IOG Element1

NEBOSH International Technical Certificate in Oil & Gas Operational Safety (Element 1) Please be advised that the course material is regularly reviewed and updated on the eLearning platform. SHEilds would like to inform students downloading these printable notes and using these from which to study that we cannot ensure the accuracy subsequent to the date of printing. It is therefore important to access the eLearning environment regularly to ensure we can track your progress and to ensure you have the most up to date materials. Version 2.0 (16/03/2015)

SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 1

1.0 - Health, Safety and Environmental Management in Context. Element 1: Health, Safety and environmental management in context.

Specific intended learning outcomes: On completion of this element, candidates should be able to demonstrate an understanding and knowledge of familiar and unfamiliar situations in the oil & gas industry. In particular you should be able to: 1.0 - Explain the purpose of and procedures for investigating incidents and how lessons learnt can be used to improve Health & Safety in the oil & gas industry. 2.0 - Explain the hazards inherent in oil & gas arising from the extraction, storage and processing of raw materials and products. 3.0 - Outline risk management techniques used in the oil & gas industries. 4.0 - Explain the purpose and content of an organisation's documented evidence to provide a convincing and valid argument that a system is adequately safe in the oil & gas industries. Recommended tuition time: Recommended tuition time for this unit is not less than 12 hours. 1.1 - Learning from Incidents. The Oil and Gas Industry generally has a good safety record. Unfortunately from time to time, incidents occur. Sometimes, sadly, with catastrophic consequences in terms of loss of life, damage to assets and harm to the environment (for example: Piper Alpha, BP Deep Water Horizon, BP Texas City and Esso Longford). Learning from incidents is, therefore, a vital part of an effective accident prevention programme. In order to learn from incidents, we need to ensure an effective system is in place to investigate both incidents and near misses in order to determine the immediate and root causes so that proper action can be taken to prevent recurrence. There are many reasons for investigating accidents and incidents:      

To identify the immediate and root causes in order to prevent recurrence. To learn lessons and communicate these internally and across industry. To ultimately improve standards of health and safety. To enable safety management systems to be improved. To demonstrate concern to workforce. Legal and regulatory compliance. It is required by law.


Tel: +44(0)1482 806805 Page: 2

1.1 - Learning from Incidents.

Important Terminology. Accident: An unplanned, unwanted event that results in injury, ill health, damage to plant or equipment, or some other loss. Near Miss: An unplanned, unwanted event that had the potential to cause injury, ill health, damage to plant or equipment, or some other loss. Ill Health: A disease or medical condition that is attributable to a work activity (for example: dermatitis, as a result of exposure to petroleum products). 1.2 - Why Prevent Incidents? We want to prevent incidents for the following reasons:       

To prevent unwanted and unintended impacts on the safety or health of people. To prevent asset damage and financial losses for stake holders. To prevent negative impact on the environment. For legal and regulatory compliance. To maintain the 'license to operate' granted by the enforcing authority. To improve safety, reliability and effectiveness of operations. To maintain a good public reputation and relations.

Other than the employer, there may be other parties who wish to investigate the incident:     

The enforcement authority (HSE, OSHA, Environment Agency etc.). Insurance companies. The coroner (in the event of a death). Trade Unions. The press or investigative journalists (although they will not necessarily be allowed complete access). 1.3 - The Benefits of a High Quality Incident Investigation.

Incident investigations can lead to several direct benefits: 

An improvement of the management systems: If an accident has occurred, this may be the result of a management system failure. The accident investigation should look


Tel: +44(0)1482 806805 Page: 3

1.3 - The Benefits of a High Quality Incident Investigation.





into the effectiveness of management systems and make recommendations on improvements that can be made. Learning of important lessons:. When the failure has been identified, are there lessons that can be learnt and applied in other areas? These may be common technical issues shared by other departments or companies using similar plant, or management system failures that may be systemic across the organisation or industry. Improved safety performance: By correcting the safety failures that lead to incidents, ultimately there will be fewer incidents over the long term.

In turn these benefits will lead to other benefits such as improved productivity as a result of less downtime caused by incidents. They will result in increased uptime and reliability, and financial costs will be less as a result of less product damage, less absenteeism, less compensation paid to injured employees, less time wasted in accident investigations, fewer prosecutions and enforcement action etc. 1.4 - Incident Investigation. To learn from incidents we need to ensure an effective system is in place to investigate incidents and significant near misses to determine the root causes so that proper action can be taken to prevent recurrence. For the purposes of the exam you must be able to:     

Describe the basic steps in an incident investigation. Recognise and distinguish the quality of the investigation. Describe process for sharing of incident and near miss lessons learnt. Understand what the term 'root cause' means. Describe and communicate requirements for investigation of contractor incidents. 1.5 - Buncefield Video: Learning from Incidents. Download Video

On December 10th 2005 there was a major explosion and fire at the Buncefield oil storage depot in the United Kingdom. It was the largest fire in the UK since the Second World War. The subsequent investigation identified a large number of immediate and root causes which helped, not just the organisations involved but the entire oil and gas industry, improve their technical control measures and management systems. The root causes identified included: 

Failures of management and contractors to repair a faulty level gauge.


Tel: +44(0)1482 806805 Page: 4

1.5 - Buncefield Video: Learning from Incidents.     

Inadequate design and maintenance of secondary and tertiary containment measures (i.e. the bund and catchment drains). The management systems related to tank filling were deficient and not properly followed. Insufficient control and information for staff to properly control the filling of the tanks. Excessive pressure placed on staff due to an increase in workload, resulting in their inability to manage the receipt and storage of fuel. The focus was on keeping the process operating and not on process safety. 1.6 - Management Involvement in Investigations.

Incident investigation guidelines and procedures are typically developed by senior management. However, first and second line supervisors and managers should play an active role in carrying out incident investigations. They are familiar with the work practices and have control over the area. In addition, they should ensure that the recommendations resulting from incident investigations are implemented as soon as possible. Without the cooperation and commitment of the line managers the investigation will be of poor quality and it is unlikely any real changes will be implemented or sustained. 1.7 - Incident Management Cycle.

Figure 1. Incident Management Cycle. The Incident Management Cycle is a simple way of understanding the order of actions which we carry out after an incident. 1. Imagine that an incident has occurred. BEFORE we tend to the casualty, we have to ensure the situation cannot get any worse. This is to ensure any rescuers or medical SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 5

1.7 - Incident Management Cycle. personnel are not put in a position of danger. By securing the site, we may be shutting down systems, processes, closing valves, isolating electricity etc. Securing the site might also include restricting access to people other than those prepared to deal with an emergency (e.g. trained personnel with specialist PPE and equipment). Once the site is safe and secure then we may rescue and attend to the casualty, providing any required first aid and medical treatment. 2. At this point we must begin to gather evidence and facts from the scene:     

Witnesses are identified and interviewed. Physical evidence is taken. Photographs of the scene are taken, possibly showing the position of objects as they were when the accident occurred. Measurements are made and recorded. Records are copied, possibly including printouts from the process logs and data.

3. The above evidence and facts are analysed and interpreted and the company draws its conclusions and takes any immediate action necessary to guarantee safety. 4. The incident must be reported to the relevant internal authorities such as the H&S Department. 5. Where applicable the incident should be reported to the relevant regulatory authorities such as the HSE or Environment Agency and also passed onto Senior Management. 6. The root cause learnings of the incidents should be shared internally so the organisation can learn the mistakes and take any opportunities to improve their own processes. 7. Any corrective actions should be implemented, with progress and their success reviewed regularly. 8. From a statistical point of view, the incident should be logged and added to the overall data to allow the analysis of trends. 1.8 - Basic Accident Investigation Process.

Which Incidents Should Be Investigated? ALL incidents should be investigated. The main reason for this is that, without an investigation and corrective action, the incident may reoccur. The effort put into the investigation, however, should be based on 'potential severity' rather than the actual severity. For example, it is just as important to investigate a process gas release (which SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 6

1.8 - Basic Accident Investigation Process. doesn't ignite, or result in injury) as it is to investigate a lost time or serious injury incident. Just because an incident did not result in significant harm or damage, does not mean that it should be ignored. Had the circumstances been slightly different, the actual severity may have been much higher. The UK HSE offers guidance on the basic accident investigation process (click on this link to read it in full: HSG 245: Investigating Accidents and Incidents). It recommends a 4 step approach: Step 1: Gather the information. Step 2: Analyse the information. Determine the Immediate and Root causes. Step 3: Identify suitable risk control measures. Step 4: Develop an action plan, and implement. However, before the Investigation can start, there are some basic emergency response actions that must be taken: 1. Render the area safe. 2. Ensure that first aid treatment is given to any injured persons. Once these actions have been taken, a decision needs to be made regarding the type and level of investigation to be undertaken. As discussed above, in determining the level of investigation you must consider the worst potential consequences of the incident, NOT the actual outcome. (e.g. a scaffold collapse may not have caused any injuries, but had the potential to cause major or fatal injuries). A risk matrix is sometimes used for this purpose. See an example of a risk matrix here: http://www.hse.gov.uk/risk/images/risk-matrix.gif There are broadly two types of investigation: 



A simple investigation (for low potential incidents), normal undertaken by the relevant line supervisor. This will look into the circumstances of the event, and try to learn any lessons in order to prevent future occurrences. Usually the lessons learnt will only be shared locally, and corrective action will not require major investment. A higher level, more detailed investigation (where there was actual, or potential for, serious outcome). This will typically involve line supervisors or line managers, health and safety advisers and employee representatives, and will look for the immediate, underlying and root causes. The lessons learnt will usually be shared across the company, and possibly across the industry. The prevention of serious damage or casualties will often justify significant expenditure and effort.


Tel: +44(0)1482 806805 Page: 7

1.8 - Basic Accident Investigation Process. The following four sections are a text copy of the Four Steps to Incident Investigation animation. This is for the benefit of those students who are studying offline and cannot access the animation. You can skip the next four sections by using the buttons below. 1.9 - Basic Incident Investigation Process. Step 1: Gathering Information.

Step 1: Gathering the information. Some of the information required to conduct the investigation must be taken from the scene of the incident. The scene must be kept secure and undisturbed until the investigation team are satisfied that they have obtained all evidence and facts they need, including all photographs, sketches and measurements they may want to take. Other information may be gathered from other sources such as:           

Witness statements. Risk assessments. Permits to Work. Safe Systems of Work (e.g. Operating procedures). Maintenance records. Training records. Medical Records. Photographs, CCTV. Computer print outs. Log Book entries. Audits, inspection reports.

The information gathering process should ensure that: 

 

It explores all reasonable lines of enquiry and that the causes are not decided beforehand (i.e. the investigation team need to have an open mind and not be biased). It is carried out in a timely manner which means as soon as possible after the event. The investigation is structured, setting out clearly what is known, what is not known, and records the investigation.

Observational Techniques. The investigators will need to have good observational techniques so that they can identify what work practices are unsafe and need to be changed. For observation to be effective, they will need to have knowledge of the workplace and procedures, be open minded, and keep a record of observations. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 8

1.9 - Basic Incident Investigation Process. Step 1: Gathering Information. The observers should:   

Take time to observe the whole scene. Look everywhere (look above, look below, look behind, look inside). Be inquisitive and question employees to get their views and information on risks.

Interview Techniques. Interviewing witnesses is a key part of an investigation. However, if poor technique is used in the interview it can severely limit the usefulness of the information obtained. Good interview technique includes: 

    

Explaining the purpose of the interview, what will be done with the information, and that the ultimate goal is not to blame a person, but to identify the root causes of the incident and prevent further incidents. The interviewee may not reveal information if they believe you will blame or persecute one of their colleagues. Making sure your manner does not intimidate the witness or make them feel uncomfortable. Conduct the interview in familiar surroundings which are less intimidating. Encourage witnesses to cooperate by speaking openly, with their own words. Interviewing witnesses privately and separately to avoid them sharing their own accounts of the incident. Providing a summary of what the witness said so that they can ensure that everything has been understood correctly and that the interviewer has not misinterpreted their account.

Essentially, you are seeking to gather all the information relating to the Material, the Task, the Environment, the Personnel and the Management.


Tel: +44(0)1482 806805 Page: 9

1.9 - Basic Incident Investigation Process. Step 1: Gathering Information.

Figure 1. Accident Information. 1.10 - Basic Incident Investigation Process. Step 2: Analysing the Information. An analysis involves:   

Examining all the facts. Determining what happened. And why it happened.

All the detailed information gathered should be assembled and examined to identify what information is relevant and what information is missing. The information gathering and analysis are actually carried out at the same time. As the analysis progresses, further lines of enquiry requiring additional information will develop. New evidence raises further questions, which require further information gathering. The analysis should be conducted with employee or trade union health and safety representatives and other experts or specialists, as appropriate. This team approach can often be highly productive in enabling all the relevant causal factors to emerge. Those with expert knowledge or experience will have a different view point and will be able to ask questions that other team member will not think of. It is only by identifying all causes, and the root causes in particular, that you can learn from past failures and prevent future repetitions. There are many methods of analysing the information gathered in an investigation to find the immediate and root causes and it is for you to choose whichever method suits you best. One such analytical tool is the "Why" tree which we illustrate below. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 10

1.10 - Basic Incident Investigation Process. Step 2: Analysing the Information. It is important to understand the difference between Immediate, Underlying, and Root causes. Immediate causes are the unsafe acts and conditions that occurred at the time and place of the accident. These are the most obvious reasons why the incident occurred. For example: a missing blank caused flammable gas to escape, or overspeeding caused a road tanker to overturn. Underlying causes are the less obvious system or organisation reasons for the incident. Using the above examples: the manager of an installation was not aware that the blank was missing because he had not been informed by the previous shift, or the delivery schedule included an extra delivery that could not be reasonably be delivered that day, and therefore the driver was speeding. Root causes are much deeper and rooted in problems within management, planning, and organisational culture. These root causes lead to the situations, events and behaviours that lead to the incident occurring. These are the true cause of the incident. Again using the two examples above, production pressures may have caused supervisors to take shortcuts in the permit to work system, resulting in gas being pumped into a pipe without a blank fitted. Similarly, poor scheduling or pay policies may encourage a driver to speed.

A common definition for a root cause is "the most basic cause (or causes) that can reasonably be identified that management has control to fix and, when fixed, will prevent (or significantly reduce the likelihood of) the problem's recurrence." How Do we Identify the True Root Cause? As we said above, there is a variety of different methods to identify Root Causes but one of the easiest and most common methods is called the '5 Whys' approach, commonly known as a 'Why Tree'. It does require experience and common sense to be used effectively and get to the true root cause. As a general rule if you identify that an individual person is at fault, then you have not reached the true root cause. Let us summarise the above examples, and hopefully you will understand the difference between the immediate, underlying, and root causes.

Missing Blank. 1. Top event: An explosion occurred. Why? 2. Immediate cause: Because flammable gas was pumped into a pipe with a SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 11

1.10 - Basic Incident Investigation Process. Step 2: Analysing the Information.

missing blank, allowing it to escape and reach an ignition source. Why? 3. Underlying cause: Because the control room operator was not aware the blank had been removed. Why? 4. Underlying cause: Because this information was on an open permit to work and this had not been communicated at shift handover. Why? 5. Root cause: Production pressures are leading to control room staff taking shortcuts in the permit to work and handover procedures, resulting in poor communication.

Overturned Road Tanker. 1. Top event: A road tanker overturns while going around a sharp bend. 2. 3. 4.

5.

Why? Immediate cause: The road tanker was travelling too fast. Why? Underlying cause: The road tanker driver felt under pressure to deliver his load on time. Why? Underlying cause: The delivery schedule added in an extra delivery at the last minute which cannot be delivered without taking shortcuts or speeding. Why? Root cause: There are problems in scheduling and priority is given to ontime deliveries instead of road safety.


Tel: +44(0)1482 806805 Page: 12

1.10 - Basic Incident Investigation Process. Step 2: Analysing the Information.

Figure 1. Example of a 'Why Tree'. 1.11 - 'Why Tree' Example.


Tel: +44(0)1482 806805 Page: 13

1.11 - 'Why Tree' Example.

