Hse Offshore Guide

HEALTH AND SAFETY EXECUTIVE HAZARDOUS INSTALLATIONS DIRECTORATE OFFSHORE DIVISION

GUIDANCE FOR THE TOPIC ASSESSMENT OF THE MAJOR ACCIDENT HAZARD ASPECTS OF SAFETY CASES

April 2006

1

CONTENTS 1. GENERAL 6 2. VESSEL IMPACT 12 2.HS1 Loss of Integrity of Structure, Process, Pipelines, Wells 16 2.HS2 Fatalities of Workforce 16 2.G1 Attendant and Passing Vessels 18 2.G2 Failures: Positional, Navigational, Navigational, Procedural, Procedural, Human Error 20 2.F1 Likelihood Factors [including historic data] 22 2.F2 Loss of Integrity to Installation Systems 23 2.F3 Fatalities to Workforce 23 2.F4 Subsea Facilities, Exclusion Zone 25 2.F5 Verification, Testing & Inspection 26 2.F6 SBVs, Communications Communications & Procedures 27 2.F7 SBVs, Visual & Radar, Platform Mounted Radar, Automated Systems 28 2.F8 Procedures [Including Vessel Contracting, Vessel Suitability, Platform Operations, Inspections, Marine Operations and Combined Operations] 29 2.F9 Physical Protection 30 2.F10 Robust Structure, Plant and Equipment 31 3 LOSS OF STRUCTURAL INTEGRITY 32 3.HS1: Fixed Steel Installations 36 3.HS2: Fixed Concrete Installations 36 3.HS3: Semi Submersible Installations 36 3.HS4: Ship Shaped/Floating Shaped/Floating Installations 36 3.HS5: Jack-Up Installations 36 3.G1: Extreme Weather, including Wave-In-Deck Loading 39 3.G2: Fatigue Failure 39 3.G3: Corrosion 39 3.G4: Marine Growth 39 3.G11: Foundation Failure 39 3.G12: Scour 39 3.G13: Seismic Event 39 3.G5: Poor Fabrication Procedures/Materials Procedures/Materials Defects/ Materials Failure [Brittle Fracture]42 3.G6: Topsides Overloading 42 3.G7: Change of Use/Structural Modification 42 3.G17 Inadequate Management Management System Procedures 42 3.G18: Inadequate Design 42 3.G19: Inadequate Inspection, Inspection, Repair & Maintenance Maintenance During Fabrication Fabrication and Operation 42 3.G20: Inadequate Re-assessment Re-assessment 42 3.G21: Inadequate Verification 42 3.G22: Operator Error 42 3.G8: Fire 47 3.G9: Explosion 47 3.G10: Blowout 47 3.G14: Boat Impact 47 3.G15: Helicopter/Aircraft Helicopter/Aircraft Impact 47 3.G16: Dropped Objects 47 3.F1: Hazard Studies [HAZOPs etc] 49 3.F2: Generic Historical Data 49 3.F3: Installation Specific Data 49 3.F4: IVB Data 49 3.F5: Reliability Reliability Analysis 49 3.F6: Extent of Structural Damage/Failure Damage/Failure 49 3.F7: Reduced Redundancy, Remaining Residual and Reserve Strength 49 3.F8: Remaining Fatigue Life 49 3.F9: Concept Selection 52 3.F10: Use of Best Design Practice 52

2

3.F11: Use of Suitable Safety Factors 3.F12: High Redundancy Redundancy - Inherent Safety 3.F13: Optimum Materials and Fabrication Procedures 3.F14: Maintenance Management Management Procedures 3.F15: Sufficient Air Gap for 10,000-year Storm 3.F16: Suitable Safety Factors [Fatigue, Applied Loading, Pile loads etc] 3.F17: High Redundancy Redundancy - Prevention 3.F18: Maintenance and Repair Management Procedures 3.F19: Control Measures [Management/Structural] [Management/Structural] for Accidental Loads 3.F20: Suitably Rated Fire and Blast Walls/Use of PFP etc 3.F21: Maintenance & Repair Management Procedures 3.F22: System Management Procedures for Accidental Loads 3.F23: High Redundancy Redundancy – Mitigation 4.1 LOSS OF MARITIME INTEGRITY - LOSS OF STABILITY 4.1.HS1 Jack Ups 4.1.HS2 Semi Subs 4.1.HS3 Monohulls 4.1.HS4 Other Types 4.1.G1-G5 Initiators 4.1.F1-F29Risk 4.1.F1-F29 Risk Evaluation Measures 4.1.F30-49 Risk Management Measures 4.2 LOSS OF MARITME INTEGRITY - LOSS OF POSITION 4.2.HS1 Mooring System 4.2.G1-G5 Initiators 4.2.F1-F16 Risk Evaluation 4.2.F17-F35 Risk Management Management Measures 4.2.HS2 Dynamic Positioning 4.2.G1-G5 Initiators 4.2.F1-F16 Risk Evaluation 4.2.F17-F35 Risk Management Management Measures 5.1 LOSS OF CONTAINMENT - PROCESS 5.1.HS1:Pressure 5.1.HS1: Pressure Vessels (Including Columns) 5.1.HS5:Piping 5.1.HS5: Piping and Piping Components 5.1.HS12: Valves 5.1.HS2:Heat 5.1.HS2: Heat Exchangers 5.1.HS3:Atmospheric 5.1.HS3: Atmospheric Vessels [eg Wemcos, TPSs] 5.1.HS4:Centrifuges/Hydrocyclones 5.1.HS4: Centrifuges/Hydrocyclones 5.1.HS6:Smallbore 5.1.HS6: Smallbore Tubing 5.1.HS8:Flexible 5.1.HS8: Flexible Hoses 5.1.HS9:Pumps 5.1.HS9: Pumps 5.1.HS10: Compressors 5.1.HS11: Turbines 5.1.HS13: Deck Tanks 5.1.HS15: Hazardous Drains/Caisson Drains/Cais son 5.1.HS17: Flare Towers 5.1.HS18: Mechanical Integrity of FPSO Mooring Turrets 5.1.HS19: Temporary Equipment 5.1.G1 Part 1: Corrosion: Internal 5.1.G1 Part 2: Corrosion: External 5.1.G2: Erosion 5.1.G4 Internal explosion 5.1.G7: Fire 5.1.G24: Incorrect Material Specification 5.1.G26: Thermal Radiation 5.1.F1: Generic Historical Data 5.1.F2: Company and Installation Specific Data 5.1.F3: Installation Specific Hazard Studies

3

52 52 52 52 52 52 52 52 52 52 52 52 52 56 61 61 61 61 61 61 61 66 71 71 71 71 74 74 74 74 80 84 84 84 93 95 97 98 99 100 100 100 102 103 105 106 108 110 113 115 117 119 120 122 123 124 125

5.1.F4: Layout 5.1.F8: Safety Integrity Levels Standards 5.1.F10: Concept Selection 5.1.F11: Size of Release, Speed of Detection and Effectiveness 5.1.F12: Dispersion, Dispersion, Open or Closed Modules, Ventilation Rates 5.1.F14: Inherent Safety 5.1.F15: Relief Systems 5.1.F16: High Integrity Protection Systems [HIPS] 5.1.F17: Blowdown/Flare Blowdown/Flare Systems 5.1.F18: Shutdown Systems 5.1.F19: Alarm and Trip Systems 5.1.F23: Isolations 5.2 LOSS OF CONTAINMENT – PIPELINES 5.2.HS0:The 5.2.HS0: The Pipeline System 5.2.HS1:Rigid 5.2.HS1: Rigid Risers 5.2.HS2: Other Risers including Flexible Risers 5.2.HS3:Outboard 5.2.HS3: Outboard Pipeline 5.2.HS4:ESDV 5.2.HS4: ESDV Valves (ESDV) 5.2.HS5:Subsea 5.2.HS5: Subsea Isolation Systems (SSIS) 5.2.HS6:Pig 5.2.HS6: Pig Traps 5.3 LOSS OF CONTAINMENT – FIRE & EXPLOSION 5.3.F1: Ignition Probability 5.3.F3: Delayed or Immediate Ignition 5.3.F7: Escalation, Layout, Separation, Open/Closed Modules 5.3.F8: Fire Types 5.3.F9: Thermal Flux, Smoke Obscuration Effects 5.3.F10: Fire Modelling 5.3.F11: Explosion Modelling 5.3.F13: Intrinsically Safe Electrical Equipment 5.3.F14: Separate Accommodation Jacket 5.3.F17: Normally Unmanned Installations (NUI) 5.3.F19: Layout – No Jet Fire Targets 5.3.F20: Hazardous Area Zoning 5.3.F21: Electrical Equipment for Use in Potentially Flammable Atmospheres 5.3.F23 Fire/Smoke/Gas/Flame Fire/Smoke/Gas/Flame Detectors/Alarms Detectors/Alarms 5.3.F24 Firewalls 5.3.F25 Passive Fire Protection [PFP] 5.3.F26 Resistant Temporary Refuges 5.3.F27 Deluge & Sprinklers 5.3.F28 Ventilation and HVAC 5.3.F29 Blast Walls 5.3.F30 Suppression and Flame Arrestors 6. WELLS 208 7. DIVING 215 7.HS1: Divers Life Support Equipment 7.HS2: Diving Bell/Basket Systems 7.HS3: Deck Chamber Complex 7.HS4: Common Systems 7.HS5: Diving Platform 7.F1-F3: Risk Evaluation 7.F1-F3: Risk Evaluation 7.F4-F9: Risk Management Management Measures 8. HELICOPTER CRASH 8.HS1 Helicopters 8.HS2: Other Aircraft 8.F1-F9: Risk Evaluation 8.F10-F20: Risk Management Management Measures

4

127 129 131 132 133 134 136 138 140 142 144 146 147 151 159 162 165 168 171 175 178 181 182 184 186 187 188 189 191 193 194 195 196 197 199 200 201 202 203 204 206 207

220 222 224 226 228 230 232 234 236 239 239 242 244

9. NON PROCESS FIRES & EXPLOSIONS 9.HS1: Accommodation Accommodation Fires 9.HS2: Cellulosic Fires 9.HS3: Electrical Fires 9.HS4: Non Cellulosic Fires 10. Emergency Response 10.F1: Emergency Response Management 10.F2: Alarms and Communication Communication 10.F3: Temporary Refuge and Muster Stations 10.F4: Access/Egress Routes 10.F5: Evacuation 10.F6: Escape 10.F7: Rescue and Recovery 10.F8: Ship Collision 10.F9: Emergency Lighting 10.F10: Emergency Communications Communications 11. HUMAN FACTORS 11.G1: Human Error: Selection, Competence and Training 11.G2: Human Error: Stress, Fatigue, Shifts and Organisational Factors 11.G3: Human Error in Design 11.G4: ALARP & SFAIRP Awareness 11.G5: Command, Control, Communication Communication [C3] and Decision Making 11.G6: Procedural Integrity 11.G7: Permit to Work Systems 11.G8: Employee Involvement 11.G9: Organisational Organisational Change Management 11.G10: Knowledge Knowledge Management 11.G11: Contractualisation: Contractualisation: Communications Communications and Competence 11.G12: Multi Skilling/Multi Tasking 12. HUMAN VULNERABILITY VULNERABILI TY 13. QUANTITATIVE RISK ASSESSMENT [QRA] 14. GLOSSARY OF ABBREVIATIONS ABBREVIATIONS

5

246 249 251 252 254 255 257 259 261 263 265 267 269 271 273 275 279 280 282 284 286 288 290 292 294 296 298 300 302 304 306 307

1.

GENERAL

1

Introduction The purpose of this document is to provide a framework of topic assessment principles and guidance in respect of the assessment of the major accident hazard aspects of offshore safety cases. The aims of this framework of assessment principles and guidance are: •

to complement SCHAM in respect of topic assessment

•

to form a component of the OSD quality system for safety case assessment

•

to provide OSD with defensibility defensibility for the decisions made regarding the sufficiency of the technical content of offshore safety cases

•

to give greater transparency to the t he assessment decisions and criteria

•

to provide a basis for consistency in the assessment process and its outcomes

•

to facilitate effective interfacing between the various topic assessments

•

to provide guidance material for specialist assessors, including those who may be new to HSE, OSD or safety case assessment

•

to identify where there are ‘gaps’ in the supporting topic guidance

•

to identify, by reference, relevant technical policy and good practice

•

•

to assist assessors in the recording of judgements made during the assessment process [eg assessment briefs, issue notes, case completion reports, etc] by relating the judgements to particulars in the guidance to allow for peer review to be undertaken.

The document is intended primarily to assist topic assessors in undertaking assessment activities, but it does not purport to present definitive criteria in respect of the adequacy of the technical content of safety case submissions. submissions. Adequacy, or otherwise, otherwise, is context specific and can only be finally determined by topic assessors using experience and judgement. The document will also be valuable to case managers and deputy case managers in understanding the basis and scope of the assessment considerations considerations and the assessment outcomes. An aim of the guidance is to provide the offshore industry with reasonable clarification of HSE’s expectations of the technical content of safety cases. The guidance should enable assessment to be undertaken in accordance with the requirements of the Offshore Installations (Safety Case) Regulations 2005 [SCR], through consideration consideration of major accident hazards and the duty holder’s evaluation of risk and proposed risk control measures. Although the guidance indicates areas where measures for controlling risk are required, the document is not intended as an exhaustive statement of the available measures or of performance standards. standards. Whilst the guidance contains reference to specific standards, models, methodologies, etc as representing good practice, alternative approaches approaches proposed by a duty holder are likely

6

to be acceptable if the duty holder can demonstrate that the alternative approaches are equivalent, or better, in terms of health and safety, than those cited in the guidance. Information pertaining to the use of good practice and research information in safety case assessment is contained in SCHAM. The document can also be used to provide valuable reference material to identify good practice, together with industry, national and international standards, which will aid OSD’s inspection and enforcement activities. 2

Scope The scope of this guidance is intended to address the assessment of duty holder’s submissions in respect of SCR Regulation 12 (1). The scope does not include the administrative procedures to be adopted for safety case assessment which are addressed in SCHAM.

3

Safety Management Systems Safety management systems (SMS) encompass many of the systems and procedures, the failure of which are key causal factors in most accidents/incidents. Moreover leadership based on sound values and policies can lead to a climate of improvements and gains in health, safety and sustainability. SMS are relevant to the lifecycle of an installation i.e. from initial concept design to dismantlement. A safety case should contain sufficient information to indicate that a clearly defined safety management system is in place for the installation, which complies with current good practice which includes the following examples: HS (G) 65 Successful Health and Safety Management Plant guidelines for the technical management of Chemical Process Safety AIChE STEP Guide to SMS Interfacing Assessment Principles for Offshore Safety Cases [APOSC] - Management of health and safety - Principle 2 A Guide to the Offshore Installations (Safety Case) Regulations 2005 (L30). Regulation 12 paragraphs 176 to 186 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACoP and guidance (L65) GASCET Chapter 11 - Human Factors The SMS should encompass the marine, helicopter and diving activities of the installation, and relevant aspects of combined operations. The areas of interface between the SMS of these operations, and the SMS of the installation, need to be identified and assessed for clarity, to ensure no potential hazard from either duplication/commission or omission. One key SMS issue is the area of examination, maintenance, test, and verification of equipment: particularly where the equipment in question is a safety critical element, as defined under the scheme of verification required by SCR, or the scheme for the systematic examination of plant required by PFEER, this includes the competence, experience and supervision of those who operate and maintain these safety critical elements. There is an overlap with the aspects of SMS that deal with verification and examination schemes, and there may be some synergy in an integrated assessment of these. Furthermore, as the above safety critical elements and plant will be identified in the

7

fire and explosion risk assessment for the installation, there is a link to the topic areas of risk assessment (GASCET Section 13) and fire/explosion (GASCET Section 5.3). 4

Assessment of Adequacy In assessing the major accident hazard aspects of safety case submissions it is necessary to determine the adequacy of, inter alia , •

Hazard identification

•

Risk evaluation

•

Risk management measures [barriers and performance standards]

•

The demonstration of compliance with the relevant statutory provisions

The significance and importance of the components of the above is dependent on the specific aspects of the installation being considered, e.g. the installation type and lifecycle stage. Each section addresses both installation type and lifecycle aspects. In general the base case guidance is for an operational safety case. Where points do not apply for certain types of safety case, or additional points do apply this is specifically identified. To assist in the assessment process prompt lists have been developed based on the experience of HSE personnel and these are documented in a categorisation table in each of the major accident sections. Each section that deals with a hazard has a categorisation table having six sub-sections that provide supporting information: •

Source of Hazard

•

Initiators

•

Risk Evaluation

•

Risk Management Measures

•



Inherent Safety



Prevention



Detection



Control



Mitigation

Performance Standards

Additionally there are standalone sections for Emergency Response, Human Factors, Human Vulnerability and QRA. 4.1

Categorisation Table The prompt lists presented in the tables in each of the major accident hazard sections constitute a categorisation table for each major accident hazard. The categorisation table can be used in association with the installation specific aspects presented in the submission to identify sources of hazard and initiators that may combine to start escalation paths to a major accident, consequence paths that might thereafter ensue, and potential risk management measures. Where appropriate and available, areas where performance standards should be considered are identified.

8

4.2

Hazard Identification In general for a major accident to occur a source of hazard has to be present together with at least one initiator. In each major accident hazard section the appropriate categorisation table may include sub-classification of sources of hazard and does contain a number of ‘initiators’. Generally in each section the categorisation table contains grouping/subclassification of similar initiators. An assessor should examine the adequacy of the hazard identification in conjunction with the contents of the categorisation tables in each section.

4.3

Risk Evaluation The evaluation of the risk that might stem from each major accident hazard can be assessed by identification and evaluation of factors that might result in an adverse combination of source of hazard and initiator [causal chains], together with identification and evaluation of escalation paths that might result [consequence chains]. The information in each categorisation table under the heading of risk evaluation lists prompts to assist in assessing the adequacy of the duty holder’s identification and evaluation of such causal and consequence chains. These are subdivided into ‘likelihood factors’ [factors affecting the frequency of the major accident] and ‘consequences’.

4.4

Risk Management Measures The adequacy of the duty holder’s identification and selection of risk management measures and their proposed implementation should be assessed. Such measures can be classified as barriers. These may be one or more of engineering, procedural or human [also classified as hardware, software or live ware]. By priority the barriers can be categorised as: 

Inherent Safety



Prevention



Detection



Control



Mitigation

Each categorisation table contains potential risk management measures categorised according to these barrier types. An assessor should note that a duty holder might change the barrier emphasis to suit the company policy and/or the characteristics of a particular installation. An assessor should assess the adequacy of the barriers [and their associated performance standards] described in a safety case in combination for each major accident in the light of the nature of the hazards, the type of installation and the level of risk. 4.5

Performance Standards To assist in the assessment of the adequacy of the duty holder’s submission in relation to performance standards, areas where such standards might be required have been identified and listed in the categorisation tables in each section. Performance standards are generally installation and context specific and the adequacy of them must be judged on a case-by-case basis. In each section the relevant performance standards have been grouped into categories pertaining to the different risk management measures [barriers].

9

The associated text in each section provides details of, or reference to, good practice associated with each performance standard. In general the management of risks associated with major hazards for new installations should be better than for similar existing installations. Therefore for new installations and major modifications assessors should be looking for evidence that duty holders are adopting existing good practice [as a minimum], and for a clear indication how best practice is being addressed. 4.6

Depth of Assessment Each section provides an indication of the scope of assessment that is likely to be required according to the type of safety case and the nature of the circumstances. The depth of assessment is to be guided by the assessment and be sufficient to establish that the measures being taken will control the major accident risks so that the relevant statutory provisions are complied with.

In addition, in order to determine the adequacy of the demonstration of compliance with the relevant statutory provisions an assessor should consider whether a duty holder has adequately assessed the reasonable practicability of introducing further risk management measures, to further reduce risk. Where safety case contents match with good practice identified in the assessment sheets for a particular topic associated with a major accident, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue to follow-up through inspection. 5

Interfaces between Assessors: Each section provides an indication of the topic teams that have an interest in the major accident in general and in particular the risk management measures and their performance standards through cross-referencing to other section as appropriate. This should be used as a guide to where dialogue between topic assessors will be required.

6

Reference Documents: There are a number of documents that provide generic guidance. These are listed below. L30 A Guide to the Offshore Installations (Safety Case) Regulations 2005 Third Edition HSE Books 2006 ISBN 0 7176 9184 9 Assessment Principles for Offshore Safety Cases [APOSC] HSE Offshore Information Sheet 2/2006 Offshore Installations (Safety Case) Regulations 2005 Regulation 12 Demonstrating compliance with the relevant statutory provisions SPC/Permissioning/09 HID’s Approach to ALARP Decisions The HSE ALARP Suite of Guidance, comprising: a)

Principles and Guidelines to assist HSE in its Judgements that duty holders have reduced risks as low as reasonably practicable

b)

Assessing Compliance with the Law in Individual Cases and the Use of Good Practice

c)

Policy and Guidance on Reducing Risks as low as reasonably practicable in Design

10

d)

HSE principles for Cost benefit Analysis (CBA) in support of ALARP decisions

e)

Cost Benefit Analysis (CBA) Checklist

f)

ALARP ‘at a glance’

g)

Reducing Risks, Protecting People, HSE’s Decision Making Process [R2P2]

L21 Management of Health and Safety at Work ACOP Second Edition HSE Books 2000 ISBN 0 7176 2488 9 UKOOA Risk Framework Document

11

2.

VESSEL IMPACT

1.

Scope This section provides guidance for the assessment of safety case content with respect to vessel collisions, from hazard identification through to consequence determination, including risk management measures. Interfaces with other sections are identified.

2.

Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a hazard source and an initiator [causal chains], together with identification and evaluation of escalation paths that might result [consequence chains]. Two broad hazard sources can be identified and divided into a number of different vessel types thus: •

Attendant vessels

•

Passing vessels

For a major accident to be realised, these Hazard Sources need an Initiator. For vessel collisions, the following broad categories of Initiator are proposed: •

Positioning Failure

•

Navigational Failure

•

Procedural Failure

•

Human Error

Evaluation of risk will need consideration of the likelihood and consequence factors: •

Frequency

•

Consequence

The usual measures are employed in controlling the hazard: •

Inherent Safety

•

Prevention through

•



Procedures



Personnel



High Visibility



Incident Reporting and Analysis



Detection

Control through 

Quality Assurance



Operating envelope

12

•

•

3.



Procedures



Fenders/barriers

Mitigation 

Platform ESD system



Pipeline subsea ESD valve



Shock resistant plant



Physical protection



Structural integrity o

Robustness

o

Redundancy

o

Reserve strength

o

Double hulls

Emergency Response

Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where relevant sections of the safety case are consistent with the good practice identified in the assessment sheets, there will usually be no need for an assessor to probe into the details of the application of this practice. However, this may be a suitable issue to followup through inspection.

13

4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation Table below: Vessel Impact Source of Hazard HS1

Loss of Integrity

Initiators

Risk Evaluation


G1

Attendant and Passing Vessels

Frequency

Inherent Safety

G2

Failures

- Structure - Process - Pipelines - Wells HS2

Fatalities of Workforce

F4

Subsea Facilities, Exclusion zone

- Positional - Navigational - Procedural - Human Error F1

Likelihood Factors [including historic data]

14

Prevention

F5

Verification, Testing and Inspection

F6

SBVs, Communications and Procedures


Vessel Impact Source of Hazard

Initiators

Risk Evaluation

Risk Management Measures F7

SBVs, Visual & Radar, Platform Mounted Radar, Automated Systems

F8

Procedures [Including Vessel Contracting and Suitability, Platform Operations, Inspections, Marine Operations and Combined Operations]

Consequences F2

Loss of Integrity to Installation Systems [structural, process, pipelines, wells]

F3

Fatalities to Workforce

15

Mitigation F9

Physical Protection

F10

Robust Structure, Plant and Equipment


2.HS1

Loss of Integrity of Structure, Process, Pipelines, Wells

2.HS2

Fatalities of Workforce

1.

Confirmation should be obtained that the risks to the workforce, integrity of the structure, the topside process and safety related equipment, pipelines and wells from all foreseeable attendant and passing vessel collisions are or will be controlled to ensure compliance with the relevant provisions. This is achieved by a multidisciplinary approach using assessment sheets contained in the relevant sections.

2.

There are likely to be differing company standards used in demonstration and each should be examined for equivalence with general ALARP principles.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC]

4.

Specific Technical Issues: For passing vessels there should be time to take some form of emergency action and assessment should, in the main, be carried out in line with that in Section 10 Emergency Response. Attendant vessels may provide a more instantaneous vessel collision and hence it is expected that appropriate robustness is built into the installation engineering and safety systems.

5.

Other Related Assessment Sheets in this Section are: 2.F1

Likelihood Factors [including historic data]

2.F2

Loss of Integrity to Installation Systems

2.F3


2.F4

Subsea Facilities, Exclusion Zone

2.F5

Verification, Inspection, Testing

2.F6

SBVs, Communications, and Procedures

2.F7

SBVs visual and radar, platform mounted radar, automated systems

2.F8

Procedures - including Vessel contracting, vessel suitability, platform, operations, inspections, marine operations & combined operations

2. F9

Physical protection

2.F10 Robust Structure, plant and equipment 6.

Cross-Referenced Sections and Sheets are: Sheet 3.G14

Boat Impact

Sheet 4.1.G5

Collision/Grounding

Sheet 10.F8

Ship Collision

Section 11

Human Factors

16

Section 12 7.

Human Vulnerability

Lead Assessment Section for this Sheet: OSD5.5

8.

Team responsible for authoring and updating this sheet: OSD5.3

17

2.G1


1.

Confirmation should be obtained that the all foreseeable attendant vessels have been identified and that particular passing vessels that may be in the vicinity of the installation have been identified.

2.

The adequacy of vessel identification process can only be assessed on an individual basis. Typical vessels may include: •

•

Attendant vessels 

Standby vessels



Supply vessels



Multi-purpose vessels



MODUs



Semis



Jack-ups



Drill ships



Accommodation units



Shuttle tankers



Heavy lift vessels



Anchor handling vessels



Diving support vessels



Survey vessels



Well intervention vessels



Tugs



Barges



Multi-role vessels [standby and supply]



Pipe lay



Counter pollution vessels

Passing vessels 

All of the above [when headed for other installations]



Merchant vessels, including:



Ferries



Fishing craft



Pleasure crafts



Naval craft

18



Submarines

Further consideration will be required where installations are located in known shipping routes. 3.


4.

Specific Technical Issues: None

5.

Other Related Assessment Sheets in this Section are: None

6.

Cross-Referenced Sections and Sheets are: None

7.


8.


19

2.G2 1.

Failures: Positional, Navigational, Procedural, Human Error For a major accident to be realised, the collision of passing and attendant vessels is caused by a failure on those vessels. For vessel collisions, the following broad categories of Initiator are proposed: •

•

•

•

Positioning Failure 

DP failure



Mooring failure



Extreme weather



Installation moves



Weather vaning

Navigational Failure 

Watchkeeping failure



Navigation equipment failure



Navigation aids failure



Mechanical failure



Control system failure



Power failure

Procedural Failure 

Incorrect/Inappropriate



Not correctly applied

Human Error 

Commission/Omission/Fatigue

Specific assessment and guidance on these failures for passing vessels are outwith the scope of this document. However, some control can be expected on reducing the risk for initiators for attendant vessels. UKOOA Guidelines for Ship/Installation Collision Avoidance, 2003 2.

The above guidelines are generic in nature and treatment of the initiators for individual platforms and platform layouts should be assessed.

3.


4.

Specific Technical Issues

20

Initiators for attendant vessels will be vessel, company and installation specific. Assessment should seek out this information. 5.

6.

7.

Other Relevant Assessment Sheets in this Section are: 2.F5

Verification, Testing & Inspection

2.F6

SBVs, Communications, and Procedures

2.F7

SBVs Visual and Radar, Platform Mounted Radar, Automated Systems

2.F8

Procedures - Including Vessel Contracting, Vessel Suitability, Platform Operations, Inspections, Marine Operations & Combined Operations

Cross Referenced Sections and Sheets are: Section 4.1

Loss of Maritime Integrity - Loss of Stability

Section 4.2

Loss of Maritime Integrity - Loss of Position

Section 10

Emergency Response

Section 11

Human factors

Lead Assessment for this Sheet: OSD5.5

8.

Team responsible for authoring this sheet: OSD5.3

21

2.F1 1.

2.

Likelihood Factors [including historic data] Confirmation should be obtained that the likelihood of vessel collisions has been derived from a recognised model or from a local marine traffic survey. •

Use of software, ‘COAST, CRASH, COLLIDE, MAN’

•

Shipping surveys

•

Historic data

Where the hazard identification process listed above has not been used, judgement as to the adequacy can only be assessed on an individual basis. Further consideration will be required on an installation specific basis.

3.

•

Installation location, particularly when sited near known shipping routes

•

No dedicated standby vessel

•

Vessel control and speed

•

Point of contact with installation

•

Vessel orientation


4.


5.


6.


7.


8.


22

2.F2


2.F3


1.

Confirmation should be obtained that all consequences of a vessel collision have been considered. The consequences may involve many disciplines and a multidisciplinary approach should have been used.

2.

Where a multidisciplinary approach has not been used, the adequacy should be judged by examining the completeness of the technical consequences documented.

3.


4.

Specific Technical Issues: 







Injuries to people o

Direct contact

o

Strong vibration

Loss of structural integrity o

Direct contact

o

Strong vibration

o

Large relative deformation

Loss of stability o

Direct contact

o

Strong vibration

o

Large relative deformation

Loss of position o

5.

6.

Direct contact



Loss of containment



Loss of other safety critical equipment



Loss of EER


Physical Protection

2.F10

Robust Structure, Plant and Equipment

Cross-Referenced Sections and Sheets are:

23

7.

Sheet 4.1.G5

Collision/Grounding

Sheet 10.F8

Ship Collision

Section 11

Human Factors

Section 12

Human Vulnerability


8.


24

2.F4

Subsea Facilities, Exclusion Zone

1.

Confirmation should be obtained that, where appropriate in design cases only, subsea facilities have been considered in the concept selection thus providing inherent safety by eliminating the need for surface facilities. Where surface facilities are provided confirmation should be obtained that the safety system acknowledges the management of appropriate exclusion zone.

2.

Not applicable.

3.


4.

Specific technical issues: None

5.


6.

7.

Cross-Referenced Sections and Sheets are: Section 6

Wells

Section 11

Human Factors


8.


25

2.F5 Verification, Testing & Inspection 1.

Confirmation should be obtained that procedures and equipment for the prevention of collisions follow the requirements of the recognised guidance/codes of practice below: UKOOA Guidelines for Ship/Installation Collision Avoidance 2003 UKOOA Guidelines for Survey of Vessels Standing by Offshore Installations 2001 UKOOA Guidelines for the Management & Operation of Vessels Standing by Offshore Installations 2001. UKOOA Guidelines for the Safe Management & Operation of Offshore Support Vessels 2002. Guidance & ACOP to the Offshore Installations (Prevention of Fire & Explosion & Emergency Response) Regulations 1995 (L65) Further guidance can be obtained from: OTO 1999 052 Effective Collision Risk Management for Offshore Installations

2.

Where standard or guidance other than that listed above has been used, judgement as to the adequacy of the detection system can only be assessed on an individual basis. Alternative/additional measures may be required for other types of field arrangement or when standby vessel sharing is agreed.

3.


4.


5.

6.

7.


SBVs Visual & Radar, Platform Mounted Radar, Automated Systems

2.F8

Procedures [Including Vessel Contracting, Vessel Suitability, Platform Operations, Inspection, Marine Operations and Combined Operations]


Emergency Response

Section 11

Human Factors


8.


26

2.F6 1.

SBVs, Communications & Procedures Confirmation should be obtained that procedures and equipment for the prevention of collisions follow the requirements of the recognised guidance/codes of practice below: UKOOA Guidelines for Ship/Installation Collision Avoidance 2003 UKOOA Guidelines for Survey of Vessels Standing by Offshore Installations 2001 UKOOA Guidelines for the Management & Operation of Vessels Standing by Offshore Installations 2001 UKOOA Guidelines for the Safe Management & Operation of Offshore Support Vessels 2002 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 ACOP & Guidance L65 Further guidance can be obtained from: OTO 1999 052 Effective Collision Risk Management for Offshore Installations

2.


3.


4.


5.

6.

7.



2.F8



Emergency Response

Section 11

Human Factors


8.


27

2.F7 1.

SBVs, Visual & Radar, Platform Mounted Radar, Automated Systems Confirmation should be obtained that detection equipment, operation and procedures follow the requirements of the recognised guidance/codes of practice below: UKOOA Guidelines for Ship/Installation Collision Avoidance 2003 UKOOA Guidelines for the Management & Operation of Vessels Standing by Offshore Installations 2001 L65 Guidance & ACOP to the Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Further guidance can be obtained from: OTO 1999 052 Effective Collision Risk Management for Offshore Installations OTO 97 058 Performance of Standby Vessel Radar

2.

Where standards or guidance other than that listed above has been used, judgement as to the adequacy of the detection system can only be assessed on an individual basis. Alternative/additional measures may be required for other types of field arrangement or when standby vessel sharing is agreed.

3.


4.


5.

6.

7.



2.F6

SBVs, Communications & Procedures

2.F8



Emergency Response

Section 11

Human Factors


8.


28

2.F8

1.

Procedures [Including Vessel Contracting, Vessel Suitability, Platform Operations, Inspections, Marine Operations and Combined Operations] Confirmation should be obtained that the control of collision risks follow the requirements of the recognised guidance/codes of practice below: UKOOA Guidelines for Ship/Installation Collision Avoidance 2003 UKOOA Guidelines for the Safe Management & Operation of Offshore Support Vessels 2002 UKOOA Guidelines for Survey of Vessels Standing by Offshore Installations 2001 L65 Guidance & ACOP to the Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Further guidance can be obtained from: OTO 1999 052 Effective Collision Risk Management for Offshore Installations

2.


3.


4.


5.

6.

7.



2.F6


2.F7



Emergency Response

Section 11

Human Factors


8.


29

2.F9 1.

Physical Protection Confirmation should be obtained that all Safety Critical Elements [SCEs] within zones vulnerable to impact from attendant vessels are properly protected against damage due to direct impact, large relative deformations and strong vibrations. Examples of such SCEs are: •

Risers [possibly including associated ESD valves]

•

Conductors

•

Caissons

•

Escape routes and other EER related items

There is no specific guidance about what constitutes adequate protection, although some of the analysis techniques used in Section 3 Loss of Structural Integrity may be used to demonstrate strength through design. 2.

Due to the lack of guidance at present, adequacy can only be assessed on an individual basis. Further consideration will be required where damage to SCEs is tolerated on the basis that other safeguards are in place. This may require discussion with other topic teams.

3.


4.


5.


6.

7.



Loss of Structural Integrity

Section 5.1

Loss of Containment - Process

Section 5.2

Loss of Containment - Pipelines

Section 6

Wells

Section 10

Emergency Response

Lead Assessment Section for this Sheet: OSD5.1 to OSD5.3

8.


30

2.F10 Robust Structure, Plant and Equipment 1.

Confirmation should be obtained that the safety critical plant and equipment in the installation can sustain the large displacements and strong vibrations resulting from reasonably foreseeable collisions from attendant vessels [see Section 3 Loss of Structural Integrity]. For structures there is limited authoritative guidance in this area: ON 27 Status of Technical Guidance on Design, Construction and Certification Also two main methods are currently available: •

•

Qualitative – through techniques such as Walkdown Quantitative – by structural analysis coupled to survival criteria for the plant and equipment

2.

Due to the lack of guidance at present, adequacy can only be assessed on an individual basis.

3.


4.


5.


6.

7.

Loss of Integrity of Installation Systems



Section 5.1


Section 5.2


Section 6

Wells

Lead Assessment Section for this Sheet: OSD5.1 to OSD5.3 [structural aspects] OSD3 [plant and equipment]

8.


31

3

LOSS OF STRUCTURAL INTEGRITY

1.

Scope This Section provides guidance for the assessment of safety case content with respect to the loss of structural integrity of an installation, from hazard identification through to consequence determination, including risk management measures.

2.

Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator, together with identification and evaluation of escalation paths that might result. The loss of structural integrity major accident hazard sources have been classified as follows: •

Fixed steel installations

•

Fixed concrete installations

•

Semi submersible installations

•

Ship shaped/floating installations

•

Jack-up installations

For the latent major accident hazards to be activated towards a major accident, initiators have been identified. These have been classified as:

3.

•

Accidental hazards

•

Environmental hazards

•

Management system hazards

Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where safety case contents match with good practice identified in the assessment sheets for a particular topic associated with a major accident, there will usually be no need for an assessor to probe into the details of the how the good practice is applied. This may, however, be a suitable issue to follow-up through inspection. A list of references is provided in each assessment sheet. It should be noted that a more extensive commentary should be referenced. The documents listed provide further guidance, particularly in relation to good practice and performance standards. In some cases the reference material will not be fully applicable and may be limited in some parts. These aspects are referred to on the assessment sheets.

32

4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation Table below: Loss of Structural Integrity Source of Hazard

Initiators

Risk Evaluation



HS1

Fixed Steel Installations

G1

Extreme Weather, incl. Wave-In-Deck Loading

HS2

Fixed Concrete Installations

G2

Fatigue Failure

HS3

Semi submersible Installations

G3

Corrosion

F1

Hazard Studies [HAZOPS etc]

F9

Concept Selection

HS4

ShipShaped/Floatin g Installations

G4

Marine Growth

F2

Generic Historical Data

F10

Use of Best Design Practice

HS5

Jack-Up Installations

G5

Poor Fabrication Procedures /Materials Defects/Materials Failure [Brittle Fracture]

F3

Installation-Specific Data

F11

Use of Suitable Safety Factors

Fixed steel installations

G6

Topsides Overloading

F4

IVB Data

F12

High Redundancy


G7

Change of Use/Structural Modification

F5

Reliability Analysis

F13

Optimum Materials and Fabrication Procedures

Semi Submersibles

G8

Fire

F14

Maintenance Management Procedures

Ship-Shaped Installations/ Floaters [Hull]

G9

Explosion

G10

Blowout

Frequency

Inherent Safety

Substructure

Jack-Ups Prevention

33

Topsides

Loss of Structural Integrity Source of Hazard

Initiators

Risk Evaluation


G11

Foundation Failure

G12

Scour

G13

Seismic Event

F6

G14

Boat Impact

G15

Helicopter/Aircraft Impact

G16

Dropped Objects

G17

Inadequate Management System Procedures

G18

Inadequate Design

G19

Inadequate Inspection, Repair & Maintenance During Fabrication and Operation

G20

Inadequate Reassessment

F20

G21

Inadequate Verification

F21


Consequences F15

Sufficient Air Gap for 10,000Year Storm

Extent of Structural Damage/Failure

F16

Suitable Safety Factors (Fatigue, Applied Loading, Pile Loads etc)

F7

Reduced Redundancy, Remaining Residual & Reserve Strength

F17

High Redundancy

F8

Remaining Fatigue Life

F18

Maintenance and Repair Management Procedures

F19

Control Measures [Management/Structural] for Accidental Loads Extreme Weather

Excess Topsides Weight

Fatigue

Fire

Corrosion

Explosion

Suitably rated fire and blast walls/use of PFP etc.

Marine Growth

Corrosion

Maintenance & repair management procedures

Foundation Performance & Scour

Mitigation

34

Loss of Structural Integrity Source of Hazard

Initiators G22

Risk Evaluation

Operator Error

35



F22

System management procedures for accidental loads

Fire

F23

High redundancy

Explosion

3.HS1:


3.HS2:


3.HS3:

Semi Submersible Installations

3.HS4:

Ship Shaped/Floating Installations

3.HS5:


1.

Confirmation should be obtained that installations have been designed and constructed, and/or re-assessed, maintained and repaired in accordance with the latest edition of a recognised standard, recommended practice or code of practice. Recognised standards, recommended practices and codes of practice include: ISO 19900 Petroleum and Natural Gas Industries Offshore Structures Part 1: General Requirements ISO 19901-1 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 1: Metocean Design and Operating Considerations ISO 19901-2 Petroleum and Natural Gas Industries - Specific Requirements For Offshore structures Part 2: Seismic Design Procedures and Criteria ISO 19901-3 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 3: Topsides Structure ISO 19901-4 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 4: Geotechnical and Foundations Design Considerations ISO 19901-5 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 5: Weight Control During Engineering and Construction ISO 19902 Petroleum and Natural Gas Industries - Fixed Steel Offshore Structures ISO 19903 Petroleum and Natural Gas Industries - Fixed Concrete Offshore Structures ISO 19904 Petroleum and Natural Gas Industries - Floating Offshore Structures ISO 19905, Petroleum and Natural Gas Industries - Site-Specific Assessment of Mobile Offshore Units ISO 13822 Basis of Design of Structures - Assessment of Existing Structures NORSOK N-001 Structural Design NORSOK N-002 Collection of Metocean Data NORSOK N-003 Actions and Load Effects NORSOK N-004 Design of Steel Structures: Annex A - Design Against Accidental Loads; Annex B - Buckling Strength of Shells; Annex C - Fatigue Strength Analysis NORSOK N-005 Condition Monitoring of Load Bearing Structures NORSOK S001 Technical Safety NORSOK Z-001 Documentation for Operation NORSOK Z-013 Risk and Emergency Preparedness Analysis

36

ON27 Status of Technical Guidance on design, Construction and Certification OTO 2001 010 Environmental Considerations OTO 2001 011 Corrosion Protection OTO 2001 012 Site Investigations OTO 2001 013 Loads OTO 2001 014 Foundations OTO 2001 015 Steel OTO 2001 016 Pile Sleeve Connections OTO 2001 017 Materials Other Than Steel Or Concrete OTO 2001 046 Concrete OTO 2001 048 Floating Installations OTO 2001 051 Self-Elevating Installations (Jack-Up Units) API RP2A 18th Edition or later Recommended Practice for Planning, Designing, and Constructing Fixed Offshore Platforms Classification Society Rules: Semi sub/Floating Installations/Jack-Ups only IMO Rules: Semi sub/Floating Installations/Jack-Ups only SNAME T&R Bulletin 5-5A 1994 Society of Naval Architects & Marine Engineers (SNAME) Recommended Practice for Site-specific Assessment of Mobile Jack-up Units 2.

Where a standard, recommended industry/company practice or code of practice other than those listed above has been employed, judgement of the adequacy of the installation can only be assessed on an individual basis, taking account of the current condition of the installation.

3.


4.

Specific Technical Issues: Hazards to structural integrity arise from three principal sources, namely: •

•

•

Accidental events, ie fire, explosions, blowout, boat impact, helicopter/ aircraft impact and dropped objects Natural events, ie extreme weather, fatigue failure, corrosion, marine growth, scour and seismic events. Management system inadequacies, ie poor fabrication procedures, topsides overloading, change of use/structural modification, inadequate system management procedures, inadequate design and inadequate inspection, repair and maintenance during fabrication and operation.

37

There is a need to consider that different approaches to the management of structural integrity may be required, depending on: •

•

Whether the installation is manned or normally unmanned. The age of the installation and the codes and standards that it has been designed to.

For ageing installations, it is important to place special emphasis on the knowledge and understanding of the integrity. 5.

Other Related Assessment Sheets in this Section are: 3.G1-3.G4, 3.G12, 3.G13: Environmental hazards 3.G8, 3.G9, 3.G10, 3.G14, 3.G15, 3.G16: Accidental hazards 3.G5-3.G7, 3.G17-3.G22: Management system hazards 3.F1–3.F8 Risk evaluation 

3.F1–3.F5 Frequency



3.F6–3.F8 Consequences



3.F9–3.F23 Risk management measures:



3.F9–3.F14 Inherent safety



3.F15–3.F19 Prevention

3.F20–3.F23 Mitigation 6.


7.

Lead Assessment Section for this Sheet: OSD5.1: Jack-up installations OSD5.2: Fixed installations OSD5.3: Semi submersible installations/ship shaped/floating installations

8.


38

3.G1:

Extreme Weather, including Wave-In-Deck Loading

3.G2:

Fatigue Failure

3.G3:

Corrosion

3.G4:

Marine Growth

3.G11:

Foundation Failure

3.G12:

Scour

3.G13:

Seismic Event

1.

