Lessons from Oil & Gas: Process Safety, Digital Twins and Readiness

■ The oil and gas industry's safety culture was built in the aftermath of disaster: Piper Alpha, Deepwater Horizon and, closer to home, Montara. ■ Its hardest lesson: good injury statistics don't mean a catastrophe can't happen. Major-hazard risk has to be managed separately and deliberately.

■ Eight practices transfer to fire services: major-hazard thinking, bow-tie analysis, the safety case and leading indicators, digital twins, asset integrity, stop-work authority, realistic drills, and human factors. ■ The industry has also seen cyber attacks reach physical operations. That is why digital twins and connected systems must be secured as safety-critical.

■ This edition adds what four major disasters taught the industry, step-by-step guides to bow-ties and safety cases, examples of leading indicators, a pre-season scenario, a cyber bow-tie, and a staged roadmap. The oil and gas industry's safety culture was built in the aftermath of disaster. Piper Alpha in 1988 killed 167 people in the North Sea.

Deepwater Horizon in 2010 killed 11 workers and caused one of the largest environmental disasters in history. Closer to home, the Montara well blowout in the Timor Sea in 2009 led to an uncontrolled release that lasted 74 days.

Each disaster brought major inquiries, reforms and new ways of thinking about major-hazard risk. Many of those reforms are directly relevant to fire services. 167 lives lost at Piper Alpha, 1988 11 workers killed on Deepwater Horizon, 2010 74 days uncontrolled release at Montara, 2009 An offshore platform serviced by a supply vessel.

Major-hazard industries manage catastrophic risk deliberately. Source: Photo by J.f Manzanero, Unsplash Why this matters now for fire services Fire services have always managed dangerous work. What has changed is the scale, frequency and variety of exposure.

Longer and more intense fire seasons mean more days in conditions where burnover is possible. More floods mean more swiftwater rescues. Longer campaigns and interstate deployments mean more long-distance driving by tired crews.

And the health risks of the job are now better understood: in 2022 the International Agency for Research on Cancer classified occupational exposure as a firefighter as carcinogenic to humans. At the same time, agencies are becoming more dependent on technology, from dispatch and crew tracking to aviation management and public warnings. Each of these systems is now part of the safety chain.

In this environment, managing safety mainly through injury statistics and procedures is no longer enough. Fire services need a way to understand and control the rare but catastrophic events that matter most. That is exactly what oil and gas has spent decades building.

Four disasters and what they taught The oil and gas industry's approach to safety cannot be understood without its disasters. Each revealed a different weakness, and each led to reforms that are directly relevant to emergency services.

Piper Alpha, 1988 On 6 July 1988, a series of explosions and fires destroyed the Piper Alpha platform in the North Sea, killing 167 people. Lord Cullen's public inquiry found that a pressure safety valve had been removed for maintenance, and that the paperwork showing it was out of service was not properly communicated at shift change. When a pump was started that evening, gas escaped and ignited.

The fire spread because connected platforms kept pumping oil and gas into the pipelines feeding it, and many of those who died had gathered in the accommodation block waiting for instructions that never came. What it taught: permit-to-work systems, shift handovers, emergency command, and the need for regulators to require operators to demonstrate that major hazards are controlled. Lord Cullen's 1990 report made 106 recommendations and led to the UK's safety case regime.

Texas City, 2005 In March 2005, an explosion at BP's Texas City refinery in the United States killed 15 people and injured around 180. Investigations by the US Chemical Safety Board and an independent panel led by former US Secretary of State James Baker found that the company had focused on personal safety measures, such as slips and trips, while process safety risks were not adequately managed or measured. What it taught: good personal injury statistics can hide catastrophic risk.

Process safety needs its own measures, leadership attention and investment. Montara, 2009 In August 2009, an uncontrolled release began from the Montara wellhead platform in the Timor Sea, off the coast of Western Australia. It continued for 74 days.

The Montara Commission of Inquiry identified failures in well integrity and in regulatory oversight. What it taught: strong, independent regulation matters. Reforms after Montara led to the creation of the National Offshore Petroleum Safety and Environmental Management Authority (NOPSEMA) in 2012, with responsibility for safety, well integrity and environmental management offshore.