Figure 1. Another 'Why Tree' example. By asking why during the investigation process, the investigation team can build up a clear picture of where the failures occurred. 1.12 - Basic Incident Investigation Process. Step 3: Identifying Suitable Risk Control Measures. The analysis will have identified a number of risk control measures that either failed or that could have interrupted the chain of events leading to the accident or incident, if they had been in place. You should now draw up a list of all the alternative measures to prevent this, or similar, adverse events. Some of these measures will be more difficult to implement than others (for example: those which correct root causes, which reflect management system failures), but this must not influence their listing as possible risk control measures. The time to consider these limitations is later when choosing and prioritising which measures to implement. Evaluate each of the possible risk control measures on the basis of their ability to prevent recurrences and whether or not they can be successfully implemented. In deciding which risk control measures to recommend and their priority, you should SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 14

1.12 - Basic Incident Investigation Process. Step 3: Identifying Suitable Risk Control Measures. choose measures in the following order, where possible: 1. Measures which eliminate the risk (e.g. use 'inherently safe' solutions such as a water-based product rather than a hydrocarbon-based solvent). 2. Measures which combat the risk at source via engineering or physical solutions (e.g. provision of guarding). 3. Measures which minimise the risk by relying on human behaviour (e.g. safe working procedures, the use of personal protective equipment and training). In general terms, measures that rely on engineering risk control measures are more reliable than those that rely on people. The above priorities are a philosophy loosely called the 'hierarchy of control'. 1.13 - Basic Incident Investigation Process. Step 4: The Action Plan and its Implementation. At this stage in the investigation senior management, who have the authority to make decisions and act on the recommendations of the investigation team, should be involved. An action plan for the implementation of additional or improved risk control measures is the desired outcome of a thorough investigation. The action plan should have 'SMART' objectives (i.e. Specific, Measurable, Agreed, and Realistic, with Timescales). Risk control measures will be implemented according to priority. In deciding your priorities you should be guided by the magnitude of the risk. Ask yourself 'What is essential to securing the health and safety of the workforce today? What cannot be left until another day? How high is the risk to employees if this risk control measure is not implemented immediately?' If the risk is high, you should act immediately. Risk control improvements will, no doubt, be subject to financial constraints. But failing to put in place measures to control serious and imminent risks is totally unacceptable. You must either reduce the risks to an acceptable level, or stop the work. For those risks that are not high and immediate, the risk control measures should be put into your action plan in order of priority. Each risk control measure should be assigned a timescale and a person made responsible for its implementation. Progress on the action plan should be regularly reviewed. Any significant departures from the plan should be explained and risk control measures rescheduled, if appropriate. Employees and their representatives should be kept fully informed of the contents of the risk control action plan and progress with its implementation. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 15

1.13 - Basic Incident Investigation Process. Step 4: The Action Plan and its Implementation.

Figure 1. Example of a blank safety action plan document. 1.14 - Types of Causes or Failures. We can categorise most causes of incidents as the following types of failure:   

Management or system failures. Cultural failures. Technical or process failures.

Management or System Failures. These can include: 

Lack of commitment by management to safety.


Tel: +44(0)1482 806805 Page: 16

1.14 - Types of Causes or Failures.      

Lack of supervision. Inadequate resources provided (manpower, financial, equipment etc.). Failure to risk assess. Mixed messages (actions and behaviour contradict verbal commitment to safety). Lack of procedures, or procedures not implemented, maintained or followed. Equipment not maintained adequately due to lack of time, resources or management oversight.

Cultural Failures. These include causes rooted in the organisation's safety culture. Safety Culture can be defined as: "The product of individual and group values, attitudes, perceptions, competencies, and patterns of behaviour that determine the commitment to, and the style and proficiency of, an organisation's health and safety management".     

Lack of safe working practices tolerated and condoned by all. Previous near-misses not reported as not seen as important. Blame culture. Poor communication or working relationships between departments or between client and contractors. Complacency amongst workforce.

Technical or Process Failures. These include any equipment malfunction, for example:      

Emergency shutdown devices do not activate. Gas detectors fail to detect the gas. Blowout preventer buckles under pressure. Automatic fire doors fail to close. Pressure relief valve fails. Overfill alarms do not send signal to control room. 1.15 - Learning the Lessons.

The lessons learned from incidents all contribute to the growing knowledge and experience of the individuals, organisation, and industry, and this can help in avoiding repetition of such events. This is because the consequences of accidents in the oil and gas industry can be particularly catastrophic causing many fatalities (for example, Bhopal and Piper Alpha), massive damage (for example, Buncefield), and major pollution (for example, Deepwater SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 17

1.15 - Learning the Lessons. Horizon). You will learn more about the above incidents in Element 2 of this course.

Figure 1. The enormous size of the Deepwater Horizon spill in the Gulf of Mexico. Acquiring knowledge and experience from incidents should be a structured process, whether it is a minor or major incident. It is important that lessons learned come from a basic understanding of the root causes to develop a safety culture and systems that are capable of avoiding major catastrophes. Learning lessons from an incident can benefit two main areas: 



Local and organisational learning i.e. the people directly involved, and others employed in the organisation who may use similar equipment and operate similar processes or systems. Wider learning, for example across industry, professions, and amongst regulators. 1.16 - Learning Lessons Locally.

At the end of the investigation there needs to be a communication of the conclusions arrived at from all of the information gathered and analysed. This includes the root causes, underlying causes, and the recommendations to remedy these. It is important to communicate these in such a way that it is understood by everyone, in a format that is appropriate to the audience and hierarchical level. Sharing information across teams and departments can result in local improvements and changes to practices. It can also SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 18

1.16 - Learning Lessons Locally. communicate lessons which can change attitudes and perceptions. For particularly large organisations it can be difficult to decide what lessons are relevant to share within our teams. Therefore sharing information should be a structured process where each department decides if the information is relevant and how to communicate it. Below is an example of a assessment process.

Figure 1. Incident Information Assessment Process. 1.17 - Learning Lessons More Widely. Lessons learnt within one organisation can be disseminated widely throughout other organisations by the publication of information in trade or specialised journals or publications, or through websites. This allows professionals in other organisations to take those lessons and present them to their colleagues and managers. One of the major lessons that the oil and gas industry has had to learn over the past 20 years is that they need to make sure they do not focus on general health and safety at the expense of process safety which is capable of causing major incidents. Regulators and enforcing authorities are also capable of learning lessons. One of the root causes of some major oil and gas disasters has been poor or ineffective regulation and oversight. This has led to the development of safety case and safety report legislation in some countries (we will learn more about this later in this Element). SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 19

Quiz - Incident Management Cycle. Please drag the elements of the 'Incident Management Cycle' to their corresponding areas.


Tel: +44(0)1482 806805 Page: 20

Question 1. Which of these parties may take part in an accident investigation? Question 2. Put the steps of accident investigation into the correct order. Question 3. Is this the correct definition of a 'root cause'? "The most basic cause (or

causes) that can reasonably be identified that management has control to fix and, when fixed, will prevent (or significantly reduce the likelihood of) the problem's recurrence". 1.18 - Example Exam Questions on Learning from Incidents. Here is a selection of past exam questions on learning from incidents. There is no guarantee that these questions will ever be asked again, but these will give you a good idea of the types of questions you could be asked. 1. Many major oil and gas incidents have occurred in recent years, e.g. Piper Alpha, Texas City, Mumbai High. (a) Outline reasons why such incidents should be investigated by employers. (4 marks available). (b) Identify parties, other than the employer, who may want to investigate these types of incident. (4 marks available). 2. Identify the information that might be included on a checklist for an investigation following an accident. (8 marks available). 1.19 - Summary. The learning outcome for this section was: 1.0 - Explain the purpose of and procedures for investigating incidents and how lessons learnt can be used to improve Health & Safety in the oil & gas industry. In summary we have learnt:  

Why investigating incidents is important. About the 4 Step process recommended by the HSE for investigating incidents:

1. Gather information. 2. Analyse information and determine immediate and root causes. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 21

1.19 - Summary. 3. Identify suitable risk control measures. 4. Develop an action plan and implement.    

The information and techniques required for an effective investigation. The difference between immediate, underlying, and root causes. The difference between management, cultural, and technical failures. The importance of sharing lessons locally and more widely. 2.0 - Hazards Inherent in the Oil and Gas Industry.

The learning outcome for this section is: 2.0 - Explain the hazards inherent in oil & gas arising from the extraction, storage and processing of raw materials and products. In this section we will look at various hazardous definitions from the oil and gas industry so that you have a greater understanding of hazardous situations and hazardous conditions. In particular we will cover the following phenomena, along with a number of hazardous gases and substances.           

Flash Point. Vapour Density. Vapour Pressure. Flammable. Highly Flammable. Extremely Flammable. Toxicity. Skin Irritant. Carcinogenic Properties. Upper Flammable Limit. Lower Flammable Limit.


Tel: +44(0)1482 806805 Page: 22

2.0 - Hazards Inherent in the Oil and Gas Industry.

Figure 1. Photo of a platform fire. 2.1 - Flash Point. This is the lowest temperature at which the vapour above a volatile liquid forms a combustible mixture with air. At the flash point the application of a naked flame gives a momentary flash rather than sustained combustion, for which the temperature is too low. The flash point is an indication of how easy a chemical may burn. Liquids with low flash points pose the greatest danger because the flash point will be below the ambient temperature of most workplaces. The higher the flash point, the less likely it is to burn.

Figure 1. Example of a flammable warning symbol. 2.2 - Vapour Density. This defines the density of a vapour in relation to air. The vapours of flammable liquids can ignite if fire or sparks are present. The vapour density would indicate whether a vapour is denser (greater than one) or less dense (less than one) than air. The density has implications during storage and personnel safety. If a container can release a dense gas, its vapour could sink and, if flammable, collect until it is at a concentration sufficient for ignition. Even if not flammable, it could collect in the lower floor or level of a confined space and displace oxygen, possibly presenting an asphyxiation hazard to SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 23

2.2 - Vapour Density. individuals entering the lower part of that space. In summary, dense gases and vapours will sink, causing potential fire and asphyxiation hazards. Lighter gases and vapours will rise, dispersing quickly but also possibly accumulating at a higher level.

Figure 1. Illustration of CO2 gas sinking to a low level and extinguishing a candle. 2.3 - Vapour Pressure. The definition of vapour pressure is difficult to understand. It is the pressure of a vapour in thermodynamic equilibrium with its condensed phases in a closed system. All liquids and solids have a tendency to evaporate into a gaseous form, and all gases have a tendency to condense back to their liquid or solid form. This can be a difficult concept to grasp, so we will try to provide a better explanation. The boiling point of a liquid is the temperature at which the vapour pressure of the liquid equals the atmospheric pressure. To make it easier to understand, think of 'atmospheric pressure' as the air in the world pushing against a certain person or object. The vapour pressure is the pressure exerted by the gas (evaporated liquid) back against the SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 24

2.3 - Vapour Pressure. atmosphere. It is a battle of the two pressures. The liquid wants to evaporate and therefore exerts pressure against the atmosphere. The atmosphere exerts pressure back. If the vapour pressure is greater than the atmospheric pressure then the liquid will evaporate. If not, then little or no evaporation can occur. Exposure to higher temperatures increases the vapour pressure of a liquid. For example, water boils at 100°C at an atmospheric pressure of 1 atm (atm is short for atmosphere, one of the units for pressure). If the atmospheric pressure was lower than 1 atm, it would be easier for the water to boil and evaporate, because there would be less pressure for it to fight against. Therefore the boiling point would be lower, which means that water would boil at a temperature lower than 100°C (water would boil more easily). If the pressure was greater than 1 atm, then a higher temperature would be needed to boil the water, because the vapour would need to have a higher pressure to fight against the atmospheric pressure. This means that you would need to heat the water to a temperature greater than 100°C in order for it to boil. All liquids have an inherent vapour pressure at normal atmospheric pressure and temperature. Some are higher, some are lower. This means that the greater the vapour pressure, the easier it is for a liquid to evaporate. This is particularly relevant when the vapours are flammable or toxic, as a higher vapour pressure will increase the amount of evaporation of these hazardous liquids, resulting in increased fire risks. A substance with a high vapour pressure at normal temperatures is often referred to as 'volatile'. For example, LPG and LNG. Consideration also has to be given to mixtures of substances with different vapour pressures.


Tel: +44(0)1482 806805 Page: 25

2.3 - Vapour Pressure.

Figure 1. Drawing illustrating vapour pressure and the effect of mixing substances. 2.4 - Flammable. Flammable liquids are defined as those with a flashpoint below 55°C. In the United Kingdom, flammable liquids are categorised according to their level of flammability:   

Flammable liquids which have a flash point between 21°C and 55°C. Highly flammable liquids have a flash point below 21°C Extremely flammable liquids and gases have a flash point below 0°C and a boiling point below 35°C

At an international level there are differences in the definition of flammable liquids, with some variation in the defining temperatures. However, what remains the same is that the lower the flash point and boiling point, the more hazardous the flammable liquid. For example, in the United States, flammable liquids are defined as those with a flash point below 38°C. For exam purposes, you should remember the U.K. definition.


Tel: +44(0)1482 806805 Page: 26

2.4 - Flammable.

Figure 1. Flammable liquid burning. 2.5 - Flammable Limits.

The Fire Triangle. The fire triangle or combustion triangle is a simple model for understanding the necessary ingredients for most fires. The triangle illustrates the three elements a fire needs to ignite:   

Heat or energy in the form of a spark. Fuel. An oxidising agent (usually oxygen).

A fire naturally occurs when the elements are present and combined in the right mixture. This means that:  

There needs to be sufficient heat or energy to ignite the fuel. The mixture of oxygen and fuel has to be in the correct proportion to burn. There is a limit to how much or how little oxygen you can introduce into an atmosphere without extinguishing the fire.

These limits are called 'flammability limits'.


Tel: +44(0)1482 806805 Page: 27

2.5 - Flammable Limits.

Figure 1. The Fire Triangle.

Upper Flammability Limit. The upper flammable limit (UFL) gives the richest flammable mixture. Beyond this there is too much vapour and not enough air for ignition to take place. We also refer to upper explosive limits (UEL) where there is a possibility of an explosion.

Lower Flammability Limit. The lower flammable limit (LFL) describes the leanest mixture that still sustains a flame, i.e. the mixture with the smallest fraction of flammable gas. Below this there is too much air and not enough vapour for ignition to take place. We also refer to lower explosive limits (LEL) where there is a possibility of an explosion.


Tel: +44(0)1482 806805 Page: 28

2.5 - Flammable Limits.

Figure 2. Flammable limits illustrated. The risk of working in an atmosphere which is in between the lower and upper flammability limits is that an ignition source (such as a spark from a metal tool, or electrical equipment) can ignite the atmosphere causing an explosion and a fire. 2.6 - Toxicity. Toxicity is the degree to which a substance is able to damage an exposed organism. Toxicity can refer to the effect on a whole organism, such as an animal, bacterium, or plant, as well as the effect on a substructure of the organism, such as a cell or an organ ( the liver for example). There are generally three types of toxic entities: chemical, biological and physical. Toxicity can be measured by its effects on the target (organism, organ, tissue or cell). Because individuals typically have different levels of response to the same dose of a toxin, effects to the human body can vary in time and outcome. A central concept of toxicology is that effects are dose-dependent. Even water can lead to water intoxication when taken in too high a dose.


Tel: +44(0)1482 806805 Page: 29

2.6 - Toxicity.

Figure 1. Toxic hazard symbol. 2.7 - Skin Irritant. Irritation is a state of inflammation or painful reaction to an allergy or cell-lining damage. A stimulus or agent which induces the state of irritation is called an irritant. Irritants are typically thought of as chemical agents but mechanical (for example fibreglass), thermal (heat), and radioactive stimuli (for example ultraviolet light or ionising radiation) can also be irritants. Chronic irritation is a medical term signifying that afflictive health conditions have been present for a long time (chronic implies a low dose over a long period of time). There are many disorders that can cause chronic irritation. The majority involves the skin, eyes and lungs. In higher organisms, an allergic response may be the cause of irritation.


