Practitioner’s Section

Engineering an Instrument to Evaluate Safety Critical

G.L.L. Reniers, W. Dullaert, B.J.M. Ale, F. Verschueren, K. Soudan

Due to the higher workload it produces, reducing the size of operational teams in the chemical process industry can have a negative effect on the ability to control abnormal situations, fatigue, etc. A lack of qualified operational personnel in unusual conditions and the resulting lack of process control can trigger a series of internal or external accidents, eventually leading to a major accident. This paper suggests a practical method to evaluate the safety critical staffing levels required to meet performance specifications for safety critical activities. For single plants as well as for clusters of chemical plants, the method also enables consul-tants and inspectors to consequently apply principles to assess those manning levels representing the last but one line of defense in the prevention of major accidents.


The organizational structure, responsibilities, practices and procedures which comprise a chemi-cal prevention policy are all fixed in the so-called Safety Management System (SMS). One of the key points of such a SMS concerns organization and personnel issues. Guidelines give recommenda-tions to streamline personnel tasks and responsi-bilities as well as recommendations to establish organizational procedures (such as education and training programmes) with respect to safety.
To date, there have been no directives on safety critical staffing levels. Neither has a best practice been established for the required quantity and/or quality of plant employees needed to monitor cer-tain safety critical tasks which prevent a Loss of Containment (LOC). However, sufficient capable personnel on the job are needed to guarantee safety critical activities to be performed safely. Since there is a large diversity of safety cultures within the chemical process industry, the means of dealing with the Safety Critical Staffing Level issue is highly dependent on individual companies. To the best of the authors’ knowledge, a harmonized guideline document for evaluating personnel oc-cupancy in chemical installations does not exist. Nevertheless, evaluating the quality and quantity of operating team staffing levels is a topic of increas-ing interest to both the Government and industrial area safety management. At present, the matter is subject to discussion and debate among companies as well as between the industry and the authorities. A reason for the growing concern is illustrated in Figure 1.





The index figures make it easy to compare the evolution of productivity and employment over time. Figure 1 illustrates that the Production In-dex, i.e. a business cycle indicator expressing the volume of output and business activity of the in-dustry, increased by 15 index points over a period of eight years. At the same time, the Employment Index measuring the changes in employment at regular intervals decreased by 9 index points be-tween 1996 and 2004. The steep rise in productiv-ity, combined with the gradual decrease in em-ployment in the chemical industry, could increase the likelihood of having to resort to the last but one line of defense to prevent a LOC, should in-sufficient staff be allocated to perform safety criti-cal activities. An immediate result would be the increased probability of an accident entailing dam-age. Making the choice of the required safety criti-cal manning levels in a chemical industrial area more transparent could prove to be a new chal-lenge to safety and risk management. Of course, living with risks remains essentially a management question [2].
To enhance safety by optimizing staffing ar-rangements within the chemical industry, a safety critical staffing evaluation methodology is needed to offer practical and usable results to inspectors and to plant and cluster management.

Research objectives

This paper aims at providing support to the chemical industry by objectively evaluating the completeness, the soundness and the quality of safety critical production manning levels with a view to tackling abnormal safety critical circum-stances. A real-life example would be the 4-day siege in November 2003 during which the man-agement of a Belgian paint factory were held hos-tage by unsatisfied employees [3]. Other circum-stances (the list is non-exhaustive) which satisfy the term “abnormal” and in which the size of op-erational teams can be necessarily restricted, are for example a strike (e.g. internal: the next team will not go to work and prevents access to produc-tion level, making a shift team change impossible; external: a truck drivers’ strike), serious terrorist threat (e.g. hindering or preventing access to an industrial area), a major accident in the neighbour-hood of a production installation or at an installa-tion of an adjacent company, a general power sup-ply failure, etc.
Safety managers need guidance on the various requirements for safety critical manning arrange-ments. A user-friendly document could offer an indication about the issues that have to be im-proved in terms of staffing levels by suggesting a variety of recommendations depending on the particular problem identified, e.g. improving the safety critical documentation, improving the alarm-management, enhancing communication between different control rooms, increasing the number of manning levels, etc.