Deepwater Horizon, 2010 In April 2010, a blowout on the Deepwater Horizon drilling rig in the Gulf of Mexico killed 11 workers and caused one of the largest marine oil spills in history. The US National Commission on the BP Deepwater Horizon Oil Spill found a series of management and technical failures, including the misinterpretation of a critical well test and the failure of the blowout preventer, against a background of time and cost pressure. What it taught: organisations can normalise warning signs, especially under pressure.

Barriers that are assumed to work must be tested, and decisions under pressure need structured challenge. The common thread Across all four, the immediate causes were technical, but the underlying causes were organisational: poor communication, unclear accountability, the wrong measures, weak challenge and barriers that had quietly degraded. These are not oil and gas problems.

They are high-consequence organisation problems, and emergency services face the same risks. Lesson 1: Major-hazard safety thinking Oil and gas separates personal safety (slips, trips, falls) from process safety (low-probability, catastrophic events). Good personal safety statistics do not mean a major disaster can't happen.

Several catastrophic accidents

happened at sites with strong lost-time injury records, because the measures being watched were not the ones that predicted disaster. For fire services: low injury rates on routine shifts don't guarantee safety on a catastrophic fire day. Agencies need to measure and manage major-hazard risk separately, such as burnover, entrapment, aircraft accidents, flood rescue and vehicle rollovers during deployment, with board-level visibility.

Why injury rates mislead Lost-time injury rates measure how often people are hurt in common, everyday incidents. They are useful, but they say little about the risk of rare, catastrophic events, which have different causes and need different controls. An organisation can steadily reduce sprains and cuts while the controls that prevent a disaster quietly weaken.

That was a central finding of the Texas City investigations. Major hazards in a fire service A fire service's major-hazard register might include: ■ Burnover or entrapment of crews. ■ Aircraft accidents, including mid-air collisions and accidents involving drones.

■ Vehicle rollovers and crashes, especially on long drives and unsealed roads. ■ Swiftwater and flood rescue incidents. ■ Structural collapse during urban firefighting.

■ Hazardous materials exposure. ■ Long-term exposure to carcinogens and contaminants. ■ Psychological injury from cumulative trauma.

■ Loss of critical systems such as dispatch, communications or warnings. Each deserves its own analysis, controls, measures and executive owner. A NSW Rural Fire Service crew working a fire edge with a hose line.

Burnover and entrapment are major hazards that need their own analysis, controls and owners. Source: Photo by Darren Covington

Separating the two in practice Separating personal safety from major-hazard safety doesn't mean running two safety systems. It means asking different questions and reporting different measures: ■ Personal safety asks how often people are hurt in everyday work, and how to reduce it. It is measured with injury rates, and managed through procedures, equipment and supervision.

■ Major-hazard safety asks what could kill several people at once, or cause irreversible harm, and whether the controls against it are working. It is measured with barrier health and leading indicators, and managed through engineering, systems, training and leadership attention. Executive and board reports should give each its own section, so a good month for sprains and strains can't mask a deteriorating picture for burnover or vehicle rollovers.

Lesson 2: Bow-tie analysis and the "Swiss cheese" model Bow-tie analysis maps a hazard's threats, preventive barriers, consequences and recovery barriers in one picture. James Reason's "Swiss cheese" model shows how accidents happen when holes in several layers of defence line up at the same time. Seeing barriers weaken before they fail.

Source: Darren Covington For fire services: bow-ties for burnover, swiftwater rescue, aircraft operations and hazmat would make barriers visible and owned. Live data can then show when a barrier is weakening, for example when a communications blackspot coincides with a fire run and an escape route is compromised. The power of the bow-tie is that it turns abstract risk into a conversation crews, commanders and executives can all have.

“Good injury statistics don't mean a catastrophe can't happen.”

Building a bow-tie step by step 1 Name the hazard and the top event. For example, the hazard is a fast-moving fire, and the top event is a crew being caught by it. 2 List the threats that could cause the top event: a wind change, a spot fire, poor visibility, loss of communications, fatigue.

