a week it turns red, which means click on me and install updates.

So let us promote Linux not only based on very low initial cost, but also about the very easy maintance of not just the OS, but all the software installed on the system, and also based on the native language versions available. Lets do this as professionally as the competition!

From Daily Safety Leader to Looking for Work

2008-05-07T17:16:00.000+02:00

In 1982 I joined Imperial Oil in Sarnia as a process control applications engineer. From the first day I was impressed by the attitude towards process safety and ethics.

The company started by sending me on several weeks of course on process control systems and process control application in beautiful New Jersey. That was a wonderful time in the spring months of that year.

As I returned to Sarnia after the courses I was informed, that before I could enter the plant area of the site I had to complete an introductory safety course, and that course would not take place for another two weeks. Until then I was asked to stay in the trailor like office building outside the plant fence.

While working in Sarnia I had to sign the company ethics guidelines every year. All engineers and managers had to do that. Each year the company also provided a summary booklet about possible ways to get in conflict with the ethics guidelines. One year this booklet contained the following three ethics guidelines at the end:

1. Is it legal? Am I maling or proposing a decision that breaks the law or runs contrary to a company policy?

2. Is it fair? Will my decision disadvantage or perhaps even bring harm to anyone - colleagues, customers, suppliers, the community? Or is it a decision that will make those affected by it feel they have been treated fairly in the long run as well as the short term?

3. Can I defend it? If I had to justify my decision to my family or the media would I feel embarrassed and uncomfortable? Or could I explain my decision with pride, believing that in making my decision I have done the right thing?

Since the middle of 1992 I had been the daily safety leader at my last place of employment, but in the spring of 2007 I was formally appointed to that position. In the fall of 2007 I together with a few safety representatives planned an evacuation exercise of one of the buildings at that place of employment. I agreed with these safety representatives, that we would monitor how fast people was comming out of the building, but that we would not report any names to the management. The exercise went quite well, and most people was out within our two minutes success criteria. One person had not heard the initial alarm - you know how knowledge workers can get really into their work - and this person did not leave the building until well after the two minutes had passed. At the next safety committee meeting, where the evacuation exercise was evaluated this was of course reported without any names being mentioned. At the safety committee meeting and after the meeting the manager demanded to get the name of the person, who was slow. I consulted with different experts, and they told me, that I had to give the name to the manager.

I saw a clear conflict with the above ethics guidelines - especially the second and third ones - and refused to reveal the name of the colleaque. About a week later I was fired as daily safety leader.

Prior to this event the manager during the last 10 years have had no complaints about my work as daily safety leader, and at several occations had praised the work being done to improve safety and the awareness of safety issues at the workplace as well as the efficiency of our safety committee meetings.

A few weeks after being fired as safety Leader, I was offered an early retirement package. Now some months later, when I think back of the events, I still think I made the right decision. I have started a small consulting company, and have had my first customers. I have also had time to improve the administrative procedures of our local church office.

Living Happily in a Virtualized World

2008-04-30T18:33:00.000+02:00

No this blog is not about Second Life. Today I attended a seminar at Symbion a University of Copenhagen conference facility hosted by Novell Danmark on Virtulization technology provided by Novell. If you just listen to the hipe, then you are led to belive, that virtualization technology is the best thing since sliced bread for managing and optimizing your data center. Fortunately or unfortunately I have at the moment no data center to manage or optimize.

I have experimented briefly with virtualization under eComStation in the days when VirturalPC was not a Microsoft product. I had VirtualPC running WindowsXP Pro as a guest OS. It was cool technology. Todays seminar also demonstrated some really cool technology.