The literature on the subject of staffing levels is limited, indicating that little research has been done in this area. Even in renowned reference works, e.g. “Loss Prevention in the Process Indus-tries” [4], methods, studies, or accident reports in-vestigating the relationship between incidents and staffing levels are not discussed.
The HSE document by Brabazon and Conlin [5] is the most important work on the topic, offer-ing a method for assessing the manning levels in the control room (CR) of one or several chemical installations. The extensive instrument has two parts: a “physical assessment” and a “ladder as-sessment”. The first type uses assessment trees to scan the CR manning levels with respect to six fundamental principles. Organizational factors such as training and development are evaluated with the help of ladder assessments. Using the document, bottle-necks in CR personnel arrange-ments can be pro-actively detected and handled. Unfortunately, this rather complicated instrument fails to evaluate field operators and its results are not specifically targeted at assessing the staffing levels in safety critical circumstances. Therefore, the document does not meet the final objectives of this examination, i.e., a user-friendly ad-hoc review of all manning levels (including CR operators and field operators) of a cluster/plant to prepare for specific abnormal situations.
Since there is diversity in chemical plant safety cultures, every company has built up its own method to satisfy its specific needs regarding safety and employment. Therefore, it is not likely to use a harmonized instrument with merely quan-titative information to compare safety employment structures of different companies. A qualitative procedure [6] allows for the fact that two com-pletely different methods used for addressing a specific manning level problem can be equivalent in their effectiveness.

Empirical results

The study thus far identified theoretical methods to assess staffing arrangements. However, these documents are based on ideas and abstract principles rather than on practical aspects or case studies. In order, therefore, to become acquainted with common practices in the industry as regards manning levels, safety engineers and production managers at 2 multinational chemical companies as well as 2 consultants specialized in determining staffing levels were interviewed. Current practices concerning staffing levels and safety activities were mapped.

Safety activities

The activities designed to ensure safe opera-tions at chemical installations can be divided in terms of the different situations in which they must be executed. A distinction is made between “Standard Safety Activities”, “Safety Critical Ac-tivities” and “Emergency Activities”.

Standard Safety Activities are activated in the case of so-called “High Alarms”. If these interven-tions are not performed, an unsafe/dangerous situation can occur, possibly leading to the distur-bance of process safety, but not yet leading to an accident. The second type of activities, i.e. Safety Critical Activities, is activated in situations charac-terized in the industry as being “High High Alarms”. If the necessary interventions do not take place in such circumstances, this might lead either to an activation of the final line of defense, i.e. an automatic or a mechanical safety function, or di-rectly to a Loss of Containment (LOC). Whatever the case, the probability of a resultant accident with damage substantially increases if no Safety Critical Activities can be supported by the available staff. The final type of activities becomes activated in emergency situations resulting from a LOC. This type is called Emergency Activities and con-sists of mitigation measures to control the damage. Figure 2 depicts the different types of safety ac-tivities. Figure 3 illustrates the different lines of defense in controlling a chemical process.





The last line of defense makes use of Automatic or Mechanical Safety Functions. Automatic Safety Functions act in three stages: first they measure critical chemical process parameters, second they decide upon the need for action and finally they work automatically if required. These functions require electricity to be activated. Mechanical Safety Functions (e.g. a safety valve) are self-sustainable and do not require electricity for their performance. An extreme deviating process condi-tion suffices to activate these functions.

To minimize the probability of having to use the last line of defense when handling chemical installations is essential for obtaining sustainable safety. The safety dependency on the last line of defense goes hand in hand with the following drawbacks. On the one hand, Automatic Safety Functions require electricity for solid and reliable functioning and thus installation safety depends on electricity availability. On the other hand, me-chanical safety functions can in fact be seen as controllers of small Loss Of Containments pre-venting a large LOC.

Staffing levels

Table 1 offers an overview of definitions of the different possible types of manning levels in the industry, ranking them in decreasing order. An attempt is made to position the Safety Critical Staffing Levels on this scale.





To determine minimum staffing arrangements for process operations, two main types of methods are used in the industry. One option is to deter-mine staffing levels aimed at guaranteeing produc-tion at all times. This leads to the implementation of Standard Safety Staffing Levels. Another option is to establish staffing levels in accordance with safety considerations, resulting in Minimum Staff-ing Levels. The latter choice obviously requires less manning than the first option.
Methods used by consultants to minimize staff-ing levels in the CPI emanate from considering worst-case scenarios, e.g. the shutdown of chemi-cal installations as a result of an electrical power supply failure. In case tasks which have to be fulfilled are listed, providing insights into the need of all sorts of functions and their numbers under these abnormal conditions in order to guar-antee the performance of Safety Critical Activities. To further optimize staffing levels, the sequence of activities can be examined to evaluate the necessity of parallel execution. If activities can be performed in a serial manner, manning can be reduced even further. Although at first sight appealing, this ap-proach has some disadvantages. Under abnormal circumstances, operators are already under a great deal of pressure increasing even more the likeli-hood of them committing errors. Furthermore, cutting the manning levels leads to a lack of back-up operators, which can be of crucial importance should there be a situation in which abnormal cir-cumstances combine (e.g. when a domino accident occurs).
To determine Safety Critical Staffing Levels and thus optimize the last but one line of defense to prevent major accidents at a chemical installation, a trade-off between the activities ensured by Minimum Staffing Levels and those ensured by Standard Safety Staffing Levels should be made by industrial area management. On the one hand, production does not have to be guaranteed under every circumstance if activities ensuring the pre-vention of major accidents are not affected, which implies that Standard Safety Staffing Levels can be regarded as the maximum of the “safety critical manning”. On the other hand, safety has to be guaranteed under every circumstance with a cer-tain degree of back-up, suggesting that Minimum Staffing Levels should be taken as a minimum for “safety critical staffing”. Therefore, the optimal Safety Critical Staffing Levels are situated in be-tween the two types of staffing levels currently used in industrial practice.