3 List the consequences if it happens: injuries, deaths, loss of appliances, psychological harm. 4 Identify preventive barriers between each threat and the top event, such as forecasting, lookouts, briefed escape routes and fatigue limits. 5 Identify recovery barriers between the top event and each consequence, such as safety zones, vehicle protection systems and medical response.

6 Identify escalation factors that could weaken a barrier, such as smoke reducing visibility or radio blackspots, and the controls for them. 7 Assign owners to each barrier and decide how its health will be checked. Barrier health The real value of a bow-tie comes when it is connected to information about the condition of each barrier.

Are weather forecasts current? Is communications coverage available in this sector? Are crews within fatigue limits?

Are vehicle protection systems serviced? A dashboard showing barrier health across an incident, region or season turns the bow-tie from a static diagram into a live tool for decisions. Lesson 3: The safety case and leading indicators After Piper Alpha, Lord Cullen's inquiry led the UK to introduce the safety case regime, and Australia's offshore regulator NOPSEMA uses the same approach.

Operators must show that major-hazard risks have been identified and reduced to as low as reasonably practicable. The industry also tracks leading indicators, the signs before an incident happens, not just lagging indicators that measure harm after the event. For fire services: leading indicators could include training currency, equipment availability, crew fatigue levels, communications coverage, fuel load trends and the gap between forecast and actual resource availability.

They give early warning that the system is under strain, before a season or an incident exposes it. What a safety case could look like for a fire service A safety case is a structured argument, supported by evidence, that an organisation understands its major hazards and has reduced the risks as far as reasonably practicable. A fire service version might include: ■ A description of the organisation, its services and the environments it works in.

■ The major-hazard register, with bow-ties for each major hazard. ■ The critical barriers, their owners and performance standards. ■ The evidence that barriers are working, such as audits, verification data and exercise results.

■ The safety management system: training, competence, procedures, maintenance, change management and incident learning. ■ Emergency arrangements for when things go wrong. ■ A plan for improvement, with commitments and timeframes.

Emergency services are not subject to an offshore-style safety case regime, and there is no suggestion they should be. But preparing one voluntarily is a powerful discipline, and a useful way for executives and boards to test their understanding of major-hazard risk. Leading and lagging indicators Lagging indicators tell you what went wrong.

Leading indicators tell you what might go wrong next. Examples of leading indicators for fire services: ■ Share of crews with current training in burnover drills and vehicle protection systems. ■ Share of appliances with serviced vehicle protection systems before the season.

■ Fatigue exceedances in the last month. ■ Communications coverage gaps in high-risk areas. ■ Overdue maintenance on critical equipment.

■ Share of after-action review actions completed on time. ■ Gap between planned and actual crew numbers on high-risk days. Lesson 4: Digital twins and integrated operations Oil and gas operators build digital twins of platforms, refineries and pipelines: live virtual models fed by sensors that can simulate scenarios and predict failures.

Integrated operations centres let onshore experts support offshore crews in real time. For fire services: digital twins of high-risk communities, catchments and critical infrastructure could simulate fire spread, flood inundation, evacuation traffic and infrastructure failure. They could test "what if" questions before the season, such as what happens if this road is cut, this substation fails or this aged care facility needs evacuating.

Integrated operations centres could let specialists support crews anywhere in the state. Building a community digital twin A community digital twin brings together several layers of information: ■ Terrain and vegetation, including fuel loads and moisture. ■ Buildings and infrastructure, such as homes, schools, hospitals, aged care facilities, substations, water treatment plants and telecommunications towers.

■ Transport networks, with road capacities and likely bottlenecks during evacuation. ■ Hydrology, including river catchments, flood models and drainage. ■ People, including population patterns by time of day and season, and vulnerable residents, held under strict privacy controls.

■ Live feeds from weather stations, sensors, cameras and traffic systems. With these layers combined, planners can test scenarios such as a fire approaching from the west on a Catastrophic day, or a river peaking two metres above the previous record, and see the effect on evacuation times, infrastructure and response.

Watch-outs Digital twins are only as good as their data and assumptions. They need regular validation against real events, clear documentation of their limits, and governance over who can use them and for what. They also need strong security, as the cyber section below explains.