The first part showed how you using a product called ZENworks Orchestra could migrate a virtual machine from one computer to another using drag and drop. Without taking the VM down! Well, this is only, as Terry Pretchard would say a lie to children. The python script working behind the scene of-course does momentarily take the VM down or at least prevents it from doing any communication with the outside world.On the 1G ethernet used in the demo the downtime for the VM was less than a second. I don't know what applications was running on the demo VM - if any. So I don't know if you could do this with an Oracle or MySQL database running in the VM. Nonetheless, it is quite impressive that you can do this with a tool programmed in Python!
But what is the business case for this technology? The demo clearly showed that it was faster than a forced failover in most cluster configurations. However, is there a real business case for this in a scenario with just a few servers. I guess, the answer is properly not. On the other hand if you have hundreds or thousands of servers an attempts to optimize the ressource usage in your data center, then automation of this migration based on hardware utilization could be a real business benefit.
Since ZENworks Orchestra is programmed in Python it is properly possible to create rules to implement a functionality in ZENworks Orchestra similar to automatic failover in a cluster configuration. What advantage and/or disadvantages this has compared to a full cluster configuration was not answered at todays seminar. But live migration is definitely a cool technology.
Anything to watch our for? Well, you will not be able to migrate from a pentium II to a celeron processor. As said, the processors in the computers you are migrating between need to be similar. Todays demo showed a live migration from a quad core processor to a dual core processor. That worked!

The speaker at todays seminar was Gabor Nyers (gnyers@novell.com) from Novell in Holland. In his introduction of ZENworks Orchestra it was claimed it could intelligently make decisions. AI implemented in python? I doubt it! In my view this is sales language for saying, that if you can specify intelligent rules in ZENworks Orchestra, then ZENworks Orchestra have no problems following those rules any time, and using real time sensors to decide which rules or part of rules to follow. This is basically what mordern DCS does all the time in the chemical process industry and related industries.
The new thing is that similar technology with ZENworks Orchestra can now be applied to manage and optimize very large data centres for e.g. energy efficiency. Green technology?
A real cool usage of ZENworks Orchestra is for taken backups using the snapshot technology provided by most storage vendors today. Using this feature you can backup your data without having a backup agent in each VM and paying license money for these agents. I was led to belive, that this reduced hours of backup time to just a few seconds. That indeed would be cool technology!

Not so cool the claim of vendors of open source based products, that this prevents lock-in. I believe, that lock-in a a combination of the technology you buy from a vendor and the training and experience, which your people receive by attending vendor courses or using the vendor products. With time the cost of training and experience will far exceed the cost of the technology. Then you are in my view locked-in as much with open source based products as with proprietary tehcnogies. The cost of changing is just too big. Standard or norm based products can make the cost of moving from one vendor to another lesser.

To me the coolest thing is that much of this virtualization technology is freely available with openSUSE 10.3, which I am running on a server at our local church office. Unfortunately virtualization is not on the top three list of projects for that server at the moment - for many reasons.

Organizing Workplace Safety

2008-04-29T07:50:00.000+02:00

Yesterday I attended a half day seminar on the safety organisation of the future in the Danish Engineering Society, IDA. The seminar, which was arranged by SAM, started with a review of the developments in Denmark over the last 40 years. This was followed by viewpoints form the unions, represented by FOA, and by the employers, represented by HTS. Finally Danske Bank præsented a new approach to taking care of working environments and all the risk associated with it.

It is in my view quite clear, that the responsibility for creating a safe and healthy work environment is squarely with the management. Nonetheless, for the last 40 years or so in Denmark a participatory model for organizing workplace safety has been used. The work environment law demands, that any company with more than 5 employees, must have a safety committee, and if you are a larger company, then you must have safety groups throughout the organization. The safety committee is made of elected employee representatives and appointed employer representatives. With the increasing difficulty of attracting good employees it has also become more difficult to attract employees interested in participating in the work for a better workplace.

The Danish way of organizing workplace safety and its relative success over the years is rooted in our desire to be members of societies or organizations of all kinds. In north America and Canada it is said, that important business decisions takes place at the golf course. In Denmark they take place when parents meet as their childing participate in local activities, such as the soccer club, the swim club, the bicycle club, and os on. With the increasing globalization and the arrival in Denmark of a significant number of emigrants the model is under treat, since the newly arrived don't participate in the club life to the same extend as ethnic Danes.