Confirmation should be obtained that installations have been designed and constructed, and/or re-assessed, maintained and repaired in accordance with the latest edition of a recognised standard, recommended practice or code of practice for accidental hazards. General requirements for accidental hazards are found in: ON27 Status of Technical Guidance on Design, Construction and Certification OTO 2001 013 Loads ISO 19901-1 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 1: Metocean Design and Operating Considerations ISO 19901-3 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 3: Topsides Structure ISO 19901-5 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 5: Weight Control During Engineering and Construction ISO 19902 Petroleum and Natural Gas Industries - Fixed Steel Offshore Structures ISO 19903 Petroleum and Natural Gas Industries - Fixed Concrete Offshore Structures SNAME T&R Bulletin 5-5A 1994 Society of Naval Architects & Marine Engineers (SNAME) Recommended Practice for Site-specific Assessment of Mobile Jack-up Units

2.


3.


4.

Specific Technical Issues: 4.1

Extreme Weather [Initiator 3.G1]

The installation must be designed to ensure that it can withstand extreme loading, based on the use of appropriate metocean data. In accordance with ISO 19901-1 the air gap

39

assessment philosophy should be based on the principle that the deck height should be chosen such that the frequency of wave impact on the deck is compatible with the target failure rate of the substructure. The use of a load and resistance factor design methodology requires that extreme waves do not cause major structural damage with an annual failure probability exceeding 10 -4. The structure should remain capable of withstanding the 100-year environmental load without progressive collapse in the damaged condition. In both the 10,000-year [intact] and 100-year [damaged] scenarios, load and resistance factors of unity are to be used. 4.2

Fatigue Failure [Initiator 3.G2]

The consequences of fatigue failure, which is defined as the occurrence of a through thickness crack, can be very serious and fatigue life is therefore an important structural integrity performance criterion for offshore structures. The principal sources of guidance on the prediction of fatigue life are OTO 2001 015, NORSOK N-004 and ISO 19902. However, there is considerable uncertainty in the assessment process and cracking can occur within the design life. The fatigue assessment should include consideration of the effects of the principal causes of fatigue damage, ie •

•

fabrication defects, including weld root defects damage from pile driving followed by fatigue, for fixed steel platforms as well as special factors, eg

•

single-sided closure welds

•

ring-stiffened joints

•

4.3

high strength steels [generally defined as steels with a yield strength exceeding 400 MPa] Corrosion [Initiator 3.G3]

The consequence of corrosion is loss of member thickness, leading to reduced static strength, buckling capacity and possible local structural collapse. It is common practice to provide a 'corrosion allowance' for members located near mean sea level [often between 6 -12 mm] where corrosion rates are higher. Steel exposed to sea spray is also vulnerable and in the splash zone epoxy or similar paints are often used to provide corrosion protection, since the CP system is ineffective in this zone. Overprotection [ie potentials more negative than -1100mV Ag/AgCl] can be damaging to fatigue [ie it can increase fatigue crack growth rates significantly] and to epoxy or similar coatings, with the possibility of bonding to the steel being lost. Hence, design of the anode system is important to minimise this effect and regular monitoring of potentials is also essential to reduce this problem in practice. Guidance can be found in OTO 2001 011. 4.4

Marine Growth [Initiator 3.G4]

The marine growth allowance should be specified in the safety case and controlled to ensure that the loading on the structure is maintained within the design limits or remedial action is undertaken. 4.5

Foundation Failure [Initiator 3.G11]

The design adequacy of foundations is demonstrated by use of an appropriate standard or equivalent associated with that type of installation, [ISO 19901-4, ISO 19902, ISO 19903, SNAME T&R Bulletin 5-5A]. The safety case should give measures to ensure that the design capacity does not deteriorate to a level whereby foundation instability and failure

40

occurs. For situations where soils are known to be weak some monitoring of deck level may be appropriate to provide a means whereby this may be controlled. Interaction of foundations with wells, well drilling or footprints should be assessed. 4.6

Scour [Initiator 3.G12]

The safety case should specify the allowable scour and means by which the actual scour is monitored. Remedial activity should be specified where necessary. 4.7

Seismic Events [Initiator 3.G13]

Duty holders should be able to demonstrate that structures have a low probability of catastrophic failure when subjected to earthquakes and that supports of both safety critical plant and equipment are sufficiently robust to withstand the accelerations, displacements and relative deflections caused. The emphasis of the assessment is that the primary control of the seismic hazard is inherent safety, achieved by the ability of structures and equipment supports to withstand seismic forces and vibrations through adequate design with suitable safety factors [eg to the 200-year return period] and a subsequent check to a longer return period [eg to the 10,000-year return period]. Equipment safety is provided by appropriate specification and attention to vulnerability of supports. The implications of acceleration, displacement and deflection for the integrity of Safety Critical Elements also need to be considered. See ISO 19901-2. 5.

6.

7.

Other Related Assessment Sheets in this Section are: 3.HS1


3.HS2


3.HS3


3.HS5


Cross Referenced Sections and Sheets are: Section 4.1


Section 4.2


Section 6

Wells

Section 10

Emergency Response

Section 11

Human Factors


8.


41

3.G5:

Poor Fabrication Procedures/Materials Defects/ Materials Failure [Brittle Fracture]

3.G6:

Topsides Overloading

3.G7:

Change of Use/Structural Modification

3.G17

Inadequate Management System Procedures

3.G18:

Inadequate Design

3.G19:

Inadequate Inspection, Repair & Maintenance During Fabrication and Operation

3.G20:

Inadequate Re-assessment

3.G21:

Inadequate Verification

3.G22:

Operator Error

1.

Confirmation should be obtained that installations have been designed and constructed, and/or re-assessed, maintained and repaired in accordance with the latest edition of a recognised standard, recommended practice or code of practice for management system hazards. General requirements for accidental hazards are found in: ON27 Status of Technical Guidance on design, Construction and Certification ISO 19901-1 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 1: Metocean Design and Operating Considerations ISO 19901-2 Petroleum and Natural Gas Industries - Specific Requirements For Offshore structures Part 2: Seismic Design Procedures and Criteria ISO 19901-3 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 3: Topsides Structure ISO 19901-5 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 5: Weight Control During Engineering and Construction ISO 19902 Petroleum and Natural Gas Industries - Fixed Steel Offshore Structures EEMUA 158 Construction Specification for Fixed Offshore Structures in the North Sea HS(G)65 Successful Management of Health and Safety CSWIP Certification Scheme for Welding and Inspection Personnel or equivalent

2.

Where a standard, recommended industry/company practices or code of practice other than those listed above has been employed, judgement of the adequacy of the installation can only be assessed on an individual basis, taking account of the current condition of the installation.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996

42

Assessment Principles for Offshore Safety Cases [APOSC] 4.


Fabrication Procedures [Initiator 3.G5]

For new installations or platform reuse, fabrication defects are a major cause of fatigue failure in offshore structures and consequently a principal mechanism for the control of fatigue failure is the thorough inspection for weld defects during fabrication. Defects detected during fabrication should be repaired. They may be allowed to remain only where it can be demonstrated that they do not compromise the integrity of the structure. Further information is given in EEMUA 158. Studies have shown that significant defects [ie up to 5 mm in height] can be present. Although such defects would normally be repaired, the detection of defects in this size range is close to the limits of current inspection techniques for this kind of defect and the integrity assessment should take this into account. 4.2

Topsides Overloading [Initiator 3.G6]

Evidence of the structure’s ability to withstand foreseen changes in the topsides loading is required. This may include weight monitoring procedures – see ISO 19901-5. Careful consideration needs to be given to the ability of the structure to withstand changes in the topsides loading. Appropriate weight monitoring procedures should be complemented by component and system strength assessments to ensure that the design limits of the structure are not exceeded during its operational life. 4.3

Change of Use/Structural Modification [Initiator 3.G7]

Any change of use affecting the original design [eg variation of the topsides loading and change of process requirements] and any structural modification require a reassessment of the structural integrity to ensure that the operational limits are not exceeded. 4.4

Management System Procedures [Initiator 3.G17]

The duty holder must implement adequate system management procedures to ensure that the risk of structural failure is maintained at an acceptable level. Reference should be made to the requirements of HS(G)65. Competence is an essential requirement in the management of structural integrity and is now recognised in the suite of ISO structural standards. The need for suitably qualified personnel in all aspects of structural integrity management, eg offshore structural engineering and inspection planning, is specified. Assessors should ensure that suitably qualified personnel to CSWIP or equivalent are designated. 4.5

Design [Initiator 3.G18]

The Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 (DCR) place a requirement on the duty holder to design installations to withstand such forces acting on it that are reasonably foreseeable and that in the event of foreseeable damage it will retain sufficient integrity to enable action to be taken to safeguard the health and safety of personnel on or near it so far as is reasonably practicable. The application of good practice is one of the key measures with respect to structural integrity risk management in demonstrating compliance with these regulatory requirements, with particular emphasis on the setting of performance standards [see Verification, 3.G21] and the provision of adequate safety margins against failure from major hazards. This requires the use of appropriate standards for the design of offshore structures. Where an installation designed under the previous certification regime does not show the same level

43

of safety as newer structures, the duty holder should demonstrate that it meets the relevant DCR requirements. 4.6

Inspection, Repair & Maintenance During Fabrication & Operation [Initiator 3.G19]

Inspection Planning Methodologies Structural inspection is a key factor in providing data for the management of structural integrity. For North Sea structures on the UKCS, preparation of an inspection plan is a requirement of Regulation 8 of DCR. This requires the duty holder to ensure that suitable arrangements are in place for maintaining the integrity of the installation. This entails the quantification/identification of the risk of structural failure and the subsequent formulation of a suitable cost-effective inspection schedule to enable the targeting of critical components. The inspection programme should include a thorough fabrication inspection [see 3.G5], a baseline inspection once the platform has been installed, the collation and evaluation of platform and inspection data, periodic inspections to monitor any deterioration [eg from fatigue] and special inspections following any accidental damage or extreme loading events to determine whether there is a need for any remedial work in the event of damage or deterioration. Reference should be made to the ISO standard for offshore inspection (ISO 19902), for both in-service inspection and structural integrity management. The plan should contain information to demonstrate that the accidental hazards are within the design limits.

It is important that the plan takes into account the effects of structural redundancy in setting targets with a contingency that shows an awareness that unexpected failures may occur in practice, which will not be predicted using current probabilistic techniques. Inspection Techniques A number of different inspection techniques are used during fabrication and operation. The case should either refer to or describe appropriate inspection techniques. Standard techniques applied in the fabrication yard include UT, MPI and sometimes RT.

The use of FMD as the principal inspection method applied to primary and secondary members in steel jacket structures accepts that significant damage must occur for the damage to be detected and hence total reliance on FMD is not necessarily sufficient to ensure structural integrity. It is therefore necessary that this approach is complemented with rigorous structural integrity assessment and management. Repairs The ability of a repair to restore the integrity of a fatigue damaged component is a necessary requirement in maintaining the overall integrity of an offshore structure. Several different repair methods can be used offshore. They involve weld repair, structural modification or the use of strengthening techniques. Methods used include: •

normal welding for above water repairs

•

hyperbaric weld repair [underwater]

•

removal of cracks by grinding with or without subsequent re-welding

•

drilling of crack arrester holes

•

member removal or replacement

•

addition of strengthening members

•

•

joint reinforcement using gusset plates internal grouting of members and joints

44

•

use of grouted and mechanical clamps

There is a continuing need for regular inspection of repaired components as part of the overall inspection of the structure. 4.7

Re-assessment [Initiator 3.G20]

Where structures have come to the end of the design life or suffered significant damage, reassessment of the structural integrity should be performed to demonstrate that existing installations continue to meet regulatory requirements. The principal sources of guidance on reassessment are ISO 13822, ISO 19902 and NORSOK. The safety case should demonstrate the criteria for reassessment ISO 19901 and 19902: •

extension of service life beyond the original calculated design life

•

damage or deterioration of a primary structural component

•

change of use that violates the original design or previous integrity assessment

•

•

departures from the original basis of design [eg increased loading or inadequate deck height] original design criteria are no longer valid

as well as the versions of the design codes used. Many installations have been designed to earlier versions of structural codes and standards which have subsequently been updated to reflect improved knowledge and experience. Hence, design criteria based on the original version of the code may now be unconservative and no longer valid and reassessment is necessary. In-service inspection practices will determine the nature and extent of the reassessment process to demonstrate structural integrity. Hence, the reassessment process needs to take into consideration the changes in inspection practices that have taken place in recent years as these have implications on the approach to structural integrity assessment. When it is shown that the structure is not acceptable by analysis then strengthening or repairs may be required to demonstrate that measures have been or will be taken to ensure compliance with DCR. When this is not possible operational limits may be needed on the platform [eg demanning when extreme weather is imminent]. The adequacy of fatigue life for the intended remaining life should also be reviewed and this should be taken into account when planning repairs and future inspection schedules. Ageing Installations Ageing is characterised by deterioration which is caused mainly by fatigue and corrosion. Any structural deterioration due to ageing should be taken into account in the reassessment process. It is therefore important to have accurate knowledge of both the condition of a structure with respect to fatigue and corrosion and knowledge of the response of the structure to the ageing process for effective structural integrity assessment. Knowledge of the design specification and the damage state may not always be available for ageing structures. Safety margins during reassessment need to be increased in such circumstances. It is therefore important that good records of both design details and changes in the structural condition [due to in-service damage and deterioration] are maintained. 4.8

Verification [Initiator 3.G21]

45

Verification is a key process in the overall SIM as a result of DCR. This includes the identification and risk management of Safety Critical Elements (SCE). In general, the whole jacket is considered to be a SCE and other SCEs include the topsides, temporary refuge and helideck. For each SCE, performance standards need to be developed, providing a statement of the performance required of the system and which is used as a basis for managing the particular hazard through the lifecycle of the installation. 4.9

Operator Error [Initiator 3.G22]

The assessment should take into consideration the possibility of the introduction of enhanced risk resulting from operator error, particularly in areas of weight growth or ships collision. 5.

6.

7.



3.HS2


3.HS3


3.HS5


Cross Referenced Sections and Sheets are: Section 7

Diving

Section 10

Emergency Response

Section 11

Human Factors

Lead Assessment Section for this Sheet: OSD5.1, OSD5.2 and OSD5.3.

8.


46

3.G8:

Fire

3.G9:

Explosion

3.G10:

Blowout

3.G14:

Boat Impact

3.G15:

Helicopter/Aircraft Impact

3.G16:

Dropped Objects

1.

Confirmation should be obtained that installations have been designed and constructed, and/or re-assessed, maintained and repaired in accordance with the latest edition of a recognised standard, recommended practice or code of practice for accidental hazards. General requirements for accidental hazards are found in: ON27 Status of Technical Guidance on Design, Construction and Certification OTO 2001 013 Loads ISO 19902 Petroleum and Natural Gas Industries - Fixed Steel Offshore Structures ISO 19903 Petroleum and Natural Gas Industries - Fixed Concrete Offshore Structures ISO 19904 Petroleum and Natural Gas Industries - Floating Offshore Structures NORSOK S001 Technical Safety NORSOK Z-001 Documentation for Operation NORSOK Z-013 Risk and Emergency Preparedness Analysis SCI Technical Note No 4 Explosion Resistant Design for Offshore Structures

2.


3.


4.


Fire [Initiator 3.G8]

The structural response of equipment, TR supports and primary structure from fires identified in the case should be assessed to the Steel Construction Institute’s Interim Guidance Notes on fire & explosion [IGN]. 4.2

Explosions [Initiator 3.G9]

47

The structural response and escalation potential from explosions identified in the case should be assessed to the IGN. 4.3

Blowout [Initiator 3.G10]

Refer to Section 6 – Wells for potential of this hazard. 4.4

Boat impact [Initiator 3.G14]

The structural response from boat impact should be assessed - see Section 2 – Vessel Impact. 4.5

Helicopter/Aircraft Impact [Initiator 3.G15]

The structural response from helicopter/aircraft impact should be assessed - see Section 8 - Helicopter Crash. 4.6

Dropped Objects [Initiator 3.G16]

The structural response to dropped objects should be assessed. Normal engineering principles should have been applied taking account of the size and weight of objects identified in the case. 5.

6.

7.



3.HS2


3.HS3


3.HS5



Vessel Impact

Section 5.1


Section 5.3

Loss of Containment - Fire & Explosion

Section 8

Helicopter Crash

Section 10

Emergency Response

Section 11

Human Factors


8.


48

3.F1:

Hazard Studies [HAZOPs etc]

3.F2:


3.F3:

Installation Specific Data

3.F4:

IVB Data

3.F5:

Reliability Analysis

3.F6:

Extent of Structural Damage/Failure

3.F7:

Reduced Redundancy, Remaining Residual and Reserve Strength

3.F8:

Remaining Fatigue Life

1.

Confirmation should be obtained that risk evaluation has been carried out in accordance with industry guidelines and is based on recognised risk data sources, for example: CMPT A Guide to QRA for Offshore Installations UKOOA Guidelines for QRA Uncertainty UKOOA Guidelines Formal Safety Assessment DnV Guidelines for Offshore Structural Reliability Analysis

2.

Where industry guidance and data sources other than those listed above have been used then the duty holder will need to justify the validity of other sources of guidance and data.

3.


4.


Hazard Studies [Initiator 3.F1]

It is not normal engineering practice to perform discrete hazard studies. ISO 19000 [General Requirements] lists the hazards that are considered in the more specific standards in the ISO series. 4.2

Generic Historical Data [Initiator 3.F2]

Historical data is usually inappropriate to determine the loss of integrity frequency although some cases may try and use this approach. If used the appropriateness [type of structure, geographical location] of the data should be assessed. 4.3

Installation-Specific Data [Initiator 3.F3]

Reliable and comprehensive structural data are an essential requirement for the structural integrity assessment of an installation during its life cycle. The case should give an account of this deterioration. 4.4

IVB Data [Initiator 3.F4]

49

See 3.F3 Installation-specific data 4.5

Reliability Analysis [Initiator 3.F5]

If the case uses a reliability approach, good practice is to be found in the DnV guidelines for offshore structural reliability analysis. A recent initiative, Advanced Structural Reliability Network (ASRANET), has been set up to encourage the integration of reliability analysis with advanced structural analysis in an attempt to provide more accurate and realistic measures of failure and hence provide some technical basis for dealing with ageing infrastructures. CONSEQUENCES [3.F6–3.F8] Loss of structural integrity can have serious consequences, depending on the redundancy, component strength, system strength and fatigue life. The safety case should therefore contain evidence that foreseeable structural damage to the installation, escalation potentials and all likely scenarios have been considered. 4.6

Extent of Structural Damage/Failure [Initiator 3.F6]

The case should indicate: •

whether there is any existing damage or local failure

•

the assessment has taken this into account to ensure the appropriate integrity.

4.7

Redundancy, Residual & System Strength [Initiator 3.F7]

Existing codes and standards are based on satisfying component adequacy and hence structures are normally designed on a component basis. However, fixed offshore platforms generally have a multiplicity of load paths so that failure of one component does not necessarily lead to catastrophic structural collapse. The implementation of an effective structural integrity management system requires the application of system strength analysis to provide an understanding of the performance of the structural system. Thus, should the duty holder wish to optimise the design and inspection procedures, full consideration should be given to the performance of a systems analysis to quantify the reserve and residual capacities, now recognised as the key parameters in managing integrity, and the identification of critical components in the structure. Platform configuration is a key factor to be considered in assessment. X braced panels are more 'ductile' in that they offer alternative load paths compared to, for example, K bracing where once a member fails there is no alternative load path through the frame. Thus, the potential reduction in static strength of a joint in K-based framing is likely to be more damaging than a cracked joint in X-braced framing and this needs to be reflected in the level of assessment of system strength. 4.8

Remaining Fatigue Life [Initiator 3.F8]

For welded joints in offshore structures, the fatigue life N3 is defined as the point at which a through-thickness crack forms. However, actual failure will occur when the load bearing capacity of the remaining ligament is insufficient for the applied load and this is designated N4. At this stage load shedding will take place and the applied loads will be transferred to neighbouring components. The reliance on FMD in maintenance strategies for offshore installations requires that the inspection interval is such that N4 is not exceeded. The available information indicates that the remaining fatigue life on penetration of the wall thickness may be rather limited. It is therefore important that due consideration is given in the development of the structural

50

integrity management plan to the possibility of total member failure occurring after penetration of the wall and of the consequences to structural integrity. 5.

6.

7.



3.HS2


3.HS3


3.HS5



Human Factors

Section 12

Human Vulnerability

Section 13

QRA


8.


51

3.F9:

Concept Selection

3.F10: Use of Best Design Practice 3.F11: Use of Suitable Safety Factors 3.F12: High Redundancy - Inherent Safety 3.F13: Optimum Materials and Fabrication Procedures 3.F14: Maintenance Management Procedures 3.F15: Sufficient Air Gap for 10,000-year Storm 3.F16: Suitable Safety Factors [Fatigue, Applied Loading, Pile loads etc] 3.F17: High Redundancy - Prevention 3.F18: Maintenance and Repair Management Procedures 3.F19: Control Measures [Management/Structural] for Accidental Loads 3.F20: Suitably Rated Fire and Blast Walls/Use of PFP etc 3.F21: Maintenance & Repair Management Procedures 3.F22: System Management Procedures for Accidental Loads 3.F23: High Redundancy – Mitigation 1.

Confirmation should be obtained that risk evaluation has been carried out in accordance with industry guidelines and is based on recognised risk data sources, for example: CMPT A Guide to QRA for Offshore Installations UKOOA Guidelines for QRA Uncertainty UKOOA Guidelines Formal Safety Assessment HS(G)65 Successful Management of Health and Safety

2.

Where industry guidance and data sources other than those listed above have been used then the duty holder will need to justify the validity of other sources of guidance and data.

3.


4.

Specific Technical Issues: Inherent Safety [3.F9-3.F14] 4.1

Concept Selection [Initiator 3.F9]

52

The integrity of the concept selected should be of a level which is ensured by following the latest standards. If reuse is part of the concept, the assessment must consider loss of deterioration and fatigue in previous uses as well as evidence of the actual condition of the structure. 4.2

Use of Best Design Practices [Initiator 3.F10]

Design best practice is to be found in the latest editions of standards. 4.3

Use of Suitable Safety Factors [Initiator 3.F11]

Standards stipulate safety factors. These are generically suitable but in some cases special consideration of alternative safety factors may be made. The rationale behind such consideration should be examined. 4.4

Redundancy [Initiator 3.F12]

Adequate component integrity is achieved through appropriate material selection and design for static strength and fatigue capacity [complemented by an appropriate level of inspection during fabrication for weld defects and in service for defects, corrosion and marine growth]. A fundamental requirement for the design of offshore installations with the required level of inherent safety is the use of best design practice. The principal documents for the structural design of offshore installations operated on the UKCS are the appropriate parts of API RP 2A [at least 18th Edition] and the emerging ISO documents supplemented by information outlined in ON27. Many installations have been designed to earlier versions of structural codes and standards which have subsequently been updated to reflect improved knowledge and experience. Hence, design criteria based on the original version of the code may be unconservative and no longer valid and reassessment is necessary. 4.5

Optimum Materials and Fabrication [3.F13]

Most offshore structures are constructed from weldable medium strength steels [usually grade 50D], for which codes and standards exist, eg BS 7191. Welding procedures are now well developed for the medium strength steels used offshore and are well codified, eg EEMUA 158 and AWS D1.1. More recently, newer higher strength steels, with a better strength to weight ratio, are being used increasingly. However, in general there is less test data available to support the design equations and the duty holder should ensure that sufficient and reliable data are available to enable a structural integrity assessment with an appropriate level of confidence. Inspection at the fabrication stage is recognised as a major part of the reliability aspect of performance standards and there is a need for this to be well documented for proper life cycle efficiency. 4.6

Maintenance Management Procedures/Structural Inspection & Condition Monitoring [Initiator 3.F14]

Structural inspection is a key factor in providing data for the management of structural integrity. For North Sea structures on the UKCS, preparation of an inspection plan is a requirement of DCR Regulation 8. This requires that the duty holder ensures that suitable arrangements are in place for maintaining the integrity of the installation, through periodic assessments and carrying out any remedial work in the event of damage or deterioration. The inspection programme includes: •

a baseline inspection once the platform has been installed

•

periodic inspections to monitor any deterioration [eg from fatigue]

53

•

special inspections following any accidental damage or extreme loading events.

A set of default inspection requirements is included, with prescriptive survey periods for cases where an inspection plan has not been produced. The inspection planning methodology should demonstrate an understanding of the significance of the analytical information requirement and the inspection strategy implementation. Normal underwater inspection programmes include a condition survey of the anodes, the extent of marine growth and corrosion potential monitoring of areas of the jacket structure. Through this, anodes can be identified and subsequently replaced to ensure an adequate level of cathodic protection is provided for the life of the structure. Prevention [3.F15-3.F19] 4.7

Sufficient Air Gap for 10,000-year Storm [Initiator 3.F15]

ISO 19900 specifies that the air gap assessment philosophy should be based on the principle that the deck height should be chosen such that the frequency of wave impact on the deck is compatible with the target failure rate of the substructure. The NPD approach, which is applicable to the UKCS, is based on a load and resistance factor design methodology and requires that extreme waves do not cause major structural damage with an annual failure probability exceeding 10 -4. It is considered acceptable for load damage to occur provided that the structure remains capable of withstanding the 100-year environmental load without progressive collapse. In both the 10,000-year [intact] and 100year [damaged] scenarios, load and resistance factors of unity are to be used. 4.8

Suitable Safety Factors [Fatigue, Applied Loading, Pile Loads, etc] [Initiator 3.F16]

An important requirement in traditional deterministic approaches to engineering design is the selection of appropriate safety factors, eg on fatigue life, the applied loading, the pile loads, etc. A major calibration exercise has been performed on the ISO standard for offshore structures in order to derive consistent values for partial safety factors [PSFs] for actions & resistance, based on a selected target reliability. The target reliability is commonly taken to be the implied probability of structural failure in codes & standards which are judged to be acceptable. For offshore structures, the system target reliability based on extreme wave system reliability, ignoring fatigue analysis, has been used. 4.9

High Redundancy [Initiator 3.F17]

High redundancy is redundancy that is significantly more than that enshrined in the latest standards. Claims for this should be examined with a view to establishing common load paths and the adequacy of bracing giving the higher than standard redundancy. 4.10

Maintenance and Repair Management Procedures [Initiator 3.F18]

See 3.G17 Inadequate Management Systems Procedure. 4.11

Control Measures [Management/Structural] for Accidental Loads [Initiator 3.F19]

The management system should ensure that the installation retains sufficient structural integrity in the event of accidental damage so that the overall risk is maintained at an appropriate level. Mitigation [3.F20–3.F23] 4.12

Suitably Rated Fire & Blast Walls [Initiator 3.F20]

A significant amount of work [including full scale testing] has been undertaken concerning the science and engineering of fire and explosion loads and effects on offshore structures.

54

The design and reassessment framework for this work is currently being considered as the industry moves to standardise and harmonise matters associated with these hazards. Topsides structures are sensitive to fire and explosions and consequently it is important to model steel panels realistically. The strengthening of structures to enable them to withstand large explosions requires a better understanding of ultimate capacity performance and escalation prediction. This requires understanding of and data on high temperature and strain rate effects on materials plasticity and fracture behaviour. 4.13

High Redundancy [Initiator 3.F23]

See 3.F12 Redundancy. 5.

Other Related Assessment Sheets in this Section are: 3.G1

6.

7.

Extreme Weather including Wave-In-Deck Loading


Vessel impact

Section 5.1

Loss of containment - Process

Section 5.3

Loss of containment - Fire & Explosion

Section 7

Diving

Section 8

Helicopter Crash

Section 10

Emergency Response

Section 11

Human Factors

Section 13

QRA


8.


55

4.1 LOSS OF MARITIME INTEGRITY - LOSS OF STABILITY 1.

Scope This Section provides guidance for the assessment of safety case content with respect to the loss of stability of an installation, from hazard identification through to consequence determination, including risk management measures. The installation types [source of hazard] are categorised by hull form as:

2.

•

Jack-Ups

•

Semi-submersible Units

•

Monohulls [includes FPSO, FSU, Drillships, Well intervention vessels]

•

Other hull forms [eg TLPs, Spar buoys]

Assessment of Adequacy of Demonstration ‘Any loss in the stability of the installation’ is defined as a ‘major accident ’ in Regulation 2 of the Offshore Installations (Safety Case) Regulations 2005 [SCR]. For the purpose of this Section and safety case assessment this is interpreted as any unplanned change in the floating stability of the installation. This might be due to a variety of reasons which include, but are not restricted to: collision with another vessel, failure of the watertight integrity, internal flooding from pipework, operation of installations drench and firefighting system, human errors in deck loading and ballast distribution, movement of deckload, failure or unexpected loads on mooring line, excessive loads on derrick, or exceedence of design environmental parameters. The categorisation table in this Section presents a number of prompts or keywords for the initiators that might lead to a loss of stability [the causal chain]. The initiators have been divided into 5 categories as: •

Design

•

Operational Hardware

•

Interface Systems

•

Human Factors

•

External Events

The categorisation table also shows keywords for the evaluation of the escalation path [the consequence chain]; how the risk is evaluated in terms of both frequency and consequence. Similarly keywords are presented for the risk management measures that can be introduced, these cover the complete range of possible measures and are: •

Inherent Safety

•

Prevention

•

Detection

•

Control

56

•

Mitigation

•

Evacuation, Escape and Rescue [EER]

The assessor should examine the adequacy of the hazard identification, risk evaluation and management measures as described in the safety case in conjunction with the contents of the categorisation table below. 3.

Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where the safety case contents match with good practice identified herein, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue to follow up through inspection. Stability is fundamental to the motion responses of an installation. The motion characteristics are important design inputs for the design of installation plant and equipment, weather dependent activities and the effects on personnel. It is important that these motion characteristics are adequately assessed at the design stage for any installation. A list of references is found at the end of this Section. These are the main references that should be familiar to, and consulted by, the assessor. They are not a complete list of references on the subject of loss of stability.

57

4. The Assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation Table below: Loss of Maritime Integrity - Loss of Stability Source of Hazard

Initiators G1

Risk Evaluation

HS1

Jack-Ups

HS2

Semi Subs

Hull subdivision

F1

Generic data

HS3

Monohulls

Watertight structure

F2

Company data

HS4

Other Types

Piping systems

F3

Classification Society

Weight management

F4

ISO/IMO standards

F31

Sub division

Codes and standards

F5

HAZOP studies

F32

Collision resistant

Specification/ dimensions

F6

FMECA studies

F33

Isolation valves

Operational Hardware Section 3

F7

Personnel policies

F34

Bilge alarm systems

Overload

F8

Selection – Section 11

Fatigue

F9

Training – Section 11

Material defect

F10

Competency – Section 11

F35

CCTV

Construction defect

F11

Concept design

F36

Flood detection

Commissioning defect

F12

Operations procedure

F37

Inspection procedures

Maintenance defect

F13

Maintenance policies

F38

Draft, trim, heel indicators

F39

Tank gauging system

G2

Design Assessment


Frequency F30

Corrosion/ erosion

58


Inherent Safety

Intact stability

Not afloat [jack-up]

Damage stability Ballast systems

Prevention

Detection

Marine competency

Loss of Maritime Integrity - Loss of Stability Source of Hazard

Initiators G3

G4

G5

Risk Evaluation

Interface systems

Consequences


Bilge alarm system

Electric controls Section 5.1

F14

Stability design codes

Hydraulic controls

F15

Marine systems design

Pneumatic controls

F16

Redundancy

F41

Emergency response plan

UPS/power generation

F17

Flexibility of operation

F42

Training simulators

Human Factors – Section 11

F18

Subdivision

F43

Damage control

Operations deficiency

F19

Damage extent

Training

F20

Trim/heel/draft

Competency

F21

Motions

Communication

F22

Incorrect action

F23

Progressive flooding

External Events

F24

Cargo movement

Fire/explosion – Section 5.3, & Section 9

F25

Structural collapse – Section 3

Firefighting water

F26

Additional environmental load

F47

Non essential [Helicopter]

Over/under pressure

F27

EER impairment – Section 10

F48

Emergency [TEMPSC]

Hydrocarbon containment – Section 5.1

59

Control

Mitigation F44

Counterballast

F45

Support vessels

F46

Towage/salvage

Emergency Response


Loss of Maritime Integrity - Loss of Stability Source of Hazard

Initiators

Risk Evaluation

Sabotage/terrorism

F28

Personnel mobility – Section 12

Dropped object – Section 3

F29

Panic – Section 12

Severe environment – Section 3 Moorings failure – Section 4.2 Collision/ grounding – Section 2 Power failure – Section 5.1

60


Keep within limits


4.1.HS1

Jack Ups

4.1.HS2

Semi Subs

4.1.HS3

Monohulls

4.1.HS4

Other Types

4.1.G1-G5

Initiators

4.1.F1-F29

Risk Evaluation Measures

4.1.F30-49


1.

The assessor should obtain confirmation that the risk of loss of stability has been fully assessed. Both intact and damage stability criteria and environmental loads are to be used in the assessment. This in practice means that the installation is designed, constructed, operated and maintained in accordance with HSE standards. In general, HSE standard of performance is defined in the former ‘4th Edition’, see Operations Notice ON27, and in particular referencing OTO 2001-049. There are particular points that require further attention, and these are listed in the bullet points that follow in this Section. The risk assessment approach should follow one of the techniques described in guidance document OTO 2001-063. Where there is not compliance with the above assessment standards the duty holder should demonstrate that there is an equivalent level of performance, with regard to the loss of stability, obtained by the use of some other internationally recognised standard. HSE recognise that the standards of the Norwegian Maritime Directorate [NMD] are broadly equivalent to HSE required performance standard. The assessor should obtain confirmation that the installation is fully compliant with the NMD Mobile Offshore Unit [MOU] Code. Any qualifications to the NMD approval should be investigated to HSE satisfaction to confirm acceptance of the safety case. Compliance only with either the International Maritime Organisation [IMO] codes for Mobile Offshore Drilling Units [MODU Code], or the Code for Special Purpose Ships are not equivalent to the HSE requirements. Further risk assessments will be required and possible modifications to subdivision and piping arrangements. Each installation will be considered on an individual basis. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c); 12(1)(d); Schedule 3 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996, Regulations 5, 8, 9

4.

Specific Technical Issues All Installation Types For all installation types, the safety case will be required to demonstrate to the assessor, directly or by reference to other documents, that:

61

•

•

•

•

•

•

An acceptable standard of watertight integrity is achieved in the design of the installation. The risk of accidental flooding has been properly assessed with regard to both frequency and consequence of this accidental event The piping and control systems are capable of control of the flooding and restoring the installation to stable equilibrium. The risk of loss of the control system has been adequately assessed, and that loss of the main control system will not lead to a loss of stability. There are suitably qualified personnel for the operation and maintenance of the marine equipment essential to vessel stability and watertight integrity. The components of the marine systems essential to watertight integrity have been defined as safety critical elements and are included in the verification scheme.

Jack-Up Units The following points are particularly relevant to jack-up units and require to be addressed in the safety case: •

•

Procedures and systems for maintenance of watertight integrity during in-field and ocean transit. Procedures for marine operations on approach and departure from adjacent installations. Pre-load procedures.

•

Compliance with Safety Notice 2/2001.

•

Compliance with SPC/TECH/OSD/21.

Semi-Submersible Units The following points are particularly relevant to semi sub units and require to be addressed in the safety case: •

•

•

Effect of moorings and thrusters on stability. Adequate de-ballasting system or secondary system, capable of developing adequate suction with vessel at maximum inclined angle after damage. Ability to de-ballast with a flooded pump room.

Monohull Units The following points are particularly relevant to FPSO/FSUs and require to be addressed in the safety case: •

•

•

•

Adequate freeboard, or other protection, against the effects of green water loading. Suitable procedures for the maintenance of stability during the offloading of cargo to shuttle tanker. Risk of collision with the shuttle tanker minimised due to suitable equipment and procedures. Compliance with Safety Notice 4/2003.

62

5.


6.


Vessel Impact

Section 3

Structural Integrity

Section 4.2


Section 5.1


Section 5.2


Section 5.3

Loss of Containment - Fire and Explosion

Section 6

Wells

Section 10

Emergency Response

Section 11

Human Factors

Section 12

Human Vulnerability

Section 13

QRA

This Section has been cross-referenced by the following Sections and Sheets:

7.

Sheet 5.1.F8

Safety Integrity Levels Standards

Section 7

Diving

Section 8

Helicopters

Lead Assessment Section OSD5.4

8.


63

Annex 1 LIST OF REFERENCES The following sources of general guidance are useful, but are not to be taken as a complete list of references on the assessment of loss of stability: Operations Notices ON27

Status of technical guidance on design, construction and certification

Safety Notices SN 04/2003

Reducing the Risks Associated With Flooded Machinery Spaces on Monohull FPSO and FSU Installations

SN 01/2003

Ageing semi-submersible installations

SN 02/2001

Jack-up [self elevating] installations: floating damage stability survivability criterion

Semi-Permanent Circulars SPC/TECH/OSD/24 Accident/Incident Data SPC/TECH/OSD/21 The Safe Approach, Set-up and Departure of Jack-up Rigs to Fixed Installations SPC/TECH/OSD/17 Report by the OSD Working Group into P36 Incident SPC/TECH/OSD/04 SPC/ENF/68

Collision Risk Management Advice to Inspectors Risks Associated with Flooded Machinery Spaces on Monohull FPSO and FSU Installations

HSE Research Reports RR049

Review of the Jack-Ups: Safety in Transit [JSIT] technical working group

RR095

Accident statistics for floating offshore units on the UK Continental Shelf 1980–2001

RR143

Review of the risk assessment of buoyancy loss [RABL] project

OTO 2001-010

Environmental considerations

OTO 2001-011

Corrosion protection

OTO 2001-012

Site Investigations

OTO 2001-013

Loads

OTO 2001-048

Floating Installations

OTO 2001-049

Stability, Watertight integrity and ballasting

OTO 2001-051

Self-elevating installations [jack-up units]

OTO 2001-063

Marine Risk Assessment

OTO 2001-065

Mechanical equipment

64

OTO 2000-097

Rationalisation of FPSO design issues

OTO 2000-123

Review of model testing requirements for FPSOs

OTO 1999-092

Human factors assessment of safety critical tasks

OTO 1998-045

Quantified Risk Assessment of Jack-Up Operations Afloat

OTH 1994/434

Criteria for jack-ups manoeuvring in close proximity to jacket platforms

Other Sources DNV OS-C301

DnV Offshore Standard Stability & Watertight Integrity

UKOOA

Guidelines for Safe Movement of Self-Elevating Offshore Installations (Jack-Ups), April 1995

UKOOA

FPSO Design Guidance Notes for UKCS Service

UKOOA

Guidelines for Selection and Training of Ballast Control Operators

HSG 48

Reducing error and influencing behaviour

65

4.2 LOSS OF MARITME INTEGRITY - LOSS OF POSITION 1.

Scope This section provides guidance for the assessment of safety case content with respect to the loss of position of any floating installation. The scope ranges from hazard identification through to consequence determination, including risk management measures. Position may be lost through either a failure of the mooring system, or a failure of the dynamic positioning system.

2.

Assessment of Adequacy of Demonstration Loss of position of a floating installation can easily lead to collision with an adjacent installation, or to the release of hydrocarbons from fractured drilling or well operations risers. Hence, loss of position is clearly a hazard ‘with the potential to cause a major accident’ and requires evaluation within the safety case [SCR Regulation 12(1)(c), d)]. ‘ Loss of position’ is an incident that is reportable under the Offshore Installation and Wells (Design and Construction, etc) Regulations 1996 [DCR] as well as more generally in the application of Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995 (RIDDOR) offshore. The categorisation table in this section presents a number of prompts or keywords for the initiators that might lead to a loss of position [the causal chain]. The initiators have been divided into five categories as: •

Design

•


•

Interface Systems

•

Human Factors

•

External Events

The categorisation table also shows keywords for the evaluation of the escalation path [the consequence chain]; how the risk is evaluated in terms of both frequency and consequence. Similarly keywords are presented for the risk management measures that can be introduced, these cover the complete range of possible measures and are: •

Inherent Safety

•

Prevention

•

Detection

•

Control

•

Mitigation

•

Evacuation, Escape and Rescue [EER]

The assessor should examine the adequacy of the hazard identification, risk evaluation and management measures as described in the safety case in conjunction with the contents of the categorisation table below.

66

3.

Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where the safety case contents match with good practice identified herein, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue to follow up through inspection. A list of references is found at the end of this section. These are the main references that should be familiar to, and consulted by, the assessor. They are not a complete list of references on the subject of loss of stationkeeping. Two ‘sources of hazard’: the mooring system and the dynamic positioning system are identified in the Categorisation Table. These are dealt with separately in the following assessment sheets 4.1HS1 [Moorings] and 4.2HS2 [Dynamic Positioning]. Thruster assisted mooring systems are included in the assessment of the mooring systems.

67

4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation Table below: Loss of Maritime Integrity - Loss of Position Source of Hazard HS1

Mooring System

Initiators G1

Design Assessment


Frequency


Inherent Safety

Classification societies

Anchor

Environmental Forces Section 3

F1

Generic data

F17

Redundancy in design

IMCA/NMD/API standards

Chain

Seismic/erosion

F2

System specific data

F18

Water depth

Material specification

Wire

Incorrect specification

F3

Emergency tow

F19

Excursion radius

Software specification

Fairleads

Uncontrolled modifications

F4

Support vessels

F20

Flexible riser

Audit reports

F5

Incident response time

F21

Weathervaning

Client standards


F6

Proximity to other hazards

Control system – Section 5

Overload

F7

Maintenance programme

Turret

Fatigue – Section 3

Turret bearings

Material defect – Section 5.1

Stopper Winches

HS2

Risk Evaluation

G2

Personnel competency

Prevention

F22

Redundancy

Consequences

F23

Tension meters

Manufacturing defence

F8

Collision – Section 2

F24

Weather forecasts

Dynamic Positioning

Commissioning defect

F9

HC release – Section 5.1

F25

Standby power

Reference sensors

Maintenance defect

F10

Motions outside of limits

68

Loss of Maritime Integrity - Loss of Position Source of Hazard

Initiators

Thrusters

Risk Evaluation

Risk Management Measures Detection

F11

Emergency Response required – Section 10

Interface systems

F12

HELO Ops impaired – Section 10

F26

Tension meters

and generation – Section 5

Electric controls

F13

Tilt/trip

F27

Position monitoring

Computer software

Hydraulic controls

F14

Noise/vibration – Section 12

F28

Position alarms

Hydrodynamic model

Pneumatic controls

F15

Riser damage – Section 5.2

F29

Other vessels

UPS/power generation

F16

Turret drag chain

Power management

G3

Control G4

Human Factors – Section 11

F30

Emergency response

Incorrect operation

F31

Monitor movement

Poor ergonomics

F32

Shutdowns

Inadequate training Mitigation

Low competence Deficient procedures

G5

F33

Alert Coastguard

F34

Emergency tow

External Events Emergency response action

Emergency Response

69


Loss of Maritime Integrity - Loss of Position Source of Hazard

Initiators

Risk Evaluation

Fire – Section 5.3, Section 9


Explosion – Section 5.3 Gas release – Section 5.1, Section 6 Trawler/external disturbance

70

Precautionary – Section 11


4.2.HS1

Mooring System

4.2.G1-G5

Initiators

4.2.F1-F16

Risk Evaluation

4.2.F17-F35


1.

The assessor should obtain confirmation that the mooring system is designed, constructed, operated, and maintained in accordance with recognised standards. In general, HSE standard of performance is defined in the former ‘4th Edition’, see Operations Notice ON27. Reference may also be made to Classification Society Rules, and the associated ‘Class Notation’ [eg POSMOOR Code from Det Norske Veritas, and Offshore Standard OSE301]. The assessor should be satisfied that the appropriate design rules have been selected to suit the operating environment for the installation safety case.

2.

Where there is not compliance with the above assessment standards the duty holder should demonstrate that the mooring system would have an equivalent level of performance. HSE recognise that the standards of the Norwegian Maritime Directorate [NMD] are broadly equivalent to HSE required performance standard. In addition to the Classification Society Rules, there is also much useful information obtainable from the American Petroleum Institute [API] as well as various industry working parties and associated publications [JIP publications]. These are listed in Annex 1 – List of References at the end of this section.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Regulations 12(1)(c); 12(1)(d); Schedule 3 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996, Regulations 5, 8, 9

4.