Integrated operations in oil and gas Many oil and gas operators run onshore support centres that monitor offshore facilities in real time. Engineers, maintenance planners, drilling specialists and safety advisers can see the same data as the offshore crew and help solve problems as they arise. This lets scarce experts support several facilities at once, and gives offshore teams access to knowledge they would not otherwise have.

The parallel for fire services is clear: specialist fire behaviour analysts, hazardous materials advisers, structural engineers and hydrologists supporting incidents across a state, using shared live data, rather than travelling to each one or advising by phone without the full picture. Lesson 5: Condition-based maintenance and asset integrity Asset integrity management, which means knowing the real condition of every critical asset, is fundamental in oil and gas. For fire services: knowing the real-time condition of appliances, pumps, breathing apparatus, aircraft, communications infrastructure and stations means readiness reports reflect reality rather than assumptions.

Asset integrity in practice Asset integrity means knowing, with evidence, that critical equipment will work when it is needed. In oil and gas, that involves inspection programs, maintenance records, defect tracking and performance standards for safety-critical equipment. For fire services, safety-critical equipment includes breathing apparatus, vehicle protection systems, pumps, radios, personal protective equipment and the vehicles themselves.

Each should have a performance standard, an inspection regime and a clear rule for what happens when it fails. Lesson 6: Permit to work and stop-work authority Oil and gas uses permit to work systems to control hazardous activities, and gives every worker stop-work authority: the right and the duty to stop any task they believe is unsafe, without fear of blame. For fire services: a culture where any crew member, career or volunteer, feels empowered to call a halt, backed by leaders and systems that support it, is one of the most powerful safety barriers there is.

Making stop-work authority real Stop-work authority only works if people actually use it. Oil and gas companies found that a written policy was not enough. What made the difference: ■ Leaders who thank people for stopping work, even when it turns out to be unnecessary.

■ No blame for raising concerns in good faith. ■ Simple, well-known language for calling a stop, so there is no confusion in the moment. ■ Stories shared of times when stopping work prevented harm.

■ Follow-up on every stop, so concerns are addressed and lessons are learned.

In fire services, this connects naturally with existing principles such as the right to refuse unsafe work, and with crew leaders' responsibility for their people. The challenge is making sure it works for volunteers and junior crew members as well as for experienced officers. An offshore platform in heavy seas.

Readiness is built through realistic, frequent exercises. Source: Photo by Julia Taubitz, Unsplash Lesson 7: Emergency preparedness and drills Offshore operators run realistic, frequent emergency exercises, often including regulators and emergency services. For fire services: frequent multi-agency exercises using simulation and digital twins, joined by industry partners and critical infrastructure operators, build familiarity and trust before the real event.

The best exercises are uncomfortable. They test the plan against the worst day, not the expected one. Designing better exercises Exercises range from simple to complex: ■ Discussion exercises, where people talk through a scenario and their roles.

■ Functional exercises, where specific functions, such as a control centre or a communications system, are tested under realistic conditions. ■ Full-scale exercises, where people, equipment and agencies deploy as they would in a real event. The most useful exercises have clear objectives, realistic scenarios drawn from real data, honest evaluation and tracked actions.

They should regularly include partner agencies, critical infrastructure operators and, where relevant, industry. Lesson 8: Human factors and crew resource management Oil and gas, like aviation, has embraced human factors and crew resource management: structured communication, situational awareness, challenge-and-response and teamwork under stress.

For fire services: human factors training for incident management teams and crews improves decision-making in the high-stress, high-fatigue conditions of major events, and helps people speak up when something doesn't look right. Crew resource management skills Crew resource management originated in aviation after accidents in which capable crews failed to share concerns or coordinate. Its core skills translate directly to incident management teams and fire crews: ■ Situational awareness: building and sharing an accurate understanding of what is happening.

■ Communication: clear, closed-loop communication, where messages are confirmed back. ■ Decision-making: structured approaches for time-critical choices. ■ Teamwork and leadership: clear roles, mutual support and leaders who invite challenge.