This might therefore be a good time to review of the involvement of employees in workplace safety could be arranged in a way, which is better aligned with current management and leadership principles. The case presented by Danske Bank at yesterday meeting is one example of how this could be done. By clearly focusing the responsibilit for workplace safety on the local leader the company appearantly have been able to increase employee involvement and knowledge about workplace safety. During the experimental period of the FARMOR project (Google FARMOR Danske Bank Arbejdsmiljø for more information about this project) local leaders were coached by professional workplace consultants, and these also participated in the facilitation of local meetings about workplace safety. Other companies years ago have adopted a similar approach, i.e. eliminating safety leaders in the organization and placing the responsibility squarely with the business group or section or brach leader, who ultimately must find the founding necessary to finance workplace improvement projects. This approach combined with a clear evaluation of the leader on workplace safety issues has been highly successful.

Maybe this is the time, when we in Denmark should change the focus around involvement and participation in workplace improvement activities from how these activities are organized to the business goals of these activities? It is now more than 14 years since a CEO of the Dow Chemical Company to Harward Business Review said, that he could not think of a single investment in SHE, which had not improved the profit of the company.

Ryerson University in Toronto don't like collaborating students

2008-03-09T20:27:00.000+01:00

I just read on the CBC news, that a student at Ryerson University face explusion because he facilitated collaboration among his fellow students. To me it appears as if Ryerson don't like collaborating students.

The days when each students sat behind a small disk in the library for long hours to study a subject has long gone from most progessive universities around the world. Todays business demand engineers who are able to collaborate not just with a colleaque in the office next door, but also with the people in the company or supplier office on the other side of the world.

Such collaboration is what students can learn in the facebook environment created and managed by the Ryerson student. So in my view Ryerson would be better off if they encouraged such collaboration, and maybe allowed the professor to learn some modern teaching approaches at a course, e.g. the ones given by Professor Felder.

Re-install on a ThinkPad 42p

2007-06-16T15:42:00.000+02:00

Some months ago I installed SLED 10 on my T42p, which already had Window XP Professional and eComstation 1.2MR on the 80 GB HD. Unfortunately I did not set aside sufficient space aside for SLED 10. I was unable to install patches due to insufficient disk space. I have allocated 5 GB to root, but that turned out to be unsufficient. When I installed SLED 10 I used linux tools to partition and format the areas needed for SLED 10. That turned out to be a bad idea, since DFSee later showed allignment errors.

My initial idea was to wipe the whole disk. I did not look forward to that, and it would properly only have increased the space I could set aside for SLED 10 by 5 to 10 GB, so I decided to keep the 36 GB NTFS partition with Windows XP Professional on it. It has about 40% freespace, and in the fall I need to install an object oriented process simulator on and some models. Beside the NTFS partition I also kept the BM partition. I am rather oldfashioned with respect to boot managers, and I am using the IBM Boot Manager as modified by Serenity Systems and Mensys.

The remaining partitions was wiped away. Upps! I forgot to burn the ISO image of eComstation 2.0 Beta4, which I downloaded a few days ago. So I had to re-downlaod it - damn!

The hard disk now is partitioned as follows:
- Windows XP Professional with SP2 - 36600 MB on an NTFS partition
- IBM Boot Manager - 7 MB
- eComstation 2.0 Beta 4 - 7500 MB on a JFS partition
- eComstation Data - 7500 MB on a JFS partition
- LILO - 36 MB Ext2 partition
- SWAP - 1000 MB on a swap partition
- SLED 10 - 10000 MB on a Ext3 partition
- /home - the rest - about 13000 MG on a Ext3 partition

At the moment, Windows XP Professional and SLED 10 are installed. SP1 for SLED 10 are being installed, and I am looking forward to using the new virtualization features of the upgrade. My goal is to run the ICAS programs virtualized in eComstation and SLED 10 before the end of the year. There may not be much current use for this, but it makes for some independence of the base OS.