Tel: +44(0)1482 806805 Page: 30

2.7 - Skin Irritant. Figure 1. Hazard symbol for irritant substances. 2.8 - Carcinogenic Properties. A carcinogen is any substance, radionuclide or radiation, which is an agent directly involved in causing cancer. Several radioactive substances are considered carcinogens, but their carcinogenic activity is caused by the radiation which they emit (for example, gamma rays and alpha particles). Other common examples of carcinogens are inhaled asbestos, certain dioxins, and tobacco smoke. Cancer is a disease in which damaged cells do not undergo programmed cell death. Carcinogens may increase the risk of cancer by altering cellular metabolism or damaging DNA directly in cells, which interferes with biological processes, and induces uncontrolled, malignant division, ultimately leading to the formation of tumours.

Figure 1. Hazard symbol for carcinogens. 2.9 - Properties and Hazards of Gases: Hydrogen.

Figure 1. Hydrogen as represented on the periodic table. Hydrogen is a colourless, odourless, tasteless, flammable and non-toxic gas. It is the lightest of all gases.

Hazardous Properties

Risks

Hydrogen is flammable over a wide High risk of fire and explosion, even range of concentrations (LFL 4% - HFL with the smallest and largest of leaks. 75%). The ignition energy for hydrogen is Incredibly easy to ignite. very low. This means it can ignite even with very low energy sparks. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 31

2.9 - Properties and Hazards of Gases: Hydrogen. A single volume of liquid hydrogen This means that a hydrogen leak can expands to about 850 volumes of gas rapidly become a large flammable at standard temperature and pressure vapour cloud. when vaporised. Hydrogen is able to reduce the Metals can become brittle and break performance of some containment easily, causing loss of containment. and piping materials, such as carbon steel as a result of a phenomenon called 'hydrogen embrittlement' where hydrogen atoms diffuse into the metal. This diffusion of atoms also means it Tendency to leak easily and cause has a tendency to easily leak out of flammable atmospheres. vessels and pipes. Liquid hydrogen is extremely cold. Can cause frostbite and cold burns. The cold also contributes to metal embrittlement. If a hot metal is exposed to liquid hydrogen then it can suffer from thermal shock and fracture. Can be an asphyxiant in its pure, A build-up of hydrogen can asphyxiate oxygen free form. people. A hydrogen fire is extremely hot and If you cannot see it you may almost invisible. accidentally come into contact with it. Table 1. The hazardous properties and risks of Hydrogen. 2.10 - Properties and Hazards of Gases: Methane.

Figure 1. Chemical formula of methane. Methane is a naturally occurring, flammable gas that is colourless and odourless. Methane is the primary component of natural gas. 97% (by volume) of natural gas is methane. Methane comes from a number of different sources. Underground deposits of natural gas are the primary source of methane. Methane is also trapped in pockets near coal deposits. Methane can also be stored in liquid form. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 32

2.10 - Properties and Hazards of Gases: Methane.


Risks

Methane's flammability range is between LEL 5% and UEL 15%. Colourless and odourless. Cannot be seen or smelled. Displaces the surrounding oxygen. Methane reacts violently with oxidisers, halogens and halogen containing compounds. Leak from a refrigerated stored vessel is heavier than air. Methane at ambient temperature is lighter than air.

High risk of fire and explosion when in presence of oxygen. Difficult to detect by humans without detection equipment. Can be an asphyxiation risk. Can spontaneously ignite or explode if it comes into contact with incompatible materials. Leaks will initially create a pool of flammable liquid and gas. When the methane reaches ambient temperature it can form a flammable vapour cloud.

Table 1. The hazardous properties and risks of methane. 2.11 - Properties and Hazards of Gases: Liquid Petroleum Gas (LPG). Produced from petroleum, LPG is a mixture of gases (propane and butane). Its uses include fuel for cooking, heating and vehicles, and as a refrigerant. It is colourless and odourless, and has an odorising agent added for leak detection purposes.


Risks

Flammable between LEL 2% and UEL Can cause fire and explosions in the 10%. presence of oxygen, even at very low concentrations. Twice as heavy as air. Will sink to the lowest possible level and accumulate. This could be in basements, cellars, pits, drains, where it can find an ignition source. There is an obvious fire risk in underground confined space work. Extremely cold when stored under Can cause severe cold burns due to pressure. the low temperature and rapid vaporisation. It can also cool equipment to the point where touching the equipment can also cause cold burns. LPG is stored under pressure. On Can quickly create a flammable SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 33

2.11 - Properties and Hazards of Gases: Liquid Petroleum Gas (LPG). release it reverts to its gaseous state, the gas becoming about 250 times its stored liquid volume. Vapour and air mixtures arising from leakages travel some distance from the point of escape. At very high concentrations when mixed with air, vapour is an anaesthetic and subsequently an asphyxiant by diluting the available oxygen. Colourless and odourless (without the odorising additive).

vapour cloud.

When ignited the flame can travel back to the source of the leak. Asphyxiant risk.

Difficult for humans to see or smell, which is why an odorising additive is added. Empty LPG vessels usually contain Even empty vessels are a fire and some residual LPG vapours. explosion risk. Table 1. The hazardous properties and risks of LPG.

Figure 1. Warning sign for LPG. 2.12 - Properties and Hazards of Gases: Liquefied Natural Gas (LNG). LNG is liquefied natural gas. It originates from underground natural oil and gas reservoirs, SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 34

2.12 - Properties and Hazards of Gases: Liquefied Natural Gas (LNG). often discovered through drilling and exploration operations. LNG is principally used for transporting natural gas to markets, where it is regasified and distributed as pipeline natural gas.


Risks

Has a flammability range of LEL 5% to UEL 15%. The gas is a liquid because it is stored at very low temperature (-162C), at around atmospheric pressure. When released at its cold temperature will create a pool of liquid and gas.

Highly flammable and explosive in the correct air to gas ratio. Because of its temperature LNG can cause cold burns.

Can create a pool fire which is extremely difficult to extinguish. Usually this is left to burn until all of the fuel is burnt. Once it reaches ambient temperature Can create a flammable vapour cloud. the liquid rapidly expands to 600 times the volume of its liquid form. Table 1. The hazardous properties and risks of Liquified Natural Gas.

Figure 1. A LNG pool fire. 2.13 - Properties and Hazards of Gases: Nitrogen.


Tel: +44(0)1482 806805 Page: 35

2.13 - Properties and Hazards of Gases: Nitrogen. Figure 1. Nitrogen on the periodic table.

Nitrogen is a nontoxic, odourless, colourless, tasteless and non-flammable gas. 78% (by volume) of the air we breathe is nitrogen. Oxygen constitutes approximately 21% of the air. Nitrogen weighs approximately the same as air, therefore it does not tend to sink or rise. Its ability to displace oxygen in the air is the reason it is often used as an inerting gas to control flammability risks.


Risks

Will displace the oxygen in the air.

Will cause asphyxiation when the concentration of oxygen drops below 19.5%. Odourless, colourless, and tasteless. Difficult for humans to detect without the use of detection equipment. When stored under pressure nitrogen Contact with this liquid or the cold is an extremely cold liquid (-200oC). vapours can cause severe frostbite (it is used by the medical profession for destroying warts). When inhaled at high pressures it Has an anaesthetic effect on the body begins to act as an anaesthetic. and nervous system. For example, nitrogen narcosis when scuba-diving below 30m. Nitrogen dissolves in the bloodstream Rapid decompression of scuba-divers and body fats. can lead to decompression sickness and "the bends" where the nitrogen bubbles form inside the bodily tissues. Table 1. The hazardous properties and risks of nitrogen.


Tel: +44(0)1482 806805 Page: 36

2.13 - Properties and Hazards of Gases: Nitrogen.

Figure 2. A jar of liquid nitrogen evaporating. 2.14 - Properties and Hazards of Gases: Hydrogen Sulphide (H2S).

Figure 1. Hydrogen sulphide hazard symbol.

Found in crude oil and gas, hydrogen sulphide is considered a broad-spectrum poison, meaning that it can poison several different systems in the body, although the nervous system and respiratory systems are most affected. Besides being highly toxic, H2S is a flammable gas. It also causes irritation to the eyes, skin and mucous membranes. H2S is commonly found in natural gas, biogas, and LPG.


Tel: +44(0)1482 806805 Page: 37

2.14 - Properties and Hazards of Gases: Hydrogen Sulphide (H2S).


Risks

Has a flammability range of LEL 4.3% and UEL 46%. Highly toxic at extremely low concentrations.

Highly flammable and explosive in the correct fuel to air ratio. At concentrations of 800ppm 50% of people will die within 5 minutes of exposure. 1000ppm will cause instant collapse and loss of breathing, even with one single breath. It is heavier than air and hence tends Risk of death to anyone in a low-lying to accumulate in low-lying areas. space where H2S accumulates. Also a fire and explosion risk if it finds an ignition source. It has an extremely pungent odour Despite its odour, the corrosiveness (rotten eggs) and highly corrosive. will rapidly destroy the body's sense of smell. The corrosiveness can also make metals brittle. Therefore, employers need to take special precautions when choosing equipment if they may come into contact with H2S. Table 1. The hazardous properties and risks of Hydrogen Sulphide.

Figure 2. Workers working on plant containing H2S. 2.15 - Properties and Hazards of Gases: Oxygen.


Tel: +44(0)1482 806805 Page: 38

2.15 - Properties and Hazards of Gases: Oxygen.

Figure 1. Oxygen as represented on the periodic table.

The air we breathe contains about 21% oxygen (O2). Without oxygen we would die in a matter of minutes. However, oxygen can also be dangerous. The dangers are fire and explosion. Oxygen behaves differently to air, compressed air, nitrogen and other inert gases. It is very reactive. Pure oxygen, at high pressure, such as from a cylinder, can react violently with common materials such as oil and grease. Oxygen is not flammable. But other materials may catch fire spontaneously when in contact with pure oxygen. Nearly all materials including textiles, rubber and even metals will burn vigorously in oxygen enriched atmospheres. A small increase in the oxygen level in the air to 23% (oxygen enrichment) can create a dangerous situation. It becomes easier to start a fire, which will then burn hotter and more fiercely than in normal air. It may be almost impossible to put the fire out. A leaking valve or hose in a poorly ventilated room or confined space can quickly increase the oxygen concentration to a dangerous level (for example the HMS Glasgow incident in 1976).

Figure 2. Example of how oxygen helps a fire burn faster and hotter.


Tel: +44(0)1482 806805 Page: 39

2.15 - Properties and Hazards of Gases: Oxygen.

Hazardous Properties Highly reactive.

Stored under pressure and at low temperature. Pure oxygen can be toxic to inhale. Oxygen can also be toxic in high pressure atmospheres.

Risks Oxygen enriched atmospheres or pure oxygen can cause spontaneous burning of materials (particularly oils and greases). All fires will burn hotter and more fiercely in the presence of oxygen. Can cause cold burns. Disrupts the central nervous system and causes pulmonary difficulties. In particular scuba divers and people being treated in hyperbaric chambers are most at risk.

Table 1. The hazardous properties and risks of Oxygen.

2.16 - Properties, Hazards, and Control Measures of Additives: Antifoaming and AntiWetting Agents.

Antifoaming Agents: A defoamer or an antifoaming agent is a chemical additive that reduces and hinders the formation of foam in industrial process liquids. Generally a defoamer is insoluble in the foaming medium. An essential feature is a low viscosity and a facility to spread rapidly on foamy surfaces. It tends to float on the surface where it destabilises the foam. This causes the rupture of the air bubbles and the breakdown of surface foam. Foam (entrained and dissolved air that is present in coolants and processing liquids) may cause various kinds of problems, including:      

Reduction of pump efficiency (cavitation). Reduced capacity of pumps and storage tanks. Bacterial growth. Dirt flotation and deposit formation. Reduced effectiveness of the fluids in use. Eventual downtime for cleaning.


Tel: +44(0)1482 806805 Page: 40

2.16 - Properties, Hazards, and Control Measures of Additives: Antifoaming and AntiWetting Agents. Antifoaming agents may be oil, powder, water or silicone based.

Figure 1. Defoamer in action.

Anti-Wetting Agents: Water is often detrimental to materials when their surfaces become penetrated by moisture. Metal surfaces can corrode and wood degrades. Anti-wetting agents (for example, Teflon) place a waterproof barrier between the surface of the material and the water (for example, sea water and rain). Such coatings are said to be 'hydrophobic' (water repellent). Anti-wetting agents effectively offer good corrosion protection.


Tel: +44(0)1482 806805 Page: 41

2.16 - Properties, Hazards, and Control Measures of Additives: Antifoaming and AntiWetting Agents.

Figure 2. Example of 'phobic' coatings such as anti-wetting and self-cleaning.

Hazards and Controls. Antifoaming and anti-wetting agents are usually not hazardous. Prolonged exposure may cause some skin irritation so it is sensible to wash your hands carefully after use. The product's Material Safety Data Sheet will specify any particular hazards and the handling precautions. 2.17 - Properties, Hazards, and Control Measures of Micro-Biocides. Micro-biocides are used in the gas and oil industry to control the growth of bacteria and prevent the formation of harmful by-products of their growth (such as H2S). A biocide is a chemical substance or micro-organism. They can be added to protect materials (typically liquids) against biological infestation and growth. In refineries, for example, uses include the treatment of cooling water to remove and prevent spores, fungi, legionella bacteria, and to prevent bacterial slime which significantly reduces heat transfer in cooling systems, such as heat exchangers. As a general rule they tend to be irritants and toxic when ingested. The use of chlorine, for example, poses the risk of severe irritation of the skin, nose, throat and respiratory tract. To control exposure to micro-biocides they should be stored safely and precautions taken SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 42

2.17 - Properties, Hazards, and Control Measures of Micro-Biocides. to eliminate contact with the skin, eyes, and inhalation. These could include:     

Choosing a safer form of micro-biocide. For example, using a granular form instead of a powder or liquid. Using safe handling methods such as automatic dispensers. Adequate chemical resistant storage. Suitable PPE such as appropriate gloves, and if necessary goggles, apron, and respiratory protection. Procedures for dealing with spillages and releases.

Material Safety Data Sheets (MSDS) should be consulted for the specific hazards and control measures required for each type of biocide.

Figure 1. Example of chlorine cylinders stored securely. 2.18 - Properties, Hazards, and Control Measures of Corrosion Preventatives. Corrosion of metal in the presence of water is a common problem across many industries. The fact that most oil and gas production includes water and other corrosive substances makes corrosion a pervasive issue across the industry. These are additives which are used to delay or prevent the formation of corrosion within SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 43

2.18 - Properties, Hazards, and Control Measures of Corrosion Preventatives. vessels, pipelines and structures. These are often applied to the surfaces of metals, forming a film which displaces water and other liquids from cracks to block out their corrosive effect. Other products form a protective barrier to prevent liquids from coming into contact with the metal. The Material Safety Data Sheet (MSDS) should specify the relevant risk control measures. The products are often irritants, such as alkyl amine corrosion inhibitors which can cause severe skin, nose, throat and eye irritation. The controls will usually be similar as those for micro-biocides i.e. safe storage, handling, and appropriate PPE.

Cathodic Protection. Cathodic protection (CP) is another technique used to control the corrosion of a metal surface by making it the cathode of an electrochemical cell. The simplest method to apply CP is by connecting the metal to be protected with a piece of another more easily corroded 'sacrificial metal' to act as the anode of the electrochemical cell. The sacrificial metal then corrodes instead of the protected metal.

Figure 1. A sacrificial anode is bolted to the hull of a boat.


Tel: +44(0)1482 806805 Page: 44

2.18 - Properties, Hazards, and Control Measures of Corrosion Preventatives.

