Version Oct 8th 2003

What is a HIPO?
(High Potential Incidents A Guideline)
The purpose of this note is to define a HIPO, as used by the Step Change in Safety HIPO Workgroup. Supporting notes and examples from various disciplines within the industry (production, drilling and well services, construction, maintenance, etc) will clarify the definition.
1

Definition: A High Potential Incident (HIPO) is one where the worst PROBABLE outcome is a fatality. Guidelines
The word probable rather than possible is deliberately used. This is to ensure that the outcomes that are considered are quite credible in terms of potential circumstances and severity. To determine potential circumstances, look at the actual circumstances and consider what might have been. Take a similar approach with potential severity - look at the actual severity and consider what might have happened. Within the above definition of a HIPO, the outcome in terms of injury can be varied many HIPOs have no injurious outcome and are often referred to as near misses. Other HIPOs can have injurious outcome ranging from minor to serious the key point is that a HIPO is an incident that did not realize the ultimate potential and become a fatality. Potential Circumstances: In most cases, the argument will be that if the circumstances were less favorable, a much worse outcome would have been realized. This is often expressed in terms of barriers, as if only one more barrier was removed then the outcome could have been tragic. Less favorable circumstances could be. : Could this have fallen (or been dropped) in a different area or at a different time? : What if the weather conditions were different? : What if ongoing ops were different? : What if the gas had ignited?

During assessment, the credible potential of this type of less favorable circumstance needs to be assessed to determine whether the incident could have a direct and drastic impact on people were it to happen again. Potential Severity.

1.

Avoid unlikely what-ifs, e.g. what if the person who slipped over had landed awkwardly on their neck..?. It might be possible that this leads to fatality, but it is not probable. 2. Avoid stringing what-ifs together unrealistically. If two or more what-ifs are needed to reach that particular severity of consequence, then the credibility of that outcome needs to be robustly challenged. Take credit for barriers (safeguards) that have worked but during investigation, ensure that that workability is challenged.

3.

If it is considered that the safeguards might not have worked (e.g. faulty, damaged, working beyond their limits) or may have been missing (e.g. requires human intervention, not permanently in place, etc.) then consider this in determining the potential outcome.
1

It is not intended to interfere with the internal reporting (or definitions) that companies use, but it hoped that when companies report HIPOs externally, they will align with these guidelines. This reporting framework does not (at the moment) include occupational health and environmental .

Version Oct 8th 2003

4. Take no credit for barriers that were there by chance. If the barriers were not factored into job planning then their presence was due to good luck rather than good judgement. Nobody can afford to rely on luck.

Examples The examples are from a variety of disciplines and activities. There is little point in choosing examples that are clearly HIPOs (or not). These examples are deliberately chosen as being marginal. Some factors that might tip the balance either way are then discussed alongside each description. The hope is that the definition, supported by the brief guidelines and the worked examples will allow some consistency in determining what is a HIPO and what is not. The intent is to flush out the serious incidents across the industry and focus on them as a group. Rather than looking at this as an academic exercise, it is necessary to ask yourself What am I doing to focus on the most serious near-misses and accidents in my business such that their ultimate potential is assessed and reported in a way that promotes cross-industry awareness and response?. In conclusion if you are still uncertain as to whether something is a HIPO or not, then it is suggested that it be reported as a HIPO. >Examples

Version Oct 8th 2003

Examples - Step Change Guidance on HIPO Reporting.

Area No. Incident Description
Leak from condensate pump Gas and heat were present; The flame detectors responded (there were gas and heat detectors present also) and operated the GA and deluge. At the time, all personnel were located on another platform. The fire team observed the fire from a safe distance, and when it died down, they approached and made the area safe. The pump area is one of low personnel occupancy. Investigation concluded that leak would have started gradually, and would have been audible. Fire in a caisson Two workers were installing a repaired caisson pump. During the period the pump was away, a missed isolation and lack of understanding relating to plant status led to the caisson emitting HC vapours. To suppress the vapours, air aspirated foam was put into the caisson, causing the presence of a flammable / explosive mixture. When they were lowering the pump into the caisson, an ignition led to a 6m high flame, engulfing both workers. Fortunately, they were wearing full-face masks and cold weather gear something they had not done previously.