After installing an update to SLED 10 which was not relevant I lost all networking and USB connections. I re-installed SLED 10 including the update to SP1. Unfortunately the connection to the server disappeared during the update to SP1, so at the moment the I have both a SLED 10 and a SLED 10 SP1 entry in LILO. This was my first experience with re-installing on a working Linux system, and it was a good one. The use of hidden files for configuration info meant, that all my Firefox and other application customization was pre-served during the re-install.

From SUSE 9.2 Pro to SLED 10

2007-03-18T12:26:00.000+01:00

Today I finally got around to updating the SUSE Linux Professional 9.2 installation on my ThinkPad 42p to SLED 10. I selected SLED 10 in place of openSUSE 10.2 in order to discover the difference between the two and get a feel for SLED 10.

At first I attempted to use the update feature on the SLED 10 EVAL DVD. This failed twice due to some missing files (I should have noted down the names of these, but did not - sorry!). The third time the update succeeded, but the first reboot failed.

This ThinkPad has 3 OS: Windows XP Professional, eComStation 1.2 MR and SUSE Linux Professional 9.2. Since neither GRUB nor LILO to the best of my knowledge knows anything about HPFS partitions and the IBM Boot Manager even in the new version included with eCS 1.2 MR don't recognise the Reiser file system the boot setup is somewhat special. From the IBM Boot Manager one can select either Windows XP, eComStation 1.2 MR or LILO, which is installed in a separate linux partition. From LILO one can select either Linux or Windows.

The update feature on the SLED 10 EVAL DVD did not as I expected leave this setup alone. In stead it attempted to install GRUB. The result was a kernel panic on the first reboot.

Then I decided to do a new install. The new install path allowed me to modify the startup, so it used LILO in stead of the default GRUB, and also to install LILO on a separate boot partition. With this setup the install of 3.04 GB from the SLED 10 EVAL DVD went without a problem.

The interest in Linux and openSUSE in particular is an attempt to migrate some computers at a local church office from Windows XP Home to an OS, which allows some more intelligent file sharing. Currently one computer has been migrated to openSUSE 10.2. On another FreeNAS has been installed, but I plan to migrate this rather old computer to a minimum openSUSE 102. install in order to use it as a file and print server (it contains a TANDBERG DAT TAPE drive).

The eComstation Community

2007-03-04T19:05:00.000+01:00

Friday and Saturday is attended Linuxforum 2007, which toke place at the Copenhagen Architect School not too far from one of the trouble spots in Copenhagen during the past few days. This event is the largest local gathering of linux enthusiast in Denmark and this was the 10th anniversary of the event, which is arranged by 5 people and a large number of volunteers.

At the event I had a change to reflect over the size of the developer community around eComstation relative to the communities around some of the linux distributions. The eComstation at least have only one OS to worry about - two if you count the server offering as a separate OS. Compare that to the BSD linux community. They have FreeBSD, OpenBSD, NetBSD, DragonFlyBSD, PC-BSD and DestopBSD to mention just some of the BSD based distributions. In additon to the mentioned distributions there are specialized distributions based on BSD, such as FreeNAS for network attached storage. All these communities need to worry about much the same issues as the eComstation community, i.e. the availability of drivers for differnt types of hardware. In one of the last releases of OpenBSD one of the achievements was the addition of 25 new drivers for different kinds of hardware. Of course all of these distributions are free, while eComstations cost money, and additionally our OS only run on Intel and AMD hardware. Nonetheless I believe we are better much better of, and I believe this is because the eComstation development takes place based on a sound business model, which in some areas is helped by volunters such the people at Netlabs.org and a significant number of individuals around the world, who ensure the availability of an increasing number of applications, such as PostgreSQL and MySQL to mention just a couple.