Specific Technical Issues The safety case will be required to demonstrate to the assessor, directly or by reference to other documents, that: •

•

•

•

•

Appropriate standards have been used for the mooring equipment. The hazard assessment includes the loss of a mooring line, or mooring system component, and further evaluation of this by quantitative risk assessment where necessary. The mooring system components are included as ‘safety critical elements’ where this is appropriate, with performance standards defined for these elements. There is a mooring integrity monitoring system with an appropriate performance standard for the detection of a failed mooring line within an acceptable timescale. This particularly applies to FPSOs and other installations that remain on station for prolonged periods. Inspection and maintenance requirements are defined for the safety critical components of the mooring system.

71

•

•

•

•

•

•

•

•

•

•

There are personnel with a defined level of competency, and responsibility for the operation and maintenance of the mooring system. The proximity to other installations, including requirements for gangway access, has been fully considered i n the assessment. There is adequate clearance of the mooring lines from any sub-surface equipment, obstructions, or pipelines. There are suitable emergency procedures, mitigation measures, and drills to deal with events such as a lost mooring line. Procedures exist for the adjustment of line tension that may be required prior to periods of heavy weather, or to offset the installation for operational requirements. Operation of the mooring system is possible from control stations without hazard to personnel. Emergency release of the moorings is possible [such as during a sub sea blowout] so that move off location is possible without main power generation being available. The availability of emergency release system has been assessed and ri ser disconnect and cargo handling considered when applicable. Suitable stand-off location for combined operations is defined. The risk assessment approach should conform to the requirements contained in guidance document OTO 2001-063.

Thruster-Assisted Mooring System In addition to meeting the specific technical issues listed above, the following points will also require to be demonstrated to the satisfaction of the assessor: •

•

•

•

•

•

•

5.

A clear definition of the control mode – ie manual, or automatic thruster assist. Appropriate selection of the consequence class and the safety factors for the marine operation to be undertaken. Availability of a back-up contr ol for the thruster if main communication/ control link fails. Thorough assessment of possible failure modes and corrective actions required [eg full pitch thruster failure]. Assessment of the thruster availability and the required redundancy in the control system. Inclusion of the thrusters, power system, control system, and reference system as safety critical elements [SCEs] and with appropriate performance standards and verification scheme. Suitable maintenance of thruster system as required for an SCE of a positional moorin g system.

Other Related Assessment Sheets in this Section are:

72

None 6.


Vessel Impact

Section 3


Section 4.1


Section 5.1


Section 5.2


Section 5.3


Section 6

Wells

Section 10

Emergency Response

Section 11

Human Factors

Section 12

Human Vulnerability

Section 13

QRA

This section has been cross-referenced by the following sections and sheets:

7.

Sheet 5.1.F8

Safety Integrity Levels Standards [Mooring release/Riser disconnect/Cargo handling]

Section 7

Diving

Section 8

Helicopters


8.


73

4.2.HS2

Dynamic Positioning

4.2.G1-G5

Initiators

4.2.F1-F16

Risk Evaluation

4.2.F17-F35


1.

The assessor should obtain confirmation that the dynamic positioning system is designed with respect to redundancy in accordance with recognised standards, for example IMO MSC circular 645, or equivalent Classification Society Rules. The safety case should also demonstrate that for any particular DP operation the equipment class of the vessel has been decided based upon a risk assessment on the consequences of a loss of position. Reference should also be made to IMCA M103, or Petroleum Safety Association Activities Regulations, section 81, for suitable examples.

2.

Where there is not compliance with the above standards, the duty holder should demonstrate that the dynamic positioning system would have an equivalent level of performance with respect to single point failures, including fire and flooding of machinery spaces. The safety case should demonstrate that requirements under the Management of Health and Safety at Work Regulations 1999 (MHSWR) are complied with including suitable and sufficient risk assessment encompassing planning of DP operations, communications, competency, and decision-making.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c); 12(1)(d); Schedule 3 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996, Regulations 5, 8, 9

4.

Specific Technical Issues The safety case will be required to demonstrate to the assessor, directly or by reference to other documents, that: •

•

•

•

•

Appropriate standards have been used for the dynamic positioning system. All modes of operation have been considered in the assessment of hazards. These will include diving operations, well operations, riser excursion limits, and proximity to other installations, control of heading for FPSO offload. Each type of operation will have its own hazards and associated risks. The interface of the DP system with any thruster-assisted mooring system has been adequately assessed. Operation of the DP system in conjunction with any interface requirements for emergency riser disconnects, mooring release, or cargo handling operations has been suitably considered. Maximum excursion limits and environmental operating restrictions are clearly defined.

74

•

•

•

•

•

•

•

•

•

5.

A Failure Modes and Effects Analysis [FMEA] is available and represents the current DP configuration, and conforms to IMCA management guidance for FMEAs. [Under development as at June 2004, but refer also to RR195] There are records of annual DP proving trials, or other proving trials at frequencies determined by the Verification Scheme. The Safety Critical Elements [SCEs] required by the safety case include the DP system, and important elements of the power generation and management system. Inspection and maintenance requirements are defined for the safety critical components of the DP system. Suitable records of the training and experience of DP qualified personnel are maintained. Any changes, repairs, or modifications to the DP system are properly managed and controlled. There is a system for reporting of DP faults and the subsequent action taken to rectify them. Operating limits in terms of environment, thrusters, power generation, control equipment etc. are developed prior to the DP operation. Operating guidelines specific to the particular DP operation to be undertaken.

Related Assessment Sheets in this Section are: None

6.

Cross-Refe renced Sections and Sheets are: Section 2

Vessel Impact

Section 3


Section 4.1


Section 5.1


Section 5.2


Section 5.3


Section 6

Wells

Section 10

Emergency Response

Section 11

Human Factors

Section 12

Human Vulnerability

Section 13

QRA

This section has been cross-referenced by the following sections and sheets:

75

7.

Sheet 5.1.F8

Safety Integrity Levels Standards [Mooring release/Riser disconnect/Cargo handling]

Section 7

Diving

Section 8

Helicopters


8.


76

Annex 1 LIST OF REFERENCES The following sources of general guidance are useful, but are not to be taken as a complete list of references on the assessment of loss of position: Operations Notices ON27

Status of technical guidance on design, construction and certification

Safety Notices SN 3/2005

Floating Production Storage and Offloading (FPSO) – Mooring inspection

Semi-Permanent Circulars SPC/TECH/OSD/24 Accident/Incident Data SPC/ENF/50

Reporting of Mooring Failures

SPC/ENF/107

Floating Production Storage and Offloading – Mooring inspection

HSE Research Reports RR219

Design and integrity management of mobile installation moorings

RR195

Review of methods for demonstrating redundancy in dynamic positioning systems for the offshore industry

RR095

Accident statistics for floating offshore units on the UK Continental Shelf 1980 – 2001

OTO 2001-010

Environmental considerations

OTO 2001-011

Corrosion protection

OTO 2001-012

Site Investigations

OTO 2001-013

Loads

OTO 2001-050

Stationkeeping

OTO 2001-063

Marine Risk Assessment

OTO 2001-065

Mechanical equipment

OTO 2000-026

Appraisal of AP1RP 2F for Floating Production System

OTO 2000-053

Collision resistance of ship-shaped structures to impact

OTO 2000-065

Development of the concept of structural toughness

OTO 2000-097

rationalisation of FPSO design issues

OTO 2000-123

Review of model testing requirements for FPSOs

OTO 1999-066

Effects of motion on cognitive performance

OTO 1999-092

Human factors assessment of safety critical tasks

77

OTH086

Quick release systems for Moorings

Other Sources – Moorings Classification Society [DnV, LR, ABS, BV] Rules DnV OS-E301

Position mooring

IMO Circ 737/1995

Guidelines on anchoring equipment

AP1 RP Spec 2F

Mooring Chain

AP1 RP 2fps

Recommended Practice for Planning, Designing and Constructing Floating Production Systems

AP1 RP 2SK

Design and Analysis of Station keeping Systems for Floating Structures

AP1 RP 2I

Inservice Inspection of Mooring Hardware for Floating Drilling Units.

AP1 RP2SM

Recommended Practice for Design, Manufacture, Installation and Maintenance of Synthetic Fiber Ropes for Offshore Mooring

AP1 RP 2T

Planning, Designing, and Constructing Tension Leg Platforms

Other Sources – Dynamic Positioning Classification Society [DnV, LR, ABS, BV] Rules IMO Guidelines

In particular from Marine safety Committee [MSC]

MSC Circ 645/1994

Guidelines for Vessels with Dynamic Positioning Equipment

MSC Circ 738/1995

Guidelines on training requirements

IMCA M103

Guidelines for the Design and Operation of Dynamically Positioned Vessels

IMCA M166

Guidance on failure modes and effects analyses [FMEAs]

IMCA M161

Guidelines for the Design and Operation of Dynamically Positioned Vessels: Two-Vessel Operations: A Supplement to IMCA M103

IMCA M 159

Guidance on Thruster-Assisted Stationkeeping by FPSOs and Similar Turret-Moored Vessels

IMCA M 150

Quantified Frequency of Shuttle Tanker Collision during Offtake Operation

IMCA M 117

The training and Experience of Key DP Personnel

115 DPVOA

Risk analysis of collision of dynamically positioned support vessels with offshore installations [Revised]

112 UKOOA

UKOOA Publications of joint initiatives – Guidelines for Offshore Installations Safety Case Diving Operations from Vessels – Guidelines for Auditing Vessels with Dynamic Positioning Systems

DPVOA 1611/14

DP Position loss risks in shallow water

IMAC D010

Diving Operations from Vessels operating in DP mode

78

Other Sources – General UKOOA

FPSO Design Guidance Notes

UKOOA

Tandem Loading Guidelines

NPD/NMD

Guidelines and NORSOK Standards

HSEG48

Reducing error and influencing behaviour

ISO 1990 1-7.E.3

Petroleum and Natural Gas Industries – specific requirements for offshore structure –Part 7: stationkeeping systems for floating offshore structures and mobile offshore units; under development as at June 2004

Joint Industry Projects [JIP] have been conducted in a number of areas. Information on these is the property of the participants, but in a number of cases this information is becoming publicly available. JIPs have been conducted with the following parties as principal contact and in subject areas: DNV

Reliability based design for Deepwater Moorings

Noble Denton

Integrated Riser and Mooring Design

Noble Denton

Studless Chain Corrosion Fatigue

BMT/Noble Denton

Response based design of FPSOs

79

5.1 LOSS OF CONTAINMENT - PROCESS 1.

Scope This section provides guidance for the assessment of safety case content with respect to the loss of containment from process plant and process operations, from hazard identification through to elements of consequence determination, including risk management measures. However it excludes assessment of the consequences of ignition of any release. This is considered separately in Section 5.3.

2.

Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator, together with identification and evaluation of escalation paths that might result. Potential sources of hazard, initiators etc, are shown in Section 4 below. Assessors should ensure that, where relevant, safety cases contain appropriate consideration of each of these factors.

3.

Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where safety case contents match with good practice identified in the assessment sheets for a particular element associated with a major accident, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue for follow-up by inspection.

80

4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation Table below: Loss of Containment - Process Source of Hazard

Initiators

Risk Evaluation

Pressure Vessels

G1

Corrosion: Internal/External

[inc Columns]

G2

Erosion

F1

HS2

Heat Exchangers

G3

Overpressure

HS3

Atmospheric Vessels

G4

Internal explosion

[eg Wemcos, TPSs]

G5

Centrifuges/

Risk Management Measures Inherent Safety

Vessels, pipework,

Generic historical data

- fully rated vessels, pipework,

tubing tanks, risers/ Temperature &

F2

Company & installation data

pipelines, risers, etc

drains/caissons

pressure rating

F3

Installation specific hazard studies

- large segregation distances

Temp & pressure rating


Under pressurisation

- HAZOPs

- separate accommodation jacket

Material specification Corrosion allowance

G6

Fatigue/vibration cracking

- FMEAs

- inventory minimisation

Corrosion allowance Fatigue life

Hydrocyclones

G7

Fire

HS5

Piping

G8

Seal failure

HS6

Smallbore tubing

G9

Turret failure

F4

Layout

HS7

Pipeline Risers

G10

Inadequate installation

F5

Company standards/procedures

HS8

Flexible hoses

G11

Operator error: inadequate

F6

HS9

Pumps

Training

F7

HS1

HS4

Frequency


F14

Fatigue life - Design reviews

Flexible hoses

Frequency of inspect

Frequency of inspect Integrity of connectors Prevention

Relief arrangements

F15

Relief systems

& capacity

Pumps, Compressors

Corrosion/erosion policy

F16

HIPS systems

Reliability of protective

Turbines

Operational reviews [procedures]

F17

Blowdown/flare systems

systems

Flow rate

81

Loss of Containment - Process Source of Hazard

Initiators

HS10

Compressors

G12

HS11

Turbines

HS12

Valves

G13

Violation

HS13

Deck Drains [inc

G14

Deficient procedures:

tote tanks and

Chemical injection

Risk Evaluation


Operator error: inadequate

F8

SIL standards

F18

Shutdown systems

Adequacy of supports

Head/pressure

competency

F9

Equipment selection [eg weld or

F19

Alarms/Trips

Fire protection

Shut-in pressure

Flange]

F20

Good procedures

Heat Exchangers

NPSH

- operational

Thermal rating

Turndown


Minimum flow

Shell & tubeside

Sealing system

F10

Concept selection

operational

G15

tanks]

Deficient procedures:

- maintenance

maintenance

Flow rates

HS14

Marine storage tanks

G16

Ship collision

HS15

Hazardous drains

G17

Dropped object

/caissons

G18

Seismic event

HS16

Integral storage cells

G19

Missile [eg turbine blade]

-speed & effectiveness of detection

HS17

Flare towers

G20

Ageing/mechanical

& response

HS18

Turrets

degradation

- blowdown system

HS19

Temporary Equipment

G21


External loads [eg stood on, struck by

F11

Consequences

F21

Competent personnel

Material specification Valves

Size of release

F22

Monitoring & audit systems

Fatigue life

Temperature &

Frequency of inspect pressure rating

F12

F23

Isolations and PTW controls

Relief arrangements


& capacity

Corrosion allowance

Detection

Closure mode

Dispersion

F24

Gas detection

Centrifuges/

Fire protection

- open/closed modules/ventilation

F25

Fire detection

Hydrocyclones

Integrity of seals

82

Loss of Containment - Process Source of Hazard

Initiators

Risk Evaluation

scaffold pole]



rates


Toxicity of release


Leakage rate

G22

Helicopter collision/rollover

G23

Inadequate design

Ignition transfer to fire & explosion

Corrosion allowance Turrets

G24

Incorrect material

Section 5.3

Separation efficiency Temperature &

F13

specification

Vibration [centrifuges]

G25

Incorrect material usage

Flare/Vent Systems Material specification

G26

Thermal radiation


G27

Slugging/water hammer

Material specification Integrity of seals

G28

Sloshing/slam liquid loads

Corrosion allowance Seal leaking rate

G29

Structural failure

Separation efficiency Gas dispersion Thermal radiation Noise level Turndown

83

pressure rating

Corrosion allowance

5.1.HS1:

Pressure Vessels (Including Columns)

5.1.HS5:

Piping and Piping Components

5.1.HS12:

Valves

[Relevant Sheets: 5.1.G17, 5.1.G18, 5.1.G20, 5.1.G21, 5.1.G29, 5.1G3, 5.1.G5, 5.1.G6, 5.1.G8, 5.1.G10, 5.1.G27, 5.3.F15, 5.3.F18] 1.

This sheet is generally applicable to the mechanical integrity of static components that form the boundary of a hydrocarbon containment system; ie pressure vessels and piping etc. It is also of relevance to rotating equipment, in so far as these also have pressure boundaries. Aspects specific to machinery and rotating equipment are dealt with elsewhere. Similarly, process control and plant isolation requirements are not dealt with here. This sheet is not intended to limit the scope of an assessor to pursue any aspect of safety that they believe is important to a particular safety case, within the remit provided by the safety case regulations. It is though intended to provide guidance as to the minimum acceptable demonstration of safety that a duty holder should be able to provide. As with all safety assessment work, there is a need for HSE assessors to concentrate on areas where there are grounds for believing the safety demonstration may be weakest. Knowledge of such areas comes from HSE’s collective experience, as well as that of the wider engineering community. This document is intended to provide pointers towards what are believed to be the most pressing concerns. Conversely, it is not considered necessary or practical for a particular safety case to mention explicitly all of the aspects of design and operational concerns identified below. However the duty holder should in principle be able to address all such concerns and hence provide an adequate demonstration of integrity. Therefore, it is reasonable for an assessor to question a duty holder on any aspect of the integrity justification. Confirmation should be obtained that the pressure system elements have been designed, constructed, installed, and operated in accordance with a recognised standard or code of practice. As a general principle, HSE accepts that codes, standards published by BSI, ASME, API and others, are for the most part well founded, in that they have been written to encompass the present best knowledge and advice available. However adherence to a code is not in itself a demonstration of safety. There are several reasons for this. Not only are some codes inherently goal oriented themselves, but there are also some matters which are the subject of technical uncertainty, or indeed where current code provisions appear to be inadequate or may not reflect the state of the art. The safety case assessment process may therefore include questioning as to the detailed application or adequacy of parts of codes. A typical, but non-exhaustive, list of standards and codes of practice would include: PD5500:2003 Specification for unfired fusion welded pressure vessels ASME VIII Boiler and pressure vessel code BS EN 13445 Unfired pressure vessels ASME B31.3 Process piping ISO13703 [API 14E] Petroleum and natural gas industries. Design and installation of piping systems on offshore production platforms ISO 15649 Petroleum and natural gas industries. Piping

84

PD CEN/TR 14549 2004 Guide to the use of ISO 15649 and ANSI/ASME B31.3 for piping in Europe in compliance with the Pressure Equipment Directive ISO 14692 Parts 1 to 4 Petroleum and natural gas industries. Glass-reinforced plastics (GRP) piping. BS 4994 Specification for design and construction of vessels and tanks in reinforced plastics Codes to assist in-service integrity: A typical but non-exhaustive list of relevant standards would include: ASME Boiler and Pressure Vessel Code Series Inspection: API 510 Pressure vessel inspection code: Maintenance inspection, rating, repair, and alteration API 570 Piping Inspection Code: Inspection, repair, alteration, and rerating of in-service piping systems API 574 Inspection practices for piping system components EEMUA Standards API RP 580 Risk based inspection API 581 Risk based inspection Flaw assessment: BS 7910 Guide on methods for assessing the acceptability of flaws in metallic structures Fitness for purpose: API 579 Recommended practice for fitness-for-service and continued operation of equipment The emerging ASME Post Construction codes are likely to provide useful benchmarks for inspection planning, flaw evaluation, repair, and testing. 2.

Where a standard or code of practice other than those listed above has been employed, judgement as to the adequacy of alternative measures can only be assessed on an individual basis, and the duty holder should be required to provide an engineering justification of how an equivalent level of health and safety performance is delivered. The avoidance of loss of containment relies primarily on the integrity of the containment in which the hydrocarbons are held. The issue of mechanical integrity can itself be subdivided into issues of initial integrity and continuing integrity. 2.1

Initial integrity

Adequate initial integrity is delivered by adherence to suitable design principles, often embodied in codes and standards. Full consideration should be taken of design details, operating and fault conditions, material properties and potential failure modes. Related issues include the provision of protective systems. Delivery of the design intent is provided by suitable quality controls on manufacture followed by appropriate inspection and testing. Adequate initial integrity is ensured by adherence to the following engineering principles.

85

•

•

•

•

•

•

2.2

Risks implicit in the design should be identified. [APOSC 91] Engineering design should seek to minimise risk and adopt a hierarchical approach [APOSC 92 & 98] Appropriate industry standards should be used. Engineering structures important to safety should maintain their integrity through life, requiring a demonstration that normal operating loads and foreseeable extreme loads have been quantified. The materials used should be suitable. [APOSC 95] Active safety features should have demonstrably adequate reliability, availability and survivability In-service Integrity

Following a consideration of the initial integrity, attention must be turned to the continuing integrity of the containment, throughout its service life. This is ensured by; operating the plant within the limits for which it was designed; by carrying out appropriate maintenance and through periodic examination by a competent person, to identify significant inservice degradation. Also, procedures must be in place to ensure that modifications to the plant will not compromise the integrity of the containment. Finally, the duty holder needs to be sure that the assumptions made at the design stage are still valid. For example, a change of usage may lead to faster corrosion/erosion rates and different applied loads may invalidate the design fatigue assessment. 3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c) & 12(1)(d) & Schedules Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 9 and 19 Provision and Use of Work Equipment Regulations 1998, Regulations 4, 5 and 6 Lifting Operations and Lifting Equipment Regulations 1998, Regulations 8 and 9 Pressure Equipment Regulations 1999, Regulations 7 and 10 Assessment Principles for Offshore Safety Cases [APOSC] 14, 16, 35, 41, 91, 92, 95, & 98

4.

Specific technical issues Relevant initiators and potential failure mechanisms are identified below: 4.1

Primary & Secondary Loads

Primary loads typically include design pressure and self-weight etc. Secondary loads typically include thermal loads and equipment displacements etc. Adherence to the relevant design codes and standards should ensure that the pressure systems are adequately designed for primary and secondary loads. 4.1.1

Overpressure [Initiator 5.1.G3]

Pressure system should be designed for maximum and, where relevant, the minimum anticipated operating pressure under all modes of operation. It needs to be borne in mind that the maximum operating pressure may not occur during the normal mode of operation.

86

Designing equipment and systems to the maximum pressure to which it can be subjected can have advantages in simplifying plant by reducing or eliminating protection or relief systems. Based on established design pressures, the facilities should be protected with recognised relief devices discharging to suitable disposal or an instrumented high integrity protection system or a combination of both. The latter subject is covered in 5.1.F16. Possible sources of overpressure need to be identified and allowed for. Issues for Safety Case Assessment It should be established whether provision against over pressurisation is provided by active measures, such as pressure relief and control systems, or is dependent upon the strength of the component itself. Later in life, plant changes may necessitate reassessment. When overpressurisation is a foreseeable event, the consequences should be considered. The nature of the failure should be determinable, ie whether a leak or a catastrophic failure could result. Further assessment of consequence could include assessment of the hazards posed by any release. 4.1.2

Risers and Topsides Pressure Rating [Initiator 5.3.F15]

It is normal practice in offshore industry to use different design codes for the design of topside piping and risers. Risers are normally designed to pipeline design codes, such as BS 8010 and topside piping is normally designed to piping code ASME B31.3. Both the codes use different factor of safety in the design of pressure systems for primary and secondary loads. Hence it is important that at the specification break between riser and topside piping the pressure rating on both sides, ie riser and topside, is compatible. Issues for Safety Case Assessment It should be established that specification break made between topside piping and a riser is made at appropriate location so that the design requirements of respective design codes are satisfied. 4.1.3

Under-Pressurisation [Initiator 5.1.G5]

Underpressure events also have the potential to cause failures i.e. by implosion if the under-pressure that results is below atmospheric pressure [vacuum conditions]. Normally, integrity is assured by adherence to a recognised design code. 4.1.4

External Loads and Structural Support Failure [Initiators 5.1.G21 & 5.1.G29]

Lack of consideration of pipe supports and movement of piping and connected equipment at the design phase can result in failure of supports, leakage at flanged joints and overloading of sensitive equipment such as pumps and compressors etc. External loads could come from a disturbance of the structure itself, ie a partial failure or relative displacements. External movements may result from vessel movements [FPSO] or wind sway, eg piping supported from a tall slender tower or temperature changes in connected equipment. Loads due to such movements need to be considered and adequate flexibility should be provided within the pipework. For floating vessels, the motion may well contribute significantly to the fatigue load Issues for Safety Case Assessment Confirmation that external loads acting on the pressure system have been considered and allowed for in the mechanical design. 4.1.5

Inadequate Installation [Initiator 5.1.G10]

87

Inadequate installation of plant is a significant source of engineering failure. Deficiencies include misalignment of mating parts, incorrect welding and jointing procedures, inadequate inspection, and the omission of certain parts of the overall commissioning process, such as pressure testing. Commissioning procedures should be in place to ensure that installed pressure equipment is inspected before use to identify any design faults that may have been introduced at the construction stage and to confirm suitability for use. Issues for Safety Case Assessment Does the duty holder have an effective safety management system for installation and modification of plant. 4.1.6

Seismic Event [Initiator 5.1.G18]

If seismic events are deemed a possibility, then in principle the effects can be included as a design load case. In such a situation, the response of the structure will have been calculated and the resultant motion would have to be imposed on the hydrocarbon containment system. Issues for Safety Case Assessment Whether seismic assessment has been carried out at the design stage. 4.2

Occasional Loads

These include slugging, water hammer, wind, sloshing and liquid slam, etc [5.1.G27 & 5.1.G28]. During design, the operation of each piping system needs to be clearly understood not only under normal conditions but also those conditions arising during start up, shutdown and as a result of process upsets. The dynamic loads produced by the movement of fluids within a pressurised system can be considerable. Excitation from valve slams or from flow instabilities has been known to be a source of severe vibration. Issues for Safety Case Assessment The safety case should make it clear that occasional loads have been considered during the design phase. 4.3

Degradation in Service

4.3.1

Corrosion

Please refer to generic sheets 5.1.G1 Parts 1 & 2 & 5.1.F6. Piping containing hydrocarbons should avoid 'dead legs' and be designed to facilitate drainage to prevent trapping of fluid. 4.3.2

Erosion

Please refer to generic sheets 5.1.G2 & 5.1.F6. 4.3.3

Fatigue/Vibration Cracking [5.1.G6]

Fatigue is a damage mechanism by which cracks can propagate in a structure under the influence of repeated cycles of stress well below the level capable of causing general yielding. Fatigue is often characterised as occurring in two phases, the first is that of initiation, ie from manufacture up to the point where a detectable crack is present. The

88

second is the phase of defect growth, where propagation from the point of detectability to the point of failure occurs. Fatigue is addressed initially at the design stage. There are a number of methodologies by which this can be done. However we note that for plant with a limited fatigue load, the codes normally provide for the exclusion of a full analysis, providing that certain preconditions can be met, ie it is established that there will only be a limited number of full pressure cycles etc. In general though, the fatigue loads from all sources of repetitive stress have to be characterised both in terms of the stress amplitude and their number. This can be used to determine a fatigue lifetime for the component. Issues for Safety Case Assessment The importance of fatigue as a potential failure mechanism varies greatly according to the type of duty a pressure vessel or piping system is subjected to. However, in an environment where installations are increasingly being used beyond its original design lifetime, there are important issues as to whether the plant is still within its original fatigue life. For older plant, the duty holder could be questioned as to the current validity of the original fatigue calculations. Experience has shown that fluid induced vibration is a significant cause of failure in offshore pressure systems, affecting both vessels and piping. Such type of vibration is perhaps somewhat difficult to treat within design codes. Further guidance on this topic is provided in: JIP Report MTD Guideline for the Avoidance of Vibration Induced Fatigue in Process Pipework; and OTR Report 2002/28 Transient Vibration Guidelines for Fast Acting Valves Screening Assessment. It is a reasonable question to ask how the duty holder assures the integrity of plant against this source of fatigue. 4.3.4

Seal/Gasket/Compression Fitting Failure [5.1.G8]

A suitable demonstration should be provided for the integrity of joints and seals where failure could lead to a release of hydrocarbons. General information should be provided to indicate that flanges and other joints have been adequately designed and properly made to avoid flammable and toxic hazards. Further guidance is available in IP/UKOOA Guidelines for the Management of Integrity of Bolted Pipe Joints. 4.3.5

Fully Welded Topside Pipework in Critical Areas [5.3.F18 & 5.1.F9]

The use of fully welded pipework topside is one of the approaches to adhere to the principle of inherently safer design. However, for ease of access for operation, inspection, maintenance and repairs, it is not possible to have fully welded pipework everywhere on topside plant. The duty holder should avoid routing of pipework containing hazardous fluid through non hazardous area. If this is unavoidable then pipework shall be all welded [no flanges] and not located in a vulnerable position where it may be mechanically damaged. Issues for Safety Case Assessment It should be established in the safety case that as far as possible hydrocarbon pipework in non-hazardous areas is fully welded. 4.4

Materials

89

Materials chosen should be suitable for the application in terms of the process fluid, environment and applied loading. 4.4.1

Incorrect Material Specification

Please refer to 5.1.G24 regarding issues relating to incorrect material specification. Issues relating to incorrect material usage [5.1.G25] are addressed by ensuring that pressurised equipment is designed and manufactured in accordance with a recognised design standard as indicated in Section 1above. 4.4.2

Brittle Fracture

The prevention of brittle fracture is addressed within design codes. Prevention involves the correct choice of materials, operation within strict temperature/pressure limits and monitoring ageing phenomena such as embrittlement. Ferritic steels are subject to a ductile to brittle transition as temperature decreases, rendering them highly vulnerable to brittle fracture when cold. Transition temperatures vary, but are typically below ambient values for offshore applications. Ageing though can lead to a shift in the transition temperature and render components more susceptible to brittle fracture. Austenitic steels remain ductile at low temperatures and may be preferred for application such as blowdown lines. Brittle fracture is possible whenever low temperatures are involved, in particular low temperatures associated with gas expansion. This is particularly the case when systems are still pressurised, although in some circumstances, the differential stresses through the wall of a vessel by sudden cooling could lead to crack propagation. Issues for Safety Case Assessment Choice of materials. Identification of vulnerable components. 4.4.3

Ageing/Mechanical Degradation [5.1.G20]

The effect of ageing is undoubtedly one of the major integrity issues facing the older installations. Ageing encompasses degradation mechanisms such as fatigue and corrosion. There are also some other phenomena, for example creep and the deterioration in mechanical properties such as fracture toughness. The latter phenomenon is associated with changes in transition temperatures. Provision against these mechanisms is explicitly required, as part of the design criteria and operational monitoring exists for the express purpose of detecting these phenomena. Nevertheless, ageing related failures are occurring. The implication of this is that either plant is being operated beyond its original design life, that conditions have changed because modification has rendered the initial assumptions invalid or that inspection regimes are inadequate. In recent years, the popularity of risk-based inspection schemes has led to situations where inspection intervals have been lengthened for some plant. Where such decisions have been made, the requirements on the knowledge about plant state are high. Issues for Safety Case Assessment As for fatigue, corrosion and other degradation phenomena above; including: Whether initial design assumptions are still valid. Whether modifications have had their implications on lifetime assessed. Whether the inspection regime is adequate.

90

4.5

Dropped Loads [5.1.G17]

Major hazards assessed are the impact of dropped loads onto hydrocarbon containment plant and or accommodation areas. Protection essentially relies upon having an effective safety management system. Typical benchmarks employed include: HSG221 Technical guidance on the safe use of lifting equipment offshore BS 7121-2 & 11 Code of practice for the safe use of cranes Step Change lifting and mechanical handling guidelines OMHEC Training Standard for offshore crane operators and banksmen OMHEC Enterprise of competence

91

Issues for Safety Case Assessment Plans showing crane over sail area and identification of areas where HC piping and vessels and accommodation units are vulnerable to dropped loads and or boom collapse. References to dropped object/load impact studies and their conclusions. Provision of protective barriers on vulnerable areas. Description of cranes and lifting machinery including safe working load, de-rating for prevailing sea state, and rated capacity indicator. Details of the arrangements for maintenance and thorough examination of cranes. Details of how competence is assessed for crane operators, banskmen, slingers and for those responsible for planning lifting operations. Evidence that lifting operations are planned and assistance is available to identify and plan non-routine lifts. 5.

6.

Other Related Assessment Sheets in this Section are: 5.1.G1 Part 1

Corrosion: Internal

5.1.G1 Part 2

Corrosion: External

5.1.G2

Erosion

5.1.G18

Seismic Event

5.1.F16

High Integrity Protection Systems [HIPS]

Cross-Referenced Sections and Sheets are: Section 5.2

7.



8.


92

5.1.HS2: 1.

Heat Exchangers

Confirmation should be obtained that heat exchangers have been designed, constructed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include: BS EN ISO 16812:2003 and API Standard 660 for shell & tube exchangers BS EN ISO 15547:2001 and API Std 662 for plate heat exchangers BS EN ISO 13706:2000 and API Std 661 for air cooled heat exchangers BS EN ISO 13705:2002 and API Std 560 for fired heaters TEMA ‘Standards of the Tubular Exchanger Manufacturers Association’ are applicable for tubular heat exchangers. Pressure Vessel Design Codes applicable to heat exchangers: PD 5500:2003 Specification for unfired fusion welded pressure vessels BS EN 13445 Unfired pressure vessels ASME VIII Boiler and pressure vessel code Printed circuit heat exchangers [PCHEs] are normally designed to ASME VIII Division 1 but other design codes such as PD 5500 can be employed as required by the purchaser.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the heat exchange equipment can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35 Provision and Use of Work Equipment Regulations 1998 Regulation 4

4.


Shell and Tube Heat Exchangers

Flow induced tube vibration which results in thinning of the tubes can occur where the tubes pass through the tube sheets. The possibility of this occurring should have been examined as part of the design. The provision of overpressure relief for tube failure should be considered when the design pressure for the low pressure side of the exchanger is less than 2/3 of the design pressure of the high pressure side. Justification should be provided if the requirements of the 2/3 rule [as contained in API RP 521] are not met. [NB the 2/3 rule is written in the context of ASME pressure vessel codes for which the test pressure is typically 150% of the design pressure. In the rare circumstances where test pressures do not conform to these requirements, the 2/3 rule may not apply and more detailed assessment will be necessary.] Related guidance: API RP 52 Guide for Pressure Relieving and Depressuring Systems. 4th Edition March 1997

93

IP Guidelines for the Design and Safe Operation of Shell and Tube Heat Exchangers to Withstand the Impact of Tube Failure, August 2000, ISBN 0 85293 286 3 4.2

Printed Circuit Heat Exchangers

For PHCEs there is an issue with thermal cycling which has been known to have caused failure of the integrity of the heat exchange matrix. This phenomenon is most likely to occur when the unit is subjected to frequent start-ups and shutdowns. Confirmation should be sought that this has been taken into account as part of the design process. 4.3

Gasketed Plate Heat Exchangers

There is a likelihood of significant hydrocarbon release to the atmosphere on gasket failure. Shields should normally be fitted to prevent fluids from contacting personnel in the event of gasket failure. There is a working pressure limitation for gasketed plate heat exchanger of approx 25 barg. 5.

Other Related Assessment Sheets in this Section are: 5.1.HS1

6.



7.


8.


94

5.1.HS3: 1.

Atmospheric Vessels [eg Wemcos, TPSs]

Confirmation should be obtained that atmospheric vessels and their accessories have been designed and constructed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include: API Standard 2000 Venting Atmospheric and Low Pressure Storage Tanks; Non Refrigerated and Refrigerated, 5 th Edition, 1998 API Publication 2210 Flame Arresters for Vents of Tanks Storing Petroleum Products API Bulletin 2521 Use of Pressure-Vacuum Vent Valves for Atmospheric Pressure Tanks to Reduce Evaporation Loss API Standard 620 Design and Construction of Large, Welded, Low Pressure Storage Tanks API Standard 650 Welded Steel Tanks for Oil Storage API Specification 12D Field Welded Tanks for Storage Production Liquids API Specification 12F Shop Welded Tanks for Storage of Production Liquids BSI 1564:1975 Specification for the manufacture of vertical steel welded non-refrigerated storage tanks with butt-welded shells for the petroleum industry

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the atmospheric vessel can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14, 16 and 35 Provision and Use of Work Equipment Regulations 1998, Regulation 4

4.


Venting for Fire Exposure

It is likely that tanks installed on offshore installations will not be fitted with a frangible roofto-shell attachment for fire venting purposes. Where this is the case, confirmation should be sought that venting capacity is adequate for fire exposure conditions. 4.2

Bunding

It should be clear that any decision as to whether tanks should be bunded or not has been made in the light of a corresponding fire analysis. 4.3 The emergency dumping/draining of the flammable content of large tanks should have been considered. 4.4 Consideration should have been given to minimising storage tank sizes and inventories as part of a wider consideration of an inherently safer design features. 4.5

Methanol Storage Tanks

95

Provision should be made to limit the discharge of methanol vapour to atmosphere. For large storage tanks, the provision of an inert gas blanket should have been considered. 5.

Other Related Assessment Sheets in this Section are: 5.1.F14

6.

Inherent Safety


7.


8.


96

5.1.HS4: 1.

Centrifuges/Hydrocyclones

Confirmation should be obtained that centrifuges and hydrocyclones have been designed, and constructed, in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include: PD 5500:2003 Specification for unfired fusion welded pressure vessels BS EN 13445 Unfired pressure vessels ASME VIII Boiler and pressure vessel code

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the centrifuge or hydrocyclone can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35 Provision and Use of Work Equipment Regulations 1998, Regulation 4

4.


5.


6.



7.


8.


97

5.1.HS6: 1.

Smallbore Tubing

Confirmation should be obtained that the design, installation and maintenance of smallbore tubing is in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include: Guidelines for the Management, Design, Installation and Maintenance of Smallbore Tubing Systems: UKOOA/Institute of Petroleum 2000

2.

Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy can only be made on an individual basis and the duty holder should be required to justify why equivalent standards of safety should result.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35 Provision and Use of Work Equipment Regulations 1998, Regulation 4

4.

Specific Technical Issues: None over and above those described in the referenced standard.

5.

Other Related Assessment Sheets in this Section are: 5.1.G6

6.

Fatigue/Vibration Cracking


7.


8.


98

5.1.HS8: 1.

Flexible Hoses

Confirmation should be sought that the design, specification and usage of flexible hoses used on the installation is in accordance with a recognised standard or code of practice. Recognised standards/codes of practice include: Flexible Hose Management Guidelines: UKOOA/HSE/Institute of Petroleum 2003

2.

Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy can only be made on an individual basis and the duty holder should be required to justify why equivalent standards of safety should result.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35

4.


5.


6.

Cross-referenced Sections and Sheets are: None

7.


8.


99

5.1.HS9:

Pumps

5.1.HS10: Compressors 5.1.HS11: Turbines [Relevant Sheets: 5.1.G7, 5.1.G19] 1.

Introduction This sheet is to provide guidance for safety case assessment for areas dealt with by the Mechanical Systems Team OSD3.4. What follows is therefore generally applicable to the mechanical integrity of machinery and rotating equipment. Aspects specific to hydrocarbon containment are dealt with elsewhere. Similarly, process control and plant isolation requirements are not dealt with here. The document is not intended to limit the scope of an assessor to pursue any aspect of safety that they believe is important to a particular safety case, within the remit provided by the Safety Case Regulations. It is though intended to provide guidance as to the minimum acceptable demonstration of safety that a duty holder should be able to provide. As with all safety case assessment work, there is a need for HSE assessors to concentrate on areas where there are grounds for believing the safety demonstration may be weakest. Knowledge of such areas comes from HSE’s collective experience, as well as that of the wider engineering community. There is some guidance below that provides pointers towards what are believed to be the most pressing concerns. Conversely, it is not considered necessary or practical for a particular safety case to mention explicitly all of the aspects of design and operational concerns identified below. However, the duty holder should in principle be able to address all such concerns and hence provide an adequate demonstration of integrity. Therefore, in the last resort, it is reasonable for an assessor to question a duty holder on any aspect of the integrity justification.

2.

Machinery and Rotating Equipment Integrity Machinery and rotating equipment is often packaged together to form a single system. The packages employ a combination of rotating equipment such as pumps, compressors and generators, driven by a gas turbine or electric motor. Typical applications include: •

Process and export gas compression

•

Oil export pumping

•

Fire water pumping

•

Utilities [electricity generation/compressed air]

Our main source of reference is HSE’s Inspection Guidance Notes [IGN]: HSE Research report 076 “Machinery and Rotating Equipment Integrity Inspection Guidance Notes” . The IGN provides technical guidance that focuses on commonly used equipment such as gas compression and oil export packages, typical machinery including turbines, motors and diesel engines, and rotating equipment such as pumps and compressors etc. The IGN provides an understanding of the technology used and considers those aspects of design, operation and maintenance that could contribute to a major offshore incident. The report also includes a structured review to assist Inspectors gauge compliance with statutory requirements and it gives examples of poor practice to look out for. A comprehensive list of relevant standards is provided in Section 5.15 of the IGN.

100

3.

Relevant Legislation, ACOP and Guidance Includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35

4.


5.


6.


7.


8.


101

5.1.HS13: 1.

Deck Tanks

Confirmation should be obtained that deck tanks and their accessories have been designed and constructed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice include: API Standard 2000 Venting Atmospheric and Low Pressure Storage Tanks; Non Refrigerated and Refrigerated, 5 th Edition, April 1998 API Publication 2210 Flame Arresters for Vents of Tanks Storing Petroleum Products API Bulletin 2521 Use of Pressure-Vacuum Vent Valves for Atmospheric Pressure Tanks to Reduce Evaporation Loss API Standard 650 Welded Steel Tanks for Oil Storage API Specification 12D Field Welded Tanks for Storage of Production Liquids API Specification 12F Shop Welded Tanks for Storage of Production Liquids BS 1564:1975 Specification for the manufacture of vertical steel welded non-refrigerated storage tanks with butt-welded shells for the petroleum industry BS 1564:1975 Specification for pressed steel sectional rectangular tanks.

2.

Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy of the deck tank can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35 Provision and use of Work Equipment Regulations 1998, Regulation 4

4.


Venting for Fire Exposure

Venting capacity should be adequate for fire exposure. 4.2

Methanol Storage Tanks

Provision should be made to limit the discharge of methanol vapour to atmosphere. 5.


6.


7.


8.


102

5.1.HS15: 1.

Hazardous Drains/Caisson

Confirmation should be obtained that the hazardous drains system and disposal caisson have been designed and constructed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice include: Pipework: ANSI B31.3 Petroleum refinery piping Sump Tanks & Disposal Caisson: API Standard 2000 Venting Atmospheric and Low Pressure Storage Tanks; Non Refrigerated and Refrigerated, 5 th Edition, April 1998

2.

Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy of the hazardous drains system and disposal caisson can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.

3.


4.


Flame Arrester

The hazardous drains sump tanks and disposal caisson will generally be vented to the atmospheric vent header although, in some cases, a dedicated vent may be provided. In either case, the vent should be fitted with a flame arrestor designed to API 2210 or equivalent. 4.2

Wave Action

The drains sump vent should be of sufficient capacity to accommodate the inbreathing and outbreathing due to the rise and fall in liquid level as a result of wave action. Dip pipes, within the caisson, should terminate at sufficient depth to ensure that they are submerged at all times. 4.3

Dip Pipe Perforation

Dip pipes can be subjected to accelerated rates of corrosion at, or just below, the liquid level in the caisson. Perforation resulting from such corrosion may result in the migration of hydrocarbon vapour from the caisson into the drains system, [this has resulted in a number of hydrocarbon releases]. Confirmation should be obtained that there is an inspection scheme in place to address this phenomenon. 4.4 A number of hydrocarbon releases have resulted from poor design involving inappropriate interconnections between the closed/flare system and the open drains. Plant blowdown then causes gas to discharge from the open drains. Confirmation should be sought that this possibility has been examined during the plant HAZOP studies. 5.


103

6.


7.


8.


104

5.1.HS17: 1.

Flare Towers

Confirmation should be obtained that flare towers have been designed and constructed in accordance with recognised standards or code of practice. Recognised standards/codes of practice include: API RP 521 American Petroleum Institute [1997] Guide for Pressure Relieving and Depressurising Systems The Institute of Petroleum [2001] Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown Systems ISBN 0 85293 287 1 The above codes, standards and guidance are applicable to flare towers on both fixed installations and FPSOs. Well test equipment on drilling installations is likely to have dedicated well test flare booms.

2.

Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy of the flare tower can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.


4.

Specific Technical Issues: A review of lessons learned from past incidents is given in Section 6 of Institute of Petroleum Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown Systems. This guide includes ‘checklists for assessment of relief and blowdown systems’ [pp 100-102] for both designers and operators. The guide should be included as part of the assessment process. An overview of radiation exposure levels is given in Section 5.8 of the Institute of Petroleum Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown Systems . Confirmation should be obtained that the suggested limits are not exceeded.

5.


6.

Relief Systems


7.


8.


105

5.1.HS18:

Mechanical Integrity of FPSO Mooring Turrets

[Relevant Sheets: 5.1.G.9] Introduction Many floating production storage and offtake facilities [FPSOs] employ the principal of free weathervaning of the hull round a geostationary mooring spread. For this purpose, the hull structure is designed or modified to accommodate an internal turret to which static mooring lines are fixed permitting unrestricted rotation of the vessel about that axis of fixation. The turret incorporates a bearing arrangement similar to a crane slew ring to reduce friction and, also usually a high pressure swivel system to permit and control the transfer of fluids from the stationary risers to the rotating vessel and its processing and storage facilities. The design and operational safety/integrity of the bearing and swivel arrangements are matters for technical assessment by OSD Mechanical Specialists at the design safety case and operational safety case stages. Other aspects such as integration of the turret with the hull structure and the design/integrity of flowlines and flexible risers need to be addressed by respective specialist sections. Assessment Principles i.