Potential Fatality? Yes

If the investigation found that the detection system might not have detected the fire (e.g. because of poor design or functionality) and that an escalating fire could have led to fatalities in nearby areas. If the leak could have started and ignited quickly, people could be trapped and killed. This may depend on the likelihood of area being occupied During the work, the caisson contained a flammable mixture, which varied in composition. Persons were working over the caisson for an extended time. If the ignition had occurred when the mixture was explosive, they would have been thrown into the air some 6m and landed on process equipment. It is probable that it would have killed them. The hot gases that they would have inhaled would increase the likelihood of death.

No
The detection system operated as it was designed and intended. and controlled the fire. No reasonable possibility of escalating. If area was occupied, as the leak began gradually, personnel would not have been at risk. They could have escaped and manually initiated safety systems. The persons working over the caisson were wearing appropriate PPE and were not working over the caisson more than 2 hours in 24. Had they been caught in an explosion they would have been thrown up in the air, but while they would probably be injured , fatality is unlikely.

1.

Production

Production

2.

Version Oct 8th 2003

Drill & WS

Falling bolts Instead of using the manufacturers recommended bolt retention system of washer / split pin / castellated nut, of which the crew were unaware, bolts were retained using R-clips, which themselves were smaller than the optimum size required. During cement drilling, vibration (which is reasonably common) led to two bolts, each of which weighed 250 grammes, to work free from elevators and fall to the rig floor. The procedure for elevator changeover did not identify the bolting requirement, and a large variety of lift subs had been used resulting in use or change of several types of elevators. The pre-job toolbox talk recognised the risk of dropped objects. A routine had been specified, and was being observed to address this - the rig floor was cleared of personnel before the elevators were lifted high in the derrick. Pulling casing from the well A 750 kg joint was lowered down the v-door to the stop on the catwalk. There, it rested safely while the elevators were being removed on the drill-floor. A sling was attached at the pin end to be ready for the next stage that of lifting the joint over the stop. The sling was connected to the crane, and with no signal from the banksman, the crane-driver took up the slack but misjudged the manoeuvre, resulting in the joint going over the stop and sliding in an uncontrolled manner across the pipe deck, coming to rest just 1.5m from a person. There were others working on the pipe deck at the time.

Had the bolts working free allowed a larger/heavier part of the elevators to fall, or the elevators to fail releasing their load, AND Had the routine to clear the rig floor not been rigorously followed, then someone could have been struck by an object with sufficient energy to kill them.

3.

The risk of dropped objects was recognised; the procedure followed was to clear the rig floor before raising the elevators high in the derrick. With no-one on the rig floor there is no possibility of a fatality from a falling object. A 0.25kg bolt from 30m is highly unlikely to kill someone.

Drill & WS

4.

The potential energy in a 750kg joint sliding uncontrollably down the catwalk is clearly sufficient to take someones legs away, such that they hit their head hard as they land, or against something as they go down, or get crushed against a bulkhead all have the basic capability to cause death. If the catwalk is raised the possibility may exist without adequate dropped object protection for the joint to fall off and cause a fatality.

If the catwalk was contained, such that there was never any possibility of someone being struck by the casing/lifting arrangement. If there were an enforced policy of no-one working in the contained area as the crane is being operated.

Version Oct 8th 2003

5.

Starting up a compressor without checking the other end of the hose The crew had rigged up and were about to start operations. They turned the compressor on, with the immediate result that a two inch hose, with its couplings, flailed uncontrollably around the deck. It was only good fortune that no one happened to be working near the hose at the time.

D & WS

6.