At Linuxforum 2007 I saw a couple of interesting things. First there was the new Playstation3 with the IBM Cell processor running Yellow Dog Linux in dual boot mode - games console for the kids and a powerfull computer for the rest of the family. A researcher at DIKU at Copenhagen University compared the performance of a 3,2 GHz Pentium from Intel with the CELL processor on a protein folding problem. The CELL processor was 8 times as fast as the Intel based computer! Now I finally have a reason to buy a PS3.

Then there was a guy from CSC, who needed some tool for monitoring > 4000 servers, and developed Hobbit to fit his and his companys needs. I just need to monitor two servers, but the application scales well, and it would be nice to know about problems with the servers before my boss.

Finally I have a choice. I like OS/2 and eComstation. During more than 10 years daily usage I have got used to some applications on OS/2 and eComstation. There are some applications I would like to continue to use, but I also need to exchange documents with others, and most of them work in a Windows based environment. One choice is to switch to a linux distribution such as OpenSUSE. Then I could use Innotek's VirtualBox to run the Windows and eComstations applications, which I still need. Also with the release of the next version of Notes I can get access to my old Smartsuite documents and convert them to OpenOffice.org or Microsoft Office documents using tools, which where previously only available on the Domino server. Notes 8 is build on top of the Eclipse Rich Client Platform, this opens up a second choice.

If someone, e.g. the current company behind eComstation, ports the Eclipse Rich Client Platform to eComstation, then eComstation users would gain access to a state of the art document conversion tool. So many old documents could be converted and distributed in new formats. Also the current effort used to make OpenOffice.org available to eComstation users could be directed to towards making the Eclipse RCP available on eComstation. This would have the advantage, that as future applications based on the Eclipse RCP become available, then they would automatically run on eComstation. To run the few Windows applications I still need to run I would need to rely on Innotek's VirtualBox on an OS/2 host. However, this software is currently in closed beta.

The first choice precently seems like the path of least resistance, and except for Notes 8 for linux everything is there today. They other choice allows me to continue with eComstation, but some other people need to make the right business decisions to make it happen.

No One Solution Is Enough

2006-09-04T17:38:00.000+02:00

Last week at CHISA 2006 in Prague the keynoe speach "Possibilities into reality to create a greener energy future" was given by the Australian Greg Lewin, who is President of Shell Global Solutoins International. The key message was that chemical engineers were uniquely positioned to help solve the worlds complex demand that the climate change must be taken seriously and the world is ever more hungry for energy.

I agree, that chemical engineers will be part of the solutions as they have been part of the problem. This appears to be the track history of the profession!

After WWII ever larger chemical plants was created. The old approach of learning by doing failed, and we experienced Flixborough (1974), Seveso (1976) and Bhopal (1984) to mention just a few of the hundreds of events which helped give the chemical engineer a tainted image.

Then the politician introduced controls - after a very long delay. After the introduction of the controls we saw an industry trying desparately to change. They merged and divested, so today it difficult to recognize many of the giants of the early nineties.

Can this industry really be trusted to create the sustainable energy solutions of tomorrow?

Then today the Statoil Magazine arrived stating, that the gap between energy production and consumption is widening due to huge demands in China and India. I find this very hard to believe!

If production is short of demand, then according to comming economic theory the price of oil will go up. Sure, the price of oil has increased, but appears to happen more based on weather and politics, than based on equating supply and demand.

Nonetheless, we do have a problem if the world hunger for energy must be satisfied. Last week I enjoyed lunch with a researcher from ISPRA - EU's Research Center in Italy. In his group they very working on the next generation nuclear reactors. It was a fascinating story. The bottom line will be no more long distances transportation of highly radioactive vaste. In situ regeneration of spent fuel.
All with zero CO2 emissions! Can we ignore this solution?

You don't need to answer today, because the new technology will take some years to mature, but your children may have to deal with this question and similar once.

Do we have time for REACH?

2004-12-05T11:01:00.000+01:00

REACH is the European Unions new program for registration, evaluation, and analysis of chemicals. The aim is to make our life safer.