Figure 2. An underground pipe with cathodic protection. 2.19 - Properties, Hazards, and Control Measures of Refrigerants. A refrigerant is a substance used to provide cooling either as the working substance of a refrigerator or by direct absorption of heat. Common refrigerants include ammonia, sulphur dioxide, and propane. They are liquified gases, and present minimal risk when they are contained within their system. The risks increase when there is an escape or a release of the refrigerant. Health risks include flammability, toxicity and cold burns. At high levels they can cause Central Nervous System depression and cardiac arrest. Vapours displace air and can cause asphyxiation in confined spaces, particularly as the gases are heavier than air. As usual, the Material Safety Data Sheet will contain information on the hazards from exposure, toxicity, and exposure limits for the specific substance used. Generally speaking, the hazards and risks associated with refrigerants are:


Risks


Tel: +44(0)1482 806805 Page: 45

2.19 - Properties, Hazards, and Control Measures of Refrigerants. Will displace oxygen in the Can cause asphyxiation. atmosphere. May be flammable. Fire or explosion risk. Refrigerant gases are heavier than air. Will collect in the low available space, creating an asphyxiation and/or fire risk. Combustion byproducts can be toxic. If involved in a fire the byproducts can cause harm if inhaled. Stored under cryogenic pressure. Cold burns, particularly to skin and eyes if the worker comes into contact with the refrigerant. They have a high expansion rate when Can cause overpressure to vessels and they change from a liquid to a gas. piping, possibly causing rupture. In the event of a high pressure escape, workers can be injured from ejected material or components. Table 1. The hazardous properties and risks of refrigerants. The general control measures for controlling refrigerants include: 



  

Ensuring maintenance and inspection procedures are in place to ensure leaks and loss of containment do not occur, and that faults are repaired when they are identified. Having procedures in place to deal with unexpected release of refrigerants, such as emergency spillage procedures, recovery procedures, and equipment to contain the release. Confined Spaces precautions such as atmospheric testing before and during work, and not working in a confined space if there is a risk of refrigerant release. Having well ventilated areas and ventilation equipment to quickly dilute and disperse concentrations of refrigerant. Emergency procedures for evacuation if there is a large release, along with first aid measures such as moving victims to fresh air and providing oxygen as necessary. Medical assistance may be necessary. 2.20 - Properties, Hazards, and Control Measures of Water and Steam.

Water exists in three states: liquid, solid (ice) and gas (steam). It is used extensively in the oil and gas industry processes.


Tel: +44(0)1482 806805 Page: 46

2.20 - Properties, Hazards, and Control Measures of Water and Steam. Uses include: Water:   

Cooling. Lubrication (drilling muds). Fire water source.

Steam:  

Power turbines to generate electrical power, to drive pumps, compressors, fans and other equipment. Heating source (control rooms, tank coils and trace heating).

Hot Water and Steam. Heated water produces steam. When released (intentionally or accidentally) it is generally under very high pressure and extremely high temperature. Steam most often refers to the visible white mist that condenses above boiling water as the hot vapour mixes with the cooler air. This mist consists of tiny droplets of liquid water. Pure steam emerges at the base of the spout of a steaming kettle where there is no visible vapour. Pure steam is a transparent gas. At standard temperature and pressure, pure steam (unmixed with air, but in equilibrium with liquid water) occupies about 1,600 times the volume of an equal mass of liquid water. Water and steam are used extensively in oil and gas processing. Hazards and control measures include: 







Burns from steam or hot water. The avoidance of contact is critical. Good maintenance procedures are required to ensure systems are in good condition to prevent leaks and releases. Valves will need to be isolated to prevent the flow of hot water and steam if work is to be carried out on the system. Corrosion of pipe work or equipment. This can lead to leaks and releases, or the failure of load-bearing metal structures. As discussed previously, protective coatings can be applied to steel components or sacrificial anodes can be fitted to provide cathodic protection. Water starvation leading to overheating of process equipment. This can be caused by blockages of cooling water, possibly caused by ice or hydrate formation (plugs of ice and hydrocarbons). Loss of water supply can also lead to overheating. High pressure injuries and amputation, especially from pressure jet cleaning. Safe systems of work need to be put in place, including exclusion of unnecessary


Tel: +44(0)1482 806805 Page: 47

2.20 - Properties, Hazards, and Control Measures of Water and Steam.



 







personnel, and safety features on the cleaning equipment (such as a dead man's switch). Water hammer from condensed water in steam systems. This is usually prevented by closely controlling the conditions within the system to minimise condensation, and regularly draining the water. Exothermic reaction when water reacts with volatile substances. This is prevented by controlling the process and strictly separating water from volatile substances. Legionella exposure, from poorly maintained cooling water systems. This is prevented by good temperature control, chemical disinfection, maintenance and testing for bacteria. Water must be regularly circulated to prevent it from stagnating, especially if it is in the 20°C to 45°C temperature range. Leptospira, which can be found in water which has its source in freshwater rivers or lakes. It can be transmitted to humans via broken skin or through the mucous membranes of the nose and eyes. Extreme cases can lead to Weil's Disease which can be fatal. Good personal hygiene is crucial. Stored under pressure, as in fire lines and steam water lines. An increase in pressure within pipework and other components can cause a sudden and catastrophic release. This may be caused by an increase in temperature (e.g. exposure to direct sunlight, or overheating). If steam is suddenly introduced to a cold pipe then it can cause thermal shock, leading to damage to the pipe due to the uneven expansion of the metal. Metal joints and flanges are especially vulnerable.

Figure 1. Diagram illustrating power generation from steam turbines.


Tel: +44(0)1482 806805 Page: 48

2.20 - Properties, Hazards, and Control Measures of Water and Steam.

Figure 2. Ultra high pressure jet cleaning.

Freezing Water and Ice. Water expands when it freezes, and this can result in the bursting of pipework and other components within the system. Under certain conditions plugs of ice can form and these can block pipes and pumps and prevent the closure of valves. In critical situations this can have catastrophic effects. An example of this is the Feyzin Disaster in France 1968. An operator was draining water from a pressurised propane tank when a hydrate plug formed in the drain valve. Consequently, he was unable to close the valve and a cloud of propane vapour escaped and exploded when it came into contact with a source of ignition. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 49

2.20 - Properties, Hazards, and Control Measures of Water and Steam. Controls to prevent this include:   

Lagging and insulating pipes which are at risk of being damaged by freezing water. Fitting steam or electric trace lines, which prevent the pipe from freezing. Draining unused components so they cannot freeze.

Figure 3. Example of pipe lagging.

Figure 4. Example of electrical trace heating.

Sea Water. Sea water contains living organisms which can multiply and cause blockages such as in filters and the heads of sprinkler systems. This can be avoided by regularly maintaining all parts of the system to keep them free of blocks, including using additives to kill any organisms which may be present. 2.21 - Properties, Hazards, and Control Measures of Mercaptans. Mercaptans are a group of sulphur-containing organic chemical substances. They smell like rotting cabbage. If mercaptans are in the air, even at low concentrations, SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 50

2.21 - Properties, Hazards, and Control Measures of Mercaptans. they are very noticeable. Pulp mills are the chief source of mercaptans. They are found in production process of petroleum products. They are also used as an odorising agent in natural gas (LNG). The human body produces them naturally during digestion of beer, garlic and some other foods. The vapours of some mercaptans, if inhaled, may cause headaches, nausea, dizziness, drowsiness and loss of consciousness. They may also be irritating to the eyes, respiratory system and skin. They can also be flammable. Where potentially harmful levels are present, suitable respiratory protection, gloves, eye protection and coveralls should be worn.

The Milan Incident. In 2004 near Milan, an empty mercaptan canister used by a natural gas distributor was being returned to a supplier for refilling. The canister sprang a leak while in transit at a road deliveries company in Sesto San Giovanni, a town just north of Milan, Italy. Gas was carried by winds across the eastern half of the city of Milan, causing residents as far as 12km from the canister to make thousands of calls that overwhelmed emergency services for four hours, and risked hiding actual gas leaks. 2.22 - Properties, Hazards, and Control Measures of Drilling Muds. Liquid drilling fluids are often called drilling 'muds'. This is because it often contains locally sourced clays and has a brown mud colour. However, it is not mud taken directly from the ground, it is a specially designed fluid. On a drilling rig, mud is pumped from the mud 'pits' (storage tanks for the liquids) through the drill string where it sprays out of nozzles on the drill bit, cleaning and cooling the drill bit in the process. The mud then carries the crushed or cut rock ('cuttings') up the annular space ('annulus') between the drill string and the sides of the hole being drilled, up through the surface casing, where it emerges back at the surface. Cuttings are then filtered out with either a 'shale shaker' or similar technology, and the mud returns to the mud pits. The mud pits let the drilled 'fines' (smaller particles) settle. The pits are also where the fluid is treated by adding chemicals and other substances. The returning mud can contain natural gases or other flammable materials which will collect in and around the shale shaker and conveyor area, or in other work areas. Because of the risk of a fire or an explosion if they ignite, special monitoring sensors and explosionproof certified equipment is commonly installed. The mud is then pumped back down the hole and further recirculated. After testing, the SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 51

2.22 - Properties, Hazards, and Control Measures of Drilling Muds. mud is treated periodically in the mud pits to ensure properties which optimise and improve drilling efficiency and borehole stability.

Figure 1. Diagram of the flow of drilling mud and cuttings.


Tel: +44(0)1482 806805 Page: 52

2.22 - Properties, Hazards, and Control Measures of Drilling Muds. Figure 2. Typical drilling fluid system.

The Functions of Drilling Muds.        

Control pressures within the wellbore. Maintain wellbore stability (i.e. line the walls of the hole). Keeping the drill bit cool, clean, and lubricate during drilling. Carrying out drill cuttings. Suspending the drill cuttings while drilling is paused and when the drilling assembly is brought in and out of the hole. Transmit hydraulic energy to the tools and bit. Control corrosion to an acceptable level. Facilitate the cementing and completion of the oil and gas well.

Types of drilling fluids include water based, oil based and synthetic. Water based mud is the most frequently used.

Water Based Mud. This is a combination of clay and other additives blended with water to make a thick fluid. The more additives in the water, the thicker the mud will be. The fluid is normally made from indigenous clays although some additives may be brought in from specialist suppliers. The additives alter the properties of the mud, making it more fluid and free-flowing when it is pumped into the system, and semi-solid when the pumping stops.

Oil Based Mud. These have oil, usually diesel oil, as their base fluid. The advantages oil based muds bring to the drilling process include:  

Increased lubrication of the drill shaft. Greater cleaning ability.

They allow for higher working temperatures to be used without adverse effects. However, due to the presence of oil there are environmental considerations to be taken into account.

Synthetic Based Mud. These muds have the properties of oil based muds but have the advantage of being less toxic as their base is made from synthetic oil. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 53

2.22 - Properties, Hazards, and Control Measures of Drilling Muds.

Hazards. The hazards and risks include:  

The possible presence of low-specific activity (LSA) scale and sludge (which we will study in the following section) which can expose workers to radiation. Chemical hazards which can affect workers depending on the route of exposure. o Skin contact: this usually affects the hands and arms. This can cause skin irritation and dermatitis. Regular exposure to diesel in oil based muds can be carcinogenic in the long-term. Workers should attempt to minimise manual handling of the chemicals, and wear personal protective equipment such as overalls and gloves. o Inhalation: muds can create vapours, aerosols, and emit dusts into the air. These are contaminated with chemicals, hydrocarbons, and possibly LSA substances. These can be neurotoxic and cause headaches, nausea, dizziness, fatigue, loss of coordination, problems with attention and memory, and narcosis. The presence of benzene in the diesel can be carcinogenic. o Ingestion: muds are rarely ingested, but are obviously toxic if swallowed. Good personal hygiene is essential. Workers should change clothing and wash before eating, drinking, or smoking.

Control Measures. Depending on the circumstances, control measures will include: 



Engineering measures: o Maintaining high levels of ventilation to keep airborne concentrations and exposures to an acceptable level. o Enclose the drilling fluid systems to reduce emissions into the air. o Use bulk handling systems to eliminate the need to handle the fluids manually. o Use of sensors inside the fluid tanks to monitor levels and carry out other measurements, instead of having to open the tank and visually inspect them. Administrative controls: o Work overalls and clothing should be cleaned regularly and thoroughly to remove all traces of drill mud contamination. Dirty clothing is a regular source of skin irritation. o Regular washing and moisturing of the skin. This will remove contaminants, and using skin moisturisers will keep the skin hydrated and healthy. The use of barrier creams can also provide a barrier between the skin and low level exposure to fluids. o Job rotation can reduce the exposure of workers to drilling muds by reducing


Tel: +44(0)1482 806805 Page: 54

2.22 - Properties, Hazards, and Control Measures of Drilling Muds.



the length of time they are exposed to the hazard. While this will expose more people, the overall exposures of each person will be much lower. o Health surveillance programmes are necessary to monitor the condition of employees' skin and their pulmonary function. o Deliver training and raise awareness of the hazards and the controls to be followed. The information on Material Safety Data Sheets should be communicated to all relevant personnel. This will include the hygiene and PPE requirements to be followed. o Emergency spillage procedures so that in the event of an accidental release there is a method of cleaning and collecting the fluids while minimising exposure. Personal Protective Equipment: o The use of protective clothing is advised to prevent direct contact with chemicals. PPE may include chemical splash goggles, appropriate chemicalresistant impermeable gloves, rubber boots, and coveralls. o If ventilation is not adequate it is recommended that goggles and selfcontained respirators are worn at all times. Respiratory protective equipment (RPE) is considered to be a last resort. RPE should only be considered when exposure cannot be adequately reduced by other means. It is vital that the RPE selected is adequate and suitable for the purpose. It should reduce exposure to as low as reasonably practicable, and in any case to below any applicable occupational exposure limit or other control limit. To make sure that the selected RPE provides adequate protection for individual wearers, fit testing of RPE including full-face masks, half-face masks and disposable masks is strongly recommended. This will help to ensure that inadequately fitting face masks are not selected.

2.23 - Properties, Hazards and Control Measures of Sludges (including LSA material). During the drilling process, Naturally Occurring Radioactive Material (NORM) flows with the oil, gas, and water mixture, and accumulates in scale, sludge, and scrapings. These NORMs include:    

Uranium. Thorium. Radium. Lead 210.

Oil and gas were created in the Earth's crust by the decay of sea life in ancient seas and are, therefore, often found in aquifers which contain salt water (brine). Various minerals, as well as radioactive elements, are also dissolved in the brine and these separate out and form SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 55

2.23 - Properties, Hazards and Control Measures of Sludges (including LSA material). wastes at the surface. These include:    

Mineral scales inside pipes. Sludges. Contaminated equipment or components. Water.

The process of hydrocarbon extraction exposes the environment and workers to the radioactive elements contained in the sludges. As such, they are classified as hazardous. They can be found in the following locations:    

On the drill string. Inside vessels and tanks. Inside filters. In coolers where tubes might be coated with sludge.

Hazards. Sludges are a mixture of liquid and suspended material, and therefore present a range of hazards:    

Skin irritation, and possibly dermatitis. Inhalation of the fumes or dusts from dried sludges. Ingestion, through poor hygiene practices such as not washing, not cleaning up, eating at work site). Exposure to radioactive substances and carcinogens.

The main hazard of exposure to ionising radiation from LSA materials is that of the inhalation and ingestion of radionuclides, especially of dust and fumes. Employees are at a higher risk of significant exposure to ionising radiation if they work with dusty processes unless adequate control measures have been put in place to prevent the inhalation of dust. Employees may be exposed, although to a lesser extent, to direct radiation where there is bulk storage of the material. They may also be exposed to external radiation if they are involved in cleaning operations or the dismantling of equipment which contains scale from oil and gas extractions.

Control Measures. Employers should put in place controls to ensure that the risk of exposure to ionising radiation is reduced 'so far as is reasonably practicable'. The use of PPE may be used only as a last resort after all other control measures have been considered. Engineering controls SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 56

2.23 - Properties, Hazards and Control Measures of Sludges (including LSA material). and the implementation of safe systems of work should take priority, and they include:     

    

The provision of ventilation equipment to contain dusts and fumes. The use of wet methods of working and good housekeeping to reduce the amount of dust in the atmosphere. Having equipment in place to collect sludge instead of using manual means. Diluting sludge with water. The use of permit-to-work systems. especially if the concentrations of dust or fumes reach a level where only designated persons are allowed to work under the restrictions of written safe system of work. The provision of training and awareness programmes. The provision of a health surveillance programme to monitor the health of employees. Good supervision to ensure that everyone follows the necessary control measures. Good hygiene practices, including washing before eating, drinking, or smoking, and keeping work clothes clean. The use of respiratory protective equipment specifically chosen to protect against exposure to airborne radioactivity.


Tel: +44(0)1482 806805 Page: 57

2.23 - Properties, Hazards and Control Measures of Sludges (including LSA material).