There are no national or international standards or formal codes for the design of turrets or swivels, although they draw heavily upon existing large low speed bearing design and fluid/gas sealing technology. Each example to date is a bespoke engineering solution and the most appropriate method of assessment therefore involves the basic principals of hazard identification, FMEA, Risk Assessment and whether risks are controlled to ensure compliance with the relevant statutory provisions.

ii.

OSD3.4, to obtain the information necessary to approach the assessment task in a competent and consistent manner, commissioned a technical survey of published information covering all FPSO and FSO installations in the UK sector. From this information a practical and comprehensive database was created called:

The FPSO Turret and Swivel Interactive Knowledge Base The IKB provides the following principal reference facilities: i.

General description of turret systems -

Ship structures

-

General systems and arrangements

-

Mooring systems and turret loadings

-

Scaffolding and support systems

-

Personnel

-

Construction standards

ii.

Turret system design -

Major components and boundaries

-

Turret transfer systems

106

-

Interfacing systems

iii.

Fluid transfer systems

iv.

Failure modes

v.

Inspection and maintenance

vi.

Examples of good and bad practice

This extensive register encompasses detail of all existing turret mooring designs and arrangements existing in UK waters. In addition it discusses in appropriate technical language the merits and weaknesses of respective systems and guides the reader first toward an appreciation of the broader aspects of the technology, hazard identification and risk recognition processes, to a position where specific examples may be subject to comparative appraisal against a cross industry selection of design types and their operational characteristics and histories. 3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4, 5, 9 & 19 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996, Regulations 4, 5, 6, 7 & 8

4.

For marginal field development the turret moored FPSO offers commercial attractions. Mooring turrets clearly embody major hazard potentials including both the control of the transient hazardous inventories within them and station keeping of the parent vessel. Full and intelligent use of the FPSO turret database and application of its reflective appraisal procedures are the best means available for assessing and evaluating both the design and the lifetime operational integrity of this advanced production technology.

5.

Other Related Assessment Sheets in this Section are: For the purpose of this manual mooring turrets have been assigned to Section 5.1 - Loss of Containment - Process. However, the turret is a multi functional design feature, its construction and housing form an integral part of the vessel primary structure and the mooring system. Whilst these considerations are the responsibility of structural and marine specialists, structural strength and especially stiffness are of paramount importance to the performance of the turret bearings, seals and flanged joints. Consequently there are at least three safety critical elements to be assessed in relation to the turret, namely integrity of primary and support structure, mooring integrity and the integrity of fluid paths [flexible risers, swivels and rigid pipework]. It is therefore desirable that the assessment of turret design and operational issues should be undertaken on a multi discipline basis with input from OSD5 and other OSD3 Specialist Teams.

6.


7.


8.


107

5.1.HS19: 1.

Temporary Equipment

Confirmation should be obtained that systems and procedures are in place to manage the risks associated with the use of temporary equipment. These should be broadly in line with the guidance given in SPC/TECH/OSD/25. Confirmation should also be obtained that all temporary equipment has been designed and constructed in accordance with recognised standards or codes of practice, or if not, justification sought as to why the standard(s) employed should result in equivalent levels of safety.

2.

Where systems and procedures differ markedly from those recommended in SLC 2004/02, judgement as to the adequacy of the management of risks associated with the temporary equipment can only be assessed on an individual basis and the duty holder should be required to justify that the applied systems and procedures will be equally effective.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC], paras 14 and 35 Provision and Use of Work Equipment Regulations 1998, Regulation 4

4.


Deciding What Is, and Is Not, Temporary Equipment

Essentially Temporary Equipment compromises equipment which is not a permanent part of the installation, and which is intended to be removed after a finite period of time. 4.2

Impact of Temporary Equipment on Existing Plant/Systems

A HAZID and HAZOP should have been conducted to ensure that the Temporary Equipment will not compromise the integrity of the existing plant and systems [and vice versa]. 4.3

Control of Change

There should be systems/procedures in place to control short term amendments to existing procedures/documentation. The systems/procedures should cover the reinstatement of amended material. 4.4

Competence and Training

Temporary training requirements need to be identified, recorded and implemented. Contractor competence and training should be verified by the duty holder. 4.5

Control of Contractors

The integration of systems/procedures will be required where the Contractors have their own systems/procedures for the operation, control and maintenance of the temporary equipment. 5.


6.


108

7.


8.


109

5.1.G1 Part 1: Corrosion: Internal Topsides Plant 1.

Confirmation should be obtained that internal corrosion is being managed through implementation of a corrosion management system. There are no recognised standards or codes of practice that deal with the corrosion management system. Hence in cooperation with the offshore industry CAPCIS have prepared the research report OTO 2001/044 Review of Corrosion Management for Offshore Oil and Gas Processing for HSE, which provides guidance and examples of best practice. This is considered to be the benchmark that duty holders’ corrosion management system should satisfy. Recognised standards and codes of practice dealing with certain specific elements of corrosion management include: DnV RP G-101 Risk Based Inspection of Topsides Static Mechanical Equipment API Publication 581 Risk Based Inspection HSE RR363/2001 Best Practice for risk based inspection as part of integrity management RIMAP Generic Risk Based Inspection and Maintenance Planning NORSOK standard M-506 CO2 Corrosion Rate Calculation Model NORSOK Standard M-CR-505 Corrosion Monitoring Design NACE Standard RP0775 Preparation and Installation of Corrosion Coupons and Interpretation of Test Data in Oil Field Operations NACE Standard RP0497 Field Corrosion Evaluation Using Metallic Test Specimens NACE Standard RP0192 Monitoring Corrosion In Oil & Gas Production with Iron Counts ASTM G4 Standard Guide for Conducting Corrosion Coupon Tests in Field Application ASTM G96 Standard Guide for On-line Monitoring of Corrosion in Plant Equipment [Electrical and Electrochemical Methods] Institute of Petroleum Model Code of Safe Practice for Petroleum Industry Part 13: Pressure Piping Systems Examination Institute of Petroleum Model Code of Safe Practice for Petroleum Industry Part 12: Pressure Vessel Systems Examination EEMUA 193 Recommendations for the Training, Development and Competency Assessment of Inspection Personnel EEMUA 179 A Working Guide for Carbon Steel Equipment in Wet H2S Service [Developed largely from Oil Refinery experience] API RP574 Inspection Practices for Piping System Codes API RP570 Piping Inspection Code: Inspection, repair, alteration and re-rating of inservice piping systems API RP510 Pressure vessel inspection code: Maintenance inspection, rating, repair, and alteration

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of corrosion management can only be assessed on an individual basis, and the duty holder should be required to justify why its

110

procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. 3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations12(1)(c) and 12(1)(d) Assessment Principles for Offshore Safety Cases [APOSC], paras 95, 98 and 102 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4(1)(a); 9(b) and 12 Pressure Equipment Regulations 1999

4.

Specific Technical Issues: The safety case assessment should seek to establish to what extent aspects of the corrosion management system listed below have been addressed particularly because experience has shown them to be contributory factors in corrosion incidents: •

•

•

Clear, explicit policy governing corrosion and plant monitoring. Sufficient in–house expertise, clear allocation of responsibilities and involvement of offshore staff to enable delivery of the policy. Better analysis and integration of inspection and monitoring data including use of statistical techniques to allow for uncertainties resulting from limitations of inspection techniques and coverage.

•

Better use of opportunistic inspection.

•

Better documentation of system.

•

Increased utilisation of platform staff knowledge and raised awareness.

•

•

•

•

Widen scope of inspection plans that includes certain amount of speculative inspection. Improved identification of corrosion hot spots based on plant walkabout rather then examination of drawings. Increased system performance monitoring and improved failure investigations that identify underlying system failures. Regular system reviews that includes assessment of system performance against set criteria, evaluation of system failures and identification of areas to be improved.

•

Regular independent audits of the corrosion management system.

•

Ensuring high availability of inhibitor injection system.

•

•

•

Consideration of enhanced degradation near injection points due to local flow/environmental conditions. Planning of non-invasive inspection [NII] scheme based on considerations outlined in JIP reports “HOIS NII Decision Guidance”, “Mitsui Babcock GSP 235, Recommended Practice for NII”. Minimisation of deadlegs and where unavoidable implementation of targeted inspection scheme.

111

•

•

•

•

•

•

•

•

•

5.

6.

Identification of areas prone to pitting and application of the most appropriate inspection techniques and prevention schemes including designing them out. Identification of components that could suffer preferential weld corrosion and application of appropriate specialised inspection techniques and prevention strategies. Further guidance in JIP report “Risk of preferential weldment corrosion of ferritic steels in CO2 containing environments” and the “Guidelines for the prevention, control and monitoring of preferential weld corrosion of ferritic steels in wet hydrocarbon production systems containing CO2”. Level of attention given to the hydrocarbon drains systems integrity management. Special consideration of the failure mechanisms of smallbore piping [3” and below] and application of appropriate inspection techniques. Consideration of chloride stress corrosion cracking and or pitting in corrosion resistant materials operating in environmental condition where high concentration of salts can develop. Management of process conditions [ie ensuring no oxygen] to prevent formation and deposition of elemental sulphur in plant handling sour fluids. More user friendly and accessible corrosion monitoring probe and chemical injection quill access fittings and locations. Inspection and monitoring data analysis including use of statistical and reliability methods. How is past experience captured and incorporated in the design of corrosion protection measures for new installations.


Erosion

5.1.G6

Fatigue/Vibration Cracking

5.1.G15

Deficient Procedures: Maintenance

5.1.G20

Ageing/Mechanical Degradation

5.1.G24


5.1.G25

Incorrect Material Usage


7.


8.


112

5.1.G1 Part 2: Corrosion: External Topsides Plant and Structure 1.

Confirmation should be obtained that external corrosion has been managed by implementation of a corrosion management system. There is no single national or international standard dealing with this topic and hence a number of approaches, including treating it as part of the process plant corrosion management system or the installation fabric maintenance system have been adopted. Recognised standards/codes of practice dealing with certain specific elements of corrosion management include: OT0 2001-011Corrosion Protection BS5493 Code of practice for protection of iron and steel structures against corrosion NORSOK standard M-501 Surface preparation and protective coatings ISO 12944 Paints and Varnishes – Corrosion Protection of Steel Structures 85 5493: 1977 Protective coating of iron and steel structures against corrosion. EN ISO 14713: Protection against corrosion of iron and steel in structures - Metal coatings - Guide. EN ISO 1461: Hot dip galvanized coatings on fabricated products. EN 10240: (Draft) Coatings for steel tubes: Specification for hot dip galvanized coatings. ISO 4628-3: 1982 Paints and varnishes - Evaluation of degradation of paint coatings Designation of intensity, quantity and size of common types of defect - Part 3: Designation of degree of rusting. BS 7079: Part Al Preparation of steel substrates before application of paints and related products - Visual assessment of surface cleanliness - Part 1: Rust grades and preparation grades of uncoated steel substrates and of steel substrates after overall removal of previous coatings. ISO 9223: 1992 Corrosion of metals and alloys - Corrosivity of atmospheres Classification. ISO 11303:2002 Corrosion of metals and alloys - Guidelines for selection of protection methods against atmospheric corrosion EN 22063: 1993 Metallic and Other Inorganic Coatings - Thermal Spraying - Zinc, Aluminium and Their Alloys EEMUA 200 Guide to the specification, installation, maintenance of spring supports of piping ISO CD 19902 Petroleum and natural gas industries – Fixed offshore structures

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of corrosion management system can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c) and 12(1)(d

113

Assessment Principles for Offshore Safety Cases [APOSC] paras 95, 98 and 102 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4(1)(a), 9(b) & 12 Pressure Equipment Regulations 1999 4.

Specific Technical Issues: External corrosion of topsides on an ageing installation does not usually receive the same degree of attention as the management of the internal corrosion with the result that on a number of installations the primary threat of hydrocarbon release is from external corrosion. In addition a significant number of personnel injuries on such installations are due to falls and trips resulting from failure of corroded members used as temporary supports or steps. Corroded walkways have also featured in a number of incidents. Particular issues that should be probed as part of the safety case assessment include: •

•

Management of corrosion under insulation.

•

Management of bolt corrosion.

•

•

•

6.

Management of the risks associated with surface preparation and painting on ‘live’ plant.

•

•

5.

Management of process plant integrity around corrosion traps such as pipe supports, penetrations, saddles, etc.

Management of pitting and stress corrosion cracking in corrosion resistant alloy piping and tubing operating in areas exposed to sea spray/deluge. See RR129 “Review of external Stress Corrosion Cracking of 22% Cr Duplex Stainless Steel” for further guidance. Painting and refurbishment planning systems and performance standards including short term remedies. Maintenance of spring supports. Corrosion management of walkways, hand railings, escape equipment attachment points and other similar secondary structural components.



5.1.G20


5.1.G24


5.1.G25



7.

Lead Assessment Section for this Sheet: OSD5.1 for process plant and OSD5.1 – OSD5.4 for topsides structures.

8.


114

5.1.G2: 1.

Erosion

Confirmation should be obtained that erosion is being managed through implementation of an erosion management system that includes amongst other things selection of appropriate materials and coatings, control of fluid velocities, removal/prevention of solid particles, effective detection systems, plant design that minimises changes in flow direction and erosion resistant valve design. Recognised standards/codes of practice dealing with erosion include: DNV Recommended Practice RP 0501 Erosive Wear in Piping Systems ISO 13703 Offshore Piping Systems API RP14E Design and Installation of Offshore Production Platform Piping Systems

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of erosion management system can only be assessed on an individual basis, and the duty holder should be required to demonstrate its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c) and 12(1)(d) Assessment Principles for Offshore Safety Cases [APOSC], paras 95, 98 and 102 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4(1)(a), 9(b) and 12 Pressure Equipment Regulations 1999

4.

Specific Technical Issues: There have been a number of major hydrocarbon releases recently caused by solids particle erosion where failure of a number of crucial control measures had occurred. Wall thinning is usually very rapid and hence prevention rather then control should be the guiding principle. Operations staff do not always appreciate the impact of the production rate on erosion risk. Prevention of erosion in the production plant can be achieved by design whereas for well servicing and drilling operations process management is usually the only available option. Erosion tends to be a localised effect which means that a very good knowledge of the local rather then global flow velocities is required in order to assess erosion risks. Sand detection systems have proved to have varying reliability and hence their effectiveness should be explored as part of the assessment process. Relevant guidance documents include: RR115 Erosion in Elbows in Hydrocarbon Production systems: Review Document SPC/TECH/OSD/19 Offshore Produced Sand Management

5.

Other Related Assessment Sheets in this Section are: 5.1.G1 Part 1 Corrosion: Internal 5.1.G1 Part 2 Corrosion: External

6.


115

7.


8.


116

5.1.G4 1.

Internal explosion

Confirmation should be obtained that internal explosions have been assessed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: Fire, Explosion and Risk Assessment Topic Guidance HSE website 2003 Fire & Explosion Strategy Document HSE website 2004 OTN 95 196 1995 Gas explosion handbook HSE-OSD report Guidelines for Fire & Explosion Management (UKOOA) 1995 CMPT - A guide to QRA for Offshore Installations BS EN 13702:1999 Petroleum and Natural Gas Industries – Control and Mitigation of Fires and Explosions on Offshore Production – Requirements and Guidelines.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the evaluation of the internal explosion hazard can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/ practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance include: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995

4.

Specific Technical Issues: Internal explosions are regarded as a lower risk factor in comparison to topsides external explosions. Specific attention should be paid to situations whereby air could ingress into a hydrocarbon-saturated atmosphere and form a flammable air/vapour mixture. The risk from a gas turbine sourced internal explosion should be assessed with particular emphasis on fuel/air control, emergency shutdown control and internal conditions that could give rise to volumes of un-ignited fuel air mixtures. The adequacy of Internal Explosion venting available in each engine installation should also be investigated.

5.

Other related assessment sheets in this Section are: None

6.

Cross-referenced Sections and sheets are: Section 5.1


Sheet 5.1.HS9

Pumps

Sheet 5.1.HS10

Compressors

Sheet 5.1.HS11

Turbines

Sheet 5.1.F3

Installation Specific Hazard Studies

Sheet 5.1.F8


117

Sheet 5.3.F23 7.

Fire/Smoke/Gas/Flame Fire/Smoke/Gas/Flame Detectors/Alarms Detectors/Alarms

Lead assessment section for this sheet: OSD3.2

8.

Team Responsible for authoring and updating this sheet: OSD3.2

118

5.1.G7: 1.

Fire

Confirmation should be obtained that requirements for the identification of fire hazards as initiators to other hazardous events have been analysed in accordance with recognised standards or codes of practice that would be used for a manned installation. Recognised Recognised standards/ codes of practice would include: ISO/FDIS 13702 Petroleum and Natural Gas Industries – Control and mitigation of fires and explosions on offshore production installations installations – requirements requirements and guidelines.

2.

Where a standard/code standard/code of practice other than those listed above has been employed, judgement as to the the adequacy of of the evaluation of these these hazards can only only be assessed assessed on an individual basis, and the duty holder should be required to justify which its procedures/practices procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: includes: Offshore Installations (Safety Case) Regulations Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion and Risk Assessment Topic Guidance, Guidance, HSE website 2003 Fire & Explosion Strategy Document, Document, HSE website 2004

4.

Specific Technical Issues: Issues: Specific attention should be paid to the identification of mitigation barriers to stop escalation paths early in a hazardous event situation. For example, a fire detection system should be regularly tested to maintain its design performance of identifying rapidly fires in accommodation as well as process areas.

5.


6.

7.

Cross-Referenced Cross-Referenced Sections and Sheets are: Sheet 5.3.F8

Fire Types

Sheet 5.3.F10

Fire Modelling

Sheet 5.3.F11

Explosion Modelling

Sheet 5.3.F28

Ventilation and HVAC


8.


119

5.1.G24: 1.


Confirmation should be obtained that material selection has been based on a rigorous evaluation of all internal and external environments, operational and non operational operational conditions including upset conditions, design life and system performance standards, failure modes and consequences, inspection and monitoring requirements and health conditions. In addition to the standards listed below most process plant component standards also cover material performance requirements requirements to some extent. Recognised standards/codes of practice dealing with materials selection include: NORSOK Standard M-001 Materials Selection EEMUA 194 Guidelines For Materials Selection and Corrosion Control for Subsea Oil and Gas Production Equipment ASME B31.3 Process Piping ASME Boiler and Pressure Vessel Code Section VIII BS5500 [PD 5500] Specification for Unfired Fusion Welded Pressure Vessels EFC Pub 16 Guidelines on Materials For Carbon and Low Alloys Steels for H2S Containing Environments Environments in Oil and Gas Production EFC Pub 17 Corrosion Resistant Alloys for Oil and Gas Production. Guidance on General Requirements and Test Methods for H2S Service EFC Pub 23 CO2 Corrosion Control in Oil and Gas Production NACE MR0175 Sulphide Stress Cracking Resistant Materials for Oilfield Equipment NORSOK Standards M-506 CO2 Corrosion Rate Calculation Model ISO 14692 Petroleum and natural gas industries. Glass-reinforced plastics [GRP] piping

2.

Where a standard/code standard/code of practice other than those listed above has been employed, judgement as to the the adequacy of materials materials specification specification can only be assessed on an individual basis, and the duty holder should be required to justify which its procedures/practices procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: includes: Offshore Installations (Safety Case) Regulations Regulations 2005, Regulations Regulations 12(1)(c), 12(1)(d) Assessment Principles for Offshore Safety Cases [APOSC], [APOSC], paras 95 and 98 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 9(1) and 12 Pressure Equipment Regulations 1999

4.

Specific Technical Issues: Issues: Although the above standards provide a good basis for evaluation of materials selection they are not all encompassing and hence the following should in addition be examined: •

How has the industry experience been captured and fed into the materials selection process?

120

•

•

Are risks of preferential weld corrosion adequately addressed?

•

How are the significant erosion risks in vessel sand wash drains tackled?

•

•

•

•

6.

Have the various problems with vessel internal coatings experienced by a number of duty holders been recognised?

•

•

5.

What is being done to design out corrosion under lagging?

Are ESD and Control valve trims adequate to maintain seal tightness under the operating environment? environment? Are the limitations and problems in using corrosion allowance approach approach to manage degradation recognised? Do provisions for testing include the need to t o demonstrate adequacy of the material’s corrosion resistance as well as physical properties? Have the limitations of 316SS tubing been considered in the material selection process? Are the particular requirements for bolting material and its corrosion protection adequately addressed?

Other Related Assessment Sheets in this Section are: Sheet 5.1.G2

Erosion

Sheet 5.1.G6

Fatigue/Vibration Fatigue/Vibration Cracking

Sheet 5.1.G15


Sheet 5.1.G20

Ageing/Mechanical Ageing/Mechanical Degradation Degradation

Sheet 5.1.G25


Cross-Referenced Cross-Referenced Sections and Sheets are: None

7.


8.


121

5.1.G26: 1.

Thermal Radiation

Confirmation should be obtained that requirements requirements for the identification of thermal radiation as an initiator to other hazardous events have been analysed in accordance with recognised standards or codes of practice that would be used for a manned installation. installation. Recognised standards/codes include: ISO/FDIS 13702 Petroleum and Natural Gas Industries– I ndustries– Control and Mitigation of fires & explosions on offshore production installations – requirements and guidelines

2.

Where a standard/code standard/code of practice other than those listed above has been employed, judgement as to the the adequacy of of the evaluation of of thermal radiation radiation hazards can only only be assessed on an individual basis, and the duty holder should be required to justify which its procedures/practices procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: includes: Offshore Installations (Safety Case) Regulations Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion and Risk Assessment Topic Guidance, Guidance, HSE website 2003 Fire & Explosion Strategy Document, Document, HSE website 2004

4.

Specific Technical Issues: Issues: Thermal radiation sources should be identified using techniques such as HAZOP studies in conjunction with manufacturers information, and evaluated and recorded as a thermal radiation hazard.

5.


6.

7.


Fire Types

Sheet 5.3.F10

Fire Modelling

Sheet 5.3.F11

Explosion Modelling

Sheet 5.3.F28



8.


122

5.1.F1:


1.

Confirmation: in order for duty holders to estimate the frequency of potential accident scenarios, data will be required on a range of relevant inputs, ranging from failure of individual parts of the hydrocarbon containment containment envelope, [pressure vessels, piping, heat exchangers etc] through to the probability probability that alarm and preventative systems or items of equipment such as fire and gas alarms and components of the shutdown system will fail f ail to operate correctly on demand.

2.

If the frequency estimates produced for the various accident scenarios are to be realistic and credible it is essential that the data used in deriving them is soundly based and defensible. In many cases where company company or installation specific specific data [see 5.1.F2] 5.1.F2] is not available estimates will have to have been produced using generic historical data from across the industry worldwide. This data will have been produced using a variety of different sources. Potential sources sources are described described in SPC/TECH/OSD/24 and include OREDA, E&P Forum, WOAD etc. Assessors should carefully examine the values assigned to the failure rates for different types of equipment against typical indicative historical values given in SPC/TECH/OSD/24.. The values quoted have been produced by HSE using relevant data SPC/TECH/OSD/24 sources including the OSD Hydrocarbon Release Database. Where a duty holder has used a failure rate/probability which differs markedly from the indicative values given in SPC/TECH/OSD/24 and where the usage of this figure results in a significantly lower release/accident frequency being adduced, the duty holder should be requested to provide a detailed justification.

3.

Relevant Legislation, ACOP and Guidance includes: includes: Offshore Installations (Safety Case) Regulations Regulations 2005

4.

Specific Technical Issues: Issues: None

5.


6.

Company and Installation Specific Data


7.


8.

Team responsible for authoring and updating this sheet: sheet: OSD3.1

123

5.1.F2:

Company and Installation Specific Data

1.

Confirmation: Enquiries should be made as to whether company or installation specific data is available and has been used to estimate failure/release frequencies as opposed to reliance on generic historical data.

2.

Company/installation data is preferable to generic data as it is more likely to reflect accurately the effect of company/installation specific features such as its safety management policies/practices/ competencies, operating history etc. If it is available but has not been used, justification should be sought. Care should be taken where generic data has been employed but has been modified allegedly to reflect ‘company specific circumstances’. Experience suggests that such modifications almost invariably result in claims for lower than average failure/release rates. Clearly it is an anomalous situation where every duty holder is apparently better than average and the basis for such claims should be carefully examined. Care should also be taken in cases where company/installation data is being used but it indicates failure/release rates markedly different from the indicative figures given in SPC/TECH/OSD/24. The basis for any claims of superior performance needs to be carefully established and examined.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005

4.


5.


6.



7.


8.


124

5.1.F3: 1.

Installation Specific Hazard Studies

Confirmation should be obtained that installation specific hazard studies have been carried out in accordance with recognised standards or codes of practice for all operational safety cases. Normally the hazard studies should include a detailed HAZOP study. Recognised standards/codes of practice for HAZOP include: HAZOP: Guide to Best Practice – I.Chem.E 2000 IEC 61882 Guide for Hazard and Operability Studies (HAZOP Studies) CIA 1977 A Guide to Hazard and Operability Studies (relevant to older installations only). The HAZOP study could be used in conjunction with other recognised techniques such as: Failure Modes and Effect Analysis (relevant standard IEC 60812 – Procedures for Failure Modes and Effects Analysis). Fault Tree Analysis (relevant standard IEC 61025 – Fault Tree Analysis) SAFE (Safety Analysis Function Evaluation) Charts using EN/ISO 10418 (formerly API RP 14C) methodology. BS EN ISO 17776:2002 – Guidelines on tools and techniques for hazard identification and risk assessment. Restricting the hazard identification process to high level hazards [fire, explosion, toxic release, structural failure etc] can be acceptable for design safety cases (provided more detailed work is still to be carried out) but does not provide the depth or rigour required for operational safety cases.

2.

Where a standard/code of practice/methodology other than those listed above has been employed, judgement as to the adequacy of the hazard studies can only be assessed on an individual basis and the duty holder should be required to justify why the methods employed will be equally effective.

3.

Factors to note in assessing hazard studies include: i.

As noted above whilst restricting the identification process to high level hazards or accidents [fire, explosion etc] may have some justification for design safety cases [where more detailed work has yet to be carried out] it is of extremely limited value in the operational safety cases context. Identifying fire as a hazard in a module containing hydrocarbon does nothing to identify ways in which the hydrocarbon might be released or where and how it might be ignited. Without this knowledge little can be done to reduce the likelihood of a fire occurring. What is required is a full examination of the ways in which the release might occur and become ignited, incorporating consideration of a full range of possible initiating events such as hardware failure, human error etc. The methodology cited above should provide an appropriate level of insight into the relevant accident scenarios, with perhaps additional amplification being provided via techniques such as Fault Tree Analysis for scenarios involving coincidental failure of multiple system components. It is also important that appropriate detailed hazard identification is applied to all activities taking place on a particular installation and not just to the more obvious process systems. For example, there have been instances where the hazard identification for such operations as drilling, workover and wirelining essentially consisted of noting that blow-out might occur with respect to the equipment, procedures and operations taking place on the individual installation under

125

consideration. Maintenance related activities are another area which sometimes only receive fairly peripheral attention.

4.

ii.

The possibility of accidental breakthrough of gas or liquid from a high pressure system to a lower pressure one needs to be considered as part of the hazard study process. In view of the number of accidents that have occurred in this manner, it is better if a specific HP/LP interface study has been carried out to supplement other studies such as HAZOP. It is important that such studies consider all foreseeable modes of operation.

iii.

Confirmation should be sought that all ‘actions’ and remedial work identified from the hazard studies have been completed and ‘signed off’.


5.

6.


Human Factors

Section 13

QRA


7.


126

5.1.F4: 1.

Layout

Confirmation should be obtained that the layout has been designed in accordance with a recognised standard or code of practice. Recognised current standards / codes of practice would include: EN ISO 13702 (1999) Petroleum and natural gas industries – Control and mitigation of fires and explosions on offshore production installations – Requirements and guidelines. Particularly section 5 – Installation layout EN ISO 13703 (2001) Petroleum and natural gas industries – Design and installation of piping systems on offshore production platforms. Particularly Section 9.2 Layout EN ISO 15138 (2000) Petroleum and natural gas industries – Offshore production installations – Heating, ventilation and air-conditioning. Particularly section 5.3 – System design General; 5.4 – Area-specific system design; and the associated Annexes. ISO 15544 (2000) Petroleum and natural gas industries – Offshore production installations – Requirements and guidelines for emergency response. Particularly section 11 - Escape, refuge, evacuation and rescue and associated Annex F. Institute of Petroleum (2002) Model Code of Safe Practice Part 15 Area classification code for installations handling flammable fluids. Installation layouts may have been designed to the following superseded and obsolete codes and standards. API RP 2G (1974) Recommended Practice for Production Facilities on Offshore Structures API RP 14E (1975 - 1984) Recommended Practice for Design and installation of offshore production platform piping systems API RP 14F (1978 – 1985) Recommended Practice for Design and installation of electrical systems for offshore production platforms BS5345 (1976) Code of practice for the selection, installation and maintenance of electrical apparatus for use in potentially explosive atmospheres The above codes, standards and guidance are applicable to the layout of all types of installation (fixed, FPSO and MODUs).

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the layout can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures / practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Equipment and Protective Systems Intended for Use in Potentially Explosive Atmospheres Regulations 1996 SI 1996/192 – NB: These regulations are applicable to fixed installations but do not apply to MODUs, floating production platforms (FPPs) and floating production storage and offloading vessels (FPSOs).

4.

Specific technical issues: 4.1 The safety case should not merely describe the layout but include arguments and rationale for: segregation of hazards (APOSC para 71(d)); avoidance of undue complexity (APOSC para 71(e)); location and routing of risers (APOSC para 71(g)); orientation and

127

spacing of equipment; fire zones; location of fire walls and blast walls; hazardous area classification; and, ventilation. A layout HAZOP is an appropriate technique for identifying some of these issues. 4.2 On existing installations removal of redundant equipment and removal or redesign of windwalls or module walls may reduce the potential for accumulation of flammable substances. 5.

Other related assessment sheets in this Section are: 5.1.F10

6.

Concept selection

Cross-referenced Sections and Sheets are: None

7.

Lead assessment section for this sheet: OSD3.1

8.


128

5.1.F8: 1.


Confirmation should be obtained that the consequence of failure has been identified for all instrument based protective functions. Where failure of the instrumented based protective function could lead to death or to serious injury confirmation should be obtained that the consequences of such failure have been risk assessed in accordance with a recognised standard/code of practice. Recognised standards include: UKOOA Guidelines for Instrument Based Protective Systems IEC 61508 Functional safety of electrical/electronic/programmable electronic safety related systems IEC 61511 Functional safety. Safety instrumented systems for the process industry sector Safety Integrity Levels [SILs] provide a scale for describing the performance of instrumented protection systems.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the risk assessment can only be assessed on an individual basis and the duty holder should be required to justify that the methods used will be equally effective as those in the standards listed.

3.

Relevant Legislation, ACOP and Guidance Include: Management of Health and Safety at Work Regulations 1999, Regulation 3 Provision and Use of Work Equipment Regulations 1998, Regulation 18

4.

Specific Technical Issues: 4.1 Where a methodology presented in the above standards has been followed but a non standard calibration/rule matrix [risk graph] has been employed the duty holder should provide a detailed justification that the non-standard/calibration rule matrix will be produce an equivalent level of safety to that which would be achieved using the standard calibrations/rules. 4.2 Although IEC 61508 permits functions with a SIL greater than SIL 3 any function allocated above SIL 3 is beyond what is recognised as acceptable practice in the UKOOA Guidelines and hence should always be queried and subject to the most detailed scrutiny.

5.

4.3

Functions allocated a SIL 3 target should be subject to detailed assessment.

4.4

Systems which should be considered for assessment include: •

Ballast systems

•

Cargo handling systems

•

Riser disconnect systems

•

Blowout preventer systems



5.1.F18

Shutdown Systems

5.1.F19

Alarms and Trip Systems

129

6.

7.


Loss of Maritime Integrity - Loss of Stability [Ballast systems & cargo handling systems]

Section 6

Wells [Blowout Preventers]


8.


130

5.1.F10: 1.

Concept Selection

Confirmation should be obtained that safety issues have been given prominence in choosing between different design options and that the selection has not been dominated excessively by economic considerations. In particular, evidence should be sought that inherently safer principles as set out in the Management of Health and Safety at Work Regulations 1999, [para 27] and APOSC, [paras 67, 68 and 71] have been properly taken into account. For new manned, fixed installations this should always include consideration of providing a separate accommodation jacket removed from the drilling and production facilities. Concept selection is an issue which predominately applies at the initial design stage for a new installation where a number of different design concepts can be identified. On a more limited scale similar issues are also relevant to the design of additional facilities/modifications for an existing installation.

2.

Notwithstanding the above, whilst OSD can and should seek to influence the design toward inherently safer concepts, it has no specific legal powers in this area and the decision as to which concept is selected ultimately lies with the duty holder. OSD’s role thereafter is to ensure that the risks posed by the chosen design are controlled in accordance with the requirements of the relevant statutory provisions.

3.

Relevant Legislation, ACOP and Guidance Include: Management of Health and Safety at Work Regulations 1999, ACOP para 27 Assessment Principles for Offshore Safety Cases [APOSC], paras 67, 68 and 71

4.

Specific Technical Issues: Evaluation of different design concepts for a new manned, fixed installation should always include a separate bridge linked accommodation jacket as a comparator option. This option may not be reasonably practicable in all cases but there should be clear evidence that it has been carefully examined and there are sound reasons for its rejection based on ALARP principles.

5.


6.

Inherent Safety


7.


8.


131

5.1.F11: 1.

Size of Release, Speed of Detection and Effectiveness

Confirmation should be obtained that size of release, speed of detection and effectiveness has been assessed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: ISO 13702:1999 Petroleum and Natural Gas Industries – Control and Mitigation of Fires and Explosions on Offshore Production Installations – Requirements and Guidelines.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the analysis of release, speed of detection and effectiveness can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance Include: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004

4.

Specific Technical Issues: 4.1 The release sizes used in the analysis should ideally be related to an assessment of credible failures based on a ‘walk down’ of the plant/equipment in question and parts count based on as-built P&IDs.

5.

4.2

Speed of detection and effectiveness will affect potential for escalation.

4.3

Effectiveness of detection should not be based on equipment reliability alone.


6.


7.

Dispersion, Open or Enclosed Modules, Ventilation Rates



8.


132

5.1.F12: 1.

Dispersion, Open or Closed Modules, Ventilation Rates

Confirmation should be obtained that ventilation regimes throughout the platform have been analysed in accordance with recognised standards or codes of practice. This includes open and closed modules, as well as open deck area. Recognised standards/codes of practice would include: BS 5925 [ISO 15138] Ventilation Principles and Designing for Natural Ventilation

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the installations’ ventilation regimes can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance Include: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004

4.

Specific Technical Issues: Local air movement surveys are recommended before any hot work or intrusive maintenance is carried out to evaluate the local ventilation rate.

5.


6.

7.

Cross-Referenced Sections and Sheets are: Sheet 5.3.F7

Escalation, Layout Separation, Open/Closed Modules

Sheet 5.3.F11

Explosion Modelling

Sheet 5.3.F28



8.


133

5.1.F14: 1.

Inherent Safety

Confirmation should be obtained that inherent safety has been designed into the plant in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: BS EN ISO 17776 International Standards Organisation (ISO) (2002) Petroleum and Natural Gas Industries – Offshore Production Installations – Guidelines on tools and techniques for hazard identification and risk assessment , L85 A Guide to the Integrity, Workplace Environment and Miscellaneous Aspects of the Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 , HSE Books, Regulation 5 and guidance paragraph 32. L65 Prevention of Fire and Explosion, and Emergency Response on Offshore Installations , Approved Code of Practice and guidance, HSE Books, Regulation 4 and guidance paragraph 38 and Regulation 9 and guidance paragraphs 87-88. L30 A Guide to the Offshore Installations (Safety Case) Regulations 2005 , HSE Books, paragraph 23 Regulation 6 and guidance para 136 and Schedule 1 and guidance para 249. Assessment Principles for Offshore Safety Cases [APOSC], paragraphs 92-95 and 98. L21 Management of health and safety at work , HSE Books, Regulation 4, ACOP paragraph 29, guidance paragraph 30 and Schedule 1. UKOOA (1996) Guidelines for Management of Safety Critical Elements: A Joint Industry Guide. UKOOA (1996) Guidelines for Fire and Explosion Hazard Management. Particularly Section 5 on ‘Inherent Safety and Prevention’. The above codes, standards and guidance are applicable to all types of installation.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of inherent safety can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Similar considerations will apply where the duty holder is unable to demonstrate any systematic considerations of inherent safety principles.

3.

Relevant Legislation, ACOP and Guidance Include: Offshore Installations (Safety Case) Regulations 2005, Schedule 2, para13 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4 and ACoP para 38 Management of Health and Safety at Work Regulations 1999, ACoP, para 27 Assessment Principles for Offshore Safety Cases [APOSC], paras 92, 93, 94, 95 and 98 OTH 96 521 Improving Inherent Safety

4.

Specific Technical Issues: 4.1. During the design stage, which covers concept selection through to detailed design specification [drawings, calculations, specifications, etc], there is the maximum potential for reducing risks, by early application of the principles of inherently safer design.

134

For example consideration should have been given to avoiding offshore processing [process onshore], inventory minimisation, segregation, complexity reduction, provision of separate accommodation, etc. See SPC/ENFORCEMENT/35 Safety in Design. 4.2. An installation that is designed and constructed such that risks are controlled to ensure compliance with the relevant statutory requirements depends to a significant extent on the efforts applied to achieve inherently safer design at the earliest stages of the project design process. See SPC/ENFORCEMENT/14 Design Management. 4.3 Incorporating the principles of inherent safety implies that installations should preferably be designed to have fully rated risers, vessels, pipework and pipelines. If the topsides are not fully rated a hierarchy of over-pressure protection measures should have been considered: full flow relief; partial relief with instrumented protection system; HIPS, etc. 5.

6.


Layout

5.1F10

Concept Selection

5.1.F16



7.


8.


135

5.1.F15: 1.

Relief Systems

Confirmation should be obtained that relief systems have been designed and constructed in accordance with a recognised standard or code of practice. Records standards/codes of practice would include: API RP 520 Part II American Petroleum Institute, Sizing, Selection and Installation of Pressure - Relieving Devices in Refineries, Part I – Sizing and Selection, API RP 520 Part I (2000); Part II – Installation API RP 521 American Petroleum Institute (1997) Guide for Pressure-relieving and Depressuring Systems. API Std 526 American Petroleum Institute (2002) Flanged Steel Pressure Relief Valves API Std 527 American Petroleum Institute (1991) Seat Tightness of Pressure Relief Valves PD5500: 2003 British Standard Specification for unfired fusion welded pressure vessels BS6759-3 British Standard (1984) Safety Valves: Specifications for safety valves for process fluids EN ISO, Safety Devices for protection against excessive pressure – Part 1: Safety Valves (EN ISO 4126-1); - Part 2: Bursting Disc Safety Devices (EN ISO 4126-2, 2003); - Part 3: Safety valves and bursting disc safety devices in combination (EN ISO 4126-3, 1995); Part 4: Pilot-operated safety valves (ISO 4126-4, 1999); - Part 6: Application, selection and installation of bursting disc safety devices [EN ISO 4126-6, 2000] ASME VIII (2001) Boiler and pressure vessel code The Institute of Petroleum (2001) Guidelines for the safe and optimum design of hydrocarbon pressure relief and blowdown systems, ISBN 0 85293 287 1 The above codes, standards and guidance are applicable to relief systems on all types of installation [fixed, FPSO and for well test equipment on drilling installations]. Relief systems associated with plant on new installations and new plant on existing installations should have been designed to the current version of the above codes and standards. Relief systems on older installations may have been designed to superseded codes, eg BS 1515 Pressure Vessel Code, BS 2915 Specification for Bursting Discs and Bursting Disc Devices.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the relief systems can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance Include: Offshore Installations (Safety Case) Regulations 2005, Schedule 2, para 13

4.

Specific Technical Issues: 4.1 There are important differences between proportional relief valves/check valves and safety relief valves. Swagelok proportional relief valves/check valves do not meet the requirements of the ASME Boiler and Pressure Vessel Code Section VIII. See Product Notice issued by Swagelock Feb/Mar 2002.

136

4.2 Failures of bellows in balanced bellows type relief valves have occurred. As a result some operators have modified the bonnet vents of balanced bellows pressure relief valves rather than tackling the underlying causes. However, such modifications may adversely affect the valve’s performance with serious health and safety consequences. See Safety Notice 2/2002. 4.3 A review of lessons learned from past incidents is given in Section 6 of Institute of Petroleum (2001) Guidelines for the safe and optimum design of hydrocarbon pressure relief and blowdown systems. 4.4 Modifications to existing facilities may have altered the duty subsequently required of a relief device or system/subsystem. It is important, therefore, that confirmation is obtained that potentially affected relief duties/devices have been reassessed as part of the design of the modifications. 5.

6.



5.1.F17

Blowdown/Flare System

5.1.HS17

Flare Towers


7.


8.


137

5.1.F16: 1.


Confirmation should be obtained that the HIPS has been designed to recognised standards/codes of practice. Recognised standards include: UKOOA Guidelines for Instrument Based Protective Systems IEC 61508 Functional safety of electrical/electronic/programmable electronic safety related systems IEC 61511 Functional safety. Safety instrumented systems for the process industry sector HIPS provide an instrumented means of protecting plant & equipment from conditions outside the design basis. Normally this will relate to excess pressure although it could relate to extremes of temperature [hot or cold]. HIPS are sometimes also referred to as HIPPS [high integrity pressure protection system] or OPPS [overpressure protection system].

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the HIPS can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referred standards.

3.

Relevant Legislation, ACOP and Guidance Include: Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 9 Provision and Use of Work Equipment Regulations 1998, Regulation 18 and Guidance paras 272-275

4.

Specific Technical Issues: 4.1 The duty holder should be required to demonstrate that an inherently safer alternative to HIPS is not reasonably practicable. 4.2 Where there are interdependencies between HIPS equipment and emergency shutdown equipment the HIPS performance detailed assessment may be required to establish whether the claimed benefits of the HIPS can be fully realised. 4.3 Where fast HIPS response [<10 seconds] is required detailed assessment may be required to confirm the required response time has been properly established and that HIPS performance can be readily verified. 4.4 Where the HIPS is to be located subsea detailed assessment may be required because of the limited field experience in this environment. 4.5 Generally functions implemented by HIPS will have a target SIL of 2 or 3. Targets lower than these may be reasonable but may require detailed assessment to confirm the suitability of the performance standard. 4.6 The use of software for the central logic of any SIL 3 HIPS is novel in the UKCS and outside the recommendations in the UKOOA Guidelines. The duty holder should provide a detailed justification for such software and the justification should be subject to detailed assessment.

5.



138

6.

5.1.F14

Inherent Safety

5.1.F18

Shutdown Systems


7.


8.


139

5.1.F17: 1.

Blowdown/Flare Systems

Confirmation should be obtained that blowdown and flare and vent systems have been designed and constructed in accordance with a recognised standard/code of practice. Recognised standards/codes of practice would include: API RP 521 American Petroleum Institute (1997) Guide for Pressure Relieving and Depressuring Systems The Institute of Petroleum (2001) Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown Systems ISBN 0 85293 287 1 The above codes, standards and guidance are applicable to blowdown flare systems on all types of installation [fixed, FPSO and for well test equipment on drilling installations].

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the blowdown/flare systems can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance Include: Offshore Installations (Safety Case) Regulations 2005, Schedule 2 para 13

4.

