botminds.aiRequest a demo
SystemHSE, Process Safety & OT Security

Major Accident Hazard Reporting

A major accident hazard page for the board safety committee, where each sentence has an owner and each number opens the records behind it.

See the demoBook a demo
Follow one quarter's page from draft to decision ↓
The problem

Board process safety reporting leans on a count that is usually zero

Each quarter the VP of HSE tells the board how major accident risk is being managed. The headline is the count of the most serious process safety events, and at an average plant that count is zero in most quarters.

The warning signs live elsewhere: overdue safety-critical work in the maintenance system, long bypasses in a log, temporary changes past their end date, audit actions nobody chased. An analyst copies them into slides by hand and assigns tiers by hand, and a figure in the pack seldom leads back to a record.

When a site disagrees with a line, the argument happens on a call and by email, and it disappears with the old version. A log that stopped feeding reads as a clean zero.

Built forVPs of HSEProcess safety analystsSite managersBoard safety committeesInternal auditors

The Problem Today

Boards get top-tier event counts too rare to show anything, while warning signs sit in records nobody reads together.

4 in 5
quarters with no top-tier event at an average refinery our estimate
77
top-tier events at 92 refineries in a year, lowest in 15 years published

Opened system by system today

  • Work orders
  • Bypass logs
  • Changes
  • Actions
  • Weeks of copyingEach site's figures rebuilt by hand into a pack
  • Numbers with no trailA board figure rarely leads back to its record

The Solution

  1. Reads every siteWork orders, bypass logs, changes and audit actions, read only
  2. Refuses a false zeroA log that stopped prints as not known, never as a comfortable zero
  3. Joins signs by unitLate work, long bypasses and expired changes, where they land together
  4. The site owner answersEach sentence goes to its owner to agree or dispute, with records open

Built-in controls

  • A named person owns every sentence
  • Agents never sign or send to the board
  • Disputes stay on the record

What You Get

Directors read what the records show, where they worry the company and what they cannot tell anyone.

  • Weak signs in one placeLate work, long bypasses and expired changes, joined by unit
  • Questions reach a personAgents draft from the records; a named person answers the chair
  • Evidence on requestEach number opens its records, and the evidence pack downloads
One quarter, one working day

A calm major accident hazard page, and the coker sentence a site disputed

The draft went to the sites five days ago, and their answers are due in two. A refinery coker and a gas plant with a quiet bypass log fill the day.

demoSample data throughout: the company, its plants, the people on screen and each figure.

  1. 01First look

    The draft looks calm: no event ruled top tier, and 98.2% of tasks done

    Process safety analyst

    The page opens on a question, how do we know we are safe, and answers that the records cannot prove it. Below sit 22 sentences, each with its owner and state in the margin. No event is ruled top tier so far, and 3 still wait for a ruling.

  2. 02The read

    A gas plant's bypass log went quiet, and the page says not known

    Process safety analyst

    Seven sources at four places, 61,201 records, read only. One cell is red. The gas plant's bypass log ran at about 14 entries a week, then stopped when the plant moved its notes to a new shift log form. A count from that feed would print 0, so the gap finder marks it not known.

  3. 03The join

    Unit 31 is the only unit over all three warning lines

    Process safety analyst

    Late safety-critical tasks, bypasses over 30 days and temporary changes past their end date are joined by unit. Unit 31 holds 14, 3 and 2, and only 92.5% of its tasks were done. The joiner's note says it is not calling the unit unsafe, because the records cannot say that.

  4. 04Unit 31

    Of 14 late tasks, 9 have no deferral and 3 of those no planned date

    Process safety analyst

    Above the rows sits the definition: a task still open at quarter close counts, deferred or not, because a deferral changes the plan and not the due date. Filtered, 9 of the 14 have no approved deferral. The drum switch valve interlock test and the cutting deck H2S detector are among those with no planned date.