The principles

 Reniers et al. [8] point out that the use of checklist analysis is very widespread and well-known in the chemical process industry. More-over, checklist reviews are very user-friendly and can be applied to diverse subjects [9, 10]. There-fore, an evaluation instrument is elaborated in the form of a checklist to consider safety critical tasks in the control room as well as in the field. Each company has its own trade-offs between the num-ber of personnel and the technology present, automatisation, communication structures, team structure, etc. Given that there is thus no generally accepted definition of a “best safety manning level” regarded as valid for all industrial areas, technological, human and organizational factors have to be kept in mind while making a staffing level assessment. Therefore, the method is devel-oped to cope with different possible physical con-figurations within the staffing level arrangements in an industrial area. The possible configurations are:


  • One or more operators with all-round competence are responsible for the activities in the control room and in the field;
  • One or more CR operators who permanently staff the control room and one or more field operators working only in the field.  Eventually, within both groups, competences can be arranged in such a way that operators are in-terchangeable;
  • Field operators who are not permanently present, but who may be summoned from elsewhere within the plant/cluster to assist one or more permanent CR operators under safety critical situations;
  • Control room operators and field operators not constantly present, but who may be summoned from elsewhere within the plant/cluster to ensure a safe situation under safety critical circumstances.

During the staffing level arrangement assess-ment, the safety and the lay-out of the industrial area is subject to evaluation. The lay-out of the company/cluster and of the control room is in-vestigated in terms of whether operators are able to move from one point to another within certain time limits, the consequences resulting when op-erators are not able to be in a particular place within a given time are identified and the reliability of the supporting equipment and the supporting documentation is questioned.
In summary, the evaluation verifies whether Safety Critical Staffing Levels in an industrial area affect the reliability and timeliness of detecting safety critical problems, diagnosing them, and lift-ing recovery to a safe state. Therefore, conditions such as the number of people required, the means necessary and the competences needed to be able to guarantee safety in the case of calamity is checked against six principles (see Table 2).





The instrument is conceived to identify the possible bottle-necks of personnel organization and to find a solution for a problem under abnor-mal circumstances. To do this, four questions for every principle are addressed:


  • Can the principle be violated?
  • In what way has the principle been/could the principle be violated?
  • What are the measures to counter the vio-lation?
  • Are these measures reliable and effective?

Failing on one of the above questions indicates a gap in the industrial area’s personnel organiza-tion and implies that actions are required to deal with this failure. Because each “failure” is different a gradation is added to the different assessments, e.g. A is considered “best practice”, D “worst practice“. If an industrial area fails to be situated in the A or B category, the staffing level safety in the area is insufficient and some measures are needed. Directives for such measures are given in the evaluation instrument itself. For example, to be able to improve from category C to category B, a back-up alarm warning system might be installed.
It is also important first of all to check whether operators have the knowledge and the skills to perform their tasks as required and secondly to check whether the safety policy within the com-pany/cluster meets all the requirements.

Personnel to be interviewed

Generally speaking, it is not possible to inter-view every person who might be involved in a possible sudden abnormal situation concerning safety staffing levels. Nevertheless, it is important to interview as many different people as possible concerned in practice with the problem(s) at hand. Whatever the circumstances, safety management, production management and supervisors are inter-viewed. If possible, other stakeholders to be inter-viewed include:


  • CR operators and field operators. The recommendation is to interview experi-enced and inexperienced operators as well as operators belonging to different shift teams;
  • Assisting personnel offering support dur-ing safety critical circumstances, e.g. by giving technical advice or answering tele-phones;
  • Management and administrative personnel with knowledge of operational procedures and reliability of materials and systems.


To enhance the objectivity of staffing level evaluation, certain documents are required to ver-ify the answers when filling in the checklist. When evaluating an answer from the questionnaire, the final judgement depends on the evidence given by the people answering the checklist. If the answers accompanied by the necessary documents are con-sidered insufficient to underwrite staffing level safety on a specific topic, the area fails for this topic. Extra documents which might be needed include estimation calculations or experiments (simulations) regarding the amount of time needed to react to incidents, data of previous accidents and/or observations of exercises, reliability studies of critical equipment, etc.