■ Workload management: recognising and managing overload in yourself and others. ■ Assertiveness: the confidence and responsibility to speak up when something seems wrong. Lesson 9: Management of change Many major accidents in oil and gas have been linked to changes that were not properly assessed: a modification to equipment, a new procedure, a staffing reduction or a reorganisation.

The industry responded with formal management of change processes, which require any significant change to be assessed for its effect on major-hazard risk before it is made. For fire services: change is constant. New appliances, new technology, new rostering models, restructures, mergers and changing volunteer numbers all affect safety in ways that are not always obvious.

A simple management of change process asks: ■ What is changing, and why? ■ Which major hazards and critical barriers could be affected? ■ What could go wrong during the transition, as well as after it?

■ Who needs to be consulted, including crews, volunteers and partner agencies? ■ How will we know if the change has weakened a barrier? Applying this discipline to the introduction of new digital systems is especially important.

A new dispatch platform, crew tracking system or operations centre changes how critical information flows, and its failure modes need to be understood before it goes live. Lesson 10: Learning from incidents and near misses Oil and gas companies, and the industry as a whole, put considerable effort into learning from incidents and near misses. Many use structured investigation methods that look beyond individual error to the organisational factors behind it, and share safety alerts across companies so that one operator's near miss becomes everyone's lesson.

For fire services: near misses on the fireground, such as a crew that had to use a safety zone, a vehicle that nearly rolled, or an aircraft that came too close to a drone, are valuable warnings. Capturing and learning from them requires:

■ A just culture, where people report honestly because they know the focus is on learning, not blame. ■ Easy reporting, including for volunteers, ideally from a phone after the event. ■ Proportionate investigation, with deeper analysis for events with high potential consequences.

■ Sharing across agencies and jurisdictions, through AFAC and other national forums, so lessons spread quickly. ■ Closing the loop, by telling reporters what changed as a result. Lesson 11: Contractors and partners Much of the work on oil and gas facilities is done by contractors, and the industry learned that safety performance depends on managing them as part of the same system.

Contractor selection, induction, supervision and performance review are all part of process safety. For fire services: large responses rely on contracted aircraft, heavy plant operators, catering, accommodation, logistics and technology providers, as well as partner agencies. Each brings its own people, equipment and systems into the response.

Applying oil and gas practice means: ■ Pre-qualifying contractors for safety and security before the season. ■ Inducting contracted personnel into fireground safety rules, communications and command arrangements. ■ Including contractors in exercises, particularly aviation and heavy plant operators.

■ Holding technology providers to security standards, since their systems and remote access can affect critical capabilities. Applying the same thinking to long-term health Process safety is usually discussed in terms of sudden catastrophic events, but its methods work just as well for slower harms. Firefighter cancer and psychological injury are major hazards in their own right: low visibility day to day, high consequence over a career.

Applying oil and gas thinking: ■ Treat contaminant exposure as a major hazard, with a bow-tie covering exposure at the fireground, in vehicles, at stations and at home. ■ Identify critical barriers, such as respiratory protection, on-scene decontamination, clean cab practices, separate storage for contaminated gear and laundering. ■ Track leading indicators, such as the availability of decontamination kits, compliance with clean-and-dirty separation, and health monitoring participation.

■ Do the same for psychological injury, with barriers such as manageable exposure, peer support, early intervention and recovery time after traumatic events. The data involved is sensitive health information and must be protected accordingly, but the discipline is the same: know the hazard, know the barriers, check that they work.

What safety leaders do differently Studies of high-reliability organisations, and the experience of oil and gas companies that improved after disasters, point to a set of leadership behaviours: ■ Chronic unease. Good safety leaders assume something could be going wrong and go looking for it, rather than taking good news at face value. ■ Visible presence.

They spend time where the work is done, asking open questions and listening. ■ Bad news welcomed. They reward people who raise problems, so problems surface early.

■ Consistency under pressure. They hold to safety standards when time, cost or public pressure push the other way. ■ Learning orientation.

They treat incidents and near misses as opportunities to strengthen the system, not to find someone to blame. Illustrative scenario: the pre-season readiness review The following scenario is illustrative. Six weeks before the fire season, a regional executive team reviews its major-hazard dashboard.