Catastrophic failure of a nipple During pressure testing to 5000psi, a NPT nipple failed catastrophically on a 2 1502 crossover. The test-fluid in use was water but it was noted that there had been some air in the lines in previous tests. The low-pressure test had initially shown a minor drop, and the line had been walked to checked for leaks, as was the usual practice. Eventually a satisfactory test had been achieved. Barriers were in place (and observed) to protect against casual approaches. As the pressure was being brought up from 500 to 5000psi, a bang was heard at 2600psi and fluid was seen escaping from the area of the nipple. A new hole was discovered in the wind-wall in the suspect area, but the nipple was never found. Accidental line penetration The team were erecting a pressurised habitat. A 3metre section of sheet metal had to be inserted to cover obstructions, one of which was a 4 hydrocarbon line. While drilling to secure the sheet metal with pop rivets, resistance was felt through the drill. Drilling was suspended. After removal of the sheet metal it was seen that the 4 line had been penetrated to a depth of approximately 3mm. Work stopped and the Area Operator was informed

7.

The hose may have been long enough to have potential to strike in the head. If this did occur - any serious head injury could lead to a fatality. During rapid movements the coupling could have become disconnected, resulting in a flying or dropped object. This could hit someone in the face causing serious injury that could lead to a fatality. Had the nipple failed when the person who was walking the line was nearby, 2500psi could have caused fatal injury, if the fitting had struck a vital organ. The investigation will have to look closely if: Barriers were in the right place (i.e. protecting the general public) those not watching or listening for leaks (and working nearby) could be at risk. Why did the item fail? (for example it was damaged or its certification had expired) Could this could have been a worse failure? could more than one elements have failed? or could a bigger element have failed? If the investigation found that. Detection system would not have detected gas prior to escalation The potential for escalation could have led to impairment of the pressurised unit The potential impact on the number of personnel working in the area at the time

A free 2 hose at 115psi would have energy to give a serious blow. The probability of a fatality is questionable. The hose would be much more likely to flail around at deck level and break a persons legs rather than leap up and strike them in the head? Before such a failure, there would be signs (lower pressure leaks, fluid loss, air leaks, etc.) that may attract the attention of the person if they were close to the fitting. The likelihood of failure, without signs at the precise time of arrival of an individual, with the consequence of the item striking the individual in a vital organ, should be carefully considered.

D & WS

If the investigation found that: The detection system was adequately designed with sufficient redundancy The hydrocarbon line was out of service.

Eng Maint.

Version Oct 8th 2003

8.

Collision of a riser with a welding location frame On completion of welding of a new riser, the welding habitat floor and roof were removed to allow the platform crane to transfer the riser to the support frame. The securing restraints, dead weight support, anchor restraints and dead weight support frame were removed. The Rigging Superintendent, positioned on the installation main deck, received the all clear to lift. During the lift the riser collided with the welding location frame. This dislodged a 16.2 kg shim, which fell into the sea through the deck opening. The operation was halted and a scaffold subsequently erected to allow the safe removal of a second shim.

9.

Release of hydrocarbons under pressure Using a compressed air gun, a fitter was breaking a 10 bolted flange downstream of an isolation valve, as part of the destruct for the subsequent installation of multi-phase metering tie-ins. After releasing the torque on the fourth nut, hydrocarbons under pressure were released from the line. The fitter promptly put down the gun and was assisted in re-tightening the bolts by spanner. He then informed his supervisor. The permit to work was withdrawn, and the pressure subsequently bled off and the line flushed. Investigation by the operator confirmed that the task had been incorrectly isolated.

Had any of the rigging personnel been looking up the riser with their head against it, for example while checking for points of impact, there is the potential for fatality. This would have to be assumed a HIPO if the investigation found that: Banksmen were exposed to the falling object Other personnel were exposed to the falling object, incorrect or missing barriers The item was not secured and could have fell at any time during the lift and therefore the exposure to personnel around the route of the lift. The LOLER lifting plan was significantly deficient Potential is dependent on the proximity of sources of ignition, volume of release and concentration of impurities such as H2S. Due to the nature of the tasks, it is likely that the pipework is in a zone-rated area but a windy gun carries a spark risk. The volume appears low asphyxiation unlikely to be a serious risk. In summary if the investigation found that: Significant volume of hydrocarbons could have been released The work team could have been seriously impacted by the release The detection systems would not have initiated a platform shutdown at this location.