Figure 1. Photo of an employee in full PPE following a tank sludge cleaning operation. Question 4. Is the below statement true or false? The higher the flash point, the greater the potential fire hazard. Question 5. Select the correct missing word to complete the below statement. _____ designates liquids with a flash point below 21°C. Question 6. Select the correct missing word to complete the below statement. When Nitrogen concentrations increase (e.g. when purging equipment) and the oxygen levels drop below _____, rapid suffocation can occur. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 58

2.24 - Example Exam Questions on Hazards Inherent to the Oil and Gas Industry. Here is a small selection of past exam questions on recent sections. It is unlikely that you will be asked these questions at your exam. But you may be asked similar questions, and therefore this is an opportunity for you to familiarise yourself with types of questions NEBOSH ask at Certificate level. 1. (a) Outline the term Flash Point. (3) (b) Identify the Hazards associated with LNG. (4) 2. Give the meaning of the following terms: (a) upper flammable limit (UFL); (2) (b) lower flammable limit (LFL); (2) (c) flashpoint; (2) (d) Highly flammable liquids. (2) 3. Following preparation of a vessel for maintenance within an oil and gas installation a low specific activity (LSA) radioactive sludge was encountered. (a) Identify hazards associated with the sludge. (2) (b) Outline control measures to reduce the risk to workers exposed to the sludge. (4) (c) Identify TWO other pieces of workplace equipment where the sludge may be found. (2) 4. (a) Identify properties of hydrogen. (4) (b) Outline hazards associated with hydrogen. (4) 5. (a) Identify properties of nitrogen. (4) (b) Outline hazards associated with nitrogen. (4) 5. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 59

2.24 - Example Exam Questions on Hazards Inherent to the Oil and Gas Industry. (a) Identify properties of Hydrogen Sulphide. (4) (b) Outline hazards associated with Hydrogen Sulphide. (4) 6. (a) Identify properties of Methane. (4) (b) Outline hazards associated with Methane. (4) 7. (a) Identify properties of LPG. (4) (b) Outline hazards associated with LPG. (4)


Tel: +44(0)1482 806805 Page: 60

2.25 - Summary. The learning outcome for this section was: 2.0 - Explain the hazards inherent in oil & gas arising from the extraction, storage and processing of raw materials and products. In this section we have learnt:  



About various physical properties such as flash point, vapour density, vapour pressure and flammability limits etc. About the hazards and risks of various hazardous gases and substances such as LPG, LNG, methane, hydrogen, hydrogen sulphide, mercaptans, water, drilling mud, low specific activity sludge etc. About related control measures for the above hazards. 3.0 - Risk Management Techniques Used in the Oil and Gas Industries.

The learning outcome for this section is: 3.0 - Outline risk management techniques used in the oil & gas industries. In this section we will provide an overview of risk management techniques. In particular we will discuss:          

The purposes and uses of risk assessment techniques. Qualitative and quantitative techniques. How risk management tools are applied in process safety risk identification and assessment. How they are applied in project phases from concept, design and start-up. The concept of 'as low as is reasonably practicable'. The management of major incident risks. Industry related process safety standards, inherent safe and risk based design concepts, engineering codes and good practice. The concept of hazard realisation. The concept of risk control using barrier models. The use of modelling for risk identification, such as thermal radiation output and blast zones. 3.1 - The Purposes and Use of Risk Assessment Techniques.

Employers in each workplace have a general duty to ensure the safety and health of workers in every aspect related to their work. The purpose of carrying out a risk assessment is to enable the employer to introduce control measures necessary for the safety and SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 61

3.1 - The Purposes and Use of Risk Assessment Techniques. health protection of workers. Whilst the purpose of risk assessment includes the prevention of occupational risks, and this should always be goal, it will not always be achievable in practice. Where elimination of risks is not possible, the risks should be reduced and the residual risk controlled. At a later stage, as part of a review programme, such residual risk will be reassessed and the possibility of elimination of the risk, perhaps in the light of new knowledge, can be reconsidered. In the oil and gas industry it will be necessary to identify risks related to plant, equipment, products, processes, and systems of work. All of these have the potential to cause harm. The UK Health and Safety Executive states that a risk assessment is "a careful examination of what, in your work, could cause harm to people, so that you can weigh up whether you have taken enough precautions or should do more to prevent harm". There are a number of techniques available when assessing risks, including:    

The HSE's 5 Steps to Risk Assessment approach. Qualitative assessment techniques. Semi-quantitative assessment techniques. Quantitative assessment techniques.

We will learn more about these in the following sections. Before we progress further, it is important to define what is meant by 'hazard' and 'risk'. A hazard is defined as something with the potential to cause:   

Harm, including ill-health and injury. Damage to property, plant, products or the environment. Production losses or increased liabilities.

A risk is defined as the likelihood that the harm will occur. It is the chance, high or low, that a person could be harmed or some infrastructure could be damaged. This is usually accompanied by an indication of how serious the harm could be. It is commonly considered that risk is the combination of the likelihood of a hazard causing harm, and the potential severity of that hazard.


Tel: +44(0)1482 806805 Page: 62

3.1 - The Purposes and Use of Risk Assessment Techniques. In other words:

Risk = Likelihood x Severity General Structure of a Risk Assessment. The risk assessment should be structured and applied so that organisations can: 



  



Identify the hazards created at work and evaluate the risks associated with these hazards, to determine what measures they should take to protect the health and safety of their employees and other workers, having due regard to legislative requirements. Evaluate the risks in order to make the best informed selection of work equipment, chemical substances or preparations used, the fitting out of the workplace, and the organisation of work. Check whether the measures in place are adequate. Prioritise action if further measures are found to be necessary as a result of the assessment. Demonstrate to themselves, the competent authorities, workers and their representatives that all factors pertinent to the work have been considered, and that an informed valid judgment has been made about the risks and the measures necessary to safeguard health and safety. Ensure that the preventive measures and the working and production methods, which are considered to be necessary and implemented following a risk assessment, provide an improvement in the level of worker protection. 3.2 - The HSE's 5 Steps to Risk Assessment.

The UK's HSE promote a very simple of method called the 5 Steps to Risk Assessment. It is explained in further depth in their publication INDG163. The five steps are: 1. 2. 3. 4. 5.

Identify the hazards. Decide who might be harmed and how. Evaluate the risks and decide on precautions. Record the findings and implement them. Review the assessment on a regular basis and update if necessary.


Tel: +44(0)1482 806805 Page: 63

3.2 - The HSE's 5 Steps to Risk Assessment.

Step 1: Identify the Hazards. The first step is to identify what might harm people in the workplace. The following procedure should be followed:    

Conduct a tour of the workplace and observe what could reasonably be expected to cause harm. Consult the workers or their representatives for their views and opinions. Consult the manufacturers' instructions or data sheets. They will highlight hazards associated with machinery or substances. Consult the accident log and ill-health records. These can often indicate less obvious hazards as well as highlighting trends.

Step 2: Decide Who Might be Harmed and How. For each hazard, there has to be clear identification of the groups of people who might be harmed. This will help identify the best way of managing the risk (for example, 'people in the boiler room' or 'the public'). In each case, identify how they might be harmed i.e. how exactly will they be exposed to the hazard and what type of injury or ill-health might occur. For example, workers carrying out maintenance on an electrical panel might suffer an electric shock if there is a failure to isolate the supply.

Step 3: Evaluate the Risks and Decide on Precautions. Having identified the hazards, the next step is to decide what action to take to reduce the SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 64

3.2 - The HSE's 5 Steps to Risk Assessment. risks associated with the hazards. In most developed countries the law requires employers to do everything 'reasonably practicable' to protect people from harm. When deciding on control measures to minimise the risks to 'as low as is reasonably practicable' (ALARP), the Hierarchy of Control should be used. We shall look at the meaning of ALARP later in this Element. When using the Hierarchy of Control, priority should be given to those control measures at the top of the following list: 1. 2. 3. 4.

Elimination. Substitution. Engineering Controls. Administrative Controls (e.g. safe systems of work, procedures, training and information etc.). 5. Personal Protective Equipment.

Step 4: Record the Findings and Implement Them. Implementing the results of the risk assessment is the next step. This requires you to write down the findings of the risk assessment and share the document with those staff members involved. A risk assessment is not expected to eliminate all risks, but it is expected to be 'suitable and sufficient'. In order for it to meet these criteria, it will need to show that:       

A proper check was made. All of those who might be affected were consulted. All the significant hazards were addressed. The recommended risk control measures are suitable and sufficient, and the remaining risk is low. All the staff or their representatives were involved in the process. The assessment will be valid for some time. Actual conditions and events likely to occur have been considered during the assessment.

If the findings of the risk assessment conclude that there are a number of improvements to be made, it is appropriate to draw up a prioritised plan of action which clearly identifies what should be done, by who, and by when. These actions should then be implemented and management need to check regularly on the progress of the improvements.

Step 5: Review the Risk Assessment and Review if SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 65

3.2 - The HSE's 5 Steps to Risk Assessment.

Necessary. Few workplaces remain static. Inevitably, new equipment or variations in substances used and procedures undertaken will introduce new hazards to the workplace. Consequently, it's sensible to review all control measures on an ongoing basis. They should also be reviewed if there is an incident which shows that the control measures have not controlled the risk.

Risk Assessments in the Oil and Gas Industry. This straightforward method should be suitable for most low to medium risk organisations. But for the oil and gas industry, where there are more complex risks, the techniques used are likely to require more technical insight and depth. The UK Offshore Installations (Safety Case) Regulations 2005 (OSCR) requires a demonstration by duty holders that:   

All hazards with the potential to cause a major accident have been identified. All major accident risks have been evaluated. Measures have been, or will be, taken to control the major accident risks to ensure compliance with the relevant legal requirements (i.e. a 'compliance demonstration').

The compliance demonstration should be proportionate to the level of risk. Because of the higher levels of, and more complex, risks in the oil and gas industry, other risk assessment techniques need to be considered such as:   

Types of qualitative risk assessments. Types of quantitative risk assessments. Types of semi-quantitative risk assessments.

These techniques are regarded to be more comprehensive and can be used to take in a wider range of factors, including financial costs, loss of time, loss of business, loss of reputation etc. In the following pages we will look at these different types of risk assessment in more detail. 3.3 - Qualitative Risk Assessment. A qualitative risk assessment is based on the conclusions reached by the assessor using their expert knowledge and experience to decide:   

If current risk control measures are effective and adequate. Whether those control measures reduce the risk 'as low as is reasonably practicable'. If more measures need to be implemented.

Since it is based on the risk assessor's knowledge and experience, qualitative risk assessment is a subjective technique. Qualitative techniques allow the assessor to identify SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 66

3.3 - Qualitative Risk Assessment. hazards from specific activities and to develop an understanding of the risks involved and how serious they may be. This allows them to prioritise the control measures. Qualitative risk assessment can be used for both low risk and high risk industries. The 5 Steps to Risk Assessment approach is a typical qualitative technique which is appropriate for most low to medium risk activities. However, there are qualitative methods, such as HAZOP (which we will study later), that are used frequently in the oil and gas industry. When applied to the correct level of detail by a team with the required knowledge, expertise, and experience, qualitative risk assessment techniques can be a powerful risk management tool. There are advantages in using the combined skills of a team of assessors. Using a multidisciplined team of people with different knowledge and expertise means that a more complete idea of the risks is obtained. These people may bring additional theoretical knowledge, or practical experience of how activities and equipment work in reality. This is much better than relying on the views of a single person. When a team of assessors is involved, it is better to have them work on the risk assessment individually at first, and then to bring them together. This will ensure that more dominant members of the team do not overly influence or subdue the more introverted members of the team. This would conclude with a debate and comparison of ideas in order to reach a consensus of opinion and a final decision on which risk control measures should be applied. When making a qualitative judgement on the severity of a risk, two parameters are taken into considerations. These are:  

The likelihood of an event occurring. And the consequences or severity if the event does occur.

Severity can be assessed in terms of its effect on:     

Harm caused to people. Time lost. Cost to the organisation. Cost to quality. Inconvenience and disruption.

The Benefits and Limitations of Qualitative Techniques. The benefits of Qualitative Techniques are: 

Relatively low cost as the only cost is usually the time of the assessors.


Tel: +44(0)1482 806805 Page: 67

3.3 - Qualitative Risk Assessment.   

Different methods can be used to assess both low and high risk situations. Requires minimal training in the risk assessment method compared to quantitative techniques. The necessary expertise and knowledge is usually already available in the organisation.

The limitations of Qualitative Techniques are: 

 

There is a potential for disagreement between the assessors on the level of risk and what control measures should be put in place. This is because the assessment is subjective, and people of different experiences can have different opinions. Cannot quantify the risk precisely. Therefore its findings may be disputed. The quality of the output of the risk assessment is only as good as the expertise and knowledge of the assessors.

Examples of Qualitative Risk Assessment Methodologies. The HSE's 5 Steps to Risk Assessment that we discussed previously is a typical qualitative process. There is no quantification of the risks, and the outcome is purely down to the judgement of the assessor. It is a technique that is especially suited to low to medium risk environments. However, some qualitative approaches are uniquely placed for the high risk oil and gas industry. Hazard and Operability Studies (HAZOP) are a qualitative technique used primarily in high risk process industries. It requires a multi-disciplinary team to use a structured method to assess the risks from an existing or planned process, and agree control measures. Qualitative methods are often used outside of the safety environment, for example to risk assess commercial opportunities, decisions, and product development. These methods can include such techniques such as SWOT analysis. However, this is outside of the requirements of the course. 3.4 - Semi-Quantitative Risk Assessments. This type of risk assessment is actually closer to qualitative i.e. the assessment is still a subjective one, dependent on the judgment, knowledge and experience of the assessor. The difference with a true qualitative risk assessment is that the assessors will attempt to provide a numerical score or value to their assessment of the risk. In practice this means that a value will be given to the 'likelihood' and 'severity' factors. Some methods will also include a third factor such as 'number of people exposed' but this is usually not necessary. The individual values of each factor are multiplied together to form a 'risk rating'. Usually SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 68

3.4 - Semi-Quantitative Risk Assessments. the higher the number, the higher the risk. This method serves two purposes:  

This can be used against a 'risk matrix' to decide whether the risk is acceptable or whether more needs to be done. The risk ratings of individual risks can be compared in order to prioritise them.

It is necessary to provide definitions for each numerical value given. For example, if 'likelihood' is scored out of 5, then 1 might be 'extremely unlikely' and 5 might be 'very likely'. Similarly for 'severity', 1 might mean only a 'first aid injury' and 5 may signify 'death'. There are no standard definitions. Each organisation will usually develop their own semiquantitative method with their own definition and risk matrices. The risk matrix may be as simple as a 3 x 3 system, or as complicated as 10 x 10. See some examples below.

Figure 1. A typical 5 x 5 matrix, colour coded to show what action is required.


Tel: +44(0)1482 806805 Page: 69

3.4 - Semi-Quantitative Risk Assessments.

Figure 2. A typical 3 x 3 risk matrix.

Figure 3. A slightly more complicated 5 x 5 risk matrix, including consideration of damage to assets, the environment, and corporate reputation.


Tel: +44(0)1482 806805 Page: 70

3.4 - Semi-Quantitative Risk Assessments.

Figure 4. A 16 x 13 risk matrix. This one is used to assess the risk of equipment failure. As we have discussed previously, the use of semi-quantitative risk assessment depends on the equation:

Risk Rating = Likelihood x Severity

What Action should be Taken for each Risk Level? Risk matrices are useful to define precisely:   

What action is required for each risk level. At what point an organisation would consider the risk to be sufficiently controlled. How high the risk needs to be for the organisation to decide to stop the process or refuse to start the process until the risk is lowered.

A typical 3 by 3 risk matrix would usually say the following: 1. If the risk is 'Low' then the risk is tolerable. No further action is required other than monitoring of the effectiveness of controls and regular reviews. The goal is to reduce all risks to this tolerable level. 2. If the risk is 'Medium' then further action should be considered within a specific timeframe, such as 1 week or 30 days, to bring the risk down to a tolerable level. 3. If the risk is 'High' then the job must stop, or must not start. Immediate controls are SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 71

3.4 - Semi-Quantitative Risk Assessments. required to bring the risk down to a more acceptable level.

Benefits and Limitations of Semi-Quantitative Risk Assessment. The benefits are:     

It allows risks to be prioritised and compared against one another. It provides a clear and consistent definition to the organisation of what risk ratings are considered acceptable, and which ones need further control measures. In the event of very high risks with imminent danger, it clearly defines when work should be stopped (or not started). It provides a level of consistency to a qualitative system. The results are easier and quicker to interpret for a busy reader.