The dashboard shows: ■ Burnover drill training is current for 78% of crews, against a target of 95%. ■ Three appliances have vehicle protection systems overdue for service. ■ A new subdivision on the edge of town is outside reliable radio coverage.

■ Fatigue exceedances were high during last season's longest campaign. ■ Two after-action actions from last season remain open. None of these has caused an incident.

All are warning signs that barriers could fail on a bad day. The team assigns owners and deadlines: additional training sessions on weekends for volunteers, priority servicing for the three appliances, a portable repeater for the new subdivision, and a review of campaign rostering rules. At the next monthly review, progress is checked against the same indicators.

This is what leading indicators are for: fixing problems before they meet a fire. Assurance: the role of independent oversight One of the clearest lessons from Montara and Deepwater Horizon is that organisations need independent challenge. In Australia's offshore industry, NOPSEMA assesses safety cases, inspects facilities and investigates incidents.

Operators know their arrangements will be examined by someone outside the organisation. Emergency services already have forms of independent oversight. Several states have inspectors-general or similar bodies for emergency management, and major events are regularly reviewed by independent inquiries.

The opportunity is to use that oversight proactively, before major events rather than only after them, for example by commissioning independent reviews of major-hazard controls, readiness and cyber resilience ahead of high-risk seasons.

Internal assurance matters too. Agencies can use internal audit, peer reviews between regions or jurisdictions, and structured self-assessments against their own bow-ties and leading indicators. The goal is the same: to find weaknesses before a fire or flood does.

Cyber security at the core: when digital risk becomes physical risk Cyber security at the core: secure by design, not bolted on. Source: Darren Covington Oil and gas has seen what happens when cyber attacks reach operations. The 2021 ransomware attack on Colonial Pipeline in the United States led the operator to shut down a major fuel pipeline as a precaution, disrupting supply across a large region.

In 2017, the malware known as Triton (or Trisis) targeted the safety instrumented systems at a petrochemical facility: the very systems designed to prevent catastrophe. The lesson for fire services is that cyber risk is a major-hazard risk, and should be managed with the same discipline as burnover or entrapment: ■ Put cyber on the bow-tie. Treat a ransomware attack on dispatch, or the manipulation of a warning system, as a threat line with preventive and recovery barriers.

■ Secure the digital twin. A digital twin holds a detailed map of a community's vulnerabilities, including where vulnerable people live and which infrastructure matters most. It must be protected as sensitive information, with strict access control and auditing.

■ Protect safety-critical systems first. Crew tracking, warnings and dispatch get the highest security maturity, independent monitoring and tested manual fallbacks. ■ Track cyber leading indicators.

Patch currency, multi-factor authentication coverage, backup restore tests and phishing exercise results belong in the same dashboard as fatigue and equipment readiness. ■ Rehearse a cyber incident during a fire. Exercise the combined scenario, because attackers may choose the worst possible moment.

Australia's Cyber Security Act 2024, the Security of Critical Infrastructure framework and the ASD Essential Eight give agencies a clear baseline. A cyber threat line on a bow-tie An illustrative example for computer-aided dispatch: ■ Top event: loss of dispatch capability during a major emergency. ■ Threats: ransomware, a compromised vendor connection, a failed software update, a power or network outage.

■ Preventive barriers: multi-factor authentication, patching, application control, segmented networks, vendor access controls, change management, redundant power and network links. ■ Recovery barriers: tested manual dispatch procedures, offline resource lists, backup systems, incident response plans, tested restoration from backups. ■ Escalation factors: an attack timed for a high-risk day, staff unfamiliar with manual procedures, backups that have never been restored.

Seen this way, cyber security becomes part of the same safety conversation as burnover and vehicle safety, with the same discipline of owners, verification and leading indicators. Securing the digital twin in detail Because a community digital twin combines so much sensitive information, it deserves particular care: ■ Classify the data in each layer, and apply stronger controls to the most sensitive, such as information about vulnerable residents. ■ Limit access by role, so planners, incident teams and partner agencies see only what they need.

■ Log and review access, so misuse can be detected. ■ Separate planning and operational versions, so experimentation can't affect live operations. ■ Check the integrity of live feeds, so manipulated sensor data can't distort the model during an event.