Due to mass and geometry of the shim, it is unlikely to be carried sideways. If the investigation found that: The banksmen could not have been impacted by the object. The floor hatches were of a size that would not allow anyone to lean out to the danger zone. The barriers were fully operational and effective The LOLER lift plan adequately provided all safeguards

Eng Maint.

Potential for gross joint failure low (4 of 12 or 16 bolts), large release (to detonateable cloud) unlikely. If investigation found: Only a small inventory of hydrocarbons could have been released, i.e. small dead leg The work team could not have been impacted by the release The detection system was adequately designed for the location The procedure allowed for trapped hydrocarbons to be detected.

Eng Maint.

Version Oct 8th 2003

10.

11.

Falling Stinger A hose was being retrieved from the boat. The crane was involved in main-block work at the time and the hose retrieval was a one-off job prior to whip-line work. The correct practice of removing the stinger from the main block was not carried out. The hose became fouled over the side of the rig in a large fairlead. When moving the boom back and forth to free the hose, the 4m / 95Kg stinger, by now swinging freely on the main block, escaped the safety device on the hook. It fell 15-metres to the deck in the starboard-aft corner of the rig, landing on an anchor winch. Such corners generally have major access-egress points but this corner did not. Operations on the winches were very unlikely at this time. It was not considered possible that the stinger could have dropped on top of anyone. It was considered just possible that the stinger could have landed, flopped over and hit someone. Pressurised hose strikes emergency team member An emergency response team exercise had been completed using foam fire fighting equip. The fire hose in use had been de-pressurized and laid down on the deck. Three fire-team members were standing next to the foam branch discussing the exercise, when the fire main supply to the foam branch was restored. The foam branch did not have an on/off valve and thus was in open position. The restored pressure sent the attached foam branch (the weight of which is 6Kg) flying upward, striking a fire-team member a glancing blow on the helmet. He fell over and sprained his wrist.

Deck Ops

The comment that the SA corner of the rig does not have an access/egress point needs to be confirmed. It seems that falling on the anchor windlass was fortunate the possibility of falling elsewhere in the corner of the rig and any reasonable possibility that it might be occupied would make this a HIPO. If the stinger could have flopped over such an item could still give a considerable hit. The model where it hits the deck, flops over and hits someone as it falls should be considered a HIPO until the physics of that impact are examined. This decision centres on a rigorous examination of the likelihood of the area being occupied. The foam branch weighed 6KG, which is of sufficient weight to kill a person with, for example, a blow to the side of the head. The blow was to the IPs head - and had it hit 100cm to the left the he may have received a fatal blow.

The hose was caught outboard of the rig. In swinging the boom to free it a large part of the potential drop zone was overboard. This would dramatically reduce probability of risk on the rig (risk to the boat if it were still there would need to be assessed). The actual awareness of the deck crew of what was going on is also crucial in particular, any measures that they took to take themselves and any casual by-passers out of the frame.

Deck Ops

The foam branch flew up but did not flail about as would a compressed air hose. To have struck the IP on the side of the head is extremely unlikely.

Version Oct 8th 2003

12.

Danger of helicopter tail rotor Helicopter operations on a windy day; outbound passengers are disembarking on the helideck. A light rigbag blows across the deck and distracts the crew. Simultaneously, a disembarking green hand has trouble with his glasses, which are blown off. He chases them in the direction of the tail rotor and recovers them. He seems unaware of the danger and surprised by the helideck crew that are lunging at him - having initially also been distracted by the wayward bag. He claims to have been aware of the risks and within a reasonable safety envelope but several observers are of an opposite opinion.

Aviation

This sounds like momentary inattention it would be a challenge for an investigator to reach any comfort that the party was sufficiently aware. If he lost his glasses, he is likely to be less aware of the risk and more likely to walk into the danger. The bystanders - chopper and deck crew - view of the risk envelope points to a HIPO.

How green was this hand really how many flights is it likely that he really knew what the limits were? To what extent did he need glasses to see normally? were they perhaps reading glasses?