Specific Technical Issues: 4.1 Staggered or staged blowdown of sections of plant may be specified where the flare/vent system capacity is limited. The assumptions on which the design is based and any philosophy for the order in which sections of plant undergo blowdown should be clear. Where plant modifications have occurred confirmation should be obtained that checks have/will be carried out to confirm that stagings and timings are still achievable. 4.2 Tie-in of new developments may impose higher flows and lower temperatures on existing relief and vent systems. The impact of these conditions and the implications of any mitigating measures, eg staged blowdown, temperature trips to inhibit blowdown, should have been addressed. 4.3 A detailed reliability study should have been undertaken on closed flare or vent systems. The assumptions on which the design is based should be clear. The IVB should have had an opportunity to comment on and influence the design. It is likely that an actuated block valve in parallel with a bursting disc will have an overall probability of failure on demand [PFD] of about 2E-04 and therefore be SIL3. Three devices in parallel: block valve, bursting disc and buckling pin valve, with a PFD of ~2E-06, have been used by some duty holders. To achieve these levels of reliability annual or more frequent testing of all systems should be specified. The implementation of these test intervals would be a suitable topic for post-acceptance inspection. See sheet 5.1.F16 on HIP systems. 4.4 A review of lessons learned from past incidents is given in Section 6 of Institute of Petroleum Guidelines for the safe and optimum design of hydrocarbon pressure relief and blowdown systems. This guide includes ‘checklists for assessment of relief and blowdown systems’ [pp 100-102] for both designers and operators. 4.5 If a locked open valve is located downstream of a blowdown valve/restriction orifice, the pipework up to and including the locked open valve should be rated at the full pressure of the upstream system. The locked valve can be used to test the functionality of

140

the BDV without blowing down the plant. In these circumstances the pipework downstream of the orifice may fail if it is rated for the lower pressure of the flare system. 5.

6.


Relief Systems

5.1.F16


5.1.HS17

Flare Towers


7.


8.


141

5.1.F18: 1.

Shutdown Systems

Confirmation should be obtained that shutdown systems have been designed for recognised standards/code of practice. Recognised standards for trip systems include: UKOOA Guidelines for Instrument Based Protective Systems IEC 61508 Functional safety of electrical/electronic/programmable electronic safety related systems IEC 61511 Functional safety. Safety instrumented systems for the process industry sector API RP14C Recommended practice for analysis, design, installation and testing of basic surface safety systems for offshore production platforms Shutdown systems provide an instrumented means of protecting plant and equipment from conditions outside the design basis. By isolating inventories and effecting blowdown they also provide means for mitigating some of the hazards arising following loss of containment.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the protection systems can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referenced standards.

3.

Relevant Legislation, ACOP and Guidance Include: Provision and Use of Work Equipment Regulations 1998, Regulation 18 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 12

4.

Specific Technical Issues: 4.1 Where the shutdown function includes shutting subsea wells and the subsea wellhead valves do not close on loss of communication with the host platform the design should be subject to detailed assessment. 4.2 Where the closure of an import ESDV could lead to pressure exceeding the design pressure of the corresponding import pipeline the design should be subject to detailed assessment 4.3 Where the ESD equipment has not been subject to a survivability analysis the design should be subject to detailed assessment.

5.

6.



5.1.F16



7.


142

8.


143

5.1.F19: 1.

Alarm and Trip Systems

Confirmation should be obtained that alarm and trip systems have been designed for recognised standards/codes of practice. Recognised standards for alarm and trip systems include: UKOOA Guidelines for Instrument Based Protective Systems IEC 61508 Functional safety of electrical/electronic/programmable electronic safety related systems IEC 61511 Functional safety. Safety instrumented systems for the process industry sector API RP14C Recommended practice for analysis, design, installation and testing of basic surface safety systems for offshore production platforms Recognised standards for alarm systems include: EEMUA Document 191 Alarm system guidance Trip systems provide an instrumented means of protecting plant and equipment from conditions that could lead to circumstances outside the design basis. Alarm systems provide a means of warning operators that plant conditions are deviating significantly from normal or for alerting operators to take mitigating action after an incident. Trip systems shutdown items of plant when significant deviations from normal occur.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the alarm/trip system can only be assessed on an individual basis and the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to a design which is in compliance with the reference codes and standards.

3.

Relevant Legislation, ACOP and Guidance Include: Provision and Use of Work Equipment Regulations 1998, Regulation 18

4.

Specific Technical Issues: 4.1 If there are situations on plant where an operator response to an alarm condition is required to prevent conditions exceeding the design basis of the plant then the plant design does not follow the principles of inherently safer design. In such cases the duty holder should be required to justify in detail why none of the inherently safer options is reasonably practicable. 4.2. For an alarm system to function properly there must be an effective interface to the process operator. EEMUA Document 191 addresses ergonomic issues relating to alarm presentation and information overload. A detailed assessment of this area will involve consideration of human factors.

5.

6.



5.1.F16


5.1.F18

Shutdown Systems


144

Section 11 7.

Human Factors


8.


145

5.1.F23: 1.

Isolations

Confirmation should be obtained that isolation procedures are in accordance with recognised standards or codes of practice which includes: Oil Industry Advisory Committee -The safe isolation of plant and equipment

2.

Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy can only be made on an individual basis and the duty holder should be requested to justify why equivalent standards of safety should result.

3.

Relevant Legislation, ACOP and Guidance Include: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC], para 72 Provision and Use of Work Equipment Regulations 1998, Regulation 19

4.


5.


6.

Cross-Referenced Sections and Sheets are: Sheet 11.G7 Permit to Work Systems

7.


8.


146

5.2 LOSS OF CONTAINMENT – PIPELINES 1.

Scope This Section provides guidance for the assessment of safety case content, with respect to pipelines which may affect an offshore installation, from hazard identification and risk evaluation to risk management measures. It covers the major accident hazards associated with major accident hazard pipelines.

2.

Assessment of Adequacy of Demonstration A number of major accident hazard initiators have been identified which could affect the integrity of a pipeline system. The assessor should examine the adequacy of the hazard identification, initiators, risk evaluation and management in conjunction with the contents of the categorisation table. The main hazard sources are:

3.

•

fixed risers [5.2.HS1]

•

other risers including flexible risers [5.2.HS2]

•

outboard pipelines (eg interfield, intrafield, trunk lines, etc.) [5.2.HS3]

•

emergency shutdown valves (ESDV) [5.2.HS4]

•

subsea isolation systems (SSIS) [5.2.HS5]

•

pig traps (including sphere launchers/ receivers) [5.2.HS6]

Depth of Assessment It is important that safety case assessment is not used as the vehicle for dealing with matters more properly addressed by The Pipelines Safety Regulations 1996 (SI 1996/825). The assessment should therefore be limited to ensuring that a duty holder has included an adequate description of all pipelines, including design parameters as necessary, and evaluating the impact of pipelines and their inventories on the overall case for safety. This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where safety case contents match with good practice identified in the assessment sheets for a particular topic associated with a major accident, there will usually be no need for an assessor to probe into the details of how good practice is applied. This may, however, be a suitable issue to follow-up through inspection.

147

4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation Table below: Loss of Containment - Pipelines Source of Hazard

Initiators

Risk Evaluation Frequency

F14



Inherent Safety

Temperature & Pressure Rating

HS1

Rigid Riser

G1

External Corrosion

HS2

Other Risers including Flexible Risers

G2

Internal Corrosion

F1

Generic Historic data [PARLOC]

- fully rated pipelines & risers


HS3

Outboard Pipeline

G3

Erosion

F2

Company & Pipeline System Data

- riser routine

Corrosion allowance

HS4

ESDV Valves (ESDV)

G4

Overpressure

F3

Pipeline system studies

- inherent impact resistance

Fatigue life

HS5

Subsea Isolation Systems (SSIS)

G5

High Temperature

- HAZID

- pipe burial & trenching

Frequency of inspection

HS6

Pig Trap

G6

Low Temperature

- HAZOPs

- concrete ballast costing

Relief arrangements & capacity

G7

Fatigue/Vibration

- FMEAs

G8

Fire [Section 5.3]

- Design reviews

G9

Fitting Failure

F4

Equipment layout

F15

Relief systems

G10

Incorrect Installation

F5

Company standards/competence

F16

HIPS systems

Risers

G11

Operator Error – Inadequate Training [Section 11]

F6

Corrosion/erosion allowance

F17

Shutdown systems

Temperature & pressure rating

G12

Operator Error – Inadequate Competency [Section 11]

F7

Operations/Maintenance procedures

F18

Alarms/trips


Reliability of protective systems Prevention


Corrosion allowance

148

Loss of Containment - Pipelines Source of Hazard

Initiators G13

Violation [Section 11]

Risk Evaluation F8

SIL standards

F19



Cathodic protection

Fatigue life Frequency of inspection

G14

Deficient Procedures – Operational [Section 11]

F9

Equipment selection

G15

Deficient Procedures – Maintenance [Section 11]

F10

Concept selection

G16

Ship Collision [Section 2]

G17

Dropped Object

G18

Seismic Event [Section 3]

G19

Missile [eg turbine blade]

F11

F20

Good procedures

Relief arrangements & capacity

- operational [control of erosion/internal corrosion temperature during blowdown]

Reliability of protective systems

F21

Competent personnel

Fire protection

Consequences

F22

Monitoring & Audit systems

Pig Traps

Size of release

F23

Isolation and PTW controls

Temperature & Pressure Rating

- Speed & effectiveness of detection & response

F24

Intelligent pigging



Corrosion allowance G20


G21

Abnormal External Load

F12

- blowdown system

F25

Wall thickness monitoring

Fatigue life

Dispersion

F26

Inhibition performance monitoring

Frequency of inspection Relief arrangements & capacity

G22

Helicopter Collision/ Rollover [Section 8]

F13

Toxicity Refer to Section 12

F27

Fire protection

Reliability of protective systems

- active G23

Inadequate Design

Ignition Refer to Section 5.3

- passive

Adequacy of supports Integrity of closure seals

149

Loss of Containment - Pipelines Source of Hazard

Initiators

Risk Evaluation



G24


F28

Anchor pattern controls

Fire protection

G25

Thermal Radiation

F29

Fail safe system

Valves

G26

Slugging/Water Hammer

F30

Pre-operation strength & leak testing

Temperature & pressure rating

G27

Structural Support Failure [Section 3]

F31

NDT inspection


G28

Fishing Gear Snagging

F32

Condition monitoring

Corrosion allowance Closure mode

G29

G30

Anchor

F33

Gas detection

Integrity of seals

Snagging/Dropping

F34

Fire detection

Leakage rate

Explosion Overpressure

150

5.2.HS0: 1.

The Pipeline System

Pipeline System Overview General requirements for assessment: A statement that the person responsible for the operation of the pipeline has responsibility for the entire length of the pipeline (including risers, pig traps etc.). A statement of who is responsible for starting up the pipeline at any time following a shutdown, and the procedures and checks which are made before start up. Confirmation that the person(s) responsible for the inspection and maintenance of the pipeline has responsibility for the entire length of the pipeline. A description of the inspection and maintenance arrangements summarising and justifying the methods of inspection of the pipeline to the identified hazard limit distance from the installation (the distance beyond which a pipeline rupture could not conceivably cause danger to the platform), the management system for carrying out the inspection work, recording it, storage of the records, deciding on requirement and scope for remedial work, including methods of control of contractors. A description of procedures to satisfy the operation, maintenance and testing requirements for the ESD valves, demonstrating that any leakage has been assessed and found not to be excessive. A statement that damage prevention procedures are in place, including a list of identified hazards (eg dropped cargo, anchors, mooring lines, vessels, etc.) and any limitations imposed (no anchoring areas, vessel size limitations, approach routes, etc). A description of procedures to be followed for modifications and repairs, including safety studies, how isolation procedures are decided upon and how the standards of work and inspection are set. A statement that there are emergency procedures to cover all identified hazards, a list of the titles of all emergency and operating manuals applicable to the pipelines connected to the installation, the distribution list of installations at which the emergency manuals are present, who is involved in writing and updating the emergency manuals, the update frequency and the events which trigger an update, the management system for making and communicating day to day changes, the content of procedures stating the type of emergency/ hazard and main actions to be taken (eg which valves to close), with pipeline system diagrams in support, if necessary, and a statement or diagram showing responsibility interfaces with other operators. A statement that procedures are in place, and a summary description, to cover simultaneous production and diving, or any other form of maintenance, at a subsea manifold/well connected by pipeline to the installation, or on the pipeline itself, to control any hazards arising which could affect the diving support vessel, its crew or divers, or the installation. A description of connections between the installation and subsea manifolds/ wells or normally unattended satellites. A description of all past modifications and repairs to the pipelines which could have a bearing on the other parts of the safety case, namely the system description, hazard identification, risk evaluation and reduction.

2.

Where a standard/code of practice other than those listed in Annex 1 and Sheets 5.2.HS1-6 has been employed, judgement as to the adequacy can only be assessed on

151

an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective. 3.

Relevant Legislation, ACOP and Guidance includes: Pipelines Safety Regulations 1996, in particular Regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82 Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACOP and Guidance Document L65 Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 9, 14, 16, 95, 115 Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12

4.

Specific Technical Issues: The pipeline system should be described and then that information used to check the identification of hazards and to ensure that they have been addressed. The safety case should be checked to find any anomalies which may exist in the hazard identification results and to track down faults in method. Safety cases should identify all hazards arising from pipelines or their inventories that could give rise to major accidents – the most significant major accident hazards are covered in Sheets 5.2.HS1 to HS6. Hazard identification should take account of pipeline systems aspects such as management interfaces between installations, inter-platform control, telemetry, leak detection and pipelines emergency procedures. All hazards which could result in a loss of pipeline integrity at any location within the hazard limit distance [5.2.HS3] should be identified and included in the overall risk assessment for the installation. The hazard limit distance is that distance from the installation beyond which a pipeline release could not conceivably be a hazard to the installation. The hazards involving any pipeline attached to subsea wells or manifolds, which could endanger drilling rigs or diving support vessels should be identified. An assessment should be made to show that risks have been evaluated and that these analyses have been carried forward into the overall risk assessment for the installation. Checks should be made of the adequacy of proposed hazard minimisation or risk reduction measures and that they are consistent with the overall risk assessment. Within the installation description the duty holder should include all interconnecting facilities – ie pipelines and subsea installations, including: •

a description or diagram of connections to pipeline systems and of any pipeline with the potential to cause a major accident;

•

owners and operators of connected installations and interfaces;

•

fluids, pipeline sizes, directions, and approximate flow rates;

•

subsea valves, tees, wyes, remotely operable valves, etc.;

•

telemetry links to other installations;

152

•

•

•

all potential pressurising sources (eg subsea wells, other pipelines connected subsea, pumps and compressors, etc.); process flow diagrams of any subsea production facilities, showing actuated and manual valves; complex operations (eg hot water circulation, chemical injection, water or gas injection, gas lift, etc.) or where dual (or multiple) purpose lines are used (eg round-trip pigging);

•

liquid/gas separation or pumping facilities;

•

a description of the pipeline over-pressure protection system (see below);

•

a description of the leak detection system (see below); and

•

pipeline pigging philosophy and practice.

Specific pipeline data should include: •

pipe diameter;

•

wall thickness(es), stating any allowance for corrosion;

•

the pipeline platform approach route;

•

the riser, topsides pipework and demarcation points;

•

pipeline inventory at maximum allowable operating pressure between the pipeline extremities (ie from installation to installation, including any branches connected subsea);

•

the ESDV and any subsea isolation system;

•

the fluids in the pipeline;

•

the design standard or code used for the pipeline;

•

the existence of any weight coating;

•

the current maximum allowable op erating pressure;

•

the operating temperature range;

•

•

•

the grade of steel/ material of construction of the pipeline, riser and topsides pipework, including whether it is sour/non-sour service rated, and the type of any cladding. (In the case of duplex or other special materials for which an industry specification may not exist, the safety case should state, for example, the composition, specified minimum yield stress, the type of pipe (eg steel, flexible, duplex, bundle)); the arrangements for corrosion management, including monitoring and control of corrosion, internally and externally, and predicted corrosion rates; and any other element of the design of the pipeline which is critical to the safety of the installation.

Damage Prevention

153

The pipeline should be protected from third party and/or construction damage by vessel anchors and mooring wires and chains, by pipe lay abandon and retrieval wires, and by fishing trawls. Also, consider the anchoring procedures for standby vessels, supply vessels, diving support vessels, heavy lift crane vessels, flotels, drilling rigs, etc. Major damage risks come from dropped objects (eg cargo being loaded offshore) and from vessel collisions with risers. Exposed risers should be protected with fenders or equivalent, and procedures should be in place to limit vessel sizes and types, weather conditions for loading, etc. Pipeline spool-pieces located under platform cranes should be protected from dropped cargo containers, well casings, etc. Procedures should be in place to limit the types and weights of items of cargo to be handled to ensure that they do not exceed the design of the pipeline protection. A further cause of damage is due to jack-up spud cans making deep holes in the seabed into which a pipeline can slip. Protection Assessment of protection requirements, its type and extent, for all parts of the pipeline should be carried out. The assessor should be aware of relevant standards and should use them as a guide as to whether studies have produced credible results. The studies should cover hazard identification, risk evaluation and risk reduction. Pipeline Safety Systems The duty holder should describe all the safety systems in place for safe operation, safety of personnel and prevention of hazard escalation. The performance standards required of these systems should be described. For example, how often they may fail the tests without having to be replaced, how fast are they expected to react, etc. The safety systems are intended to cover the greatest and most frequent hazards, and they should provide the fastest response and warning of hazards. Emergency procedures are intended to cover the rest. The assessor should examine the installed safety systems, as described in the safety case, and should compare this description with the results of the hazard identification. The hazard identification should identify the critical safety system components. These components should be prominent in the testing and maintenance scheme, and certainly should be mentioned in the method of devising and updating it. The assessor should examine the emergency procedures in the light of the installed systems. Pipeline Over-pressure Protection and Depressurisation The safety case should describe the type and operation of any pipeline over-pressure protection and depressurisation measures in place (other than pig trap systems). This will mainly involve relief systems for pipeline sections in-board of ESD valves (with high pressure trips). Pressure breaks should be examined critically. The primary protection should be by design ie the pipeline should be designed for the highest foreseeable pressure (inherently safe design). Secondary protection may include pressure safety valves (spring operated), HIPS [5.1.F16], etc. The pipeline depressurisation philosophy should detail reasons for the need for depressurisation and any limitations or controls in place to mitigate potential low

154

temperature, embrittlement and hydrate formation problems (eg controlled depressurisation rate with methanol injection). There should be a description of all available means of depressurisation of the pipelines which could be used in an emergency, referring to the pipeline system description if necessary, and the emergency procedures - although operators are naturally reluctant to flare off large quantities of gas, methods exist for rapid removal of substantial quantities with co-operation from other users of a pipeline system. Pipeline Leak Detection The duty holder should describe the type and operation of the pipeline leak detection system, including control functions monitored, monitoring locations (eg at each end of the pipeline) and the alarm and shutdown set points for these functions. This should include: •

•

the actions resulting, eg alarms in the control room and who takes actions to shutdown? How are third parties and the beach informed? what is the response time against leak size and what are the criteria used for shutdown?

Pipeline Emergency Shut-Down Functions The safety case should give a satisfactory definition of the emergency shut-down facilities. The levels of shut-down should be clearly defined. The description should include the list of initiating parameters from the pipeline system and resulting actions on the pipeline system for each level of shut-down. In particular, the level at which the riser ESD valves are closed. All operation and failure modes should be described, including local/test controls, and the various failsafe closure modes. Are there functions built into the ESD system to receive/send shutdown signals from/to third parties, or to alarm them of ESD valve closure, or are these all manual actions by the operator? If SSIVs are installed, all modes of operation and failure should be described. Are they tied back into the ESD system and automatically actuated, at a certain shut-down level, or are they manually initiated? Where pipeline blow-down facilities or procedures are in place, their mode of operation should be clearly defined. Is the pipeline blow-down automatic or manually initiated? Is it controlled to prevent potential hydrate and pipeline low temperature problems? Connection to Pipeline Systems Communication, power and telemetry links to other installations: this aspect is required to verify claims of automatic shutdown capabilities, data transfer, etc., and will be used in detail in relation to safety systems. Fluids, approximate operating pressures and line sizes. The well head shut-in pressure of subsea wells connected to the installation: the maximum allowable operating pressure (MAOP) rating of the relevant riser should be above this pressure; The MAOPs of all pipelines connected subsea to each riser: for any particular riser these should all be equal to avoid the possibility of overpressurisation from a third party platform;

155

High pressure shut down set points for pumps and compressors and other pressure sources connected to the pipeline: these should all be less than the MAOP; Location of pipeline system control centre, especially when tying into major transportation systems. If the considerations mentioned above in connection with MAOPs are not satisfied, the MAOP should be adjusted accordingly, or a high integrity pressure limiting or shutdown system should be in place. Such a system should be examined in detail. For pipeline operations further information may be required by assessors to be included ie where operators submit a joint safety case for a number of installations such as subsea manifolds/wells or unmanned satellites connected to a central platform. Subsea Facilities These may be remote from the installation but connected to it, and details should be included of: •

satellite wells and protection afforded to these remote installations;

•

modes of control of the facilities;

•

•

process flow diagrams, showing actuated and manual valves, where dual (or multiple) purpose lines are used (eg round trip pigging), or complex operations are intended, eg. hot water circulation, methanol, chemical, water/ gas injection, provision for gas lift etc.; and details of any liquid / gas separation or pumping facilities.

The duty holder should take account of the possible hazards from backflow from water injection lines for example, which are apparently non-hazardous. In round trip pigging systems a water line could be connected subsea to a production line. Where the installation is a floater water backflow could sink the vessel. Loss of flow of corrosion inhibitor if undetected could lead to corrosion of a flowline carrying a hazardous fluid. The assessor should take into account hazards from satellite well flowlines due to dropped objects, anchors and mooring lines which could affect crews of drilling and diving support vessels. Has the potential for sand carry-over been considered in the design? This can give erosion problems, particularly at riser bends and at SSIVs. Future Pipelines and Connections to Other Installations The duty holder should give a description of routing, location and layout of known future pipelines and risers. It is important to consider and comment on these aspects at an early stage to ensure that changes can be implemented completely and without unnecessary complication. Pipeline Communications/Control/Telemetry •

•

•

Within the description of the pipeline communications, control and telemetry systems, the following should be addressed: the transmitted parameters; the criteria necessary for correct operation (ie limitations of the equipment in terms of environmental or other conditions);

156

•

•

•

action of the installed system on loss of communication/ control/ telemetry links, and manual intervention procedures: usually the pipeline should be shut down; remotely controlled action that can be taken under major accident conditions by inter-connected installations, and the sequence and timing of such actions, including emergency shut-down arrangements; and shore-based control systems.

Pipeline Operations The duty holder should state the expected frequency and purpose of pigging throughout the field life. The duty holder should summarise the inspection scheme for each part of the pipeline, describing the techniques used and justifying their adequacy with consideration to conditions such as currents/sand waves, wave action, corrosion, fishing and other activity. For ESD valves testing and inspection activities should be covered under this heading. Testing of ESD, control, telemetry and communication systems should be included. Any special equipment used for inspection should be described, such as intelligent pigs, ESD valve seat leak testing facilities, new technology, etc. For all cases of leaking seats on ESD valves the duty holder should demonstrate that the effects have been assessed and that appropriate action has been or will be taken. This should be covered in the safety case as the summary of an assessment study. The duty holder should provide the maintenance schedule and demonstrate that adequate maintenance is carried out. Parts which are expected to be included are valves, actuators, pig trap closures, control, telemetry and communication systems, riser tensioners and quick-disconnect systems on floating production platforms, and any other mechanical equipment. Operating Temperatures The assessor should recognise the potential for: •

•

hydrate formation which can lead to blockage problems and possible ineffectiveness of safety systems; formation of process condensates which may lead to pipeline slugging conditions, for which the pipeline may or may not be designed;

•

wax formation in oil lines which may lead to blockage of critical components;

•

ice formation on the outside or inside of valves which may render them inoperable;

•

low temperature embrittlement of pipe steel; and

•

failure of blowdown systems.

Process Upset Conditions Examples of process upsets include slugs, surges and emergency shut-downs. Some system designs rely upon the processes not going outside certain parameters, eg a dry sour gas line if not designed for sour service must not get wet due to a process upset. What systems are in place to warn operators or to shut down the line in this type of situation?

157

Decommissioning and Abandonment Taking a pipeline out of use falls under two main headings - cleaning out of hazardous substances from pipelines, risers and topsides, and ensuring safe removal of facilities as required. For pipelines this subject involves principally the safety of divers and of other personnel involved with platform abandonment. 5.

6.

7.

Other Related Assessment She ets in this Section are: 5.2.HS1

Rigid Riser

5.2.HS2


5.2.HS3

Outboard Pipeline

5.2.HS4

ESDV Valves (ESDV)

5.2.HS5


5.2.HS6

Pig Trap



Section 4.1


Section 4.2


Section 5.1


Section 5.3


Section 10

Emergency Response

Section 11

Human Factors

Section 13

QRA

Sheet 2.F6


Lead Assessment Unit for this Sheet: SI3

8.

Team responsible for authoring and updating this sheet: SI3B

158

5.2.HS1:

Rigid Risers

[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G6, 5.2.G7, 5.2.G8, 5.2.G9, 5.2.G10, 5.2.G16, 5.2.G17, 5.2.G19, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G25, 5.2.G27, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F16, 5.2.F17, 5.2.F18, 5.2.F19, 5.2.F20, 5.2.F24, 5.2.F25, 5.2.F26, 5.2.F27, 5.2.F30, 5.2.F31, 5.2.F32] 1.

The riser is one of the most important parts of the pipeline system and its integrity has to be assured. All information relating to risers should be assessed from the seabed to either the emergency shutdown valve (ESDV) or the pig trap (if fitted). In particular: •

approximate route (eg showing relevant module decks, bulkheads and jacket members, riser supports/ guides);

•

ESDV location;

•

mechanical joints, eg flanged and insulation joints;

•

•

all branches outboard of the ESDV as far as their respective isolation valve(s) and their nominal diameter; and fire, explosion, impact or other protection provided for the riser and ESDV.

Confirmation should be obtained that the pipeline operator/duty holder has ensured that the pipeline riser has been properly designed and constructed and is operated safely to ensure that the riser will be in accordance with recognised standards and guidance. These include: BS 4515-1 Specification for the Welding of Steel Pipelines on Land and Offshore – Part 1: Carbon and Carbon Manganese Steel Pipelines BS 4515-2 Specification for the Welding of Steel Pipelines on Land and Offshore – Part 2: Duplex Stainless Steel Pipelines ISO 13847 Pipeline Welding ISO 15590 Part 1 Induction Bends ISO 15590 Part 2 Fittings ISO 15590 Part 3 Flanges ISO 15589 Part 2 Cathodic Protection Offshore ISO 3183 Petroleum and Natural Gas Industries – Steel Pipe for Pipelines API 5L Line Pipe High Integrity Pressure Protection Systems (HIPPS) for the Overpressure Protection of Pipelines (Draft) 2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.

3.

Relevant Legislation, ACOP and Guidance includes:

159

Pipelines Safety Regulations 1996, in particular Regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82 Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACoP and Guidance Document L65 Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 9, 14, 16, 95, 115 Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12 4.

Specific Technical Issues: Riser Routing and Design The duty holder should, with the aid of schematics, describe the riser routing in relation to platform, pipeline platform approaches and field layout. This is necessary from the assessor's point of view to enable him to assess the full impact of layout versus topsides and vessel activities. The riser should, where possible, be routed away from hazards such as fire, explosion and impact. Specific issues to be addressed include: •

•

position of cranes, which will be used for loading vessels; whether an external riser is located on the weather side of the platform, making it vulnerable to impacts from drifting vessels, especially important where there is also a crane on that side;

•

fire protection;

•

accessibility for inspection, ie when located in caissons or in platform legs;

•

•

gas risers in concrete platform legs, which could leak and pressurise the leg causing it to collapse; and adequate support of the riser, especially in the wave zone.

Risers should ideally be located in-board of jacket braces or other structural members to protect them from vessel impact. If not, there should be fenders or other means installed which can absorb impact energy without touching the riser. Where risers are located in J-tubes (conduits) or in caissons, the J-tubes or caissons should be sealed off at both ends and filled with inhibited water to protect the riser from corrosion. 5.

6.


Outboard Pipelines

5.2.HS4

ESDV Valves (ESDV)

5.2.HS5


5.2.HS6

Pig Trap


160

7.

Section 3


Section 4.1


Section 4.2


Section 5.1


Section 5.3


Sheet 2.F6



8.


161

5.2.HS2:


[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G6, 5.2.G7, 5.2.G8, 5.2.G9, 5.2.G10, 5.2.G16, 5.2.G17, 5.2.G19, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G25, 5.2.G27, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F16, 5.2.F17, 5.2.F18, 5.2.F19, 5.2.F20, 5.2.F24, 5.2.F25, 5.2.F26, 5.2.F27, 5.2.F30, 5.2.F31, 5.2.F32] 1.

The riser is one of the most important parts of the pipeline system and its integrity has to be assured. All information relating to risers should be assessed from the seabed to either the emergency shutdown valve (ESDV) or the pig trap (if fitted). In particular: •

approximate route (eg showing relevant module decks, bulkheads and jacket members, riser supports/ guides);

•

ESDV location;

•

mechanical joints, eg flanged and insulation joints;

•

•

all branches outboard of the ESDV as far as their respective isolation valve(s) and their nominal diameter; and fire, explosion, impact or other protection provided for the riser and ESDV.

Confirmation should be obtained that the pipeline operator/duty holder has ensured that the pipeline riser has been properly designed and constructed and is operated safely to ensure that the riser will be in accordance with recognised standards and guidance. These include: API Specification 17J 2nd Edition November 1999 Specification for Unbonded Flexible Pipe API RP 17B 2nd Edition July 1998 Recommended Practice for Flexible Pipe ISO 13628-2 Design and Operation of Subsea Production Systems – Part 2: Flexible Pipe Systems for Subsea and Marine Operations Other guidance and sources of information: UKOOA Study Report on State of the Art Flexible Riser Integrity Issues – MCS International Doc No 2-1-4-181/SR01 Rev 04 April 2001 UKOOA Guidance Note Monitoring Methods and Integrity Assurance for Unbonded Flexible Pipe Rev 5 Oct 2002 API Technical Report TR17RUG The Ageing of PA-11 in Flexible Pipes High Integrity Pressure Protection Systems (HIPPS) for the Overpressure Protection of Pipelines (Draft) 2.


3.

Relevant Legislation, ACOP and Guidance includes: Pipelines Safety Regulations 1996, in particular regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82

162

Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACoP and Guidance Document L65 Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 9, 14, 16, 95, 115 Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12 4.

Specific Technical Issues: Risers to floating installations are particularly vulnerable to damage. Steel tensioned risers located under the installation are susceptible to dropped object damage, damage during running and retrieval, and to overstressing or fatigue in certain circumstances. The riser stress analysis should be applicable for all sea states and modes in which the riser can remain connected to the installation. These risers usually include short sections of flexible pipe at the topsides which is susceptible to damage also. Flexible risers are vulnerable to damage from vessels, dropped objects, fatigue and overstress damage. As with the steel tensioned risers the stress analysis should cover all applicable cases. Connections with steel pipe should be configured to avoid the flexible being damaged by bending at the connection, either by their layout or by use of bend restrictors. Riser stress analysis for both of the above types should cover extreme static installation offsets from its station, static wind, wave and current loading, natural frequency analysis, dynamic response to wave frequencies (stresses and fatigue damage assessment) and dynamic transient responses. Operators should be aware of the fatigue lives of the components. At a minimum, assessors should check the design lives of key components which are difficult or expensive to replace regularly, and the limiting sea states for the riser system. Duty holders should provide an isometric drawing of the riser routing(s), showing the module decks and bulkheads through which it passes, from the seabed to the ESD valve/pig trap and the first process isolation valve. The assessor can then use this and module general arrangement drawings, plot plans, etc. to compare with the list of identified hazards to the riser. This drawing should indicate the ESD valve location, the types and positions of riser supports, flange joints, insulation joint, any other weak joint, any branches outboard of the ESD valve to their respective isolation valve(s) and their nominal diameter and any parts of the riser that are not accessible for inspection and fire, explosion, impact or other protection which is fitted. It is not necessary to show topside branches other than the main process flow branch. Any hook-up welds should be shown to indicate the interface between contractors. For floating installations there should also be scale plans and elevations of the risers, showing extreme offset configurations. A description of fire, explosion and impact protection should address: •

•

active and passive fire protection; explosion protection - in terms of segregation by layout and physical partitioning using blast walls;

163

•

•

5.

6.

7.

fire & gas detection systems (a rough check of what is in place should be made detailed analysis will be carried out by topsides assessors); and dropped object protection.


Outboard Pipelines

5.2.HS4

ESDV Valves (ESDV)

5.2.HS5


5.2.HS6

Pig Trap



Section 4.1


Section 4.2


Section 5.1


Section 5.3


Sheet 2.F6



8.


164

5.2.HS3:

Outboard Pipeline

[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G5, 5.2.G6, 5.2.G7, 5.2.G9, 5.2.G10, 5.2.G17, 5.2.G18, 5.2.G20, 5.2.G21, 5.2.G22, 5.2.G24, 5.2.G28, 5.2.G29, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F16, 5.2.F17, 5.2.F19, 5.2.F20, 5.2.F24, 5.2.F25, 5.2.F26, 5.2.F28, 5.2.F29, 5.2.F30, 5.2.F31, 5.2.F32] 1.

It is important to assess in detail the pipeline within 500 metres from the installation, taking into account features such as: •

the installation itself;

•

pipeline(s);

•

no-anchoring areas;

•

•

anchor patterns and jack-up footprints for vessels normally moored in the vicinity; and layout of tie-ins, spool pieces, crossovers, subsea isolation systems (SSISs), other subsea equipment and extent of protection measures such as mattresses, rock dump, trenching, protection covers, etc.

All hazards which could result in a loss of pipeline integrity at any location (within the hazard limit distance – ie where the installation could be affected) should be identified and included in the overall risk assessment for the installation. The hazards involving any pipeline attached to subsea wells or manifolds, which could endanger drilling rigs or diving support vessels should be addressed. Assessment should be made of the interaction between the installation and others linked by pipeline(s) and the effect an interconnected pipeline system could have on the installation. Safety cases should identify all hazards arising from pipelines or their inventories that could give rise to major accidents. Hazard identification should take account of parts of pipelines located close to installations whose failure could affect the installation and pipeline systems aspects such as management interfaces between installations, interplatform control, telemetry, leak detection and pipelines emergency procedures. Confirmation should be obtained that the pipeline operator/duty holder has ensured that the outboard pipeline (for example, interfield pipeline, trunk line, etc.) has been properly designed and constructed and is operated safely to ensure that the pipeline will be in accordance with recognised standards and guidance. These include: BS 4515-1 Specification for the Welding of Steel Pipelines on Land and Offshore – Part 1: Carbon and Carbon Manganese Steel Pipelines BS 4515-2 Specification for the Welding of Steel Pipelines on Land and Offshore – Part 2: Duplex Stainless Steel Pipelines ISO 13847 Pipeline Welding ISO 15590 Part 1 Induction Bends ISO 15590 Part 2 Fittings ISO 15590 Part 3 Flanges

165

ISO 15589 Part 2 Cathodic Protection Offshore ISO 3183 Petroleum and Natural Gas Industries – Steel Pipe for Pipelines ISO 21329 Testing Mechanical Connectors API 5L – Line Pipe Other guidance and sources of information: SPC/TECH/OSD/18 Health & Safety Issues Associated with Changes from Dry Gas to Wet Gas Operations High Integrity Pressure Protection Systems (HIPPS) for the Overpressure Protection of Pipelines (Draft) 2.


3.

Relevant Legislation, ACOP and Guidance includes: Pipelines Safety Regulations 1996, in particular regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82 Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACoP and Guidance Document L65 Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 8, 9, 14, 16, 115 Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12 Specific Technical Issues: Pipeline to Platform Approaches The duty holder should describe, with scale diagrams: •

the layout and configuration of the plant;

•

the connections to be made to any pipeline or installations; and

•

any wells to be connected to the installation.

The scale plan of the location should be large enough to show any features that may be significant in the assessment of the hazard or risk associated with the site. Typically, items of significance include: •

pipelines, whether connected to the installation or not;

•

subsea wells and manifolds;

•

control umbilicals;

•

other fixed installations in the area; and

166

•

any significant undulations in the seabed.

The duty holder should therefore provide a pipeline to installation approaches plan to 500 metres from the installation, showing the installation(s), pipelines, direction of geographical (true or grid) and installation north, no-anchoring areas, anchor patterns for vessels normally moored in the vicinity (and the vessel itself), layout of tie-ins, spoolpieces, crossovers, SSISs, other subsea equipment, extent of protection measures such as mattresses, rock dump, trenching, protection covers, supports and any significant undulations in the seabed elevation which could conceivably cause bending/spanning/upheaval buckling. Note that this is also required for subsea manifolds and producing subsea wells because of potential hazards to drilling rigs, DSVs and their crews. Details of tie-ins, spool-pieces, cross-overs and other subsea equipment such as SSISs should be evaluated to assess risks from dropped objects, fishing activities and anchors. The assessor should consider the effects of having a flotel located over the lines, if this is the case, with respect to dropped object and anchor/ mooring line damage. Similarly jackup temporary moorings used during jacking operations, construction vessels, diving support vessels, and standby vessels should be considered. Moorings for drilling semis (usually but not always located well away from fixed platforms) and jack-ups drilling satellite wells and exploration wells should be considered in connection with the in-field pipeline layout. Duty holders should take account of hazards from satellite well flowlines due to dropped objects, anchors and mooring lines which could affect crews of drilling and diving support vessels. 5.

6.

7.


Rigid Riser

5.2.HS2


5.2.HS5




Section 4.1


Section 4.2


Section 5.1


Section 5.3


Sheet 2.F6



8.


167

5.2.HS4:

ESDV Valves (ESDV)

[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G5, 5.2.G6, 5.2.G7, 5.2.G8, 5.2.G9, 5.2.G10, 5.2.G17, 5.2.G19, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G25, 5.2.G27, 5.2.G30, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F16, 5.2.F17, 5.2.F18, 5.2.F19, 5.2.F20, 5.2.F23, 5.2.F24, 5.2.F25, 5.2.F26, 5.2.F27, 5.2.F29, 5.2.F30, 5.2.F31, 5.2.F32] 1.

An assessment should be carried out for all ESDVs at an installation with particular reference to the definitions of ESD levels and modes of operation and failure of the ESDVs. Confirmation should be obtained that the pipeline operator/duty holder has ensured that the ESDV has been properly designed and constructed and is operated safely to ensure that the ESDV will be in accordance with recognised standards and guidance. These include: API Spec 6D Pipeline Valves ISO 14313 Pipeline Valves Other Guidance and Sources of Information: Department of Energy – Guidance Notes in Support of the Offshore Installations (Emergency Pipeline Valve) Regulations 1989 SI 1989/1029 HSE/UKOOA Guidance On The Setting Of Tolerable Pipeline Riser ESDV Internal Body Seal Leak Rates For Offshore Pipelines (in draft) SPC/TECH/OSD/26 Riser Emergency Shut Down Valve (ESDV) Leakage Assessment

2.


3.

Relevant Legislation, ACOP and Guidance includes: Pipelines Safety Regulations 1996, in particular regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82 Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACOP and Guidance Document L65 Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 8, 9, 14, 16, 109, 115 Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12

4.

Specific Technical Issues: ESDV Location The ESDV shall be located in a position: •

in which it can be safely and fully inspected, maintained and tested;

168

•

•

such that the ESDV is above water; and subject to the above, such that the distance along the riser from the ESD valve to the base of the riser is as short as reasonably practicable.

The duty holder should indicate the ESD valve location(s) on the riser isometric drawing. ESDV Fire, Explosion and Impact Protection The duty holder should demonstrate, through description and general layout drawings, that adequate fire, explosion and impact protection is afforded to the ESD valve and its appurtenances, eg actuator, hydraulic accumulators, hydraulic piping, outboard maintenance valve. It is expected that in order to define the type and extent of protection, the duty holder will carry out detailed studies which should be listed among the references. The assessor should check the scope of these studies and their results. Fire Protection The ESDV actuator and all components necessary for ESDV fail-safe closure should remain fully operable under anticipated fire conditions. The pressure containing capability of the ESDV, including any out-board maintenance valves and any flanged connections to the riser, should be preserved under the anticipated fire conditions. The assessor should check the results of studies against these criteria. Whilst both passive and active fire protection systems may be used, it should be noted that passive systems (coatings, covers, etc) do not require prime movers, distribution systems and an initiation signal, and are therefore likely to be more reliable and have higher integrity than active systems (deluge, etc). Accordingly, active fire protection systems acting on their own may not be sufficient. There should be fire and gas detection in the vicinity of the ESD valve. Explosion Protection It is not usually reasonably practicable to afford protection against all of the effects of an explosion in the immediate vicinity of an ESDV. Operators should conduct studies to find expected explosion overpressures and missile energies and to decide the reasonably practicable protection required. In general, explosion protection is best achieved by locating the ESD valve well outside congested equipment modules where the explosion over-pressures are known to be highest. ESDVs located immediately outside the openings from congested modules are also susceptible to explosion damage. Whilst this is possible with new designs, it will probably be found that for existing installations the duty holder has provided blast walls to protect the ESDVs from explosion effects. Impact Protection Protection from horizontal impacts may be achieved by blast walls provided for explosion protection. The main impacts to be considered are: •

dropped and falling objects;

•

missiles resulting from explosions; and

•

vessels/ships.

169

The operator should carry out a study of the possible impacts, including those which could be experienced following another incident, such as heavy machinery falling from above, and he should assess what protection is necessary. Note, whilst this "protection by design" will be possible for new installations, for existing installations the assessors experience will be necessary in judging the adequacy of protection in place. Some of the protection may be in the form of procedural control, eg for crane handling, boat approach, etc. ESDV Operational Failure The duty holder should assess the risks of the ESD valve failing to operate on demand. This could be anticipated in design by the fitting of a subsea isolation system (SSIS) or otherwise. Actuators and Control Panel The duty holder should describe the type of actuators used on the ESDVs. The ESDV, its actuator, the local control panel, and where fitted, its accumulators and any ESDV dedicated maintenance valves, should be located close together. The location of the local control panel, together with any other measures taken, should facilitate the rapid selection of the correct control panel and should enable the operative to view the valve position indicator during local partial closure tests. The actuator and any stored energy device (eg spring return or accumulator) required for fail-safe close purposes should be protected as part of "the valve and its actuating mechanism". A description of the protection of these items should be included in the safety case. 5.

6.

7.


Rigid Riser

5.2.HS2




Section 5.1


Section 5.3


Sheet 2.F6



8.


170

5.2.HS5:


[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G6, 5.2.G7, 5.2.G9, 5.2.G10, 5.2.G17, 5.2.G18, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G27, 5.2.G28, 5.2.G29, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F17, 5.2.F18, 5.2.F19, 5.2.F20, 5.2.F24, 5.2.F26, 5.2.F28, 5.2.F29, 5.2.F30, 5.2.F31, 5.2.F32] 1.

An assessment should be carried out for all ESDVs at an installation with particular reference to the definitions of ESD levels and modes of operation and failure of the ESDVs. Confirmation should be obtained that the pipeline operator/duty holder has ensured that the ESDV has been properly designed and constructed and is operated safely to ensure that the ESDV will be in accordance with recognised standards and guidance. These include: API Spec 6D Pipeline Valves ISO 14313 Subsea Pipeline Valves

2.


3.

Relevant Legislation, ACOP and Guidance includes: Pipelines Safety Regulations 1996, in particular Regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82 Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACoP and Guidance Document L65 Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 8, 9, 14, 16, 109, 115 Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12

4.

Specific Technical Issues: The duty holder should describe the subsea isolation systems (SSISs) installed. There should be a description with layout giving location, modes of operation, type of valve and actuator and failure modes (eg fail close on loss of hydraulics/signal). The hardware description of an SSIS is not of such great importance. What is more important is having adequate measures taken against hazards from pipelines and risers and if not, and if a SSIS is not fitted, why not? If a SSIS is fitted, how was its location decided? The assessor should acknowledge that subsea isolation valves (SSIVs) are not a mandatory requirement. However, the duty holder is expected in agreement with the Cullen Report and in particular recommendation 44 to ".... demonstrate in the safety case that adequate provision has been made, including if necessary the use of SSIVs, against hazards from risers and pipelines".