  5. 05Behind one sentence

    The blowdown drum ran high while its own trip had been bypassed 32 days

    Process safety analyst

    One sentence names a limit excursion. Its record says the blowdown drum level went over its high limit during a drum switch. Beside it sits the same instrument: the drum's high-high level trip, LSHH-3124, was bypassed when it happened, and its own proof test is late.

  6. 06The dispute

    The site manager calls the unit safe, and four phrases are flagged

    Site manager

    The site manager's wording says the unit is safe to operate, that the five deferred tasks are not overdue, and that the rest are planned and in hand. The claim checker lists what to test: safe, in hand, not overdue, and counts that differ from the records. It passes nothing, and marks the words not compared.

  7. 07The decision

    A third wording: 14 past due, 5 deferred to the turnaround, 9 with none

    VP of HSE

    Deciding is refused until the VP of HSE has opened each list behind the sentence, and the screen counts 3 of 3. A third wording keeps the full count of 14 and shows the 5 deferrals beside the 9 without one. With the print box left ticked, the committee reads the site manager's view under it.

  8. 08Fresh check

    Changed words get a fresh check: each list and one record from each

    Process safety analyst

    Changed words make earlier checks lapse. The analyst, who did not write them, opens the tasks, the bypasses and the temporary changes, and one record from each: here a temporary clamp on the coke drum overhead line, past its end date with no extension signed. Only then can the analyst say the records match.

  9. 09The late log

    The new log shows 2 long bypasses, at about half its normal rate

    Site manager and analyst

    From the gas plant comes the new shift log, 41 entries. The gap finder holds it, since it runs at about 7 entries a week against a normal 14. Only after opening all 41 does the analyst lift not known. Unit 530 moves to three warning signs, and the page says entries may still be missing.

  10. 10End of the day

    The page now prints both wordings, and 11 sentences still wait

    VP of HSE

    The decided sentence carries the full count with its deferrals, and under it the site manager's view, marked as not compared with the records. In the margin: who wrote it and who read it against the records. Two company sentences changed with the late log, so their owner agrees again. Still a draft: 11 of 22 wait.

The quiet log, the bypassed trip and the promise that went the other way

Four findings a headline zero would have carried to the board unread.

A zero that was a stopped log

The gas plant's bypass log stopped mid-quarter when notes moved to a new form. A report would have printed zero. Until the analyst opens the late entries, the page says not known.

Bypassed and late on the same tag

Three protections on Unit 31 are switched out while their own tests are late, among them the drum trip that was off when the blowdown drum ran high.

Deferrals that hid late work

Five of the 14 late tasks on the coker carry an approved deferral to the turnaround. Counted apart, 9 have none, and 3 of those have no date.

A promise to the committee missed

Last quarter the company told the committee it would bring Unit 31 under 5 late tasks. The count went from 6 to 14.

demoSample data, from the working solution.

Unit 31 went from 6 late tasks to 14 against a promise of under 5

The coker this quarter, beside the same unit on last quarter's page.

Sign on Unit 31Last quarterThis quarter
Safety-critical tasks past due614
Bypasses over 30 days13
Temporary changes past their end date02
Late tasks with no approved deferralNot split9

demoSample data, from the working solution. Across the company 98.2% of tasks were done; the coker alone reached 92.5%.

41 events in the quarter, and 3 sit in no count until two people rule

The tier classifier proposes a tier with its confidence. The analyst rules, and the VP of HSE countersigns.

Tier 1, ruledcomputed from rulings, owned by the VP of HSE0
Tier 2, ruled2
Tier 3 entries36
Waiting for a rulingin no count until ruled and countersigned3
Events in the quarter41

demoSample data, from the working solution.

Around the page

Process safety KPI reporting as the sites, the chair and the auditor see it

The quarter around that day, screen by screen. Click any screen for its full size.