Safety critical activities

To determine Safety Critical Staffing Levels, the relationship needs to be identified between the activities to be executed in abnormal circumstances and the corresponding staffing levels. Figure 4 presents an overview of operating a chemical installation.





The reciprocal relationship between activities performed on an installation and the different pos-sible staffing levels of the same installation needs to be investigated to guarantee that Safety Critical Activities can be performed in unusual circum-stances. Figure 5 illustrates the different paths leading to an accident if the last but one line of defense fails and offers suggestions to determine the activities that have to be taken into account in the checklist.





In Figure 6, a decision chart is given to distin-guish between activities which select the activities to be catalogued as “Safety Critical Activities” in the evaluation.
The tasks emerging from Figure 6 are those which define the Safety Critical Staffing Levels in this research. Once the Safety Critical Activities are identified, the evaluation document as developed in the next section can be used.




The safety critical staffing evaluation instrument

The instrument, which amounts to a checklist, puts forward a number of binary (yes/no) questions related to the six principles of Table 2. All questions lead to an indirect evaluation of the possibility of performing the Safety Critical Activities (listed as a result of executing the Figure 6 decision chart) in an industrial area. The checklist answers should provide a clear insight into the ability of an industrial area to handle safety critical problems in the field and in the control room(s). To verify whether the interviewees interpret the questions in the right way, a control question (indicated “C.Q.”) is inserted for each yes/no question. This C.Q. is an open question asking for evidence, information and documentation to support the “yes” or “no” rating on the binary question. The complete instrument is shown in the appendix.

Evaluating the checklist results

As indicated before, three parameters are im-portant for monitoring process installation safety, i.e. detection, diagnosis and recovery of problems.
For each of these three issues, two principles are checked. The evaluation of every principle, and hence every question, leads to a safety critical staff-ing ranking ranging from “A” to “D”. Table 3 offers an easy-to-use ranking tabulation, indicating the company Safety Critical Staffing Levels’ failures.
In the “Total Ranking” boxes, the worst of the combined ranking outcomes is always assigned for each problem parameter. For example, if ranking principle 1 = 1A, and ranking principle 2 = 2C, then the total ranking for detection of problems would be “C”. The implications of the ranking de-grees A, B, C or D in terms of the final decision are given in Table 4.





An effective industrial area Safety Management System is characterized by the solid evaluation of its constituents. A very important topic for managing safety in process installations is the quality and the quantity of staffing levels required to perform safety critical activities. These activities represent the last but one line of defense for preventing accidents. This paper provides a user-friendly checklist for evaluating the manning levels in an industrial area to meet the needs of plant or cluster safety management as well as of government safety inspectors. The information required for using the checklist can vary considerably from cluster to cluster and facility to facility. Therefore, the checklist provides guidelines for collecting the right information to support the evaluation of the current staffing levels.


This work was partially supported by the Belgian Government (Project CRC/WPS/13). This support is gratefully acknowledged. It should be stressed, however, that the contents of the paper, including all opinions and/or conclusions expressed, are those of the authors alone and do not necessarily reflect the Belgian Government in any way.






[1] Available online:


[2] Ale, B.J.M. (2005), Living with risk: a management question, Rel. Eng. & System Safety 90, pp 196-205.


[3] Available online:


[4] Lees, F.P. (1996), Loss Prevention in the Process Industries, 2nd Ed., Butterworth Heinemann, Oxford, United Kingdom.


[5] Brabazon, Ph., Conlin, H. (2001), Assessing the safety of staffing arrangements for process operations in the chemical and allied industries, Health and Safety Executive, London, United Kingdom.


[6] Center for Chemical Process Safety (1993), Guidelines for auditing Process Safety Management Systems, New York, United States.


[7] Belgian Federal Public Service Employment, Labour and Social Dialogue (2001) Procesveiligheidsstudie: een praktische leidraad voor het analyseren en beheersen van chemische procesrisico's, CRC/IN/002-N, Brussels, Belgium.


[8] Reniers, G.L.L., Dullaert, W., Ale, B.J.M., Soudan, K., (2005) The use of current risk analysis tools evaluated towards preventing external domino accidents, Journal of Loss Prevention in the Process Industries 18 (3), pp 119-126.


[9] Greenberg, H.R., Cramer, J.J., (1991) Risk Assessment and Risk Management for the Chemical Process Industry, J. Wiley and Sons, New York, United States.


[10] Center for Chemical Process Safety (1992), Guidelines for Hazard Evaluation Procedures, 2nd Ed., New York, United States.