171

Due to the location of the subsea isolation systems, significant inventory of hydrocarbons will be present between the subsea valve and the top of the riser. Therefore, failure of the riser or underwater pipeline near the installation will result in an unavoidable discharge of hydrocarbons under pressure, with the potential of serious fire or vapour cloud explosion. A subsea valve cannot prevent this initial discharge from taking place and cannot protect personnel in the open or working in the vicinity of the riser. This can also upset the buoyancy of floating production installations and vessels. In assessing the arguments for/against installing a subsea valve, it is necessary to concentrate on the effect it has upon the consequences of a failure. Particularly so where pipelines are branched into main transportation lines or third-party imports are concerned. Note that in such cases, without a subsea isolation system, there is scope for an unlimited supply of fuel in a fire situation. Although topside ESDVs are required by law for most major accident hazard pipelines, the risk of the ESDV failing to operate on demand should be included in the input to the decision concerning the fitting of an SSIS. Non-return or Check Valves On some risers a non-return valve (NRV) or check-valve may be used as a means of isolation. The NRV has the advantages of being a self-contained operation and of rapid closure in the event of a pipeline rupture. Due to the closure times of actuated valves, there will be some initial hydrocarbon discharge which will last longer than for a non-return valve. One of the disadvantages with NRVs is that an actuated SSIV has the advantage of being closed in the event of a small leak or a fire in the vicinity of the riser, whereas the same cannot be said about non-return valves. They are however, not suitable for all applications - they can be installed on export lines but, by their nature, not on import lines. For export pipelines they may prevent the normal flow being reversed for operational reasons, such as during routine depressurisation. Their presence also makes it more difficult to pig the line, and are liable to be damaged by pigging. The important thing to note is that they will not prevent a small leak (ie may not give a tight seal). Accordingly, the duty holder should give the exact criteria under which their operation and efficiency is expected. Location of SSIS Location studies will normally be carried out where SSISs are to be installed. Subsea valves are usually located some distance away from the installation they are intended to protect. This is necessary to balance the risks due to any possible line failures resulting from objects dropped from the platform, supply boats, or from dragging anchors, fishing hazards, etc. on the platform side of the valve A rupture on the far side of the valve in which case it is necessary to address: •

gas cloud or oil pool dispersion;

•

protection of the pipeline; and

•

protection of the SSIS which can itself be an extra leak path.

In some cases an operator will wish to locate a SSIS for ease of construction - examples are floating production installations with riser base valves, flowline bundles which arrive

172

within 50 metres of a fixed platform, SSIS skids serving several pipelines, spool-piece flanges being used to avoid the cost of hyperbaric welds, etc. The pipeline to platform approach layout should be considered carefully to ensure that each SSIS is located on a sound risk balancing basis. Description of SSIS The description must include the modes of closure/operation and the failure modes. Operators are sometimes reluctant to have fail safe close valves in case, during a test or following a spurious failure, it shuts and remains jammed shut. It is however, no use having a SSIS in place which is almost impossible to use or is functionally locked open. There should be fail safe modes of closure or similar in event of loss of hydraulics/other platform signals. The system should include local energy storage (such as a spring or hydraulic accumulator) to close the valve, and it should not rely on platform based hydraulic or other power supply for closure in an emergency. Protection The SSIS should be protected from impact and snag loads from anchor lines and fishing trawls. Usually a structure is provided for this purpose. Inspection, Testing and Maintenance The duty holder should describe the philosophy for carrying out inspection, testing and maintenance on the subsea isolation valves. This should not just be limited to SSIVs NRVs should be addressed as well. As with any safety system, the reliability needs to be assured, and this is normally done by carrying out periodic tests. The duty holder should describe the extent, type and frequency of these tests. There should be detailed procedures in place for this purpose. However, experience indicates that this is not always the case and operators are sometimes afraid of testing in case the valves are damaged or cannot be opened again. Testing should include: •

full (and if desired partial) closure;

•

valve seat leak tests; and

•

5.

6.

checks for confirming closure, eg provision of local (visual) valve position indicators as well as the remote system.


Rigid Riser

5.2.HS2


5.2.HS3

Outboard Pipeline



Section 4.1


Section 4.2


Section 5.1


173

Sheet 2.F6 7.



8.


174

5.2.HS6:

Pig Traps

[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G5, 5.2.G6, 5.2.G7, 5.2.G8, 5.2.G9, 5.2.G10, 5.2.G17, 5.2.G19, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G25, 5.2.G26, 5.2.G27, 5.2.G30, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F20, 5.2.F23, 5.2.F24, 5.2.F25, 5.2.F27, 5.2.F29, 5.2.F30, 5.2.F31, 5.2.F32] 1.

Confirmation should be obtained that the pipeline operator/duty holder has ensured that the pig trap (including sphere launchers and receivers) has been properly designed and constructed and is operated safely to ensure that the pig trap/ sphere launcher/receiver will be in accordance with recognised standards and guidance. These include: BS 4515-1 Specification for the Welding of Steel Pipelines on Land and Offshore – Part 1: Carbon and Carbon Manganese Steel Pipelines ISO 13847 Pipeline Welding ISO 15590 Part 2 Fittings ISO 15590 Part 3 Flanges ISO 3183 Parts 1 & 2 Linepipe

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.

3.

Relevant Legislation, ACOP and Guidance includes: Pipelines Safety Regulations 1996, in particular Regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82 Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995) and associated ACoP and Guidance Document L65 Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 8, 9, 14 and 16 Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12

4.

Specific Technical Issues: Ensure that pig trap loading hatches are facing outboard and that adequate protection is afforded against accidental opening of the hatches whilst under pressure. There should be a description of the pigging facilities including closure design, detail on all safety features such as double blocking method, interlocks etc. Bad maintenance and material defects have led to failure of pig trap closures, resulting in substantial damage to pipework and other platform facilities. Incorrect maintenance of a pig signaller has led to an uncontrolled release of gas.

5.


175

6.

7.

5.2.HS1

Rigid Riser

5.2.HS2




Section 5.3


Sheet 2.F6



8.


176

Annex 1 REFERENCE DOCUMENTS A list of references is provided in each assessment sheet. The documents listed below provide guidance for pipeline systems in general, particularly in relation to good practice and performance standards. However, in some cases the reference material will not be fully applicable and may be limited in some parts. Standards and Codes of Practice BS EN 14161:2003 – Petroleum and Natural Gas Industries - Pipeline Transportation Systems BS PD 8010 Part 2:2004 Code of Practice for Pipelines. Part 2: Subsea Pipelines Institute of Petroleum Model Code of Safe Practice Part 6 Pipelines DNV Offshore Standard DNV-OS-F101 Submarine Pipeline Systems January 2003 ISO 13623 Pipeline Transportation Systems (but see BS EN 14161) ISO 16708 Reliability Based Limit State Methods ANSI/NACE Std MR0175-2002 Sulphide Stress Cracking Resistant Metallic Materials for Oilfield Equipment API RP 14C Recommended Practice for Analysis, Design, Installation and Testing of Basic Surface Safety Systems for Offshore Production Platforms 7th Edition March 2001 OIAC The Safe Isolation of Plant & Equipment Other guidance and sources of information HSE/IP/UKOOA PARLOC 2001: The Update of Loss of Containment Data for Offshore Pipelines 5th Edition OSD Hydrocarbon Release Database Department of Energy – Submarine Pipelines Guidance Notes SPC/TECH/GEN/18 Underlagging Corrosion of Plant & Pipework Offshore Safety Notice 2/00 Bolting of Flanged Joints for Pressurised Systems Institute of Petroleum Guide to the Design of Relief and Blowdown Systems UKOOA/IP Guidelines for the Management of Integrity of Bolted Pipe Joints UKOOA/IP Guidelines for the Management, Design, Installation and Maintenance of Smallbore Tubing Systems UKOOA Guidelines for Instrument Based Protection Systems Rev 2 1999 Report 2003 3135 Project Guidelines for Engineering Critical Assessment for Pipeline Installation Methods Introducing Cyclic Plastic Strain.

177

5.3 LOSS OF CONTAINMENT – FIRE & EXPLOSION 1.

Scope This Section provides guidance for the assessment of safety case content with respect to the loss of containment from process plant and process operations, leading to fires and explosion. The assessment procedure includes hazard identification, consequence determination and risk management measures.

2.

Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator, together with identification and evaluation of escalation paths that might result. Potential sources of hazard, initiators, etc, are shown in the document. Assessors should ensure that, where relevant, safety cases contain information demonstrating that consideration has been given to each of these factors

3.

Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where safety case contents match with good practice identified in the assessment sheets for a particular element associated with a major accident, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue for follow-up by inspection.

178

4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation Table below: Loss of Containment - Fire & Explosion Source of Hazard

Initiators

Risk Evaluation


Loss of Containment

Ignition

Frequency

Inherent Safety


Ignition Probability

F13

Intrinsically Safe Electrical Equipment

Fire resistant structures

*Ignition sources/’Ex’ rating/

F14

Separate Accommodation Jacket

Inventory size

Electrical Zoning

F15

Risers & Topsides Pressure Rating

Fire load limits

F2

Hot and cold work policies

F16

Fully Rated Structure

Impact loads

F3

Delayed or Immediate Ignition

F17

Normally Unmanned Installations (NUI)

Impact protection

F4

Energy of Ignition

F18

Fully Welded Topside Pipework in Critical Areas

Containment strength

Consequences

F19

Layout – No jet fire Targets


F1

Low risk location F5

Release Size, Detection, Shutdown

Certification schemes

Effectiveness F6

F7

Prevention

Cloud size, Dispersion Conditions/

F20

Hazardous Areas

Ventilation

F21

Electrical Equipment for Use in Potentially Flammable Atmospheres

Escalation, Layout, Separation,

F22

PTW

Open/Closed Modules F8

Fire Types

Detection

179

Loss of Containment - Fire & Explosion Source of Hazard

Initiators

Risk Evaluation F9


Thermal Flux, Smoke Obscuration

F23

Fire/Smoke/Gas/Flame Detectors/Alarms

Effects Mitigation

F10

Fire Modelling

F11

Explosion Modelling

F24

Firewalls

F12

Near and Far Field Effects

F25

Passive Fire Protection [PFP]

F26

Resistant Temporary Refuges

F27

Deluge & Sprinklers

F28


F29

Blast Walls

F30

Suppression and Flame Arrestors

180


5.3.F1:


1.

There are no agreed recognised standards or codes of practice for confirming that the probability of ignition has been derived from information relevant to the installation design and operational intent, see Section 3 below.

2.

Judgement as to the adequacy of the ignition probability assessment can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire & Explosion Strategy Document, HSE website 2004 Fire & Explosion and Risk Assessment Topic Guidance, HSE website 2003

4.


5.


6.


7.


8.


181

5.3.F3: 1.


There are no agreed recognised standards or codes of practice for the assessment of delayed or immediate ignition. Analysis of the timing of ignition of a gas releases is important in determining the explosion risk. Early ignition will tend to give rise to a jet fire. Delayed ignition can cause an explosion or flash fire, depending on the degree of confinement.

2.

Judgement as to the adequacy of the analysis of delayed or immediate ignition can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion & Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004

Specific Technical Issues: 4.1 The safety case should provide evidence that techniques such as event tree analysis or an equivalent approach has been used to assess consequences of immediate or delayed ignition. 4.2 The basis for calculation of delayed or immediate ignition used in the event trees should be justified on the basis of ignition probability models used. 4.3 Models should to take account of factors including the leak duration, type and dimensions of module, ventilation rate and types of ignition sources which are present 5.


6.




Sheet 5.1.F12

Dispersion, Open or Closed Modules, Ventilation Rates

182

7.


8.


183

5.3.F7: 1.

Escalation, Layout, Separation, Open/Closed Modules

Confirmation should be obtained that escalation, layout, separation, open/closed modules have been designed, constructed and analysed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: ISO/FDIS 13702 Petroleum and Natural Gas Industries – Control & Mitigation of Fires and Explosions on Offshore Production Installations: Requirements and Guidelines Escalation of a fire or explosion incident will be dependant on installation layout, separation of hazardous and safe areas, and module type. Escalation risk will be primarily focussed on TR impairment and escape/evacuation risks rather than individual risk to personnel working on the plant or involved in drilling etc.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the design for escalation, layout, separation and open/closed modules can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/ practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion & Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004 UKOOA/HSE Fire & Explosion Guidance Part 0: Fire & Explosion Hazard Management, October 2003 UKOOA/HSE Fire & Explosion Guidance Part 1: Avoidance & Mitigation of Explosions, October 2003

Specific Technical Issues: 4.1 Evidence should be provided to demonstrate that wherever possible large hydrocarbon inventories have been separated and isolation is provided between them such that escalation risk between them has been minimised. 4.2 It should be demonstrated that both immediate and delayed escalation has been considered. 4.3 Evidence should be provided that the HAZID process has been thorough and consideration of escalation from relatively small scale initiating incidents has been included. 5.

6.


Release Size, Detection, Shutdown Effectiveness

5.3.F6

Cloud Size, Dispersion Conditions/Ventilation

5.3.F8

Fire Types


184

Section 5.1 7.



8.


185

5.3.F8:

Fire Types

1.

There are no agreed recognised standards or codes of practice for confirming that all reasonably foreseeable fire types have been identified and assessed.

2.

Judgement as to the adequacy of the identification and characterisation of fire types can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.


4.


5.

6.


Thermal Flux, Smoke Obscuration Effects

5.3.F10

Fire Modelling


7.


8.


186

5.3.F9:


1.

There are no agreed recognised standards or codes of practice for confirming that due consideration has been given to the determination of appropriate levels of thermal flux and smoke obscuration effects within a consequence assessment, see Section 3 below.

2.

Judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion & Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004 OSD SPC Human Vulnerability Criteria for Use in Hazard and Risk Assessment for the Offshore Industry [under development]

4.


5.


6.


7.


8.


187

5.3.F10:

Fire Modelling

1.

There are no agreed recognised standards or codes of practice for assessing the modelling of fires.

2.

Judgement as to the adequacy of the fire modelling assessment can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.


4.

Specific Technical Issues: 4.1. There are major uncertainties in modelling the behaviour and properties of fires of condensate and higher molecular weight hydrocarbons, multi-component materials, and liquids released from pressurised containment. 4.2 Evaluating very large flames of all materials, and the behaviour of running fires also require careful consideration, as the fire characterisation parameters may exceed the model’s capability. 4.3 The influence of water deluge and foam on fuel distribution should be considered separately as part of fire mitigation.

5.

6.


Fire Types

5.3.F9



7.


8.


188

5.3.F11: 1.

Explosion Modelling

Confirmation should be obtained that explosion modelling has been analysed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: ISO/FDIS 13702Petroleum and Natural Gas Industries – Control and Mitigation of Fires & Explosions on Offshore Production Installations: Requirements & Guidelines Explosion modelling for offshore structures is required to quantify the risk of immediate or delayed escalation. Phenomenological modelling can provide an acceptable level of accuracy provided that appropriate gas dispersion modelling is carried out to give a representation of gas cloud size. CFD modelling may provide the highest degree of accuracy provided appropriate gas cloud modelling is carried out.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the explosion modelling can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion & Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004 UKOOA/HSE Fire & Explosion Guidance Part 0: Fire & Explosion Hazard Management October 2003 UKOOA/HSE Fire & Explosion Guidance Part 1: Avoidance and Mitigation of Explosions October 2003

4.

Specific Technical Issues: The explosions analysis should explain what type (average, average peak or peak) of overpressure has been calculated and how it has been used in the analysis of effects on blast walls, fixings, structures, decks and roofs, plant and equipment.

5.

6.



5.3.F7



Loss of Containment – Process

Sheet 5.1.F11 Size of Release, Speed of Detection and Effectiveness 7.


189

8.


190

5.3.F13: 1.


Confirmation should be obtained that intrinsically safe electrical apparatus has been designed and is maintained to recognised standards/codes of practice appropriate to the nature of the flammable atmosphere that the apparatus may encounter and the category of hazardous area zone where the apparatus will be located/operated. Appropriate CE marking with respect to the Atex Directive is one way of indicating that the design is to a recognised standard [See 5.3.F21 Electrical Equipment for Use in Potentially Flammable Atmospheres]. Design Standards for Intrinsically Safe Apparatus Include: BSEN50020 Electrical apparatus for potentially explosive atmospheres. Intrinsic safety ‘i’ and; IEC60079-11 [BSEN60079-25] Electrical apparatus for explosive gas atmospheres. Part 11: Intrinsic safety Standards for Selection of Intrinsically Safe Apparatus Include: BSEN60079-14 [IEC60079-14] Electrical apparatus for explosive gas atmospheres. Electrical installations in hazardous areas (other than mines) Standards for Inspection/Maintenance of Ex Equipment Include: BSEN0079-17 [IEC60079-17] Electrical apparatus for explosive gas atmospheres. Inspection and maintenance of electrical installations in hazardous areas (other than mines) and; BS5345 Code of practice for selection, installation and maintenance of electrical apparatus for use in potentially explosive atmospheres (other than mining applications or explosive processing and manufacture) [now superseded]. ‘Intrinsic safety’ is a type of protection for electrical apparatus to be used in potentially flammable atmospheres. The mechanism by which ‘intrinsic safety’ protection is achieved is the restriction of electrical [and electromagnetic] energy within apparatus and interconnected wiring to a level which cannot cause ignition by sparking or heating. Intrinsically safe equipment is designated Exi.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the electrical equipment and its maintenance regime can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referenced standards.

3.

Relevant Legislation, ACOP and Guidance includes: Electricity at Work Regulations 1989, Regulations 4 and 6: Memorandum of Guidance on EAWR Regulation 6, paras 14-19 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 9(2)(d) Provision and Use of Work Equipment Regulations 1998, Regulation 4 Equipment and Protective Systems for Use in Potentially Explosive Atmospheres Regulations [Not applicable to MODUs, FPSOs and FSUs].

191

4.

Specific Technical Issues: 4.1 Intrinsically safe electrical equipment is divided into two further categories Exia and Exib. An Exib circuit must remain non-incendive in normal operation and operation with one fault. An Exia circuit must remain non-incendive in normal operation and operation with two faults. Some of the mechanisms employed to achieve ‘intrinsic safety’ rely on the operation of active components [eg Zener diode barriers in a safe area] to restrict the flow of energy into the apparatus. Other mechanisms for achieving intrinsic safety include procedural elements [eg apparatus should not be opened in a hazardous area]. Thus even within electrical equipment designated ‘intrinsically safe’ there can be significant variation in the degree to which the equipment corresponds to the concept of ‘inherently safer’. 4.2 Exia certification is the only standard type of certification allowed for electrical equipment which is intended for use in Zone 0 atmospheres. 4.3 Many electrical functions cannot readily be implemented using the ‘intrinsically safe’ concept [eg trace heating, motors]. 4.4 Where risk of electrical ignition is a key determinant of risk for the installation [eg congested modules near TR] then the duty holder should examine the extent to which protection against incendivity of electrical equipment using Exia ‘intrinsically safe’ techniques is a reasonably practicable option.

5.

6.


Hazardous Area Zoning

5.3.F21



7.


8.


192

5.3.F14: 1.

Separate Accommodation Jacket

One of the most obvious and inherently safer means of protecting personnel on offshore installations from fire and explosion hazards is to provide a separate accommodation jacket removed from but connected to [normally by bridge link] the main hazardous activity centres of drilling and hydrocarbon production. This concept of two separate bridge linked jackets has been incorporated into a number of recent new designs [eg Shearwater, Buzzard] as well as modifications to existing platforms [eg Claymore]. Whilst the selection between different design options ultimately lies with the duty holder, confirmation should be obtained that provision of a separate accommodation jacket was considered as a design option for all new facilities. Provision of a separate accommodation jacket should also have been examined as a potential risk reduction remedial measure for existing installations.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the design options considered can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referenced standards.

3.

Relevant Legislation, ACOP and Guidance includes: Management of Health and Safety at Work Regulations 1999, ACOP para 27 Assessment Principles for Offshore Safety Cases [APOSC], paras 956 and 98

4.


5.


6.

7.

Cross-Referenced Sections and Sheets are: 5.1.F10

Concept Selection

5.1.F14

Inherent Safety


8.


193

5.3.F17: 1.

Normally Unmanned Installations (NUI)

Confirmation should be obtained that requirements for fire and explosion hazards have been analysed in accordance with recognised standards or codes of practice that would be used for a manned Installation. Recognised standards/codes of practice would include: ISO/FDIS 13702 Petroleum and Natural Gas Industries – Control and Mitigation of Fires & Explosions on Offshore Production Installations: Requirements and Guidelines

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the evaluation of these hazards can an only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.


4.

Specific Technical Issues: Specific attention should be paid to the Installation status to ensure that plant and equipment is in a safe state prior to a planned visit such that persons are not entering a hazardous environment.

5.

6.


Fire Types

5.3.F10

Fire Modelling

5.3.F11

Explosion Modelling

5.3.F28



7.



8.


194

5.3.F19: 1.

Layout – No Jet Fire Targets

Confirmation should be obtained that the installation’s layout for jet fire mitigation has been analysed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include: ISO/FDIS 13702 Petroleum and Natural Gas Industries – Control and Mitigation of Fires & Explosions on Offshore Production Installations: Requirements and Guidelines

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the layout for jet fire mitigation can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.


4.

Specific Technical Issues: 4.1 Wherever possible redundant plant should be removed to minimise potential targets for incident jet fires. 4.2 Process plant including pipework, vessels cable tray etc should, as far as possible, be oriented to minimise targets for potential jet fires or protection provided to absorb jet fire momentum and thermal flux.

5.

6.



5.3.F9


5.3.F10

Fire Modelling

5.3.F28



7.



8.


195

5.3.F20: 1.


Confirmation should be obtained that hazardous area zoning of plant is based on the likelihood that a flammable atmosphere may arise in the area. Recognised standards/codes of practice would include: BSEN60079-10 [IEC60079-10] Electrical Apparatus for Explosive Gas Atmospheres. Classification of Hazardous Areas Institute of Petroleum Model Codes of Safe Practice in the Petroleum Industry. Part 15: Area Classification Code for Installations Handling Flammable Fluids IEC 61892-7 Mobile and Fixed Offshore Units – Electrical Installations – Hazardous Areas API-RP500B Recommended Practice for Classification of Locations for Electrical Installations at Petroleum Facilities Classified as Class 1, Division 1 and Division 2

2.

Where a standard other than those listed above has been employed, judgement as to the adequacy can only be made on an individual basis and the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to those required by the referenced standards.

3.

Relevant Legislation, ACOP and Guidance includes: Equipment and Protective Systems for Use in Potentially Explosive Atmospheres Regulations [not applicable to MODUs, FPSOs and FSUs] Electricity at Work Regulations 1989, Regulation 6 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 9 Provision and Use of Work Equipment Regulations 1998, Regulation 10 [Atex aspects not applicable to MODUs, FPSOs and FSUs]

4.

Specific Technical Issues: 4.1 Zones may change depending on activity [eg drilling or the presence of another installation during a combined operation]. 4.2 Zoning may depend on forced ventilation. If ventilation fails then equipment not suitable for use in the reduced ventilation zone should be de-energised.

5.

6.



5.3.F21



7.


8.


196

5.3.F21:


Introduction Electrical equipment can cause ignition of flammable atmospheres either by sparking or by temperature effects. Suitable equipment [whether or not it predates the requirements of the Atex 95 Directive] is usually marked with an Ex symbol and this has led to the colloquial designation ‘Ex equipment’. Sources of electromagnetic radiation [eg aerials] can also cause ignition of flammable atmospheres whether or not the radiation source is located in a hazardous atmosphere 1.

Confirmation should be obtained that electrical equipment in potentially flammable atmospheres has been designed selected and maintained with a recognised industry standard or code of practice. Recognised design standards for electrical equipment for use in potentially flammable atmospheres include: The harmonised standards under the Atex 95 Directive. The European Atex 95 Directive requires new equipment in hazardous areas from July 2003 on fixed installations to be suitably ‘CE’ marked. Details of harmonised standards under Atex 95 are issued in the European Union Journal. A summary of the relevant harmonised standards is given at http://europa.eu.int/comm/enterprise/newapproach/standardization/harmstds/reflist/atex.ht ml IEC60079 Electrical Apparatus for Explosive Gas Atmospheres. Parts of this are almost identical to the corresponding CENELEC standards identified above. BS5345 Code of Practice for the Selection, Installation and Maintenance of Electrical Apparatus for Use in Potentially Explosive Atmospheres [no longer current] Recognised standards for selection of electrical equipment for use in potentially flammable atmospheres include: BSEN60079-14 (IEC60079-14) Electrical Apparatus for Explosive Gas Atmospheres Recognised standards for inspection and maintenance of electrical equipment for use in potentially flammable atmospheres include: BSEN60079-17 (IEC60079-17) Electrical Apparatus for Explosive Gas Atmospheres BS5345 Code of Practice for the Selection, Installation and Maintenance of Electrical Apparatus for Use in Potentially Explosive Atmospheres (no longer current). The recognised standard for ignition of flammable atmospheres by radio frequency radiation sources include: BS6656 Guide to Inadvertent Ignition of Flammable Atmospheres by Radio Frequency Radiation

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the management of electrical equipment for hazardous areas can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referenced standards.

3.


197

Equipment and Protective Systems for Use in Potentially Explosive Atmospheres Regulations 1996 [not applicable to MODUs, FPSOs and FSUs] Electricity at Work Regulations 1989, Regulation 6 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 9 Provision and Use of Work Equipment Regulations 1998, Regulation 10 [Not applicable to MODUs, FPSOs and FSUs] 4.

Specific Technical Issues: 4.1 A typical installation may contain several thousand items of electrical apparatus for use in potentially flammable atmospheres. In the vast majority of cases it is unlikely that safety case assessment would require evidence of electrical protection for specific items of apparatus. It is normally evidence of the general approach that is being sought and assessed. 4.2 Where deluge is automatically triggered by detection of gas the suitability of electrical equipment in the relevant area should be subject to detailed assessment. 4.3 Where equipment acts as a source of high power electromagnetic radiation [eg Radar] then the duty holder should have assessed the risk that ignition of flammable atmospheres could be caused by induced currents in local metallic structures. In general unless the sources of radio frequency radiation are very powerful it is unlikely they will be a significant contributor to the risk of ignition.

5.

6.



5.3.F20



7.


8.


198

5.3.F23 1.


Confirmation should be obtained that fire, smoke and gas detection and alarm systems have been designed and assessed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: ISO/FDIS 13702: 1998E Petroleum and Natural Gas Industries – Control and Mitigation of Fires & Explosion on Offshore Production Platforms – Requirements and Guidelines BS EN 60079-10: 1996 Electrical Apparatus for Explosive Gas Atmospheres, Part 10, Classification of Hazardous Areas IP [2002] Model Code of Safe Practice for the Petroleum Industry: Part 15 Model Code of Safe Practice Part 15: Area Classification Code for Installations Handling Flammable Fluids, Institute of Petroleum 2nd Edition August 2002

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis. In these cases the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion Strategy, HSE website 2004 Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2003

4.


5.


6.

Cross-Referenced Sections and Sheets are: Sheet 10.F3

7.


Temporary Refuge and Muster Stations


8.


199

5.3.F24 1.

Firewalls

Confirmation should be obtained that firewalls have been designed, constructed and maintained in accordance with a recognised standard or code of practice. This would typically be provided by adequate certification that the firewall had satisfied a suitable fire test. Recognised standards/codes of practice would include: BS 476 [Parts 20, 21 and 22] fire tests on building materials and structures BS 6336 1982 Guide to the development and presentation of fire tests and their use in hazard assessment BS 5950 Part 8: 1990 Structural use of steelwork in building: Code of practice for fire resistant design ISO 834 1999 Fire resistance test elements of building construction ISO 13702 1999 Control & mitigation of fires & explosions on offshore production installations IMO [2001] Code for the construction and equipment of mobile offshore drilling units – consolidated ASTM E-119 Fire Tests of Building Materials

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion Strategy, HSE website 2004 Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2003

4.


5.


6.


7.


8.


200

5.3.F25 1.


Confirmation should be obtained that passive fire protection [PFP] has been designed and constructed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: BS 476 [parts 20, 21 and 22] Fire tests on building materials and structures ISO 2003 Determination of resistance to jet fires of passive fire protection materials BS EN13381 2002 Test methods for the determining the contribution to the fire resistance of structural members ISO 834 1999 Fire resistance test - elements of building construction ISO 13702 1999 Control and mitigation of fires and explosions on offshore production installations

2.


3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion strategy, HSE website 2004 Fire, Explosion and risk assessment Topic Guidance, HSE website 2003

4.


5.


6.


7.


8.


201

5.3.F26 1.

Resistant Temporary Temporary Refuges

Confirmation should be obtained that the temporary refuge [TR] performance has been designed and assessed in accordance with a recognised standard or code of practice. Recognised standards/codes standards/codes of practice would include: ISO/FDIS 13702: 1998E Petroleum and Natural Gas industries - Control and Mitigation of Fires and Explosions on Offshore Production Platforms UKOOA/HSE Fire and Explosion Guidance Part 1 Avoidance and Mitigation of Explosions Issue 1 October 2003

2.

Where a standard/code standard/code of practice other than those listed above has been employed, judgement as to the the adequacy can can only be assessed assessed on an individual individual basis, and and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: includes: Offshore Installations (Safety Case) Regulations Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion Strategy, Strategy, HSE website 2004 Fire, Explosion and Risk assessment Topic Guidance, Guidance, HSE website 2003

4.

Specific Technical Issues: Issues: 4.1 Criteria used for the impairment of safety functions due to fire and explosion events which have an endurance time of less than an hour, and/or the risk of breach of the integrity of the TR is greater than one in one thousand per year.

5.

4.2

Exceptional circumstances where a TR is not provided.

4.3

The reliance on manual fire damper shutdown.

4.4

The need to monitor the environmental conditions inside the TR.


6.


7.


8.


202

5.3.F27 1.

Deluge & Sprinklers

Confirmation should be obtained that water deluge and spray systems have been assessed in accordance with a recognised standard or code of practice. Recognised standards/codes standards/codes of practice would include: BS EN 13702:1999 Petroleum and Natural gas industries – Control and Mitigation of Fires and Explosions on Offshore Production – Requirements and Guidelines BS 5839:1988 Fire detection and alarm systems for buildings

2.

Where a standard/code standard/code of practice other than those listed above has been employed, judgement as to the the adequacy can can only be assessed assessed on an individual individual basis, and and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: includes: Offshore Installations (Safety Case) Regulations Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion Strategy, Strategy, HSE website 2004 Fire, Explosion and Risk assessment Topic Guidance, Guidance, HSE website 2003

4.

Specific Technical Issues: Issues: General deluge flow rates should be a minimum of 10 litres/min/m2 for pool fire protection, 20 litres/min/m2 for high pressure leak fires [high thermal output], and 400 litres/min/m2 to protect structural steelwork from impinging jet fires.

5.


6.


7.


8.


203

5.3.F28 1.


Confirmation should be obtained that ventilation systems have been designed and assessed in accordance with a recognised standard or code of practice. Ventilation should be derived from the identification and assessment assessment of major accident hazards. Recognised standards/codes standards/codes of practice would include: ISO/FDIS 13702: 1998E (1998) Petroleum and Natural Gas industries - Control and Mitigation of Fires & Explosions on Offshore Production Platforms - Requirements and Guidelines ISO 15138:2000(E) (2000) Petroleum and Natural Gas Industries - Offshore Production Installations - Heating, Ventilation and Air-conditioning IP (2002) Model Code of Safe Practice for the Petroleum Industry: Part 15 Institute of Petroleum Model Code of Safe Practice Part 15: Area Classification Code for Installations Handling Flammable Fluids, 2nd Ed, August 2002 BSI 5925:1991 Ventilation Principles and Designing for Natural Ventilation

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the the adequacy can can only be assessed assessed on an individual individual basis, and and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of performance. performance.

3.

Relevant Legislation, ACOP and Guidance includes: includes: Offshore Installations (Safety Case) Regulations Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion Strategy, Strategy, HSE website Fire, Explosion and Risk Assessment Topic guidance, guidance, HSE website 2003 HSE Offshore Information Sheet 2/2006 Offshore Installations (Safety Case) Regulations Regulations 2005 Regulation 12 Demonstrating compliance with the relevant statutory provisions

4.


5.

6.

7.



5.3.F23



Size of Release, Speed of Detection and Effectiveness

Section 9

Non Process Fires & Explosions

Section 13

QRA

Lead Assessment Section for this Sheet:

204

OSD3.2 8.


205

5.3.F29 1.

Blast Walls

Confirmation should be obtained that blast walls for overpressure mitigation have been analysed in accordance with recognised standards or codes of practice. Recognised standards/codes standards/codes of practice would include: ISO/FDIS 13702 Petroleum and Natural Gas industries - Control and Mitigation of Fires & Explosions on Offshore Production Platforms - Requirements and Guidelines

2.

Where a standard/code standard/code of practice other than those listed above has been employed, judgement as to the the adequacy the blast wall for overpressure overpressure mitigation mitigation can only be be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: includes: Offshore Installations (Safety Case) Regulations Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion strategy, strategy, HSE website 2004 Fire, Explosion and Risk Assessment Topic Guidance, Guidance, HSE website 2003

4.

Specific Technical Issues: Issues: 4.1. Blast walls should be built to the highest resistance possible within the constraints of CBA and capability of the supporting structure. 4.2. Process plant including pipework, vessels, cable tray, etc, should as far as possible be oriented in line with explosion vent paths to reduce turbulence and blockage and hence overpressure incident on the blast walls.

5.

6.



5.3.F11

Explosion Modelling

Cross-Referenced Cross-Referenced Sections and Sheets are: Section 5.1

7.

Loss of Containment Containment - Process


8.


206

5.3.F30 1.

Suppression and Flame Arrestors

Confirmation should be obtained that the requirement requirement for flame suppression devices or flame arrestors has been analysed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include: EN 12874 Flame arrestors – Performance requirements, requirements, test methods and limits for use

2.

Where a standard/code standard/code of practice other than those listed above has been employed, judgement as to the the adequacy the the flame arrestor duty duty and related performance performance can only only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: includes: Offshore Installations (Safety Case) Regulations Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion Strategy, Strategy, HSE website 2004 Fire, Explosion and Risk Assessment Topic Guidance, Guidance, HSE website2003

4.

Specific Technical Issues: Issues: 4.1 Wherever possible flame arrestor devices should be specified as suitable for unstable detonations and not the less onerous stable detonations. 4.2 The Maximum Experimental Safe Gap (MESG) is a property of a specific gas mixture. Installed devices must must be designed and built to the most onerous onerous flammable gas mixture an installation will process.

5.

6.


Fire Types

5.3.F10

Fire Modelling

5.3.F11

Explosion Modelling

5.3.F28


Cross-Referenced Cross-Referenced Sections and Sheets are: Section 5.1

7.

Loss of Containment Containment - Process


8.


207

6.

WELLS

1.

Scope This Section provides guidance for the assessment of safety case content with respect to wells and well systems, from hazard identification through to consequence determination, including risk management measures.

2.

Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of source hazard and initiator, together with identification and evaluation of escalation paths that might result. The main hazard sources have been identified as follows: Shallow Formations Intermediate Formations Reservoir Introduced Fluids Explosives Radioactive Sources Pressure Vessels Dropped Objects For the latent major accident hazards to be activated towards a major accident, 33 initiators have been identified. These are detailed in the categorisation table below. Guidance and standards exist for the basic design of the well and equipment [although the relevance for a particular well will need to be considered]. A list of relevant guidance is given in Section 4 below. Generally, however, guidance and standards are not available for the assessment of conditions and operational activities. These should be evaluated using the assessors own technical expertise and peer reviewed with other wells inspectors using either the formal peer review system or discussed at the monthly well practices forum. It is envisaged that internal guidance will be developed in the near future at which stage the guidance will be added to this manual. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the categorisation table below.

208

3. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation Table below: Wells Source of Hazard

Initiators

HS1

Shallow Formations

G1

Overpressure

HS2

Intermediate Functions

G2

Underpressure

HS3

Reservoir

G3

HS4

Introduced Fluids

HS5

Risk Evaluation


Frequency

F1


Inherent Safety

Well Specific Hazard Studies

F16

Fully Rated Equipment

Material Specification

High Temperature

- basis of design

F17

Inherent Impact Resistance

Containment Capability

G4

Low Temperature

- HAZID

18

Wellhead Platform

Competency Schemes

Explosives

G5

Erosion

- HAZOP

F19

Normally Unmanned Installation

Inspection & Monitoring

HS6

Radioactive Sources

G6

Corrosion

- FMEA

F20

Subsea Development

Arrangements

HS7

Pressure Vessel

G7

Seismic Event

F2

Equipment Selection

F21

Equipment Selection – Ex, IS

Impact Protection

HS8

Dropped Objects

G8

Fatigue/Vibration

F3

Equipment Layout

F22

Material Selection

Fire Resistant Equipment

G9

Fire

F4

Corporate Standards

Prevention

Inventory Size

G10

Explosion

F5

Competence

G11

Inadequate Design

F6

Operations Procedure

- operational

G12

Inadequate Specification

F7

Maintenance Procedure

- maintenance

G13

Inadequate Material Specification

F8

Company/Installation Data

F24

Competent Personnel

G14

Incorrect Installation

F9

Generic Historic Data

F25

Pre-operational Tests

F23

209

Competent Procedures

Wells Source of Hazard

Initiators

Risk Evaluation F10

G15

Inadequate Training

G16

Inadequate Maintenance

G17

Inadequate Supervision

G18

Incorrect Maintenance Procedures

G19

Incorrect Operational Procedures

- speed of detection

F28

Monitoring and Audit Systems

G20

Incorrect Equipment

- effectiveness of response

F29

Alarms

G21

Mechanical Degradation

F12

Dispersion of Release

G22

Structural Failure

F13

Toxicity of Release

G23

Thermal Radiation

F14

Ignition Source: Mechanical and/or Electrical

F30

Competent Personnel

G24

Fishing Gear Snagging

F15

Escalation

F31

Alarms

G25

Anchor Subsidence

G26

Subsidence

G27

Violation

G28

Weather – Extreme

G29

Helicopter Collision

G30

Ship Collision

F11

Concept Selection


Isolation and PTW Controls

F27

Integrity Monitoring

Consequences

- mechanical

Size of Release:

- electrical

Detection

210


Wells Source of Hazard

Initiators G31

Operator Error

G32

Seal Failure

G33

Chemicals

Risk Evaluation

211



4.

Standards and Guidance for Equipment Design APE SPEC 16D

Specification for Control Systems for Drilling Well Control Equipment and Control Systems for Diverter Equipment

API 14E

Recommended Practice for Design and Installation Products Platform

API 17B

Recommended Practice for Flexible Pipe

API 6A

Specification for Wellhead and Xmas Tree Equipment

API BULL 16J

Comparison of Marine Drilling Riser Analysis

API BULL 6AR

Recommended Practice for Repair and Remanufacture of Wellhead and Xmas Tree Equipment, First Edition

API BULL 6FA

Specification Fire Test for Valves

API BULL 6FC F1

Fire Test for Valve with Automatic Backseats

API BULL 6FC F2

Fire Test for Valve with Automatic Backseats

API RP 16Q

Design, Selection, Operation and Maintenance of Marine Drilling Riser Systems

API RP 2R

Design, Rating, and Testing of Marine Drilling Riser

API RP 53

Characterisation of Exploration and Production Associated Wastes

API SPEC 10

Specification for Materials and Testing for Well Cements

API SPEC 13A

Drilling Fluid Materials

API SPEC 13C

Recommended Practice for Drilling Fluid Processing Systems Evaluation

API SPEC 14A

Subsurface Safety Valve Equipment

API SPEC 16A

Specification for Drill Through Equipment

API SPEC 5CT

Specification for Casing and Tubing

APR RP 5B1

Recommended Practice for Gauging and Inspection of Casing, Tubing and Pipeline Threads

APR RP 5C1

Recommended practice for care and use on casing and tubing

ASME 8

Boiler and Pressure Vessel Code

BS 1515

Flanges & their joints bolting

BS 5500

Specification of unrefined fusion weld pressure vessels

ISO 10405

Petroleum and natural gas industries - Care and use of casing and tubing

ISO 10407

Petroleum and natural gas industries; drilling and production equipment; drill stem design and operating limits

ISO 10414

Petroleum and natural gas industries - Field testing of drilling fluids Part 1: Water based fluids

212

ISO 10416

Petroleum and natural gas industries - Drilling fluids - Laboratory testing

ISO 10418

Petroleum and natural gas industries - Offshore production installations - Basic surface process safety systems

ISO 10423

Petroleum and natural gas industries - Drilling and production equipment - Wellhead and Xmas tree equipment

ISO 10424

Draft Document - Petroleum and natural gas industries - Rotary drilling equipment - Part 1: Specification for rotary drilling equipment

ISO 10426

Petroleum and natural gas industries - Cements and materials for well cementing - Part 1: Specification

ISO 10427

Petroleum and natural gas industries - Casing centralisers - Part 1: Bow-spring casing centralisers

ISO 10432

Petroleum and natural gas industries - Downhole equipment Subsurface safety valve equipment

ISO 11960

Welded carbon steel gas cylinders; periodic inspection and testing

ISO 11961

Seamless aluminium alloy gas cylinders; periodic inspection and testing

ISO 13500

Petroleum and natural gas industries - Drilling fluid materials Specifications and tests

ISO 13533

Petroleum and natural gas industries - Drilling and production equipment – Drill through equipment

ISO 13534

Petroleum and natural gas industries - Drilling and production equipment - Inspection, maintenance, repair and remanufacture of hoisting equipment

ISO 13628-4

Petroleum and natural gas industries - Design and operation of subsea production systems - Part 4: Subsea wellhead and tree equipment

ISO 13678

Petroleum and natural gas industries - Evaluation and testing of thread compounds for use with casing, tubing and line pipe

ISO 13680

Corrosion resistant alloy seamless tubes for use as casing, tubing and coupling stock - Technical delivery conditions

ISO 13702

Control and mitigation of fires and explosions on offshore production installations - Requirements and guidelines

ISO 14224

Collection and exchange of reliability and maintenance data for equipment

ISO 14310

Downhole equipment - Packers and bridge plugs

ISO 15156

Materials for use in H2S containing environments in oil and gas production - Part 1: General principles for selection of cracking resistant materials

ISO 15544

Offshore production installations - Requirements and guidelines for emergency response

213

ISO 16070

Downhole equipment - Lock mandrels and landing nipples.

214

7.

DIVING

1.

Scope This Section provides guidance for the assessment of safety case content with respect to diving operations, from hazard identification through to consequence determination, including risk management measures. It covers the major accident hazards of: •

•

•

•

the failure of life support systems for diving operations in connection with the installation; the detachment of a diving bell used for such operations; the trapping of a diver in a diving bell or other subsea chamber used for such operations; and any other event arising from a diving operation involving death or serious personal injury to five or more persons on the installation or engaged in any activity in connection with it.

Guidance in relation to the assessment of a collision of a diving support vessel [DSV] is provided in Section 2: Vessel Impact. 2.

Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator [casual chains], together with identification and evaluation of escalation paths that might result [consequence chains]. The diving major accident hazard prompts have been classified as follows: •

•

Diving major accident hazards that are specified in the Safety Case Regulations [ie failure of life support systems, detachment of diving bell and trapping of a diver in a bell or other chamber] Any other event involving death or serious personal injury to five or more persons on the installation or engaged in an activity in connection with it.


3.

•

Human error

•

Design failure

•

Maintenance failure

•

Procedural failure

•

Positioning failure

•

Collision of bell or chamber with subsea structure

•

Fire or explosion affecting diving operation

Depth of Assessment

215

This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where safety case contents match with good practice identified in the assessment sheets for a particular element associated with a major accident, there will usually be no need for an assessor to probe into the details of the how the good practice is applied. This may, however, be a suitable issue to follow-up through inspection A list of references is provided in each assessment sheet. It should be noted that a more extensive commentary should be referenced. The documents listed provide further guidance, particularly in relation to good practice and performance standards. In some cases the reference material will not be fully applicable and may be limited in some parts. These aspects are referred to on the assessment sheets.

216

4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation Table below: Diving Source of Hazard HS1

Divers’ Life Support Equipment Heating system Umbilicals

Initiators Human Factors [Section 11] G1

Risk Evaluation F1

Likelihood Factors


Commission

Historic data concept selection

Omission

Layout design

Fatigue

Installation/DSV information

G2 G3


Inherent safety

DSV

National & industry standards

Selection

SMS: client and contractor

Capability

Competence [Section 11] client and contractor

Crewing Audit

Personal equipment

Vessel performance procedures Competence [Section 11]

HS2

Diving bell/basket systems

G4

Design failure

Project scheduling timeframe

Power Failure

Weather

F5

Prevention alternatives to diving operations

Diving plant and equipment Selection

SIMOPS assessment Dive control

G5

Mechanical Failure

Audit Planned maintenance familiarisation

Bell/basket launch and recovery Diving bell/basket main bell umbilical

G6

Pressure System Failure

G7

Maintenance Failure

G8

Power failure

G9

Mechanical Failure

[diving personnel with installation & vice versa]

EER

Hazard identification

Evacuation

[HAZOPS – client with contractor]

Escape Rescue

Subsea habitats.