■ Host it under Australian jurisdiction, with clear contractual controls on any provider. Putting it into practice: a staged roadmap First 90 days ■ Create a major-hazard register separate from personal injury reporting. ■ Build bow-ties for the top three fatal hazards, including the loss of critical systems.

■ Choose an initial set of leading indicators and start reporting them. First year ■ Complete bow-ties for all major hazards and identify critical barriers and owners. ■ Pilot a secure digital twin for one high-risk community.

■ Formalise stop-work authority for career staff and volunteers. ■ Introduce crew resource management training for incident management teams.

Years two to three ■ Prepare a voluntary safety case and have it independently reviewed. ■ Connect barrier health to live data where possible. ■ Extend digital twins to other high-risk communities and use them in exercises.

■ Exercise combined physical and cyber scenarios at least annually. Measuring success ■ Major-hazard reporting: frequency and quality of reporting to executives and boards. ■ Barrier health: share of critical barriers verified as effective.

■ Leading indicator trends across seasons. ■ Stop-work events: how often they are used and how they are followed up. ■ Exercise actions: share completed and tested.

Barriers and how to overcome them ■ Language. Terms like "process safety" and "safety case" can feel foreign. Translate them into the language of fire services: fatal hazards, critical protections, evidence that they work.

■ Data. Many leading indicators rely on data that is scattered or incomplete. Start with a small set that can be measured reliably.

■ Workload. Bow-ties and safety cases take time. Focus first on the hazards that kill people, and use them to simplify rather than add procedures.

■ Culture. Stop-work authority and near-miss reporting depend on trust, which is built through consistent leadership behaviour over time. ■ Funding.

Digital twins and live barrier monitoring require investment. Pilots in high-risk communities can demonstrate value before wider rollout. What leaders should do next ■ Report major-hazard risk separately from personal injury statistics, at executive and board level.

■ Build bow-ties for your top five fatal hazards, including a cyber threat line. ■ Agree a set of leading indicators and review them before and during each season. ■ Pilot a secure digital twin for one high-risk community, with security designed in from day one.

■ Formalise stop-work authority for career staff and volunteers alike. Questions for boards and executives ■ Do we report major-hazard risk separately from personal injury statistics? ■ What are our critical barriers against the worst outcomes, and how do we know they are working?

■ Which leading indicators tell us we are getting weaker before something goes wrong? ■ Would a junior volunteer feel able to stop unsafe work? ■ How would we cope if a cyber attack hit our dispatch system on a Catastrophic day?

Glossary ■ ALARP: as low as reasonably practicable, the standard for reducing major-hazard risk in many safety regimes. ■ Asset integrity: confidence, supported by evidence, that critical equipment will perform when needed. ■ Bow-tie analysis: a diagram linking threats, a top event and consequences, with barriers on each side.

■ Leading indicator: a measure that gives early warning that risk is increasing. ■ Lagging indicator: a measure of harm that has already happened. ■ Process safety: the management of low-frequency, high-consequence events.

■ Safety case: a structured argument, supported by evidence, that major-hazard risks are controlled. Further reading ■ The Hon Lord Cullen, The Public Inquiry into the Piper Alpha Disaster (1990). ■ The Report of the BP U.S.

Refineries Independent Safety Review Panel (the Baker Panel, 2007). ■ US Chemical Safety Board, Investigation Report: Refinery Explosion and Fire, BP Texas City (2007). ■ Report of the Montara Commission of Inquiry (2010).

■ National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, Report to the President (2011). ■ James Reason, Managing the Risks of Organizational Accidents (1997). Which oil and gas safety practices would make the biggest difference in emergency services?

#EmergencyManagement #FireServices #OilAndGas #ProcessSafety #DigitalTwin #CyberSecurity #SafetyCulture #HumanFactors #LeadingIndicators #Australia Darren Covington writes on intelligence-driven emergency services, climate resilience, technology and cyber security in Australia. Photo credits: J.f Manzanero / Unsplash; Darren Covington; Julia Taubitz / Unsplash. Unsplash photos are used under the Unsplash Licence.

Other photos and graphics © Darren Covington.