The limitations are the same as with qualitative risk assessments: 

 

There is a potential for disagreement between the assessors on the level of risk and what control measures should be put in place. This is because the assessment is subjective, and people of different experiences can have different opinions. Cannot quantify the risk precisely. Therefore its findings may be disputed. The quality of the output of the risk assessment is only as good as the expertise and knowledge of the assessors. 3.5 - Quantitative Risk Assessments.

Quantitative Risk Assessment is often called QRA. It is often said that the level of risk assessment should be proportionate to the risks i.e. the higher the risk, the more effort should be invested in accurately assessing the risks. In the oil and gas industry, the hazards associated with complex processes and operations require a highly sophisticated approach in order to evaluate the risks involved. QRA techniques provide the means to make a detailed assessment that will be based on quantitative considerations of event probabilities and consequences. It is a key element tool applied in safety management and risk control throughout the design, construction, operation and decommissioning of all industrial activity in order to achieve safe operation and major hazard control. These quantitative techniques and tools will seek to:  

Identify hazards. Give a statistical estimate of the severity of the consequences.


Tel: +44(0)1482 806805 Page: 72

3.5 - Quantitative Risk Assessments. 

Quantify the likelihood of the hazards being realised.

This will result in a reliable numerical estimate of the risks. Frequently the QRA is combined with a cost-benefit analysis to ensure that the optimum return is obtained from investments in risk-reducing measures.

Different Uses of a QRA. 

 





Regulatory compliance where QRA may be required in order to obtain a license to operate. For example, in the European community, most enforcing authorities provide strong guidelines on report format and methodologies. For example, in the UK this is required under the Offshore Installation (Safety Regulations) 2005. Risk prioritisation is used to rank potential hazards or system deficiencies for possible mitigation. Corporate policy may require all operations meeting particular criteria to be subject to QRA. This requirement is most often driven by a need to understand the risks facing the company and to manage the full set of risks to a tolerable level. Cost benefit analysis is most commonly used to select risk mitigation measures for potential implementation. In some cases a QRA may be justified when a recommendation from a more qualitative study will be expensive to implement and a more precise level of risk needs to be developed. Identify the potential cost and duration of business interruption.

Information Inputs. The number of possible inputs into QRA is extremely wide, and what data is required is dependent on the what kind of process is being risk assessed and the tool used to make the calculations. QRA is often carried out with the use of sophisticated computer software and modelling. Historical failure data is an essential input into most analyses. This might include the failure rates of equipment and components. For example, it is important to consider the reliability of a level sensor on an oil tank to prevent overfilling. The data may give an indication as to how reliable that type of sensor is and the frequency of failure. The frequencies of failure are calculated by combining accident experience and population exposure, typically measured in terms of installation-years: Number of Events Number of Installations x Years of Exposure One example of a source of historical data which can be used as the basis for quantitative SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 73

3.5 - Quantitative Risk Assessments. risk assessments is the Worldwide Offshore Accident Database (WOAD). Other inputs may include the types of chemicals and hydrocarbons, their respective energy output in the event of a fire, the heat resistance of materials used, the prevailing wind conditions etc.

Examples of QRA. There are numerous tools and techniques and commercial software applications. Common QRA techniques include:   

Fault Tree Analysis. Event Tree Analysis. Fire and Explosion modelling

Benefits and Limitations of QRA. The benefits are:   

Very objective. Based on data so reliable and precise. Theoretical models follow the laws of physics which are constant, therefore the modelling scenarios are considered to be reliable and highly predictable.

The limitations of QRA are:    

Tends to be more expensive than simpler qualitative or semi-quantitative methods. Requires significant expertise and sophisticated software. Dependent on the availability of the data. If the data is unavailable, then it becomes more difficult to accurately quantify the risk. The output is only as good as the data. Limited or inaccurate data will affect the accuracy of the QRA. 3.6 - How Risk Management Tools are Applied in Process Safety.

When a project is in the design stage, some risks can be 'designed out' i.e. the design is such that the risk is eliminated. Unfortunately, it is not possible to remove oil and gas from the oil and gas industry! Therefore some hazards and risks will always remain.

Risk Management through the Lifecycle. It is important to identify and assess hazards and risks at every stage of the project phases, SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 74

3.6 - How Risk Management Tools are Applied in Process Safety. from concept, through to the design phase, through to start up, operation, shutdown, maintenance, and decommissioning. Consideration must also be given to the management of major incident risks and the mitigation of incidents. Risks must be 'as low as is reasonably practicable' (ALARP) and we will discuss what this means shortly.

The Steps to Risk Management. Managing work health and safety risks involves four steps (see figure below): 1. Identifying hazards: finding out what could cause harm 2. Assessing risks (if necessary): understanding the nature of the harm that could be caused by the hazard, how serious the harm could be and the likelihood of it happening 3. Controlling risks: implementing the most effective control measure that is reasonably practicable in the circumstances 4. Reviewing control measures: ensuring control measures are working as planned. Have you noticed that these 4 steps are remarkably similar to the 5 Steps to Risk Assessment?


Tel: +44(0)1482 806805 Page: 75

3.6 - How Risk Management Tools are Applied in Process Safety.

Figure 1. The 4 Steps to Risk Management. Consultation with workers and their health and safety representatives is required at each step in managing risks to health and safety at the workplace. By drawing on the experience, knowledge and ideas of workers, organisations are more likely to identify all hazards and choose effective control measures. Workers should be encouraged to report any hazards and health and safety problems immediately so that risks can be managed before an incident occurs. If there is a health and safety committee for the workplace, it should also be engaged in managing health and safety risks at the workplace. In the following sections we will review a number of risk assessment tools that are commonly used within the oil and gas industry.   

Hazard Identification Studies (HAZID). Hazard and Operability Studies (HAZOP). Failure Modes and Effective Criticality Analysis or Failure Modes and Effects Analysis


Tel: +44(0)1482 806805 Page: 76

3.6 - How Risk Management Tools are Applied in Process Safety. (FMECA and FMEA respectively). 3.7 - Hazard Identification Studies (HAZID). HAZID, as its name suggests, is a tool for identifying hazards. It is normally a qualitative risk assessment and is judgement based. It is usually undertaken by a team of people who will be selected because of their particular knowledge, experience, or expertise. The reasons for identifying hazards are twofold: 1. The compile a list of hazards which can then be evaluated using further risk assessment techniques. 2. To conduct a qualitative evaluation of how significant the hazards are and how to reduce the risks associated with them. The following features are essential elements of a hazard identification study:    

A wide scope of hazards should be considered. The study should follow a structured approach so as to be comprehensive in its coverage of relevant hazards. The study should embrace historical data and previous experiences so that lessons learnt can be acted upon. The scope of the study should be clearly defined. This is to ensure that those who read the study fully understand what parts of the process and what hazards have been included, and which have been excluded.

Hazard Checklists. Checklists are an effective means of producing a comprehensive list of standard hazards which can be used for HAZID studies at the concept and design stages of a project to consider a wide range of issues related to safety. It is also used to confirm that good practice has been built into a project at the design stage. The hazards considered may include: 



Substance specific, such as: o Hydrocarbons. o Toxic materials. o Liquids and gases under pressure. o Hot or cryogenic fluids. o Explosive substances and gases. Equipment specific, such as:


Tel: +44(0)1482 806805 Page: 77

3.7 - Hazard Identification Studies (HAZID). Dangerous equipment. o Ignition sources. o Lifting equipment. o Ionising radiation. o Non-ionising radiation. o Failure of equipment such as utilities, safety systems, instrumentation, and control systems. General hazards, such as: o Transportation and traffic. o Weather. o Slips and tips. o Working at Height. o Diving operations. o Manual handling. o



Benefits and Limitations of a Hazard Checklist. The benefits are:    

Relatively cheap to produce and can be created by a single person. It can be used to help prevent the recurrence of previous incidents. It can be used for concept designs with a minimum of installation information. It can use the experience gained from previous risk assessments.

The limitations are:  

It may not be able to anticipate accidents which may occur in new designs. Using a generic checklist does not encourage new thinking about possible hazards, which can limit the understanding of the types of hazard specific to the installation.

In conclusion, a generic checklist is a useful tool for most risk assessments, although it is advisable to use it alongside other hazard identification study methods. 3.8 - Hazard Operability Studies (HAZOP).

What is a HAZOP? A hazard and operability (HAZOP) study is method that is used often in the petrochemical industries. It is a structured and systematic examination of a planned or existing process or operation in order to identify and evaluate problems that may represent risks to personnel or equipment, or prevent efficient operation. It will identify deviations from design intent, determine the causes, and recommend solutions. It is a Qualitative process. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 78

3.8 - Hazard Operability Studies (HAZOP).

When is a HAZOP performed? The HAZOP study should preferably be carried out as early in the design phase as possible. This is so it has an inﬂuence on the design. On the other hand, to carry out a HAZOP a complete design is required. As a compromise, the HAZOP is often carried out as a ﬁnal check when the detailed design has been completed. A HAZOP study may also be conducted on an existing facility after a major modification, following a major accident, and periodically as a review.

The HAZOP Team. The team will be led by a Team Leader or Chair who will be someone experienced in the HAZOP process. They will initially agree the scope of the analysis, and be involved in the selection of team members. They will direct the team members in gathering of process safety information prior to the start of the study, and lead the team in the analysis of the selected process or part of the process. At the end of the exercise the Team Leader will write a report detailing the study findings and recommendations, and report the findings and recommendations to management. Other team members may include:       

Secretary or scribe. Design engineer. Mechanical engineer. Electrical or Instrument engineer. Operations representative. Process Engineer. Safety specialist.

The HAZOP Procedure. HAZOP is applied to processes (existing or planned) for which design information is available. This commonly includes a process flow diagram, which is examined in small sections, such as individual items of equipment or pipes between them. For each of these a design 'Intention' is specified. For example, in a chemical plant, a pipe may have the intention to transport 2.3 kg/s of 96% sulphuric acid at 20°C and a pressure of 2 bars from a pump to a heat exchanger. The intention of the heat exchanger may be to heat 2.3 kg/s of 96% sulphuric acid from 20°C to 80 °C. The HAZOP team then determines what are the possible significant deviations from each SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 79

3.8 - Hazard Operability Studies (HAZOP). intention, the possible causes, and likely consequences. It can then be decided whether existing, designed safeguards are sufficient, or whether additional actions are necessary to reduce risk to an acceptable level. The key feature is to select appropriate Process Parameters which apply to the design intention. These are general words such as Flow, Temperature, Pressure, and Composition. In the above example, it can be seen that variations in these parameters could constitute deviations from the design Intention. In order to identify Deviations, the Study Leader applies (systematically, in order) a set of Guide Words to each parameter for each section of the process. Guidewords include: No, More, Less, As Well As, Part Of, Reverse, Other than. Process Parameters include: Flow, Pressure, Temperature, Level, Viscosity, Composition, pH. Let us present a simplified example: 1. We begin with a deviation. In the example above we choose 'TEMPERATURE of sulphuric acid in pipe is MORE than 20°C'. We ask the question 'Is this possible?' 2. If it is not possible we move on to the next deviation. If it is possible we ask whether it is hazardous or affects efficiency. 3. Since this deviation is possible, we ask whether the operator will know the temperature is more than 20°C. If not, then the HAZOP team must consider what mechanism or process needs to be established so that the operator is aware of this deviation. 4. We would then establish what changes to the plant, machinery, or operating procedures are necessary in order to prevent the deviation, make it less likely, or protect against the consequences. 5. We must consider whether the change is cost effective. If not then other changes must be considered, otherwise the team must agree to accept the hazard. 6. The changes are agreed and someone is made responsible for implementing them. 7. A follow up process is needed to ensure the agreed changes are implemented. On completion of a HAZOP study the possible outcomes include:    

No actions required. Improvements in operating or maintenance procedures. Hardware or design changes. A more detailed quantitative risk assessment required.


Tel: +44(0)1482 806805 Page: 80

3.8 - Hazard Operability Studies (HAZOP).

Figure 1. HAZOP process flowchart.

The Benefits and Limitations of HAZOP. Its benefits are:      

HAZOP studies are well known and widely used in the oil and gas industry. They use the knowledge and experience of operators. They systematically examine every part of the design, identifying every possible deviation. They can identify technical faults and human errors. They can evaluate existing controls, and propose further controls. The use of HAZOP offshore is useful in that it brings together different professional disciplines from different organisations.

Its limitations are:   

Its success depends on the effectiveness of the team leader, and the knowledge and experience of the team. It is best suited for process hazards. It cannot identify general safety hazards without substantial changes to how it works. Procedural descriptions are needed, and these may not be available in sufficient


Tel: +44(0)1482 806805 Page: 81

3.8 - Hazard Operability Studies (HAZOP). 

detail to identify all conceivable scenarios. The documentation required to record the findings fully can be extensive and overwhelming. 3.9 - HAZOP Process Illustrated.

Figure 2. The HAZOP process illustrated. 3.10 - Failure Mode and Effects Analysis (FMEA).

What is an FMEA? FMEAs evaluate the ways equipment, components, and physical systems can fail and the SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 82

3.10 - Failure Mode and Effects Analysis (FMEA). effects these failures can have. In an FMEA, each individual failure is considered as an independent occurrence with no relation to other failures in the system, except for the subsequent effects the original failure may produce. Basically, FMEAs identify single failure modes that either directly result in or contribute significantly to an accident. FMEAs are conducted to improve the safety of equipment by:   

Identifying single component, equipment and system failure modes. Determining the potential effects on the equipment, system, or plant associated with each individual failure mode. Generating recommendations for increasing reliability of the component, equipment and/or system.

What is the FMEA process? There are basically 5 steps involved in the FMEA process:     

Break the system into component parts. Determine how each component may fail. Determine the possible effects of these modes of failure. Consider how each failure mode can be detected. Assess the consequences of the failure on the system or other components.

An example FMEA, concerning an automated cash machine (also known as an ATM), is given in the figure below. Under the potential failure modes, there are three identified possible failure mode in dispensing cash, and their respective effects and potential causes. Severity is ranked for the respective failure mode from a low severity of 1 to a high 10. Occurrence is scored in the same manner while detection is scored in reverse. If a failure is highly detectable, the score is low. Hard to detect failures should be scored high in detection. It is worth noting that the below example is a simplified version. A full FMEA on a system would be much more detailed.


Tel: +44(0)1482 806805 Page: 83

3.10 - Failure Mode and Effects Analysis (FMEA).

Figure 1. Example FMEA for an automated cash machine. The Risk Priority Number (RPN) is the product of Severity, Occurrence and Detection (RPN = S x O x D). The higher the RPN, the higher the risk. Based on the above table, priority should be given to internal jamming because it has the highest RPN. Also running out of cash is a priority because of its 'critical characteristic'. Resources should therefore be aimed towards preventing and controlling these two failures. Since it uses scores it is a semi-quantitative technique. In summary, FMEA failures are prioritised according to how serious their consequences are, how frequently they occur and how easily they can be detected. FMEA is used during the design stage with an aim to avoid future failures. Later it is used for process control, before and during ongoing operation of the process. Ideally, FMEA begins during the earliest conceptual stages of design and continues throughout the life of the product or service.

The Benefits and Limitations of FMEA. The benefits are: 

It is a well used and understood hazard analysis tool.


Tel: +44(0)1482 806805 Page: 84

3.10 - Failure Mode and Effects Analysis (FMEA).   

It may only be used by one person to perform the analysis. It should identify all conceivable electrical and/or mechanical hazards. It identifies safety critical equipment and components where a failure would be critical to the system.

The limitations are:     

It's dependent on the experience and knowledge of the analyst. The analyst needs to develop a hierarchical system drawing before they can perform the analysis. It is limited to mechanical and electrical equipment and is not applicable to procedures or process equipment. Human errors and multiple failures are difficult aspects for it to cover. It is likely to produce a large and complex list of failures.