Detection system monitoring Pressure System Failure

F6 Dive system and vessel auditing

217

Recovery

Diving Source of Hazard HS3

Initiators Procedural Failure [Section 11] Incorrect/inappropriate

Deck chamber complex Surface compression chamber

Risk Evaluation F2

Consequences



Control diving policy

Procedures

Uncontrolled decompression

PTW [Section 11]

Operating Emergency

G10 G11

Simultaneous operations [SIMOPS]

Inability to maintain life support

Operating procedures competency [Section 11]

Cold suffocation

Manning issues

G12

Extreme Weather [Section 3]

Damage to pipeline/subsea structures [Section 5.2 & Section 3] Impact damage to installation

Client review/acceptance of procedures

Audit Life support control Hyperbaric evacuation system

[Section 2] Positioning Failure [Section 4.2] HS4

Common systems

F8

Mitigation emergency procedures [Section 10]

Human factors Selection

G13

Dynamic positioning/ mooring failure

Compressors & pumps

F3

Factors which may affect the consequence Number of Divers exposed

High pressure gas storage

Collision of bell/basket with subsea structures

Breathing gas and environmental control systems

Anchor wire G14 Other structures

Location of dive system [siting of the facility]

Training

Firefighting deluge [Sections 5.3 & 9]

Competence

F9 Supervision

Proximity of hydrocarbons [Section 5.1] EER arrangements [Section 10]

G15

Power generation & management.

218

EER Co-ordination [Section 6]

Diving Source of Hazard HS5

Initiators

Diving Platform DSVs

Risk Evaluation

Fire & Explosion G16

Offshore installation

[Sections 5.3 & 9] Any fire or explosion in vicinity of dive system affecting essential services Sinking of DSV

G17

Subsea Releases

G18

219



7.HS1: 1.

Divers Life Support Equipment

Confirmation should be obtained that the duty holder’s management system will ensure that the divers’ life support equipment [ie heating system, umbilicals and personal equipment] will be designed, constructed and maintained and will be operated in accordance with relevant recognised standards and guidance. These include: Diving Equipment Systems Inspection Guidance Note [DESIGN] IMCA 1995 IMCA D 010 [Rev 2] Diving Operations from Vessels Operating in DP Mode IMCA D0 018 (2) Code of Practice on The Initial and Periodic Examination, Testing and Certification of Diving Plant and Equipment IMCA D023 Diving Equipments Systems Inspection Guidance Note for Surface Oriented Diving Systems (Air) IMCA D 28/98 Minimum Supervisory Requirements for Offshore Diving Operations Carried Out on the UK Continental Shelf Guidelines for Offshore Installation Safety Cases: Diving Operations from Vessels. A Joint Industry Guide UKOOA 1993 Would also include the offshore ACOP and relevant HSE Diving Information Sheets.

2.

Where a standard/code of practice other than those listed above has been employed, judgements as to the adequacy of the life support equipment can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations Assessment Principles for Offshore Safety Cases [APOSC]

4.

Specific Technical Issues: For permanent onboard diving equipment the security of these systems should be discussed. For temporary equipment the management arrangements for any integration into the platform systems should be described. The effect on diving systems of platform incidents and/or extreme weather should be discussed either for the installed equipment or for the outline of possible temporary equipment.

5.

6.


Diving/Basket Systems

7.HS3

Deck Chamber Complex

7.HS4

Common Systems



Section 5.3

Loss of Containment - Fire and Explosion [Fire and Explosion in vicinity of the dive system]

220

7.

Section 9

Non Process Fires & Explosions [Fire and Explosion in vicinity of the dive system]

Section 11

Human Factors

Lead Assessment Section for this Sheet: OSD4.6 or 4.7 [dependant on location]

8.


221

7.HS2: 1.

Diving Bell/Basket Systems

Confirmation should be obtained that the duty holder’s management system will ensure that the diving bell/basket systems are designed, construction and maintained and will be operated in accordance with relevant recognised standards and guidance. These include: Diving Equipment Systems Inspection Guidance Note [DESIGN] IMCA 1995 OTH 91 338 Maintenance, Inspection and Discard of Diving Bell Hoist Ropes HSE Books 1993 ISBN 0 11 886387 8 BS ISO 4309:2004 Cranes. Wire Ropes. Care, Maintenance, Installation, Examination and Discard BS EN 12385 – 3:2004 Steel Wire Ropes. Safety Information for Use and Maintenance. OTO 97 063 Degradation of Galvanised Multi Strand Wire Ropes HSE 1997 Guidelines for Offshore Installation Safety Cases: Diving Operations from Vessels. A Joint Industry Guide UKOOA 1993 IMCA D 010 [Rev 2] Diving Operations from Vessels in DP Mode IMCA D0 018 Code of Practice on The Initial and Periodic Examination, Testing and Certification of Diving Plant and Equipment IMCA D023 Diving Equipments Systems Inspection Guidance Note for Surface Oriented Diving Systems [Air] IMCA DO 24 Diving Equipment Systems Inspection Guidance Note for Saturation Diving Systems [Bell] IMCA D 28/98 Minimum Supervisory Requirements for Offshore Diving Operations Carried Out on the UK Continental Shelf Would also include the offshore ACOP and relevant HSE Diving Information Sheets.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the diving bell/basket systems can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.


4.

Specific Technical Issues: Clearly the detailed specification of the system in use will be part of the diving contractors’ Diving Project Plan. In addition the actions to be carried out if a diving bell becomes detached from the system or if the divers are trapped in the bell or habitat will be contained in the Diving Project Plan which is the prime responsibility of the diving contractor under DWR. The safety case duty holder will probably be required to provide assistance particularly in co-ordinating any wider emergency response. If diving operations are envisaged, arrangements for providing this assistance should be documented in the safety case. Depending on the operational circumstances this might take various forms from a very detailed and specific support document to a simple statement of intent by the duty holder. The latter will usually be acceptable in a safety

222

case but will, of course, need to be expanded when a diving contract has been placed and before diving operations commenced. This would be evaluated during inspection activities. Formal procedures for providing assistance in the event of a detached diving bell or habitat are recommended. 5.

6.

7.



7.HS3


7.HS4

Common Systems



Section 5.3


Section 9


Section 11

Human Factors


8.


223

7.HS3: 1.


Confirmation should be obtained that the duty holder’s management system will ensure that deck chamber complexes are designed, constructed and maintained and will be operated in accordance with relevant recognised standards and guidance. These include: Diving Equipment Systems Inspection Guidance Note [DESIGN] IMCA 1995 AODC Guidance Note Number 029: Oxygen Cleaning, published by IMCA AODC Guidance Note Number 016 Rev 1: Marking and Colour Coding of Gas Cylinders, Quads and Tanks for Diving Applications, published by IMCA. BS EN 1089-3 1997 Transportable Gas Cylinders - Cylinder Identification. Part 3: Colour Coding AODC Guidance Note 016 Rev 1, published by IMCA IMCA D0 018 Code of Practice on The Initial and Periodic Examination, Testing and Certification of Diving Plant and Equipment IMCA D023 Diving Equipments Systems Inspection Guidance Note for Surface Oriented Diving Systems (Air) IMCA D 28/98 Minimum Supervisory Requirements for Offshore Diving Operations Carried Out on the UK Continental Shelf IMCA D 025 Evacuation of Divers from Installations Would also include the offshore ACOP and relevant HSE Diving Information Sheets.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the deck chamber complex can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.


4.

Specific Technical Issues: For permanent onboard diving equipment the security of these systems should be discussed and should be included in the verification scheme. There should be a company policy preventing the over swinging of pressurised systems and gas storage banks, and formal procedures for the evacuation of divers from an installation based dive system in the event of platform abandonment. For temporary equipment the management arrangements for any integration into the platform systems should be described. There should be a system for revising the verification scheme to cover the diving systems presence on the installation. The effect on diving systems of platform incidents and/or extreme weather should be discussed either for the installed equipment or for the outline of possible temporary equipment.

224

5.

6.

7.



7.HS4

Common Systems



Section 9


Section 11

Human Factors


8.


225

7.HS4: 1.

Common Systems

Confirmation should be obtained that the duty holder’s management system will ensure that the common systems [ie compressors, pumps, high pressure gas storage, breathing gas and environmental control systems, power generation and management systems] will be designed, constructed and maintained and will be operated in accordance with relevant recognised standards and guidance. These include: Diving Equipment Systems Inspection Guidance Note [DESIGN] IMCA 1995 IMCA D 025 Evacuation of Divers from Installations IMCA D0 018 (2) Code of Practice on The Initial and Periodic Examination, Testing and Certification of Diving Plant and Equipment IMCA D023 Diving Equipments Systems Inspection Guidance Note for Surface Oriented Diving Systems (Air) IMCA D 28/98 Minimum Supervisory Requirements for Offshore Diving Operations Carried Out on the UK Continental Shelf Guidelines for Offshore Installation Safety Cases: Diving Operations from Vessels. A Joint Industry Guide UKOOA 1993 Would also include the offshore ACOP and relevant HSE Diving Information Sheets.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the common systems can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.


4.

Specific Technical Issues: For permanent onboard equipment the security of these systems should be discussed. For temporary equipment the management arrangements for any integration into the platform systems should be described. The effect on diving systems of platform incidents and/or extreme weather should be discussed either for the installed equipment or for the outline of possible temporary equipment. There should be a company policy preventing the over swinging of pressurised systems and gas storage banks.

5.


6.



Section 9


226

Section 11 7.

Human Factors


8.


227

7.HS5: 1.

Diving Platform

Confirmation should be obtained that the duty holder’s management system will ensure that the diving platform will be designed, constructed and maintained and will be operated in accordance with relevant recognised standards and guidance. These include: Diving Equipment Systems Inspection Guidance Note [DESIGN] IMCA 1995 Guidelines for Offshore Installation Safety Cases: Diving Operations from Vessels. A Joint Industry Guide UKOOA 1993 DPVOA - 1611/14 DP Vessel Owners Association: DP Position Loss risks in Shallow Water GM - 1611/01-0189-650 DP Vessel Owners Association: Guidelines for the Design and Operation of Dynamically Positioned Vessels Guidelines for the Specification and Operation of Dynamically Positioned Diving Support Vessels - Norwegian Petroleum Directorate - Petroleum engineering division of the UK Department of Energy. IMCA D 010 [Rev 2] Diving Operations from Vessels Operating in DP Mode IMCA D 006 [Rev 2] Diving Operations in the Vicinity of Pipelines. IMCA D0 018 Code of Practice on The Initial and Periodic Examination, Testing and Certification of Diving Plant and Equipment IMCA D023 Diving Equipments Systems Inspection Guidance Note for Surface Oriented Diving Systems (Air) IMCA D 28/98 Minimum Supervisory Requirements for Offshore Diving Operations Carried Out on the UK Continental Shelf IMCA D 025 Evacuation of Divers from Installations Would also include the offshore ACOP and relevant HSE Diving Information Sheets.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the diving platform can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.


4.

Specific Technical Issues: Danger to the installation platform from a fire, explosion or the release of a dangerous substance from a diving system is considered to be low provided a sound system of maintenance and inspection is in place. Diving systems permanently onboard installations should be included in the verification scheme. Incidents from a vessel based system should also be considered though the consequences for the installation will probably be much reduced and can be discounted.

228

Collision of the DSV with the installation is a credible event which may have major consequences. The UKOOA Guidelines referred to above should be referred to in the safety case or companies manuals. There should be a management system in place to ensure that the diving system onboard DSVs used in connection with installations is maintained to a similar standard as onboard systems. 5.


6.

7.



Section 4.1


Section 4.2


Section 5.3


Section 9


Section 11

Human Factors


8.


229

7.F1-F3: 1.

Risk Evaluation

Confirmation should be obtained that that the safety case considers the risks associated with and from diving including the likelihood of an incident, the consequences and the factors affecting the consequence. There are no standards associated with the likelihood of an accident occurring, but the duty holder would be required to demonstrate that diving project plans and where appropriate the safety case takes into consideration the following guidance and standards: DMAC 028 Provision of Emergency Medical Care for Divers in Saturation DMAC 22 Proximity to a Recompression Chamber after Surfacing DMAC 21 The Duration of Saturation Exposures and Surface Intervals Following Saturation DPVOA - 1611/14 DP Vessel Owners Association: DP Position Loss Risks in Shallow Water IMCA D025 Evacuation of Divers from Installations Would also include the offshore ACOP and relevant HSE Diving Information Sheets.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the safety case can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.


4.

Specific Technical Issues: The duty holder should demonstrate that for any given diving project that all risks will be considered. These would include any historic data available, the selection of the type of diving [including the necessity for diving], the layout and design of the dive system, the DSV performance [if appropriate], the competence of those involved in the project and the project scheduling and timeframe [including weather considerations]. There could be situations where divers are at risk because their work activity prevents them from taking the normal action available to a conventional member of the workforce because they are in the pressure chamber. For such situations, emergency procedures for the evacuation of the divers would be provided. These specialised arrangements will largely be the responsibility of the diving contractor, but when the diving is taking place from an installation there is a requirement on the duty holder to co-operate. The amount of detail will vary depending on the type of installation and the diving system. Where divers are on the installation they should be included in the PFEER assessment and in the summary included in the safety case.

5.


6.



230

7.

Section 2

Vessel Impact (Impact damage to the installation)

Section 5.1

Loss of Containment - Process (Proximity of hydrocarbons)

Section 5.2


Section 5.3


Section 10

Emergency Response


8.


231

7.F1-F3: 1.

Risk Evaluation

Confirmation should be obtained that that the safety case considers the risks associated with and from diving including the likelihood of an incident, the consequences and the factors affecting the consequence. There are no standards associated with the likelihood of an accident occurring, but the duty holder would be required to demonstrate that diving project plans and where appropriate the safety case takes into consideration the following guidance and standards: DMAC 028 Provision of Emergency Medical Care for Divers in Saturation DMAC 22 Proximity to a Recompression Chamber after Surfacing DMAC 21 The Duration of Saturation Exposures and Surface Intervals Following Saturation DPVOA - 1611/14 DP Vessel Owners Association: DP Position Loss Risks in Shallow Water IMCA D025 Evacuation of Divers from Installations Would also include the offshore ACOP and relevant HSE Diving Information Sheets.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the safety case can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.


4.

Specific Technical Issues: The duty holder should demonstrate that for any given diving project that all risks will be considered. These would include any historic data available, the selection of the type of diving [including the necessity for diving], the layout and design of the dive system, the DSV performance [if appropriate], the competence of those involved in the project and the project scheduling and timeframe [including weather considerations]. There could be situations where divers are at risk because their work activity prevents them from taking the normal action available to a conventional member of the workforce because they are in the pressure chamber. For such situations, emergency procedures for the evacuation of the divers would be provided. These specialised arrangements will largely be the responsibility of the diving contractor, but when the diving is taking place from an installation there is a requirement on the duty holder to co-operate. The amount of detail will vary depending on the type of installation and the diving system. Where divers are on the installation they should be included in the PFEER assessment and in the summary included in the safety case.

5.


6.



232

7.

Section 2

Vessel Impact (Impact damage to the installation)

Section 5.1

Loss of Containment - Process (Proximity of hydrocarbons)

Section 5.2


Section 5.3


Section 10

Emergency Response


8.


233

7.F4-F9: 1.


Confirmation should be obtained that the duty holder’s safety management system takes into account relevant recognised standards and guidance. These include: All IMCA Guidance and other industry guidance identified in other sheets of this section, HSE diving information sheets, the Offshore ACOP and other HSE guidance such as HSG 65.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the risk management measures can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.


4.

Specific Technical Issues: The duty holders’ responsibility as the client for the diving project should be assessed. The responsibility for the detailed management of the safety of the diving project will be the responsibility of the diving contractor. The safety case, where appropriate, should have risk management measures in place to ensure that alternatives to diving are adequately considered. For diving operations, there should be adequate consideration of simultaneous operations, familiarisation of diving personnel with installation and vice versa , and hazard identification [client with contractor and vice versa]. There should be a system of dive system and vessel auditing, and client review/acceptance of procedures. The purpose of the assessment is to check that the management system is adequate to ensure that the relevant statutory provisions will be complied with in relation to the installation and any activity on or in connection with it. The standard of demonstration required in the case is at a high level which will mainly, be carried out by the team responsible for the SMS assessment. Tests should be carried out that envisaged diving projects will be adequately covered. This check of the SMS should include competence of the duty holder, and procedures to ensure competence of diving contractors.

5.

6.



7.HS2

Diving Bell/Basket Systems

7.HS3


7.HS4

Common systems

7.HS5

Diving Platform



234

7.

Section 9


Section 10

Emergency Response

Section 11

Human Factors


8.


235

8.

HELICOPTER CRASH

1.

Scope This Section provides guidance for the assessment of safety case content with respect to the collision of a helicopter with the installation, from hazard identification through to consequence determination, including risk management measures. It covers the major accident hazards of: •

•

2.

Helicopters used for day-to-day transport and SAR duties; and Fixed wing military aircraft if considered foreseeable because of the installation’s possible proximity to bombing ranges or other military activities.

Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator [causal chains], together with identification and evaluation of escalation paths that might result [consequence chains]. The helicopter crash major accident hazard prompts have been classified as follows: •

•

Helicopter crash major accident hazards that are specified in the Safety Case Regulations [ie helicopters or other relevant aircraft]. Any other event involving death or serious personal injury to 5 or more persons on the installation or engaged in an activity in connection with it.


3.

•

Helideck design/systems.

•

Aircraft systems performance.

•

Operational/procedural factors.

•

Human error [helideck/aircrew].

Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where safety case contents match with good practice identified in the assessment sheets for a particular sheet associated with a major accident there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue for follow-up by inspection.

236

4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation table below. Helicopter Crash Source of Hazard HS1

Helicopters

HS2

Other relevant aircraft [eg military aircraft]

Initiators G1

Risk Evaluation Frequency

Helideck design/systems Proximity of tall structures/ obstacles wind turbulence


F1


Inherent Safety

Historic Accident Data

F10

Eliminate/reduce helicopter use

F11

Helideck Operations Radio Operators Procedures

Optimised helideck design thermal plume effects

F2

Company/Installatio n Data

F12

SCE Verification

Helideck design Helicopter landing areas

Navigational/communications

F3

Installation Specific Risk Studies

F4

Military flight data

F13

Company transportation policy/ procedures

Consequences

F14

Fire Prevention Measures [Sections 5.1, 5.3, 5.9]

Prevention

failure. G2

Operational/Procedural Factors Landing aids failure

Extreme weather/environmental

F5

Process/non process fire [Sections 5.1,5.3, 5.9]

F15

Correct operational procedures

Installation movements [mobiles]

F6

Structural damage to helideck/elsewhere [Section 3]

F16

Competent personnel client review/acceptance of procedures

Incorrect/inappropriate procedures

F7

Loss of damage to EER Plan [Section 10]

237

Detection

Helicopter Crash Source of Hazard

Initiators Lack of awareness of flying restrictions

Inadequate communications

Risk Evaluation F8

F9

Implications to EER Plan [Section 10]

F17

Monitoring of helicopter

F18

Communications with Aircrew

Helicopter crash on F19 helideck/installation/ F20 in sea

Inaccurate helicopter payload manifests G3


Human Error [Helideck Crew] Commission/omission Errors/fatigues Inadequate training

Aircraft Systems Performance/Air Worthiness Engine/systems failure Navigational aids failure Helicopter design Pilot error Bird strikes

238

Unsafe Conditions Helicopter Status Lights


8.HS1

Helicopters

8.HS2:

Other Aircraft

1.

The assessor to confirm that all helidecks have been designed and that all associated helideck and helicopter operations are managed in accordance with the relevant CAA/OPITO standards and industry guidelines. Recognised standards/codes of practice include: CAA CAP 437 Offshore Helicopter Landing Areas – Guidance on Standards OIAC HLG Design Guide HSE Safety Notice 1/94 Mobile Installations & Vessels: Movement of Helidecks HSE Safety Notice 2/2004 Offshore Helidecks - Testing of Helideck Foam Production Systems HSE Operations Notice 6 Reporting of Offshore Installation Movements HSE Operations Notice 14 Guidance on Coast Protection Act – consent to locate and the marking offshore installations UKOOA Guidelines for the Management of Offshore Helideck Operations CAPs 452/535 Radio Operators’ Guides Cogent/OPITO Approved Helideck Training Standards UKOOA Guidelines for Management of Safety Critical Elements

2.

Where a standard/code of practice other than those listed above has been employed then the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations (L30) Assessment Principles for Offshore Safety Cases [APOSC] Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 and Guidance on Regulations (L85) Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and Approved Code of Practice (L65)

4.

Specific Technical Issues: Hazard identification should include helicopters and other aircraft such as military aircraft since SCR Regulation 2 defines the collision of a helicopter with an installation as a major accident and any other event likely to cause death or serious injury to 5 or more persons. Since the collision of a civil fixed wing aircraft with an installation is not considered reasonably foreseeable the duty holder should not be expected to include this in the hazard identification process. Although a helicopter ditching in the sea in the vicinity of an installation is outside the scope of SCR [SCR ACOP para 67] the duty holder would be expected to demonstrate compliance with PFEER Regulation 17 - Arrangements for Recovery and Rescue.

239

Duty holders will generally have no control over initiating events associated with the airworthiness, technical and operational requirements of helicopters or military aircraft, aircrew performance. Therefore they should not be expected to address initiating events which are within the remit of aviation regulations. However, duty holders [the operator/owner of a fixed/mobile installation] are required under Regulation 11 of DCR to ensure that the helideck design, construction and operating environment is such that helicopter operators can discharge their duty under aviation legislation. Duty holders are responsible for the safety of the helideck and helideck operations, specifically those associated with helicopter landings and take-offs. They are required to ensure that the helideck operating environment is such that helicopter operators can discharge their duty. They have direct control over the physical characteristics of the helideck, the levels and manning of the rescue and firefighting and provision of communications. They are required to ensure that competent personnel control all activities on the helideck during helicopter operations, suggest routes to be flown and have in place a weather policy for passenger safety on the helideck and for passenger survival and rescue. They should demonstrate that appropriate safety management systems and audit arrangements are in place, and include suitable reference to such management systems in their safety cases. For mobile installations and floating fixed installations, topic assessors [TAs] should be looking for evidence that initiating events associated with helideck movements and the likely causes have been considered. [Duty holders are also required to collect, store and transmit accurate weather and oceanographic data, and information relating to installation motions]. Potential deficiencies in helideck design and construction require assessment preferably at the design stage. For example, an initiating event can be contact with, or turbulent airflow caused by adjacent structures, or obstacles on the installation or on installations nearby, or thermal effects arising from plant exhausts such as gas turbines situated near the helideck. TAs should look for evidence in a design safety case as well as an operational safety case that the duty holder has taken into account published guidance. Inadequate communications, training of appropriate personnel, and ‘wrong rig’ landings can also be classed as initiating events. Although there is little that the duty holder can do about aircrew competence, appropriate operational procedures on the installation and effective helideck crew training policies should be in place. There should be evidence that a process of SCE identification and verification is in place as required by SCR/DCR for controlling the risks of helicopter/ aircraft collision. 5.

6.

Other Related Assessment Sheets in this Section are: 8.F1-F9

Risk Evaluation

8.F10-F20




Section 4.1


Section 4.2


Section 5.1


Section 5.3


Section 9

Non Process Fires & Explosion

Section 10

Emergency Response

Section 11

Human Factors

240

7.


8.


241

8.F1-F9: 1.

Risk Evaluation

Confirmation should be obtained that risk evaluation has been carried out in accordance with industry guidelines and is based on recognised risk data sources, for example: CMPT: A Guide to QRA for Offshore Installations UKOOA guidelines for QRA Uncertainty UKOOA guidelines: Formal Safety Assessment CAA Mandatory Occurrence Reports CAA data OGP data

2.

Where a standard/code of practice other than those listed above has been employed, judgements as to the adequacy of the safety case can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations (L30) Assessment Principles for Offshore Safety Cases [APOSC] Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 and Guidance on Regulations (L85) Offshore Installations (Prevention of Fire and Explosion, and Emergency response) Regulations 1995 and Approved Code of Practice (L65)

4.

Specific Technical Issues: The most comprehensive sources of helicopter accident data for assisting with risk analysis are likely to have been published by CAA as well as from research studies commissioned by HSE, CAA and industry. It is therefore unlikely that a proper risk analysis can be carried out without reference to at least the CAA data. The duty holder’s risk analysis should take account of installation specifics, for example the type of helicopter used, and the company’s transportation policies which will affect the frequency of helicopter operations to and from the installation or vessel. [Although offshore regulations do not require transport risk to be included in safety cases duty holders do address this in their submissions. We should not discourage this approach]. The duty holder should take into account the risks associated with military aircraft over flying the installation and that MOD have been consulted to obtain data which will assist with a risk analysis. Although not mandatory or prescribed some duty holders have found it helpful to calculate risks in terms of risks to individuals [IR] and as potential loss of life [PLL]. This allows comparisons to be made of the risks to personnel with HSE’s risk acceptability criteria both for helideck personnel and the rest of the workforce on the installation, and to personnel arising from helicopter crashes on the helideck, elsewhere on the installation, or where appropriate, on a NUI. For major modifications and resubmissions, the duty holder should take into account any changes to working practices which may affect the risk of helicopter collisions.

242

The likely consequences will depend on where the helicopter impacts the installation, the approach speed, the degree of structural damage to the helideck or elsewhere, the possibility of fire, and the effect on EER systems and arrangements. The safety case should therefore contain evidence that foreseeable points of impact on the installation, escalation potentials and all likely scenarios have been considered. 5.

Other Related Assessment Sheets in this Section are: 8.HS1/8.HS2 Helicopters/Other Aircraft 8.F10-8.F20

6.

7.




Section 5.1


Section 5.3


Section 9

Non Process Fires and Explosions

Section 10

Emergency Response


8.


243

8.F10-F20:


1.

Confirmation should be obtained that full account has been taken of industry guidelines, cited in the previous assessment sheets, when assessing the measures needed to manage risk.

2.

Where a standard/code of practice other than those referred to above has been employed, judgements as to the adequacy of the risk management measures can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations (L30) Assessment Principles for Offshore Safety Cases [APOSC] Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and Approved Code of Practice (L65) Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 and Guidance on Regulations (L85)

4.

Specific Technical Issues: The duty holder is required to list safety critical elements [SCEs], have them subject to independent review and develop a scheme for verification of their performance throughout the lifecycle of the installation. An offshore helideck is a collection of systems, some of which are safety critical because of the helideck’s function as a means of evacuation, or because their purpose is to limit the effects of a helicopter crash. For these reasons the safety case should provide evidence of a SCE verification scheme with respect to helidecks. The greatest scope for eliminating or minimising a helicopter collision is to consider at the conceptual and detailed design stage those features of a helideck which could affect helicopter operations and compromise safety. The duty holder should therefore demonstrate in the design safety case that the routine and key technical issues, known to arise in the design and construction of offshore helidecks and related operations, have been addressed. Total elimination of helicopter movements is probably unrealistic, however, it may still be possible to reduce the need for helicopters to visit an installation either by improved planning or management of logistics. A TA should therefore look for evidence in a safety case of how the number of helicopter visits to both NAIs and NUIs [where appropriate] could be reduced or kept to a minimum. The safety case should provide evidence of documented helicopter operational procedures for managing the risks associated with the initiating events [where appropriate] which have been listed under 8.G3 and that consideration has been given to personnel competencies, and the necessary preventative and detection measures [see 8.F11 to 8.F20]. The appropriate systems and procedures for protecting personnel [including aircrew and helicopter passengers] from the consequences of a helicopter collision should be described in the safety case. CAP 437 and UKOOA guidelines describe what is considered to be best practice with respect to the helideck fire fighting facilities, personnel training and emergency procedures. The duty holder should therefore demonstrate that procedures are in place which are based on this guidance. A helicopter [or other aircraft if considered foreseeable] colliding with the installation may lead to a need for evacuation,

244

or render the helideck unavailable for evacuation. The duty holder should therefore confirm that the emergency procedures manual for that installation specifies the action to be taken following such events. 5.

6.

7.

Other Related Assessment Sheets in this Section are: 8.HS1/8.HS2

Helicopters/Other Aircraft

8.F1-8.F9

Risk Evaluation


Loss of Marine Integrity - Loss of Stability

Section 4.2

Loss of Marine Integrity - Loss of Position

Section 5.1


Section 5.3


Section 9

Non Process Fires & Explosions

Section 10

Emergency Response

Section 11

Human Factors


8.


245

9.

NON PROCESS FIRES & EXPLOSIONS

1.

Scope This Section provides guidance for the assessment of safety case content with respect to incidents originating from non-process plant, leading to fires and explosions. The assessment procedure includes hazard identification, consequence determination and risk management measures.

2.

Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator, together with identification and evaluation of escalation paths that might result. Potential sources of hazard, initiators, etc, are shown in the document. Assessors should ensure that, where relevant, safety cases contain information demonstrating that consideration has been given to each of these factors.

3.

Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where safety case contents match with good practice identified in the assessment sheets for a particular element associated with a major accident, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue for follow-up by inspection. 4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the categorisation tablebelow

246

Non Process Fires & Explosions Source of Hazard HS1

Accommodation Fires

Initiators

Risk Evaluation


Ignition *Solid No Inventory

Frequency

Inherent Safety

Fire Resistant Structures

Human Factors



Inventory Size

Escalation from Process Events

*Ignition Sources/’Ex’ Rating/ Electrical Zoning

Impact

Hot and Cold Work Policies

Corrosion Induced Failure


Inadequate Design

Energy of Ignition

Incorrect Usage

Flash Fire or Explosion

- Laundry Fire - Galley Fire


Fire Load Limits Separate Accommodation Jacket

Impact Loads

Non Flammable Materials

Impact Protection Containment Strength Material Specification Low Risk Location


Certification Schemes

Dropped Containers HS2

HS3

Cellulosic Fires

Inadequate Maintenance

Prevention

- Pallet Fire

Overheating

Electrical Zoning

Procedural Inadequacies

‘Ex’ Rating

Vibration Induced Failure

Hot and Cold Work Policies

Electrical Fires

Detection

247

Non Process Fires & Explosions Source of Hazard HS4

Initiators

Risk Evaluation


Non Cellulosic Fires & Explosions

Consequences

Fire Detectors/Alarms

Cellulosic Load Solids only

Smoke Detectors/Alarms

- Gas Cylinder Fires

Size of Release Dispersion

Mitigation

*Open/Closed Modules – Ventilation Rates

Fire Walls

- Helifuel Fires - Methanol Fires

Passive Fire Protection - Gas Cylinder Explosions

Confinement/Layout Resistant Temporary Refuges Potential for Escalation Deluge *Separation/Layout Sprinklers Fire Models Used & Assumptions Made Fire Resistance of Potential Targets Human Vulnerability PFP Effectiveness Type of Fire Thermal Flux/Smoke Generation Shielding Vulnerability of Potential Targets to Fire/Heat Smoke Dispersion TR Vulnerability to Smoke Ingress Passive Fire Protection

248


9.HS1:

Accommodation Fires

Introduction Accommodation fires are defined as those fires that occur in the accommodation spaces, including the control room and TR. They will be predominantly cellulosic fires from combustible non-hydrocarbon sources, for example, soft furnishings, blankets, lint in laundries etc. 1.

Confirmation should be obtained that fires in accommodation areas have been analysed in accordance with a recognised standard or code of practice. Onshore Building Regulations are suitable standards to follow in assessing offshore accommodation modules for fire resistance. Recognised standards/ Codes of Practice include: BS 5839 1988 Fire detection and alarm systems for buildings ISO 13702:1999 Petroleum and Natural Gas Industries – Control and Mitigation of Fires and Explosions on Offshore Production Installations – Requirements and Guidelines SI 1991/2768 The Building Regulations UKOOA Guidelines for Fire & Explosion Hazard Management 1995 IEC 6033-1 & 2 Safety of Household and Similar Electrical Appliances Recommendations for the Use of Electrical and Electronic Equipment for Mobile and Fixed Offshore Platforms IEE 1992 Eurocode 1: Basis of design and actions on structures. Part 2.2 Actions on structures exposed to fire

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the offshore accommodation modules for fire resistance can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Electricity at Work Regulations 1989 Provision and Use of Work Equipment Regulations 1998 Operational Circular OC 217/2 (Rev) Fire Legislation and Liaison between HSE Inspectors and Fire Authorities Guidance on General Fire Precautions at Premises subject to Fire Certificates (Special Premises) Regulations 1976

4.

Specific Technical Issues: Provision for water sprinklers systems; fire resistant walls and self-closing fire doors should be evaluated as well as procedural measures such as no smoking in bedrooms. Risk evaluation of accommodation fires should be based on a standard fire assessment methodology that is, ignition sources, fire detection, fire loads, compartmentalisation, fire barriers, use of non-toxic materials, protections systems etc.

249

5.

6.


Cellulosic Fires

9.HS3

Electrical Fires

9.HS4

Non Process Fires


7.


8.


250

9.HS2:

Cellulosic Fires

Introduction Cellulosic fires are fires that result from the combustion of solid materials such as wood, cloth, paper etc. These fires are found predominantly in accommodation spaces, including the control room, laundry and TR. 1.

Confirmation should be obtained that cellulosic fires have been assessed in accordance with a recognised standard or code of practice. Recognised standards/codes standards/codes of practice would include: BS 5839 1988 Fire detection and alarm systems for buildings ISO 13702:1999 Petroleum and Natural Gas Industries – Control and Mitigation of Fires and Explosions on Offshore Production Installations – Requirements and Guidelines. SI 1991/2768 The Building Regulations

2.


3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995

4.


5.

6.


Accommodation Fires

9.HS3

Electrical Fires


7.


8.


251

9.HS3:

Electrical Fires

Introduction Electrical Fires are those associated with the electrical ignition and the combustion of the special materials [eg cables] that make up electrical equipment. Electrical fires potentially introduce the additional hazard of toxic fume [HF, HCN, phosgene] resulting from the combustion process. Fires in flammable atmospheres which have an electrical ignition source are covered in Section 5.3 Loss of Containment – Fire & Explosion and are not discussed here. 1.

Confirmation should be obtained that electrical equipment has been designed in accordance with a recognised standard or code of practice. Where recognised standards have been used the likelihood of an electrical fire is judged to be sufficiently low as not to require further assessment. The recognised standards for the design of electrical systems offshore include: Recommendations Recommendations for the Use of Electrical and Electronic Equipment for Mobile and Fixed Offshore Platforms IEE 1992 The recognised standards for electrical cables offshore include: BS 6883 – Elastomer insulated cables for fixed wiring in ships and on mobile and fixed offshore units. Requirements and Test Methods. IEC 60331 [IEC 331] Tests for Electric Cables Under Fire Conditions [Flame Resistance] Resistance] IEC 60332 [IEC 331] Tests on Electric Cables Under Fire Conditions [Flame Retardancy] Retardancy]

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the analysis of electrical fire hazard can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Electricity at Work Regulations 1989 Provision and Use of Work Equipment Regulations Regulations 1998

4.


5.

6.


Accommodation Fires

9.HS4

Non Cellulosic Fires



252

7.

Sheet 5.3.F10

Fire Modelling

Sheet 5.3.F23


Sheet 5.3.F24

Fire Walls

Sheet 5.3.F25


Sheet 5.3.F26


Sheet 5.3.F27

Deluge and Sprinklers

Lead Assessment Section for this Sheet: OSD3.5 in close liaison with OSD3.2

8.


253

9.HS4:

Non Cellulosic Fires

Introduction Non-process fires and explosions typically involve helifuel, methanol, diesel, TEG, and compressed gas cylinders. 1.

Confirmation should be obtained that non process fires have been analysed in accordance with a recognised recognised standard or code of of practice. Recognised standards/codes standards/codes of practice would include: ISO/FDIS 13702 Petroleum and Natural Gas Industries– Control and Mitigation of fires and explosions on offshore production installations – Requirements and guidelines

2.

Where a standard/code standard/code of practice other than those listed above has been employed, judgement as to the the adequacy of the assessment can only only be assessed on an individual individual basis, and the duty holder should be required to justify why its procedures/practices procedures/practices in the t he relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion and Risk Assessment Topic Guidance, Guidance, HSE website 2003 Fire and Explosion Strategy, Strategy, HSE website 2004

4.

Specific Technical Issues: 4.1 Where fire attack is possible protection by water deluge or shielding should have been provided [especially for Acetylene cylinders]. 4.2 Where gas/vapour detection is impractical or inefficient [ie Methanol or TEG] appropriate fire detection should have been provided. 4.3 Fire hazard control for atmospheric fuel storage facilities should take into account location, containment [bunding/scuppers] [bunding/scuppers] drainage, automatic fuel shut-off, passive fire protection and ventilation/ ventilation shut-off.

5.


6.


7.


8.


254

10. Emergency Response 1.

Scope

The Offshore Installation I nstallations s (Safety Case) Regulations [SCR] and associated Schedules contain specific requirements for emergency response to major accident hazards on the installation. It is also necessary for the safety case to demonstrate that the emergency response arrangements arrangements ensure compliance with the relevant statutory provisions. The Offshore Installation (Prevention of Fire and Explosion, and Emergency Response) Regulations [PFEER] also interface with SCR, in particular the identification of major accidents requiring an emergency response, the organisation and management management of emergency response and summarising the assessment of the emergency response arrangements. 2.

Assessment Assessment of Adequacy of Demonstration

To facilitate assessment of a safety case a set of elements relating to emergency response response have been defined and are set set out in the following assessment assessment sheets. This guidance covers covers all types of safety cases, installations, combinations combinations of installations and operating regimes and is therefore of necessity pitched at a fairly high level. It should not therefore t herefore be regarded as restricting assessors in any way if, in their judgement, issues not explicitly covered by this guidance need to be pursued to establish the acceptability of the t he case for safety. Reference is made throughout this Section to industry codes, standards and guidance. This should not be interpreted as conferring any status to such material in terms of achieving legislative compliance. compliance. Therefore, complying complying with UKOOA documents does not guarantee guarantee a duty holder will comply with the Regulations or will provide all the information required by assessors in a safety case. Where industry codes, standards or guidance are employed in arguments supporting the case for safety, their relevance to the particular circumstances of the installation in question should be established in the safety case together with an indication as to how compliance of the duty holder’s arrangements with this material is achieved. 3.

Depth of Assessment

Assessment of a duty holder’s emergency response response arrangements is targeted primarily at determining whether or not the performance of the t he arrangements made to secure an effective emergency response is credible and effective. Verifying whether or not the t he emergency response arrangements are physically capable of delivering the claimed performance is a matter for post acceptance inspection. While it is a matter of balance as to how much material is required in a safety case rather than verified through inspection, any discussion included included in a safety case in support of a demonstration of regulatory compliance should contain sufficient sufficient detail to lend conviction to the arguments. Further, the assessment of safety cases is basically basically a sampling process. process. Therefore, dependent dependent upon a number of factors including assessment history, not all the elements identified in this Section may necessarily be assessed in every safety case assessment. Lastly, it should be noted that this material is only relevant to safety case assessment and is not sufficient to determine full compliance with PFEER. Assessment Sheets The subdivision of emergency response into assessment sheets for the purposes of safety case assessment is shown in Table 1.

255

Table 1 Sheet No

Sheet Title

10.F1

Emergency Response Management

10.F2

Alarms and Communication Communication

10.F3


10.F4

Access/Egress Routes

10.F5

Evacuation

10.F6

Escape

10.F7

Rescue and Recovery

10.F8

Ship Collision

10.F9

Emergency Lighting

10.F10

Emergency Communications Communications

256

10.F1:


Introduction The adequacy of the management of emergency response and the contribution this makes to the demonstration that major accident hazard risks have been reduced to comply with PFEER provisions is considered. Aspects of emergency response included in this assessment sheet are the emergency response plan [ERP] and adverse weather policy, the assessment of the emergency response arrangements and the competence of those involved in executing the ERP. 1.

Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the emergency response management. Recognised codes, standards or guidance include: UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations UKOOA Guidelines for The Management of Competence and Training in Emergency Response COGENT [formerly OPITO] Offshore Emergency Response Standards. Assessment Principles for Offshore Safety Cases [APOSC]

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the emergency response management can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995

4.

Specific Technical Issues: The safety case should include information on the following topics: •

•

•

•

•

Identification of major accident hazards for which an emergency response is required. Maximum number of people for which the case for safety is being made and their likely distribution around the installation for all operational modes. Emergency response strategy associated with each type of identified major accident hazard and how the strategy has incorporated the effects of adverse and exceptional weather. Organisation and management of emergency response both on the installation and beyond in sufficient detail to show how an effective emergency response is achieved. Contribution to the reduction of major accident risks made by the emergency response arrangements.

257

•

•

•

5.

6.

Competence and training of all those involved in executing the Emergency Response Plan. Remedial action plans in relation to measures that are intended to be implemented. Verification that the emergency response arrangements are, and remain, effective.


Alarms and Communications

10.F3

Temporary Refuge & Muster Stations

10.F4


10.F5

Evacuation

10.F6

Escape

10.F7

Rescue and Recovery

10.F8

Ship Collision


7.


8.


258

10.F2:

Alarms and Communication

Introduction The Safety Case Regulations require information on the arrangements for protecting persons from hazards of explosion, fire, heat, smoke, toxic gas or fumes. Alarm and communication arrangements form part of such arrangements. It should be noted that the assessment of the electrical aspects of alarms and communications are outwith the scope of this assessment sheet. 1.

Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the emergency response management. Recognised codes, standards or guidance include: UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations UKOOA Guidelines for The Management of Competence and Training in Emergency Response COGENT [formerly OPITO] Offshore Emergency Response Standards.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the emergency response management can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Assessment Principles for Offshore Safety Cases [APOSC]

4.


•

5.

Arrangements made for emergency alarm signs, signals and communications as prescribed by the PFEER Regulations. The safety case should contain sufficient information to show that regulation 11 of PFEER is met The role of voice communications systems in directing personnel to a particular course of action during the various phases of an emergency



10.F3

Temporary Refuge & Muster Stations

10.F4


10.F5

Evacuation

10.F6

Escape

10.F7

Rescue and Recovery

259

10.F8 6.

Ship Collision


7.


8.


260

10.F3:


Introduction The arrangements for the Temporary Refuge [TR] should provide sufficient protection to enable the full POB to muster safely, permit the emergency to be assessed, monitored and controlled or limited if possible and to allow the appropriate parts of the Emergency Response Plan to be executed. The assessment of TR impairment frequency and human vulnerability is outwith the scope of this Section. 1.

Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the TR and muster stations. Recognised codes, standards or guidance include: UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the TR and muster stations performance can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.

3.


4.


•

•

•

•

•

5.

Location and extent of the primary, and any secondary, TR. TR impairment due to temperature, CO, CO2, O2, H2S, smoke etc; levels at which actions may be initiated, means of monitoring and actions to be taken. Required endurance time for TR and muster stations for all identified major accident hazards should be specified and justified together with a description of any associated protection systems. Incidents which do not require use of the TR should be identified and justified, together with alternative mustering arrangements. Systems which will ensure that the incident can be monitored, controlled and the emergency response plan implemented. Quantities and type of PPE located at the TR and muster stations.



10.F2


261

6.

10.F4


10.F5

Evacuation

10.F6

Escape

10.F7

Rescue and Recovery

10.F8

Ship Collision


7.


8.


262

10.F4:


Introduction Arrangements should be in place for ensuring sufficient designated routes are available from all work sites on the installation to the TR/muster areas/evacuation points and from these areas to the various means of evacuation and escape for as long as they are needed. 1.

Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the access/egress routes. Recognised codes, standards or guidance include: UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the TR and muster stations performance can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.

3.


4.


•

•

5.

The philosophy of access/egress routes provision. Number and location of access/egress routes from all the potential work sites on the installation to the temporary refuge/muster stations/ evacuation and escape points should be shown diagrammatically. The impairment criteria and required endurance time for all routes. Sufficient information should be included to justify how the specified endurance times will be achieved taking into account the preference to protect routes rather than individuals.

•

PPE [type and quantity] available for use with the above routes.

•

Arrangements in the event of impairment of primary access/egress routes.



10.F2


10.F3


10.F5

Evacuation

10.F6

Escape

263

6.

10.F7

Rescue and Recovery

10.F8

Ship Collision


7.


8.