The late log, entry by entryThe gas plant's new shift log, all 41 entries, with the bypasses past 30 days marked. Not known lifts only after the analyst opens these.
Each owner's sentencesEach site manager sees only their own sentences and the clock. Agreeing needs the records opened first, and lapses if the words change.
Questions from the chairA director asks the page. Agents draft from the records, and the draft waits for a named person before the chair reads any answer.
Quarter against quarterWhat moved since last quarter's page, and the five things the company told the committee it would do: 3 done, 1 late, 1 not yet due.
The path to the boardFive steps stand between the draft and the committee. Here 2 of 5 are done, the 12-record sample is not drawn yet, and no agent can sign.
The audit trailThe day in order, with old and new words on each change. The evidence pack downloads from here.

demoSample data, from the working solution.

Board process safety reporting with a named owner on each sentence

Agents write the first wording. People own each line from there.

Process safety analyst
Sees
The records behind each number, and the checker's prompts
Signs
Tier rulings, fresh checks on changed words, the record sample and the hand-over
Site manager
Sees
Only their own sentences, with the lists behind each one
Signs
Agrees after opening the records, or disputes the wording with a view for the board
VP of HSE
Sees
Each dispute with both wordings and what the checker flagged
Signs
Decides what the board reads, countersigns, then signs and issues
Committee chair
Sees
Issued pages, and answers a person has released
Signs
Nothing; asks the page questions
Internal auditor
Sees
All of it, with the audit trail and the evidence pack
Signs
Nothing; reads only
The agents

Seven agents read, join and write the page, and none of them signs it

Each hands its work on, and each has a line it cannot cross.

Record reader

Reads seven sources at four places and ties each record to a unit.

  • Never writes to a source
  • Never fills a blank
Gap finder

Checks each feed week by week before any count is printed.

  • Never prints a zero from a stopped source
Tier classifier

Proposes a tier for each event, with a confidence and a passage.

  • Never rules a tier
  • Sends low confidence to the analyst
Signal joiner

Counts signs by unit and finds the same tag both late and bypassed.

  • Never ranks a unit as safe
  • Lines change only with a signature
Page writer

Writes the plain page and gives each sentence an owner.

  • Never adds a conclusion a count does not support
  • Never removes a fixed limit
Claim checker

Tests the agents' own sentences against their records and lists prompts.

  • Never marks typed words as passed
  • Never rewrites silently
Question answerer

Answers plain record lookups from directors, with sources.

  • Forecasts and yes-or-no safety questions reach a named person
  • No field how-to

What a VP of HSE asks before a major accident hazard page reaches the board

What is major accident hazard reporting?

Major accident hazard reporting is the quarterly account a VP of HSE gives the board of how major accident risk is being managed. Here agents read each site's safety records and write one plain page, and each sentence goes to a named owner to agree or dispute before the VP of HSE signs.

Why are top-tier process safety performance indicators not enough for a board?

The most serious events are rare. On published figures, an average refinery has none in most quarters, so a zero says little about one plant. This page puts late safety-critical work, long bypasses and expired temporary changes beside the count, unit by unit.

Which process safety leading indicators does it join?

Overdue safety-critical tasks, safety system bypasses held past a set length and temporary changes past their end date, with audit actions shown beside them. A unit is marked when it reaches a line. The analyst proposes the lines and the VP of HSE signs them.

What happens when a site disagrees with a sentence?

The site manager disputes it with their own wording and a view for the board. After opening the records, the VP of HSE decides. The view prints under the sentence unless it is removed with a stated reason, which marks the page and tells the site. Changed words get a fresh check by a second person.

Where does the data stay, and for how long?

In your company's own cloud tenant, in the region chosen at install. Issued pages and evidence stay thirty years, working drafts seven.

HSE, Process Safety & OT Security

More for process safety leads and the plants behind the page

All 10 solutions →
Safety Case Management

Claims re-tested against current records each night, so drift shows up the next morning.

1-min demoBarrier Management

Every barrier shows what its records say, with the sentence that proves it.

1-min demoProcess Safety Information Management

Relief valves with no full sizing reason found, each with a relief engineer and a date for its study.

1-min demo

Bring last quarter's board pack
and we will open its numbers.

We'll take one of your past quarters and show which sentences its records hold up, and which they cannot.

Book a demoBrowse solutions