FMEAs should not be used by themselves because human error is a contributing factor in many accidents and it is difficult for FMEA to identify this. 3.11 - The Concept of 'As Low as Reasonably Practicable' (ALARP). We have mentioned a number of times the phrase 'as low as is reasonably practicable'. But what does this mean? There are risks in every aspect of our lives, both in our personal lives (such as crossing the road) and in our work activities. What we must do is reduce those risks to an acceptable level, without taking excessive or disproportionate action. What this means is that organisations must introduce appropriate control measures unless the cost is 'grossly disproportionate' to the risk reduction. Once all such measures have been introduced, the risks are said to be 'as low as is reasonably practicable'. The ALARP principle arises from the fact that infinite time, effort and money could be spent on the attempt of reducing a risk to zero, and there is a point at which it becomes unreasonable to spend anymore time, effort, and money on trying to reduce that risk. That point is called 'As low as is reasonably practicable'. It should not be understood as simply a quantitative measure of benefit against detriment. It is more a best common practice of judgement of the balance of risk and societal benefit. For example, to spend £100,000 replacing the six chairs in the control room with ones with better back support would be regarded as grossly disproportionate. However, to spend £1,000,000 on installing a fully protected escape route from the temporary refuge facility to the lifeboats and helideck could be regarded as far more SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 85

3.11 - The Concept of 'As Low as Reasonably Practicable' (ALARP). proportionate. In the oil and gas industry the risk of fire and explosion and their consequences rank highly, not only in financial terms, but also to human life and the environment. Therefore control measures that are considered disproportionate in a lower risk environment are considered reasonable and proportionate in the oil and gas industry. The risk is so high that much more stringent control measures will be needed to reduce the risk to a level that can be regarded as 'ALARP'. In most situations, deciding whether the risks are ALARP involves a comparison between the control measures the organisation has in place and the measures we would normally expect to see in such circumstances. The question to be asked is 'is it good practice?' Good practice is defined by the UK HSE as those standards for controlling risk that the HSE has judged and recognised as 'satisfying the law, when applied to a particular relevant case, in an appropriate manner'. Examples of good practice may include HSE Approved Codes of Practice and Guidance Notes, Industry Standards, and standards produced by organisations such as ISO (International Organisation for Standardisation).

Figure 1. Chart outlining the concept of ALARP. 3.12 - Management of Major Incident Risks. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 86

3.12 - Management of Major Incident Risks. When it comes to managing the risks of a major incident, this should take hierarchical approach. The recommended hierarchy is: 1. 2. 3. 4. 5.

Elimination and minimisation of hazards (designing safety into process and systems). Prevention (the reduction of the likelihood of a major incident). Detection (the warning and alarm systems transmitted to the control area). Control (the limitation of the scale, the intensity and/or the duration of an incident). Mitigation of consequences (the protection from effects of an incident).

Figure 1. Hierarchy of controls for major incident risks. Inherently safer design and measures to prevent and control major accident hazards are the highest priority. This is because they have the greatest effect and are more effective at reducing the risk. The best time to identify and eliminate the risk of major hazards on a new installation is at the design stage. This is the stage at which all elements of the process and plant are examined, tested, and where the risks are prioritised in order of significance. It is always best to prevent or eliminate risks by engineering design which will make the SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 87

3.12 - Management of Major Incident Risks. installation inherently safe. Then any residual risks can be controlled by the implementation of other controls such as management systems. It is more difficult to eliminate or prevent risks on existing installations, although they should be reduced to ALARP regardless of the difficulties. 3.13 - Industry-Related Process Standards, Engineering Codes, and Good Practice.

What are 'Standards'? In essence, a standard is an agreed way of doing something. It could be about making a product, managing a process, delivering a service or supplying materials. Standards can cover a huge range of activities undertaken by organisations and used by their customers. The standard is documented and the organisation will attempt to replicate this way of working. Standards are the distilled wisdom of people with expertise in their subject matter and who know the needs of the organisations they represent, people such as manufacturers, sellers, buyers, customers, trade associations, users or regulators. Standards are useful tools to ensure consistency, reliability, efficiency, and safety. Standards are particularly important for the oil and gas industry as they simplify global procurement and assuring quality. These standards ensure the quality of most of the equipment used in the industry, such as fittings, flanges, and valves, as well as management systems and procedures.

Who Creates Standards? The oil and gas industry is a multinational operation and is governed by both national and international health and safety regulations and codes of practice which are developed and enforced by governmental departments and other authorities throughout the world (such as OSHA in the USA, and the HSE in the UK). In addition to these governmental authorities there are a number of industry bodies which produce guidance and international standards which oil and gas organisations can use to ensure they are following good practice. Governments and enforcing authorities tend to work with these industry bodies to develop these international standards and codes of practice which are born out of specialised knowledge and experience. Models of risk management which have developed over time are shared globally throughout the industry, and minimum standards of health and safety become commonly accepted and adopted by multinational companies. The industry bodies also serve as a forum for the exchange of ideas as wells as a communication method to notify others of hazards or improved working practices. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 88

3.13 - Industry-Related Process Standards, Engineering Codes, and Good Practice. Notable nongovernmental industry bodies which produce guidance and standards include:    

International Association of Oil and Gas Producers (IOGP). Oil and Gas UK. OPITO. (Offshore Petroleum Industry Training Organisation) International Organisation for Standardisation (ISO).

A useful document which show the large number of relevant ISO standards is available on the IOGP website here: http://www.iogp.org/Portals/0/Standards/standardsposter.pdf Examples of relevant ISO standards include:  

ISO 19900 General Requirements for Offshore Structures. ISO 14001 series Environmental Management Systems. 3.14 - Inherent Safe and Risk Based Design Concepts.

One of the main elements of developing inherently safe processes is to recognise that, by reducing the complexity of the plant at the design stage, and simplifying the operation process, a significant reduction in the likelihood of accidents can be achieved. This is because there is less equipment to malfunction and fewer opportunities for human error. The design of a process which is as inherently safe as possible is the main goal of process designers. It is impossible to design out all risks, but process designers can use a hierarchical approach, with hazard avoidance being the priority, followed by the control of any risks remaining. Control features, such as designing a system which can withstand the maximum likely pressure possible, are desirable elements where hazards cannot be designed out completely. However, where control is not possible, then mitigation by designing in means of reducing the magnitude of a hazard if it is realised is acceptable. The basic principles of inherently safe design are as follows: 



Minimisation. 'What you don't have, can't leak.' Smaller inventories of hazardous materials reduce the consequences of leaks. Inventories can often be reduced in almost all unit operations as well as storage. This also brings reductions in cost, while less material needs smaller vessels, structures and foundations. Substitution. If minimisation is not possible, an alternative is substitution. It may be possible to replace flammable refrigerants and heat transfer with non-flammable ones, hazardous products with safer ones, and processes that use hazardous raw materials or intermediates with processes that do not. Using a safer material in place of a hazardous one decreases the need for added-on protective equipment and thus


Tel: +44(0)1482 806805 Page: 89

3.14 - Inherent Safe and Risk Based Design Concepts. 











decreases plant cost and complexity. Moderation. If minimisation and substitution are not possible or practicable, an alternative is moderation. This means carrying out a hazardous reaction under less hazardous conditions, or storing or transporting a hazardous material in a less hazardous form. For example you could reduce the temperature or pressure of a process, even though this might take longer. Simplification. Simpler plants are inherently safer than complex plants, because they provide fewer opportunities for error and contain less equipment that can go wrong. Simpler plants are usually also cheaper and more user friendly. Problems should be designed out, rather than adding equipment to deal with those problems. Error Tolerance. Equipment should be able to tolerate deviations, poor installation, or maintenance without failure. For example, expansion loops in pipework are more tolerant to poor installation than bellows. Piping and joints can be made capable of withstanding the maximum possible pressure if outlets are closed. Limitation of Effects. If the above cannot prevent an incident, the effects of the failure should be limited. For example, the overpressure from explosions can be directed away from populated parts of the installation, or bunds can be installed around storage tanks. Preventing Human Error. Failsafe features should be designed in, such as valves which fail to a SHUT position. Equipment should be chosen so that it can be easily seen whether it has been installed correctly or whether it is in the open or shut position. Safe plants are designed so that incorrect assembly is difficult or impossible. Avoiding Knock-On Effects. Safer plants are designed so that those incidents, which do occur, do not produce knock-on or domino effects. For example safer plants are provided with fire breaks between sections to restrict the spread of fire, or if flammable materials are handled, the plant is outside so that leaks can be dispersed by natural ventilation.

The possibility for affecting the inherent safety of a process decreases as the design proceeds and more and more engineering and financial decisions have been made. It is much easier to change the process configuration and inherent safety in the conceptual design phase than in the later phases of process design. For instance the process route selection is made in the conceptual design and it is many times more difficult and expensive to change the route later. Time and money is also saved when fewer expensive safety modifications are needed and fewer added-on safety equipment are included to the final process solution.


Tel: +44(0)1482 806805 Page: 90

3.15 - The Concept of Hazard Realisation. When a hazard leads to injury or damage we say that the 'hazard has been realised'. It is where a hazard control system has failed which, in turn, causes a hazardous event to occur. The realisation of a hazard can be catastrophic in the oil and gas industry. Here is an example based on the Buncefield disaster: 1. During tank filling the overfill sensors fail, and the tank filled until it spills over the top of the tank. 2. The spillage of highly flammable liquid creates a large vapour cloud which travels until it finds an ignition source. It ignites. 3. The ignition causes a large explosion. 4. The explosion leads to damage, injuries and fatalities. 5. Other tanks are damaged, leading to further loss of containment and more fire. Luckily the Buncefield disaster did not result in any fatalities. Let us look at another example now, the Feyzin disaster in France in 1966.

Feyzin Disaster, 1966. Three operators were draining water from a sphere containing LPG. This was a routine procedure, but none of the operators carrying out the task on this occasion had any experience in performing the task. There was a written procedure which showed how to open the valves in a specific sequence, but this was not referred to by the operators. Consequently the valves were not opened in the correct order. and the closest one to the sphere was opened first. A plug of ice formed around the internal mechanism of the valve, making it inoperable so the operators were unable to close it. LPG then began to flow from the drain valve, expanding and causing a huge vapour cloud. Being unable to close the valves (due to the ice plug), the operators ran away. The vapour cloud drifted over a nearby road and ignited (probably due to a vehicle exhaust). The flames then travelled back to the leaking sphere and resulted in a jet fire which then spread to another LPG sphere. This caused a Boiling Liquid Expanding Vapour Explosion (BLEVE, which we will study in Element 4) and the sphere exploded. Other spheres collapsed as their support legs buckled because of the heat, and in turn they also exploded. In total five spheres were destroyed even though the emergency services were at the scene. This was because they failed to cool the nearby tanks and the surrounding areas, and a domino chain of explosions was allowed to occur. 18 people were killed, including 11 firefighters and the driver of the vehicle whose exhaust ignited the vapour cloud. Over 100 people were injured. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 91

3.15 - The Concept of Hazard Realisation.

Figure 1. An aerial image after the Feyzin disaster.

Lessons Learnt from Feyzin. The Feyzin disaster raised a number of issues, including:    

The design of spheres, the safe distance between them, and the fire protection and insulation requirements of pipework, valves, and tank supports. Procedures for draining water from spheres. The need for fully trained and competent personnel. The need for emergency planning and procedures, so that emergency services know how to manage similar incidents.

The Feyzin disaster shows how poor design, the lack of effective training, and human error can come together to 'realise a hazard' and turn it into a large catastrophic event. 3.16 - Risk Control Using Barrier Modelling. A barrier can be described as something which prevents or minimises harm.  

Something which is placed between a person and a hazard to prevent them from being harmed. Something which mitigates the effects of an incident and minimises the harm caused.

Barriers to Prevent Harm to People. Barriers to prevent harm to people are easily recognisable in our everyday lives. They can be the physical barrier which prevents us from falling off of a balcony, or suncream which is a physical barrier between the skin and the harmful rays of the sun. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 92

3.16 - Risk Control Using Barrier Modelling. Barriers can also be intangible things such as procedures, knowledge, and training. A permit to work system is a barrier. But how effective that barrier is depends very much on how well the system is designed and how well people use it. Some barriers are more reliable than others. The most reliable barriers are those which are based on good design and engineering, and therefore do not rely on human intervention. An example may be an automatic gas detection system which is connected to an emergency shutdown system. However, even these barriers can fail, perhaps due to unforeseen conditions or technical faults. Barriers that are less reliable are those which are reliant on people to operate. Since people are susceptible to making mistakes, or breaking rules, barriers which rely on people have limited effectiveness and should not be relied on to protect from major risks. For example, a common barrier in use is Personal Protective Equipment (PPE). But PPE is sometimes not worn, not available, not suitable, and can be breached in a variety of ways. It also only protects the person wearing it. Preference should therefore be given to barriers which do not rely on people, and which are 'collective' in nature i.e. they should protect everyone in the area and not just a selection of people.

Use of Multiple Barriers. Since no barrier is 100% effective, it makes sense to use a combination of different barriers to attempt to control the risk. If one barrier fails, there is then a good chance that an incident may be prevented by the other barriers in place. This is often referred to as the Swiss Cheese Model. Every barrier has a 'hole', and the logic is to provide enough barriers to reduce the likelihood of the holes lining up and allowing a risk through.


Tel: +44(0)1482 806805 Page: 93

3.16 - Risk Control Using Barrier Modelling. Figure 1. The Swiss Cheese Model, illustrating how multiple barriers are needed to fully control certain risks.

Mitigation (or Recovery) Barriers. In addition to preventing incidents, barriers can also be introduced to minimise the effects of an incident if it does occur. These are barriers that are initiated after the event, and the purpose is to reduce the severity of the incident, including the numbers of people who are affected. For example, in the event of a fire there will be measures to protect people from the fire including fire resistant evacuation routes, safe refuges, clean air being pumped into accommodation blocks, and emergency lighting.

Use of Bow Tie Models. The Bow Tie method is a risk evaluation method that provides a visual representation of the preventative and reactive barriers. The method takes its name from the shape of the diagram that you create, which looks like a man's bow tie. A Bow Tie diagram does two things. First of all, a Bow Tie gives a visual summary of all plausible accident scenarios that could exist around a certain Hazard. Second, by identifying control measures the Bow Tie displays what a company does to control those scenarios. The Bow Tie model was developed by Shell to meet the requirements for risk assessment, whilst integrating the understanding of how accidents happen, derived from the Swiss Cheese Model. The left hand side of the bow tie describes how events and circumstances can release a hazard which, dependent upon the effectiveness of the systems and activities in place (active controls and barriers), can lead to an undesired event (the 'Top Event'), with the potential for harm to people, assets or the environment. The right hand side represents the scenarios that may develop from the undesired Top Event (the Consequences), dependent upon the effectiveness of the systems and activities (reactive controls and barriers). Active barriers are put in place to prevent the hazards from causing the Top Event, and Reactive barriers put in place to reduce the Consequences. Each barrier relies on one or more activities being carried out by an Organisation, such as design, engineering, or operations, to ensure its presence and effectiveness. Barriers can be 'Hard' (such as fire explosion wall design) or 'Soft', such as procedures and individual competence. Bow Ties have the advantages of being a clear graphical representation of what can sometimes be complex safety systems. In addition, they show clear links safety and SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 94

3.16 - Risk Control Using Barrier Modelling. management systems.

Figure 2. Example of a Bow Tie diagram.

Involvement of Workers. Employees should be consulted and involved in the production of barrier models. They are the people who are usually most familiar with the hazards and risks they face on a daily basis. They have a lot of familiarity with the various control measures and can inform management on how effective these controls are in practice and what other controls may be required. They are also the people who are most likely to suffer the consequences of an incident, and therefore it is morally right to make sure they are satisfied that sufficient controls are in place to protect them. 3.17 - Use of Modelling such as Thermal Radiation Output. Consequence modelling refers to the calculation or estimation of numerical values (or graphical representations of these) that describe the credible physical outcomes of loss of containment scenarios involving flammable, explosive and toxic materials with respect to their potential impact on people, assets, or safety functions. There are a number of modelling techniques and tools available to help in identifying risks of fire and explosion. These are usually based on mathematical calculations, formulae, and computer software capable of 'modelling' scenarios and predicting consequences.