Currently more than 100.000 chemicals are in use in our society. Some in quantities as small as 1 kilogram per year and others in quantities as large as millions of tons per year. Yet they are all in principle subject to REACH.

While we are waiting for REACH to register, evaluate and analyse the many chemicals we will have spills, accidents and even disasters. Even by optimistic estimates it will take decades to perform the work required by REACH, and I don't think we can afford to wait for this.
For more than 10 years the U.S. National Research Council in collaboration with the U.S. National Academy of Science have been working on the creation of scientifically based emergency exporsure limits for use in emergency situations. This effort defince exposure limites for 10 min., 30 min., 1 hour, 4 hours and 8 hours, i.e. a workday and for three different consequences: discomfort, reduced ability to escape and life threatening. When the work started a list of more than 400 priority chemicals out of the more than 100.000 in use was created in consultations between industry, government and academia. After more than 10 years work Acute Exposure Guideline Levels (AEGLs) have been proposed for a little more than 100 chemicals, and of these only a fraction are finalized. Can we afford to wait for this?

I don't believe so, and so do others. Therefore we have TEELs or Temporary Emergency Exposure Limits similar to Emergency Response Planning Guidelines. All, i.e. AEGL's, TEEL's and ERPG's are based on available information about the toxicity of the chemical and some groups interpretation of this information. But can we do better than this?

The standard operating procedure establish by the NRC for the establishment of AEGL's is a step in the right direction, but in my view it does not cover the needs. What about limits for new compounds developed during research aimed at creating new and more effective ways to treath illnesses such as Cancer or AIDS?

In my view is necessary to develop an approach to the establishment of exposure limits, which reflect the amount of information available during e.g. new drug synthesis projects. During the initial phases of such projects what is known is basically the structure of the chemical. Therefore the establishment of exposure limits for a large number of chemicals should be based on the structure of the chemicals.

In chemical engineering methods for prediciton of physical and chemical properties based on the structure of chemicals are well established. Such methods are called group contribution methods because of the way they e.g. predict boiling points and critical points based on the groups that make up a molecule. In this context groups can be viewed as the LEGO blocks of nature.

A group contribution approach to the establishment of exposure limits properly could be developed within one or two Ph.D.-projects in less than five years. This would significantly shorten the time needed to establish exposure limits for the many chemicals we already use on a daily basis.

With the ability of group contribution approaches to be based on screened experimental data for a limited number of chemicals we can use the exposure limits established by the NRC as a basis for initial models. These models could be refined as more experimental data are screened and the ability to use such models to predict properties of similar models is well known within the chemical engineering community.

Then what are we waiting on? Just salary for one or two Ph.D.-students!

Den Gamle Have Fornyer Sig

2004-12-05T10:45:00.000+01:00

Den gamle have, som har ligget hvor den ligger i Københavns centrum i længere tid end de fleste omkringliggende bygninger, fornyer sig med spændende tiltag, som rutchebanen Dæmonen og en kombineret forlystelse og restaurant med et tema fra 1000 år siden. Og så skal hun selvfølgelig kanøfles!
Jeg skriver selvfølgelig om Tivoli i Københavns centrum. Naboerne kan ikke lide alle resultaterne af Tivolis fornyelse, så de vil have en lokalplan for Tivoli, så den gamle have ikke længere kan forny sig uden politisk kontrol. Det ligner noget man ser i en helt anden industri, nemlig den kemiske industri.
Overalt i verden finder man kemisk industri under press fra naboerne. Glemt er det, at naboer er kommet til efter industrien. Det er selvfølgelig i industriens interesse, at have et godt forhold til sine naboer ligesom det er i Tivolis interesse, at naboerne også fremover vil betragte den gamle have som en dejligt åndehul i en fortravlet storby. Når det så alligevel går galt, så er årsagen nok snarest lokalpolitikeres ønske om at profilere sig i medierne uden klart at fortælle hvad formålet med deres nye 'sag' egentligt er set fra et samfundsperspektiv.