264

10.F5:

Evacuation

Introduction Evacuation encompasses arrangements and plant on and beyond the installation. These include provision of primary and secondary means of evacuation, eg helicopter, TEMPSC, sea transfer and bridge-link; some necessitating arrangements with others. Specific consideration is required of the availability, redundancy and diversity of the various means. 1.

Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the evacuation performance. Recognised codes, standards or guidance include: UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations OTO Report 02 021 Compatibility Test Protocol for Life Jackets and Immersion Suits on Offshore Installations

2.

Where a standard/code of practice other than those listed above have been employed, judgement as to the adequacy of the evacuation arrangements can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.

3.


4.


•

•

•

The philosophy behind the selection, hierarchy, redundancy, diversity and distribution of the means of evacuation and demonstrate that the arrangements ensure, so far as is reasonably practicable, the safe evacuation of all persons. Each means of evacuation in terms of number, size, capacity, location, orientation, limitations in use, means of deployment/boarding, and in the case of TEMPSC – crewing and speed. Means of communication available to control stations and means of evacuation. The philosophy behind the selection and distribution of PPE which should take account of persons who have mustered directly at the evacuation point as well as those mustering at their own normal muster station.

•

Emergency lighting arrangements at evacuation points.

•

Arrangements to be made with others beyond the installation.

•

The identification of those major accident hazards and other events which impair the evacuation arrangements.

265

•

•

5.

6.

The time for which the evacuation point and means of evacuation is required to be available. Means of impairment, impairment criteria, any means of protection and alternative arrangements to accommodate such impairment. Compatibility between the means of evacuation and any PPE.



10.F2


10.F3


10.F4


10.F6

Escape

10.F7

Rescue and Recovery

10.F8

Ship Collision


7.


8.


266

10.F6:

Escape

Introduction The distinction between the processes of evacuation and escape had not been established at the time SCR originally came into force. This distinction was introduced by PFEER and two separate Regulations [15 and 16] set out the requirements that the duty holder must satisfy in these areas. For the purpose of safety case assessment the escape arrangements may be regarded as a subset of the evacuation arrangements intended to ensure, so far as is reasonably practicable, a safe means for all persons to leave the installation in an emergency that has also involved a failure in the principal evacuation arrangements. 1.

Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the escape arrangements. Recognised codes, standards or guidance include: UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations OTO Report 02 021 Compatibility Test Protocol for Life Jackets and Immersion Suits on Offshore Installations

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the escape arrangements can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.

3.


4.

Specific Technical Issues: •

•

•

•

•

•

The philosophy behind the selection, hierarchy, redundancy, diversity and distribution of the means of escape will ensure, so far as is reasonably practicable, the escape of all persons. Such philosophy should differentiate between mass means of escape, such as could occur upon unavailability of the TEMPSC, and individual escape necessitated by having become isolated from the means of evacuation. Each means of escape in terms of number, size, capacity, location, limitations in use, and means of deployment/boarding. The philosophy behind the selection and distribution of PPE which should take account of persons who have gone directly to an escape point. Emergency lighting arrangements at escape points. The time for which the escape point and means of escape is required to be available. Compatibility between the means of escape and any PPE.

267

5.

6.



10.F2


10.F3


10.F4


10.F5

Evacuation

10.F7

Rescue and Recovery

10.F8

Ship Collision


7.


8.


268

10.F7:

Rescue and Recovery

Introduction Rescue and recovery arrangements and their required performance should be summarised in safety cases as part of both Regulation 12(1), Schedule 2 para 10, Schedule 3 para 7 and Schedule 5 para 5 requirements. Such summary need only address major accident hazards although the actual arrangements should also provide for those entering the sea either as a result of a helicopter ditching on landing or take-off or an overside working incident. 1.

Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the rescue and recovery arrangements. Recognised codes, standards or guidance include: UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations OTO Report 02 021 Compatibility Test Protocol for Life Jackets and Immersion Suits on Offshore Installations UKOOA Guidelines for the Survey of Vessels Standing by Offshore Installations UKOOA Guidelines for the Safe Management and Operation of Vessels Standing by Offshore Installations

2.

Where a standard/code of practice other than those listed above have been employed, judgement as to the adequacy of the rescue and recovery arrangements can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.

3.


4.


•

•

Selection of the scenarios for which rescue and recovery is required, eg evacuation or escape, man overboard and helicopter ditch, and selection of the rescue and recovery arrangements to accommodate the selected scenarios. A summary of the arrangements for effecting rescue and recovery for each of the scenarios including any sharing arrangement between different installations. Performance Standards for rescue and recovery which should include the numbers of persons associated with each scenario, their survival times and the total recovery times to an identified place of safety.

•

PPE required to achieve the quoted survival times.

•

Any equipment provided to assist location of survivors.

269

•

5.

6.

Weather limits on the rescue and recovery arrangements and actions to be taken when these are exceeded.



10.F2


10.F3


10.F4


10.F5

Evacuation

10.F6

Escape

10.F8

Ship Collision


7.


8.


270

10.F8:

Ship Collision

Introduction Ship collision is a major accident accident hazard. It should be noted that this assessment assessment sheet relates to passing/drifting passing/drifting vessels. Risks due to attendant vessels vessels are addressed in Section 2 Vessel Impact. Impact. 1.

Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the ship collision avoidance arrangements. Recognised codes, standards or guidance include: UKOOA Guidelines for Ship/Installation Ship/Installation Collision Avoidance UKOOA Guidelines for the Management of Emergency Response for Offshore Installations

2.

Where a standard/code standard/code of practice other than those listed above has been employed, judgement as to the the adequacy of the ship collision avoidance arrangements arrangements can only only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Assessment Principles for Offshore Safety Cases [APOSC]

4.


5.

6.

Performance standards stating the required warning time and relating this to the time needed to implement the emergency response plan.



10.F2


10.F3


10.F4


10.F5

Evacuation

10.F6

Escape

10:F7

Rescue & Recovery


7.

Lead Assessment Section for this Sheet:

271

OSD3.3 8.


272

10.F9: 1.

Emergency Lighting

Confirmation should be obtained that the emergency lighting has been designed in accordance with a recognised recognised standard or code of of practice. Recognised current current standards/codes standards/codes of practice would include: BS 5266 Emergency Lighting The Chartered Institution of Building Services Application Guide: Lighting in Hostile and Hazardous Environments Regulations laid down by the Norwegian Maritime Directorate (1992) Regulations for Mobile Offshore Units Lloyds, DNV and ABS Classification Rules: Mobile Offshore Units IMO Code for the Construction and Equipment Of Mobile Offshore Drilling Units [MODU Code] International Convention Convention for the safety of life at sea – SOLAS BS IEC 61892 Mobile and Fixed Offshore Units – Electrical Installations EN1838 [equivalent to BS 5266 Part 7] Lighting Application – Emergency Lighting BSEN 50172 Emergency Escape Lighting Systems ICEL 1006: Emergency Lighting Design Guide The above codes, standards and guidance collectively cover the layout of all types of installation [fixed, FPSO and MODUs]. However they are particularly pertinent pertinent to the design of new installations and therefore are likely to be referenced in design safety cases.

2.

Where a standard/code standard/code of practice other than those listed above has been employed, judgement as to the the adequacy of of emergency lighting lighting can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Schedule 2 para 12 and Schedule 3 para 9 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 14 para 141 The following Regulation is applicable to hazardous areas of fixed installations but does not apply to MODUs, floating production platforms [FPPs] and floating production storage and offloading vessels [FPSOs]. Equipment and Protective Systems Intended for Use in Potentially Explosive Atmospheres Regulations 1996

4.

Specific Technical Issues: The safety case should include:

273

4.1 Details of the means of affording emergency lighting in the temporary refuge, from the temporary refuge from normal places of work, from the temporary refuge to evacuation points and at evacuation points. 4.2 Evidence of the adequacy of illumination provided by each emergency lighting system installed and the periods for which they are each maintained. 4.3 An analysis of the vulnerability vulnerability of the emergency lighting systems to their operating environment and to damage from a major accident [ie protection against the effects of explosion, fire, missiles etc.] 4.4 Details of emergency lighting within hazardous areas or emergency lighting that is required to remain ‘live’ in emergency conditions regardless of location. Emergency lighting fittings for such areas should be or may have been designed in accordance with BS 5501 or BS EN 50014 and selected, installed and maintained in accordance with BS 5345 or BS EN 60079 series of standards. 5.

6.



10.F4


10.F5

Evacuation

10.F6

Escape


7.



8.


274

10.F10:

Emergency Communications

Introduction The requirement for emergency communications is detailed in PFEER. Communication Communication for health and safety purposes is detailed in the Offshore Installations and Pipeline Works (Management and Administration) Administration) Regulations [MAR]. [MAR]. In summary, the requirements requirements for emergency communications communications are to have sufficient and diverse means and arrangements for communicating with personnel on the installation and appropriate external bodies. [This assessment sheets covers all these elements]. It is desirable that as many as possible of the telecommunications systems provided for normal operation, and which can perform useful service in controlling the emergency, should remain active, provided that their continued operation does not create additional hazards. Communicating with Personnel on the Installation The following objectives are to be achieved for communicating with personnel on the installation: To enable persons controlling the emergency to alert all personnel on the installation, instruct them as required including to proceed to muster stations, and, where appropriate, to evacuate the installation. installation. To enable persons in charge of muster stations to communicate with each other, and with the Emergency Control Centre [ECC] on the installation. To enable members of emergency work teams attempting to bring the situation under control to communicate with each other, and with the ECC. To enable persons who may be trapped by the incident in an area of the installation from which they cannot reach their muster stations to communicate with the ECC. To enable the ECC on the installation to call for external assistance, and to communicate with an Onshore Emergency Response Control. Communicating with External Parties The following objectives are to be achieved for communicating with external parties: To enable the ECC on the installation to call for external assistance, and to communicate with an Onshore Emergency Response Control. To enable the ECC to communicate with other nearby offshore installations, where applicable, which may be able to provide assistance. assistance. To enable the ECC to communicate with any vessel standing by the installation and other ships in the vicinity, which may be involved in efforts to control the emergency situation, or in rescue operations. To enable the ECC and helicopter landing officer to communicate with helicopters involved in evacuation and rescue operations. To enable TEMPSC to communicate with ships and helicopters in the vicinity. To communicate with aircraft involved in an emergency [eg Search and Rescue On Scene Commander]. Systems to achieve the above objectives include:

275

Public address system General alarm system Hand portable radio units [which may be used portable-to-portable direct, portable-toportable via a repeater, or base station to portable].

Marine VHF system [using fixed base-stations or hand-portable transceivers]. Platform UHF hand-portable radio system [where vessel is equipped with fixed or hand-portable units on frequencies assigned to installation]. MF radio operating at inter-ship frequencies. Inmarsat service. Aeronautical VHF system [using fixed base-stations or hand-portable transceivers]. 1.

Confirmation should be obtained that the emergency communications has been designed in accordance with a recognised standard or code of practice. Recognised current standards/codes of practice would include: CP043 1996 Issue No 2 UKOOA Guidelines for Safety Related Telecommunications Systems On Normally Attended Fixed Offshore Installations CP044 1996 Issue No 2 UKOOA Guidelines for Safety Related Telecommunications Systems On Normally Unattended Fixed Offshore Installations BS 7443 (1991) Specification for Sound Systems for Emergency Purposes BS EN 60849 (1998) Sound Systems for Emergency Purposes BS EN 60268-16 (2003) Sound Systems Equipment Regulations laid down by the Norwegian Maritime Directive (1992) Regulations for Mobile Offshore Unit Lloyds, DNV and ABS Classification: Mobile Offshore Units IMO Code for the Construction and Equipment Of Mobile Offshore Drilling Units (MODU Code) International Convention for the safety of life at sea – SOLAS CAP 437 Civil Aviation Authority The above codes, standards and guidance collectively cover the layout of all types of installation [fixed, FPSO and MODUs]. However they are particularly pertinent to the design of new installations and therefore are likely to be referenced in design safety cases.

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of emergency communications can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.


276

Offshore Installations (Safety Case) Regulations 2005, Schedule 2 para 12 and Schedule 3 para 9 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 14 para 145 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 11 para 107-115 Offshore Installations and Pipeline Works (Management and Administration) Regulations 1995, Regulation 12 The following Regulation is applicable to hazardous areas of fixed installations but does not apply to MODUs, floating production platforms [FPPs] and floating production storage and offloading vessels [FPSOs]. Equipment and Protective Systems Intended for Use in Potentially Explosive Atmospheres Regulations 1996 Merchant Shipping (Radio Communications) Regulations 1998 [Note GMDSS not enforced by HSE] 4.

Specific Technical Issues: 4.1 UKOOA Guidelines for Safety Related Telecommunications Systems on Normally Attended Fixed Offshore Installations CPO43, 1996, Issue No 2 and UKOOA Guidelines for Safety Related Telecommunications on Normally Unattended and Fixed Offshore Installations CPO44, 1996, Issue No 2, Appendix A2 and A3, provides a basis for the specification of suitable emergency communication equipment. 4.2 The duty holder should be able to supply sufficient detailed information to show that PFEER Regulation 11 is met. 4.3

The requirements for alarm and PA functions are: i.

Provision of an audible and/or visual emergency warning, to all persons on the installation.

ii.

Provision of emergency communications between persons on the installation.

These are normally an audible and visible alarm system and an intelligible system that in an emergency situation would be required to function as follows: i.

Provide the alarm signal and continue to operate as far as possible throughout the emergency.

ii.

Alert personnel in the accommodation cabin and work area by audible alarms.

iii.

Provide verbal information to personnel on their way to muster/ embarkation points.

iv.

Provide command and control at muster and embarkation points.

The safety case should recognise the importance of both audible and visible alarms and voice communications system. 4.4. GMDSS is an international system which uses terrestrial and satellite technology and ship board radio systems to ensure rapid, automated, alerting of shore based

277

communication and rescue authorities, in addition to ships in the immediate vicinity in the event of a marine distress. GMDSS applies to vessels which would include those mobile installations registered as vessels. All offshore installations that operate on the UKCS are required to comply with PFEER. These Regulations require that amongst other things the duty holder makes suitable arrangements for the purpose of emergency response for communication between the installation and persons beyond it. In addition to PFEER, the Offshore Installations and Pipeline Works (Management and Administration) Regulations 1995 requires under Regulation 12 that duty holders have effective communication in place to communicate between the offshore installation and the shore, vessels, aircraft and other installations. Although GMDSS is not mandatory for fixed production installations, it is mandatory for all other maritime mobiles including support and supply vessels, semi submersible, mobile jack-up drilling rigs. There is therefore a decision to be made by the duty holder, as to whether a duty holder would choose to implement GMDSS as part of its safety case. Factors influencing this decision may include: Location:

Remoteness Proximity to VHF Coastal Radio Station Proximity to Sea Lanes Field operations philosophy.

5.

6.



10.F4


10.F5

Evacuation

10.F6

Escape


Vessel Impact

Sheet 5.3.F21Electrical Equipment for Use in Potentially Flammable Atmospheres 7.


8.


278

11. HUMAN FACTORS 1.

Scope The topic area of Human Factors covers three broad areas: human error; procedural integrity; and organisational integrity. The twelve elements shown in the table below subdivides these into practical assessment sheets that are underpinned by regulation and relate to key offshore safety issues, for both assessment and inspection. It must be stressed however, that the designation of these sheets is focused on the assessment of safety cases as per the Offshore Installations (Safety Case) Regulations 2005 (SCR), rather than PFEER assessment, to which the sheets relate only insofar as SCR require a description of how the duty holder has, or will ensure, compliance with regulation 4(1) of PFEER within the safety case. There are numerous interfaces and overlaps with other sections: eg Emergency Response and Risk Analysis; and where these associations exist, the overlap and demarcated areas of assessment are explained. Of particular interest is the emphasis of the human factors involved in the earlier conceptual design stages of the installation lifecycle. This reflects the increasing realisation that the human element involved in professional judgement is of equal, if not greater, significance than the hazard and risk analysis methodologies themselves in deriving realistic decisions on ALARP, SFAIRP and acceptability in general. Human error is considered in the operational scenario, but the assessment approach is to consider the pressures and influences on the individual brought by organisational culture and factors, contractualisation, multi-skilling/tasking, and competence and task analysis, and the ultimate effect this has in impairing human performance. Procedural assessment is similarly sub-divided into Permit to Work systems [11.G7] and organisational change management [11.G9], as they have sufficient content to be assessment sheets in their own right. Finally, it must be re-emphasised that the focus of human factors assessment is the risk and measures associated with human reliability in an acute sense, where this constitutes a causal factor in the development of major accident scenarios. Starting with the individual, we pan out to look at the procedural frameworks and the organisational context [with associated pressures] that influence human performance. We are not concerned with the chronic effect of the work environment upon the health of the individual - it is the safety effects of human performance - or more significantly human failure - that is of concern in assessment.

279

11.G1:

Human Error: Selection, Competence and Training

Introduction This sheet considers the arrangements for ensuring the competence of individuals to perform to an acceptable standard in given tasks and roles. In the first instance, this is influenced by appropriate test and selection procedures, but thereafter invokes the need for structured and systematic training for such tasks and roles, particularly where these are directly safety-critical. Once these measures can be demonstrated, this sheet also considers on-going competence assessment for such tasks and roles. The duty holder may operate team based working, never the less each individual team member must be competent to undertake safely the tasks they are likely to be required to do. 1.

Confirmation should be obtained that a procedure is in place for the selection, competence assessment, and training of operations and maintenance personnel and that it is designed in accordance with a recognised standard or code of practice. Recognised current standards/codes of practice would include: RR 206-01-R-01 Human Factors in Offshore Operations: Role evaluation tool RR 086 Competence assessment for the hazardous industries [Applicable to onshore and offshore domains] OTO 1999/092 Human factors assessment of safety critical tasks [along with RR 033: Evaluation report on OTO 1999/092] OTH 92 374 The Selection and Training of Offshore Installation Managers for Crisis Management OTO 2001/053 Preventing the propagation of errors and misplaced reliance on faulty systems; a guide to human error dependency

2.

Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of operator selection, competence, and training can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re ‘sufficient particulars’ which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case, invokes a particular need for task/human analysis where the human is an integral part of the Safety Critical Element [SCE] under consideration. Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC]

4.

Specific Technical Issues: Assessment within this area needs to take account of the level of ‘independence’ of an individual: where specific roles require an individual from the duty holder side to be

280

‘independent’, then evidence has to be provided to support this, and the assessor has to make an informed judgement that the level of independence is adequate. Evidence needs to be provided that safety critical roles, tasks and procedures have been identified, and that these have been subjected to systematic task analysis or procedural review to ensure that all improvements [to comply with the relevant statutory provisions] have been made. As a logical follow-on, where key safety-critical roles are identified, evidence is required that there has been a capability assessment undertaken for the role. Suitable assessment might involve structured psychometric assessment/test, particularly in the case of key management tactical decision-making roles. Similarly, where key safety-critical tasks are identified, evidence is required that the simulation and test of the human and team capability has been assessed adequate for the task. Inspection indicators: Duty holder procedures re selection, competence, training; team/individual task analysis; PFEER verification - human as SCE. 5.

6.

7.


Human Error: Stress, Fatigue, Shifts and Organisational Factors

11.G4

ALARP & SFAIRP Awareness


Vessel Impact

Section 5.1


Sheet 5.1.HS1

Pressure Vessels [Including Columns]

Section 7

Diving

Sheet 7.F1-F3

Risk Evaluation [Likelihood Factors]

Section 8

Helicopter Crash

Sheet 8:F16

Competent Personnel Client Review/Acceptance of Procedures [See sheet 8.F10-F20]


8.


281

11.G2:


Introduction Assessment needs to take account of external factors that can compromise individual performance of task or role, quite apart from competence. Such factors include stress, fatigue, shift patterns, and organisational factors, including company culture [although this may be difficult to elicit from a safety case]. 1.

Confirmation should be obtained that due consideration and assessment of external factors, in terms of stress and organisational pressure, has been conducted in accordance with a recognised standard or code of practice. Confirmation should be obtained that means are provided for managing and maintaining the alertness of staff engaged in hazardous or high consequence activities. Relevant Standards, ACOPS, Guidance [HSE and industry], and preliminary guidance [HSE research reports and internal guidance, to be formalised] are as follows: HSG 48 Reducing error and influencing behaviour [Applicable to all forms of installation] HSG 65 Successful health and safety management [Applicable to all forms of installation] RR 107 Development of internal company standards of good management practice and task-based risk assessment tool for offshore work related stress INDG 281 HSE Help on work related stress RR 133 Beacons of excellence in Stress Prevention [Guidance in progress ] SPC Shiftwork offshore SPC stress in high hazard industries

2.

Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to acceptability of risk, and procedures to control these risks, can only be assessed on an individual basis, and the duty holder should be required to justify why its provision in this area will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re ‘sufficient particulars’ which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case, invokes a particular need for consideration of human vulnerability to stress/fatigue-induced error, where the human is an integral part of the safety critical element [SCE] under consideration. Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC]

4.

Specific Technical Issues:

282

Where specific roles require an individual from the duty holder side to be ‘independent’, then evidence has to be provided to support this. This is crucial to the assessment of risks, and their associated control measures, as compromise of independence is, in itself, a stressor, and can bring inappropriate pressure to decision-making. Assessment of the stress/organisational hazard needs to have been conducted, as well as its potential realisation in the risk and consequences of human error. This indicates a need for a level of individual profiling for stress-vulnerability to have been conducted, in a climate of organisational support, particularly where safety-critical activity is concerned. Inspection links: Compliance audit/verification; organisational factors - particularly independence; safety culture; independent audit and interview of duty holder staff. 5.

6.

7.



11.G6

Procedural Integrity

11.G10

Knowledge Management


Vessel Impact

Section 5.1


Sheet 5.1.HS1

Pressure Vessels [Including Columns]

Section 7

Diving

Section 8

Helicopter Crash

Sheet 8.F16

Competent Personnel Client Review/Acceptance of Procedures [see 8.F10 –F20]


8.


283

11.G3:

Human Error in Design

Introduction Human factors (HF) feature at all phases of the installation lifecycle from inception through to dismantling. From the outset, we are concerned about human error at the initial strategic and planning stages, and concept development, particularly the capture of requirements, and any potential mismatch between design and operational function. Consequently, there is more potential to eliminate hazards at the design phase than at any other time. The ALARP judgement is more favourable towards HF and usability changes during the design phase. 1.

Confirmation should be obtained that due consideration to sources of error, in the design of an installation or part of it, have been identified, and design procedures are in place to minimise the potential for human error at this stage in an installation’s lifecycle. Demonstration needs to be made that this is in accordance with a recognised standard or code of practice. Relevant Standards, ACOPS, Guidance [HSE and industry], and preliminary guidance [HSE research reports and internal guidance, to be formalised] are as follows: RR054 Mutual misconceptions between designers and operators of hazardous installations OTO 2000/086 operational safety of FPSOs - initial summary report [Applicable to FPSOs] OTH 443A and OTH 443B Drill floor design; a consideration of human factors [Applicable to drilling rigs] HSG 48 reducing error and influencing behaviour [Applicable to all forms of installation] Ergonomics resource pack HSE web site [Applicable to all forms of installation] HSE Manual handling toolkit [HSE research report in process of publication] OTO 2002/001 Slips, trips and falls from height offshore OTO 2001/053 Preventing the propagation of error and misplaced reliance on faulty systems - a guide to human error dependency

2.

Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of the approach can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re ‘sufficient particulars’ which should be included within the case. Additionally the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case needs consideration of the human element in the design of Safety Critical Elements [SCEs] Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACoP and guidance (L65). Assessment Principles for Offshore Safety Cases [APOSC]

4.

Specific Technical Issues:

284

Where contractualisation in design has occurred, reference needs to be made to the provision for knowledge management in the design. Demonstration needs to be made by the duty holder that a full requirements analysis has been conducted to preclude designoperation misconception. 5.

6.

7.



11.G6


11.G10


11.G11

Contractualisation: Communications and Competence


Vessel Impact

Sheet 2.G1


Section 5.1


Section 13

QRA


8.


285

11.G4:


Introduction Human error - and its minimisation - is crucial in the involvement of identification of major hazards, at the conceptual HAZOP/HAZID and preliminary risk assessment phases of the project. No matter how robust a methodology is, the greatest uncertainty at this stage is in the exercise of human judgement as to what constitutes a risk that is ALARP, or conversely a measure that is SFAIRP. We need to therefore assess carefully at the design phase to see that such human involvement is under the auspices of a robust safety management system that encompasses this phase of the installation lifecycle. 1.

Confirmation should be obtained that there is sufficient consideration given to ALARP/SFAIRP principles in the formulation of the case for safety. Relevant Standards, ACOPS, Guidance (HSE and industry), and Preliminary guidance (HSE research reports and internal guidance, to be formalised) are as follows: CRR 293/2000 A comparison of accident experience and QRA methodology OTH 458 Update of the UKCS risk study Reducing risks protecting people HSE

2.

Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to its adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 (including associated Schedules and guidance) Specifically: 12(1)(d) - see guidance paras 176 and 177 re. “sufficient particulars” which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case needs consideration of the human element in the design of Safety Critical Elements (SCE’s), and the net result demonstrated to show that the relevant statutory provisions have been, or will be, complied with Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance Assessment Principles for Offshore Safety Cases [APOSC]

4.

Specific Technical Issues: Consideration of sound technical judgement must be considered in conjunction with the appropriateness of risk analysis techniques. Independence and competence needs to be assured, of those proposing arguments on ALARP/SFAIRP. The human involvement and uncertainty associated with HAZOP/HAZID and risk assessment techniques (including QRA) needs to be assessed by considering how the safety management system controls these human processes at this stage of the lifecycle. This assessment focuses more on the management of the processes than the validity of the methods and algorithms, although both elements are inextricably linked.

5.



286

11.G10 6.

7.



Vessel Impact

Section 13

QRA


8.


287

11.G5:

Command, Control, Communication [C 3] and Decision Making

Introduction The effective performance of humans, and human interaction, under emergency conditions, is an assessment topic distinct from the physical arrangements [see Section 10] under such conditions. There is an interface with the Emergency Response Section [Section 10] in the element of procedures, but whereas physical arrangements are the domain of the EER section, OSD3.3, the human performance aspects reside with OSD3.6. With the separate, and overlapping interests so defined, we can say the following. 1.

Confirmation should be obtained that a clearly-defined structure of command and control for the operation of an installation is in place, and that there is a system of communication and unambiguous decision-making for both normal and emergency conditions, with ownership, and that these comply with recognised standards or codes of practice. Recognised standards/codes of practice would include: HSG 65 Successful health and safety management HSG 48 Reducing error and influencing behaviour OTO 1999/025 Safety implications of self-managed teams OTO 1996/003 Effective shift handover - a literature review RR 135 Health and safety responsibilities of company directors and management board members RR 044 The role of managerial leadership in determining workplace safety outcomes OTH 534 Human and organisational factors in offshore safety OTH 92 374 The selection and training of Offshore Installation Managers for crisis management OTO 1999/065 Effective supervisory safety leadership behaviours in the offshore oil and gas industry OTO 2001/053 Preventing the propagation of errors and misplaced reliance on faulty systems - a guide to human error dependency

2.

Where a standard/code of practice other than that listed above has been employed, judgement as to its adequacy of systems in place can only be assessed on an individual basis, and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re ‘sufficient particulars’ which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case: need consideration of the human in the design of Safety Critical Elements [SCEs]; particularly where a C3 element is defined/declared as a SCE. Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65)

288

Assessment Principles for Offshore Safety Cases [APOSC] 4.

Specific Technical Issues: There are interfaces with sections that have responsibility for EER, marine, heliops and diving activity: these areas of interface between these crews, and the core installation crew, need to be identified and assessed for clarity, to ensure no potential hazard from either duplication/commission or omission. Inspection links: Compliance [Regulation 16]; PFEER assessment of C3 SCEs.

5.

6.

7.



11.G2


11.G4


11.G6


11.G7

Permit to Work Systems

11.G8

Employee Involvement

11.G9

Organisational Change Management

11.G10


11.G11



Vessel Impact

Sheet 2.G1


Section 5.1


Section 7

Diving

Section 8

Helicopter Crash


8.


289

11.G6:


Introduction The presence of a robust structure of procedures for the key activities in the installation’s lifecycle must be able to be demonstrated by the duty holder. These must be within an overarching safety management system, but - in their own right - must be suitable and sufficient for purpose. PTW is of sufficient magnitude to warrant its own assessment sheet [11.G7] as are HAZOP/HAZID/RA procedures [11.G4], but all other procedural types may be dealt with in this sheet. Key amongst these are procedures for the identification of safety critical tasks and roles [complementary to the assessment of individuals in these tasks/roles [11.G1]. We also need to assess to see that there is a means of formal procedural reviews, and periodic task re-analysis. 1.

Confirmation should therefore be obtained that clearly defined operational procedures are in place for all activity associated with the lifecycle of the installation, and that these comply with recognised standards or codes of practice. Recognised standards/codes of practice would include: JWP/FRD/167 Formal Procedural and Task Analysis review STEP guide to task-based risk assessment HSG 48 Reducing Error and Influencing Behaviour

2.

Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of systems in place can only be assessed on an individual basis, and the duty holder should be required to justify why its systems will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulations 12(1)(a) - management systems and 12(1)(b) - audit Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC]

4.

Specific Technical Issues: Diving procedural integrity is deferred to the Diving Specialist Section. HAZID/HAZOP/RA/QRA [11.G4] and PTW [11.G7] are dealt with as separate assessment topics.

5.

6.



11.G3


11.G7

Permit to Work systems


Vessel Impact

290

7.

Section 5.1


Section 8

Helicopter Crash


8.


291

11.G7:


Introduction Although a sub-set of the procedural assessment element within Human Factors, this is so major as to be a topic in its own right, particularly given that failure of permit to work [PTW] procedure has been a key causal factor in the major offshore accidents and incidents. 1.

Confirmation should be obtained that clearly defined permit to work procedures are in place for all activities on the installation, and that these comply with a recognised standard or code of practice. Recognised standards/codes of practice would include: OIAC Permit to work guidance HSG 65 Successful Health and Safety Management HSG 48 Reducing Error and Influencing Behaviour

2.

Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of the system in place can only be assessed on an individual basis, and the duty holder should be required to justify why its system will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re ‘sufficient particulars’ which should be included within the case. Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC]

4.

Specific Technical Issues: The issue is considered in an offshore context. Although standards exist for the onshore activity, deference should be made to the industry-supported offshore consensus guidance. Procedural integrity - in a wider context - is dealt with as a separate assessment topic [11.G6].

5.

6.



11.G2


11.G6


11.G8


11.G9


11.G11



Vessel Impact

292

7.

Section 5.1


Sheet 5.1.F23

Isolations

Section 7

Diving


8.


293

11.G8:


Introduction The engagement and involvement of the workforce of an offshore installation is essential for the operation of a health, safety and risk management system. The employees, whether in the direct employment of the duty holder, or indirectly employed by a contractor, are a key stakeholder in the offshore safety regime, who have responsibilities as well as rights under the general duty of care of the operator. The quality of employee involvement is a measure of the safety culture of a duty holder, or a specific installation, and provides a general indicator of the effectiveness of the management system in relation to an installation or its duty holder. The safety case should provide sufficient information in relation to how this involvement is implemented under the management system, such that rights, responsibilities, overall framework of health, safety and risk management is communicated to the workforce; and that issues may be communicated from workforce to management in an open and constructive manner. 1.

Confirmation should be obtained that the safety case makes a full description of the modes and methods of employee involvement: directly; via safety representatives; via trade-union representatives, and with contractor organisations via their appropriate nominated individuals. Recognised standards/codes of practice would include: CRR 1996 121 Health Surveillance in Great Britain OTO 1999/025 Safety implications of self-managed teams CRR 2000/259 The effects of new ways of working on employees’ stress levels CRR 2000/273 Valuation of benefits of health and safety control: summary and technical report CRR 2001/393 Effective teamworking: reducing the psychosocial risks RR 042 Evaluating the effectiveness of the Health and Safety Executive’s Health and Safety Climate Survey Tool RR 044 The tole of managerial leadership in determining workplace safety outcomes

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the arrangements can only be assessed on an individual basis, and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACoP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 including associated schedules and guidance Assessment Principals for Offshore Safety Cases [APOSC]

4.

Specific Technical Issues: Evidence of compliance with the following specific statutory requirements should be provided within the safety case: (i) Management of Health and Safety at Work Regulations 1999: •

reg. 2 (risk assessment);

294

•

reg. 6 (health surveillance);

•

reg. 7 (competent persons);

•

reg. 8 (employee procedures);

•

reg. 10 (information);

•

reg. 11 (cooperation and coordination);

•

reg. 12 (self-employed “employees”);

•

reg. 13 (assessment and training);

•

reg. 14 (employees duties);

•

reg. 15 (temporary workers):

(ii) Provision and Use of Work Equipment Regulations 1998: •

reg. 8 (information and instructions

•

reg. 9 (training):

(iii) Health and Safety at work etc. Act 1974: •

reg. 7 (duties on employees);

with particular emphasis on the employee involvement in the implementation of these specific conditions. 5.

6.


Command, Control, Communications [C3] and Decision Making

11.G7


11.G9


11.G10


11.G11


11.G12

Multi Skilling/Multi Tasking


7.


8.


295

11.G9:


Introduction This topic warrants a sheet in its own right, as it is applicable to Regulation 14 and 15 revisions to safety cases specifically. Transitional arrangements are of specific interest, in addition to the endconditions resulting from the completed change, and we need to be satisfied that adequate [and timely] arrangements are put in place by the duty holder. 1.

Confirmation should be obtained that a procedure is in place for the management of change in relation to an installation, and that this is in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: RR 107 Development of internal company standards of good management practice and task-based risk-assessment tool for offshore work-related stress HSG 48 Reducing Error and Influencing Behaviour HSG 65 Successful Health and Safety Management OTO 2002/016 Framework for assessing HF capability

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of arrangements can only be assessed on an individual basis, and the duty holder should be required to demonstrate that no significant increase in risk will arise during the transitional period, or upon its completion.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance para 177(a) re ‘sufficient particulars’ which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case needs consideration of the human element on any impact on the SCE. Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACoP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC]

4.

Specific Technical Issues: This topic is treated separate to, [but in conjunction with], SMS. This is because it is applicable to 14(2) where organisational change may be deemed to be a material change to the original safety case. Of particular importance are the transitional arrangements, particularly in instances of downmanning, to ensure the continued integrity of maintenance and safe operation procedures. It is incumbent upon the duty holder to make a convincing demonstration that adequate transitional provision has been made for such, and that security provisions [eg to prevent sabotage] are in place to ensure safe operation of the installation. Inspection links: Compliance [Regulation 16].

5.



11.G2


296

6.

7.

11.G5

Command, Control, Communications [C3] and Decision Making

11.G11



Vessel Impact

Section 5.1


Sheet 5.1.F23

Isolations


8.


297

11.G10:


Introduction Assessment should be made to ensure that, along with a robust structure of procedures, design, operational and historic data associated with hazard/risk assessment is retained, along with maintenance and equipment failure records. Such data can, in certain cases, drive change/improvement in the installations design, equipment and/or operation. Hitherto, this assessment sheet has not squarely resided within any of the topic sections, but since human factors deals with procedural and SMS integrity, it is perhaps most applicable for assessment by OSD3.6. 1.

Confirmation should be obtained that a procedure is in place for the management and retention of design, operational, risk and historic knowledge and data in relation to an installation, and that this is in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: RR173 The development of a knowledge-based system to develop information to designers RR128 The safety implications for offshore maintenance of using proprietary management/scheduling software RR011 Preliminary assessment of Linux for safety related systems RR012 Dealing with differences in expert opinion

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of arrangements can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance para 177(a) re ‘sufficient particulars’ which should be included within the case. Also Schedule 7: verification particulars; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case: need consideration of the human element on any impact on the SCE. Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC]

4.

Specific Technical Issues: There is a particular interface with the assessment of maintenance, as such plant and historic data informs maintenance scheduling arrangements. Inspection links: Compliance [Regulation 16].

5.


6.


298

7.

Section 2

Vessel Impact

Section 5.1



8.


299

11.G11:


Introduction This topic is of sufficient prominence to warrant an assessment sheet in its own right. The management of contractors, and the issues of ownership, responsibility, independence and competence are issues of concern in a heavily contractualised industry, where responsibility is sub-contracted along with work-packages. Assessment of both procedures and cultural aspects of contractualisation needs to be carefully undertaken, in order to gain assurance that risk is controlled offshore. 1.

Confirmation should be obtained that a procedure is in place for the management and supervision of contractors by the duty holder, and that this procedure conforms with a recognised standard or code of practice. Recognised standards/codes of practice would include: HSG 48 Reducing Errors and Influencing Behaviours HSG 65 Successful Health and Safety Management HSE/OIAC Guidance on Contractor Management STEP Guide to Interfacing SMS OTO 1999/065 Effective supervisory safety leadership behaviours in offshore oil and gas industry

2.

Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the arrangements can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and guidance (L30). Specifically: Regulation 12(1)(a) - SMS; the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case: need consideration of the human element on any impact on the SCE, particularly where examination/verification is performed by contractor Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC]

4.

Specific Technical Issues: Where specific roles require an individual from the duty holder side to be ‘independent’, as in the case of SCE verification, then evidence has to be provided to support this, and how this independence can be afforded in the contractor situation. In addition, the duty holder must demonstrate that its management of, and communication with contractors is procedurally defined, along with training, responsibility and plant proprietary responsibility [eg crane operations]. Inspection links: Compliance [Regulation 16].

5.


300

6.

7.

11.G8


11.G9


11.G10




Section 7

Diving

Sheet 7.F4-F9

Risk Management Measures [Inherent Safety]


8.


301

11.G12:

Multi Skilling/Multi Tasking

Introduction This assessment sheet is closely linked to 11.G1 on competence/training etc, but is subtly different and does require to be a separate assessment sheet. It is similarly related to stressinduced human error, [11.G2], but also does not fit squarely within this sheet either. In brief, it is an increasing trend offshore, and has its own procedural requirements and failure modes. Assessment is therefore required of operational safety cases in this specific respect. The duty holder should give some description within its management arrangements as to how it will control this particular mode of work amongst the installation crew. 1.

Confirmation should be obtained that the safety case makes a description of, and takes due account of both multi-skilling and multi-tasking, and any potential impact on human reliability. Any justification given should take due account of a recognised standard or code of practice. Recognised standards/codes of practice would include: OIAC Guide to multi skilling HSG 48 Reducing Error and Influencing Behaviour RR 086 Competence Assessment for the Hazardous Industries CRR 2001/348 Assessing the Safety of Staffing Arrangements for Process Operations in the Chemical and Allied Industries OTO 1999/025 Safety Implications of Self Managed Teams

2.

Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of the arrangements can only be assessed on an individual basis, and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and guidance (L30). Specifically: Regulation 12(1)(a) - SMS Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACoP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC]

4.

Specific Technical Issues: The duty holder needs to specify the limits it will apply to the extent of multi-skilling/tasking amongst its workforce to demonstrate that it will not be in a position where one individual’s reliability will be compromised by overloading. It must be stressed that we are concerned with the safety effects of human failure, rather than any chronic health effects, which are the domain of the Occupational Health Specialist Section. In addition, where specific roles require an individual from the duty holder side to be ‘independent’, then evidence has to be provided to support this, particularly in a multitasking situation. Inspection links: Compliance [Regulation 16]; PFEER assessment of SCEs.

5.


302

6.

11.G1


11.G2


11.G9


11.G11



7.


8.


303

12. HUMAN VULNERABILITY 1.

Scope This Section provides guidance for the assessment of safety case content with respect to the establishment of appropriate criteria for human vulnerability in the event of exposure to major accident hazards offshore.

2.

Assessment of Adequacy of Demonstration The evaluation of individual risk of harm that may result from an individual’s exposure to each major accident hazard is to be assessed by establishing the level of harm [dose] required to produce or prevent a specified effect [ie impairment of emergency functions, escape or death] from each major accident hazard scenario identified. This is expected to include direct effects, accumulation of hazards and escalation of a major accident. Human vulnerability criteria for the following should be addressed in the safety case: •

Blast overpressure

•

Thermal radiation

•

Elevated temperature and thermal stress

•

Hydrocarbon combustion products

•

Oxygen depletion

•

Non-hydrocarbon combustion or decomposition products

•

Release of toxic gas

•

Noise

•

Impact

•

Cold water immersion

•

Combined effects

The assessor should examine the adequacy of the human vulnerability criteria. 3.

Depth of Assessment Confirmation should be obtained that the human vulnerability criteria has been determined against accepted standards and applied in accordance with recognised Co des of Practice. Recognised standards, criteria and methods of application are detailed in SPC/Tech/OSD/tba Indicative Human Vulnerability to the Hazardous Agents Present Offshore for Application in Risk Assessment of Major Accidents. Where a vulnerability criterion and method of application other than those listed above have been employed, judgement as to the adequacy of the vulnerability modelling can only be assessed on an individual basis, and the duty holder should be required to just ify why its procedures or practices in the relevant areas will deliver an equivalent level of health and safety performance.

4.


304

None 5.


6.


305

13. QUANTITATIVE RISK ASSESSMENT [QRA] 1.

There are no standards for carrying out QRA, but the following are recognised as useful sources of guidance. Publication 99/100 CMPT (Centre for Marine and Petroleum Technology) (1999) A Guide to Quantitative Risk Assessment for Offshore Installations, J Spouge (Ed) UKOOA Guidelines for Fire and Explosion Hazard Management Issue 1, 1995 API 14J (RP14J) (1993) Recommended Practice for Design and Hazards Analysis for Offshore Production Facilities

2.

Where guidance other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.

3.

Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2004 Fire and Explosion Strategy, HSE website 2003 Use of Risk Assessment in the Offshore Industry (currently being developed for HSE)

4.


5.


6.


7.

Lead Assessment Section for this Sheet: OSD 3.2

8.

Team responsible for authoring and updating this sheet: OSD 3.2

306

14. GLOSSARY OF ABBREVIATIONS ABS

American Bureau of Shipping

ACOP

Approved Code of Practice

ALARP

As Low As Reasonably Practicable

API

American Petroleum Institute

APOSC

Assessment Principles for Offshore Safety Cases

ASME

American Society of Marine Engineers

BV

Bureau Veritas

CAA

Civil Aviation Authority

CBA

Cost Benefit Analysis

CCTV

Closed circuit television

CFD

Computational Fluid Dynamics

CIA

Chemical Industries Association

CMPT

Centre for Marine and Petroleum Technology

COGENT

Sector Skills Council for the Oil and Gas Extraction, Chemical Manufacturing and Petroleum Industries

DCM

Deputy Case Manager

DCR

Offshore Installations and Wells (Design and Construction, etc) Regulations 1996

DnV

Det Norske Veritas

DP

Dynamic Positioning

DWR

Diving at Work Regulations 1997

E & P Forum

The Oil Industry International Association Exploration and Production Forum

ECC

Emergency Control Centre

EEMUA

Engineering Equipment and Materials Users Association

EER

Escape, Evacuation and Rescue

ERP

Emergency Response Plan

ESD

Emergency Shutdown

FMD

Flooded Member Detection

FMEA

Failure Modes and Effects Analysis

FMECA

Failure Modes Effects and Consequence Analysis

307

FPP

Floating Production Platform

FPSO

Floating Production, Storage and Offloading Vessel

FSU

Floating Storage Unit

HC

Hydrocarbon

Helo Ops

Helicopter Operations

HID

Hazardous Installations Directorate

HSE

Health and Safety Executive

IGN

Interim Guidance Notes

IMCA

International Marine Contractors Association

IMO

International Maritime Organisation

IP

Institute of Petroleum

IR

Individual Risk

ISO

International Standards Organisation

IVB

Independent Verifying Body

JIP

Joint Industry Project

LR

Lloyds Register

MHSWR

Management of Health and Safety at Work Regulations 1999

MOD

Ministry of Defence

MODU

Mobile Offshore Drilling Unit

MOU

Mobile Offshore Unit

MPI

Magnetic Particle Testing

MSC

Marine Safety Committee

NAI

Normally Attended Installation

NMD

Norwegian Maritime Directorate

NORSOK

Norwegian Standards Organisation

NUI

Normally Unmanned Installation

OGP

International Association of Oil & Gas Producers

OHMEC

Offshore Mechanical Handling Equipment Committee

ON

Operations Notice

OREDA

DNV Offshore Reliability Data Handbook

OSD

Offshore Division

OTO

Offshore Technology Report

308

Hse Offshore Guide

Recommend Documents