Computational Fluid Dynamics. Computational Fluid Dynamics (CFD) can be used to obtain numerical solutions for ventilation, dispersion and explosion problems for both offshore platforms and onshore SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 95

3.17 - Use of Modelling such as Thermal Radiation Output. plants. CFD simulations are becoming increasingly common as the computing power of standard desktop computers grows. The purpose of the assessment is to generate realistic air overpressure data for an area based on probabilistic arguments. Ventilation, gas leaks, dispersion as well as gas explosions are considered by establishing probable explosion scenarios and performing computer based explosion simulations.

Fire and Thermal Radiation Modelling. Fire modelling is typically used to calculate the flame dimensions for 2 purposes:  

As input to a thermal radiation model. To determine whether a flame can reach a vulnerable (e.g. other equipment or accommodation).

The types of fires that modelling can be applied to are varied, and can include jet fires, pool fires, flash fires and Boiling Liquid Expanding Vapour Explosions. We will study these types of fire in Element 4. CFD models can be used to determine the fire loading on critical areas on both offshore structures and onshore plant.

Explosion and Blast Modelling. For Quantitative Risk Assessment and associated studies, explosions are usually taken to mean vapour cloud explosions (VCEs). However, other types of explosion are possible to model such as dust explosions and runaway reactions. In addition, BLEVEs and vessel bursts generate overpressures that may be significant. The use of modelling allows the calculation of the size of blast zones, with the level of damage to be expected at various distances, the level of overpressure, the direction of the overpressure (taking into account the presence of obstacles and the local topography) and the effect on people and structures.

What Modelling is Used for. An understanding of the behaviour of heat (and smoke) output from fires can help to determine the control measures required to protect plant and personnel. For example:  

How much separation distance is required between high hazard process areas and accommodation areas? What is the best location of accommodation buildings and control rooms and what fire protection do they require.


Tel: +44(0)1482 806805 Page: 96

3.17 - Use of Modelling such as Thermal Radiation Output. Modelling computer software can also be used to calculate:   

Dispersion rates of flammable and toxic gases, including concentrations at any given distance from the release (on and off site). Evaporation rates of flammable liquids (for example: an LNG spill). The types and magnitude of any fires, including intensity of the thermal radiation and maximum pressure generated by an explosion.

Modelling is a valuable tool to assist in examining possible major hazard scenarios, and is useful in safety case development and justification. Modelling software exists for substances which include LNG, LPG, Chlorine and Ammonia. Modelling and computer "generated predictability" can be used for:     

Identifying the size and shape of blast zones, with levels of predicted damage. Choosing the most appropriate fire fighting equipment or protection. Calculating the specifications of safe havens and refuges. Selecting the best location and protection of safety critical controls. Avoiding conflict of activities (storage, flaring, draining etc.).

Figure 1. 3D model of smoke spread on a platform.


Tel: +44(0)1482 806805 Page: 97

3.17 - Use of Modelling such as Thermal Radiation Output.

Figure 2. Gas plume modelling.


Tel: +44(0)1482 806805 Page: 98

3.17 - Use of Modelling such as Thermal Radiation Output.

Figure 3. Model of blast zone.

Figure 4. An illustration of different levels of damage resulting from a hypothetical blast.


Tel: +44(0)1482 806805 Page: 99

Question 7. What is the definition of a 'hazard'? Question 8. Put the 5 Steps to Risk Assessment into the correct order. Question 9. Match the action to be taken according to the risk level on a risk matrix. Question 10. Put these ways of managing risk into the hierarchical order of priority, from most effective to least effective. Question 11. Which risk management tool uses the concept of prevention and mitigation barriers to prevent and mitigate the risks from 'top events'. 3.18 - Example Exam Questions on Risk Management Techniques Used in the Oil and Gas Industries. Here is a selection of past exam questions on risk management techniques. As we have said previously, there is no guarantee that these questions will ever be asked again, but these will give you a good idea of the types of questions you could be asked. 1. (a) Identify the key stages of a workplace risk assessment. (5) (b) Outline the meaning of 'as low as reasonably practicable' (ALARP). (3) 2. A hydrocarbon gas plant and nearby plant suffered catastrophic damage when a gas cloud exploded after coming into contact with an ignition source. The damage may have been minimised if an associated deluge system had activated and an emergency shutdown of the plant had been performed. The disaster occurred when a pressure safety valve was removed for maintenance and a blank was attached to the open pipework within a permit-to-work system. The blank was not tightened sufficiently and when the pipework was re-commissioned a flammable gas cloud leaked from the loose blank. Similar disasters may be prevented within the oil and gas industry through risk control in the form of barrier models.


Tel: +44(0)1482 806805 Page: 100

3.18 - Example Exam Questions on Risk Management Techniques Used in the Oil and Gas Industries.

(a) Using the description and the diagram above (the top event being the gas explosion), identify: (i) ONE hazard; (1) (ii) TWO hazard control barriers; (2) (iii) TWO recovery measures; (2) (iv) ONE consequence. (1) (b) Outline reasons for involving all workers in the development of barrier models. (2) 3. Within onshore and offshore installations thermal radiation output modelling is a form of consequence modelling that helps with risk identification. a) Give the meaning of consequence modelling. (3) 4. Risk management tools and techniques are used to minimise hazardous events associated with oil and gas exploration and production activities. (a) Identify risk management tools and techniques. (6) (b) Identify the steps of risk management AND outline EACH of the steps identified. (8) (c) Identify project phases where risk management applies. (6) 5. A quantitative risk assessment is to be used instead of a qualitative risk assessment on a project to expand an existing oil and gas installation. a) Outline the meaning of a qualitative risk assessment. (4) b) Outline how a quantitative risk assessment differs from a qualitative risk assessment. (2) c) Outline the concept of as low as reasonably practicable (ALARP). (2) SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 101

3.19 - Summary. The learning outcome for this section was: 3.0 - Outline risk management techniques used in the oil & gas industries. In this section we have learnt:            

The purposes and uses of risk assessment. The definitions of hazard and risk. The principles of the 5 Steps to Risk Assessment. The differences between Qualitative, Semi-Quantitative, and Quantitative Risk Assessment. About the use of Risk Matrices. About various risk management and assessment tools such as HAZID, HAZOP and FMEA. What ALARP means. The principles of the hierarchy of controls for major incident risks. What Standard and Codes are, and who produces them for the offshore industry. The principles of Inherently Safe Design. How barrier models can assist in risk control. How consequence modelling can assist with thermal radiation output and blast zone identification. 4.0 - Documented Evidence (Safety Cases and Safety Reports).

The learning outcome for this section is: 4.0 - Explain the purpose and content of an organisation's documented evidence to provide a convincing and valid argument that a system is adequately safe in the oil & gas industries. In this section we will discuss the documented evidence i.e. safety cases and safety reports. In particular we will explain:    

What is meant by safety case and safety report. The different reasons these are required. The purposes of this documentation. The typical contents of both. 4.1 - What are Safety Cases and Safety Reports?

In Europe and Australia, over recent years, there has been a marked shift in the regulatory approach to ensuring system safety. Up until the 1980s and 1990s organisations had to comply with prescriptive safety codes and standards. Their compliance was then checked and enforced by the enforcing authority. Now, the responsibility has shifted back onto the SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 102

4.1 - What are Safety Cases and Safety Reports? developers and operators to demonstrate that their systems achieve acceptable levels of safety. To demonstrate that their operation is safe they are required to produce a 'safety case' or a 'safety report' for the enforcing authority. This contains all of the documented evidence to persuade the authority that the operation is safe and should be allowed to proceed. Safety cases are the documented evidence for offshore installations, such as oil and gas platforms. Safety reports are the documented evidence for onshore installations, such as refineries. 4.2 - The Requirements for Documented Evidence.

Legal Compliance. In some countries the production of this documented evidence is a legal requirement before an installation is permitted to be built or operate. For offshore installations, there are regulations in the UK which are specific to the offshore oil and gas industry. These are the Offshore Installations (Safety Case) Regulations 2005 (also known as OSCR). These regulations set out specific requirements to provide evidence and information that present a clear, comprehensive, and defensible argument that a system is adequately safe to operate. The document produced to provide this evidence is called a 'safety case'. For onshore installations, these are regulations in the UK which are specific to the onshore oil and gas industry. These are the Control of Major Accident Hazards Regulations 1999 (also known as COMAH) and their amendments made in 2005. Again the regulations set out specific requirements to provide evidence and information that present a clear, comprehensive, and defensible argument that a system is adequately safe to operate. The document produced to provide this evidence is called a 'safety report'.

Other Reasons. Similar legislation exists in some other countries around the world, such as Australia. However, for those countries that don't have specific legislation organisation may still need to produce a safety case because of the globalised nature of the oil and gas industry. Other parties may also request access to an organisation's documented evidence. For example it may be required during an application for insurance to demonstrate that the risk is as low as possible. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 103

4.2 - The Requirements for Documented Evidence. Interested parties may include:     

Loss adjusters and insurance companies for insurance applications and claims purposes. Clients who may be checking that your organisation has an effective safety management system. It may be used by the enforcing authority and any external accident investigation teams in the event of a major incident. The employees and their safety representatives who may need access to the evidence for training, communication, and consultation purposes. The local community and residents, particularly where they may be affected by a major incident. 4.3 - The Purpose of Documented Evidence.

As we discussed in the last page, the main purpose is to demonstrate the safety of an installation or facility. If there are legal requirements for this evidence then another purpose is to also comply with the local legislation. The safety case or safety report covers all aspects of health and safety on an installation or facility. It is submitted at the planning stage and remains in place throughout the lifespan of the facility until it is decommissioned. It is reviewed at five yearly intervals by the enforcing authority or Regulator, or sooner if requested. It should also be reviewed if there are significant modifications to the operation of the facility. This regular process of reviewing and updating ensures the continued safety of the facility throughout its lifespan. 4.4 - Typical Content of a Safety Case. In the UK The Offshore Installations (Safety Case) Regulations 2005 (OSCR) came into force on April 6th 2006. As mentioned, there are significant changes to the regulatory requirements as a result of the introduction of OSCR, including a duty on the installation operator or owner to consult safety representatives on the preparation, review or revision of safety cases. The safety case should show how this was done. You can access the HSE's guidance document on OSCR here: A Guide to the Offshore Installations (Safety Case) Regulations 2005 (L30).


Tel: +44(0)1482 806805 Page: 104

4.4 - Typical Content of a Safety Case.

Figure 1. Frontpage of the L30 document. An operator or owner is required by OSCR to submit a safety case to HSE for each installation. This is a written demonstration of safety that has to be updated whenever necessary, to reflect changing knowledge and operational conditions. HSE must accept the safety case before an installation can operate. In reaching a decision about acceptability, HSE assesses the content of the safety case. The Assessment Principles for Offshore Safety Cases (APOSC) guide that assessment. APOSC is for use by HSE assessors and industry safety practitioners. In publishing this document, the HSE aims to provide an understanding of how the HSE evaluates the acceptability of safety cases, by setting out the principles against which cases are assessed, with explanations of what is required. Safety cases should take account of each principle to the extent necessary to provide an adequate demonstration, and also include the factual information required by OSCR. APOSC complements the guidance on the Regulations. They should be read together. The three principal matters to be demonstrated in a safety case are that: 1. The management system is adequate to ensure compliance with statutory health and safety requirements; and for management of arrangements with contractors and sub-contractors. 2. Adequate arrangements have been made for audit and for audit reporting. SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 105

4.4 - Typical Content of a Safety Case. 3. All hazards with the potential to cause a major accident have been identified, their risks evaluated, and measures have been, or will be, taken to control those risks to ensure that the relevant statutory provisions will be complied with. In the following pages we will look at the specific contents of a safety case which includes:       

Factual information on the facility. Details of the management system. Demonstrate that all major accident hazards have been identified, evaluated, and controlled. How major accident risks are managed. Provisions for rescue and recovery. Consideration of the facility's lifecycle, from design to decommissioning. Demonstration of how safe design principles and inherent safety have been included in the design of the installation.

The safety case should be available to anyone on the installation who wishes to look at it. 4.5 - Offshore Safety Case Content - Factual Information. The safety case will include factual information about the installation itself, the plant and systems used, the location and external environment. It should also cover the activities to be carried out on, or in connection with, the installation. Each piece of information will be linked to all identified hazards associated with the information and which have the potential to cause a major accident. Other information includes:   

Name and address of the operator of the installation. Summary of how the employee safety representatives for that installation were consulted with regard to the preparation (or revision) of the safety case. A description, with suitable diagrams, of: o The main and secondary structure of the installation and its materials. o Its plant. o Its layout and configuration of its plant. o The connections to any pipeline or installation. o Any wells connected or to be connected to the installation. o The types of operation, and activities in connection with the operation, which the installation is capable of performing. o The maximum number of people expected to be on the installation at any time, and for whom the accommodation is to be provided. 4.6 - Offshore Safety Case: Details of the Safety Management System.


Tel: +44(0)1482 806805 Page: 106

4.6 - Offshore Safety Case: Details of the Safety Management System. The safety case should show how the management system will apply appropriate levels of control during each phase of the installation's lifecycle. This will include the design, construction, commissioning, operation, decommissioning and dismantlement stages. The safety case should include the following elements in the descriptions of the management system in order to demonstrate that the system is adequate: 









Policy setting: o Outlining the policy and its objectives. o Demonstrating corporate acceptance of responsibility. Organisation: o The structure of the organisation. o Demonstration of its accountability. o Demonstration of its safety culture. o Demonstration of how professional and safety advice will be shared. o Demonstration of how the workforce will be encouraged to be involved. o Outlining of the risk assessment systems. Planning and standards: o Outlining the standards and the procedures for controlling risks, including workload and working hours. o Outlining the permit to work system and where it will be applied. o Outlining how competency and training will be implemented. o Outlining how key personnel will be selected. o Outlining how changes will be controlled. o Outlining how contractors will be selected and controlled, including subcontractors. o Outline the planning and control for emergencies. o Outlining how occupational health will be managed. Performance measurement: o Outlining how the recording and investigation of incidents will be implemented. o Outlining how active monitoring will be implemented. Audit and review: o Outlining the auditing process. o Outlining when and how any review will be applied and the process for learning lessons.

The safety management system should clarify who is in charge of activities during normal operating conditions and in emergency situations. This would include the arrangements for communications between the 'responsible persons' both on and offshore.


Tel: +44(0)1482 806805 Page: 107

4.6 - Offshore Safety Case: Details of the Safety Management System. The safety management system should take account of:    

The levels of authority. Performance standards. How to deal with exceptional conditions. Any lessons learnt from previous incidents.

In the situation where an installation is working in combination with another installation or vessel, the safety case should summarise any arrangements which have been put in place to coordinate both parties. 4.7 - Offshore Safety Case Content: Management of Major Risks and Hazards.

Identification, Evaluation, and Control of Major Risks and Hazards. The safety case will show how a systematic process has been used to identify all reasonably foreseeable major accident hazards that are applicable to the installation. This will include identifying the initiating events or sequences related to those identified hazards. The safety case should demonstrate that all hazards with the potential to cause a major accident have been identified, their risks evaluated and that measures have been taken to control those risks. The safety case will clearly show what criteria have been adopted for major accident risk assessment, including the methods used and the evaluation process applied. They will include: 

   



That particular attention has been paid to instances or areas that have been identified where people may be exposed to significantly higher risks in comparison to the installation as a whole. How the evaluation has considered people as both a key element in safe operation as well as a potential cause of major accidents and their escalation. That adequate considerations of uncertainty has been taken into account when presenting quantitative and qualitative risk assessment arguments. That the relative merits of engineering judgement and good practice have been adequately considered. That the process of identifying risk reduction measures is systematic and takes into account new knowledge. Furthermore, what the reasoning was behind the choice of risk reduction measures. That proposed measures to reduce risk have timescales applied.


Tel: +44(0)1482 806805 Page: 108

4.7 - Offshore Safety Case Content: Management of Major Risks and Hazards.

Major Accident Risk Management. The safety case should describe what measures will be taken to manage major accident hazards. These will include:    

 



An explanation as to how inherently safer design concepts have been applied in the decision-making process relating to design. What measures are in place to prevent major accident hazards during the installation's current phase of operation and the activities associated with it. What measures are provided for detecting events that require an emergency response. What control and mitigation measures will be provided to protect personnel from the consequences of a major accident. Also, how they will take account of likely conditions during an emergency. Finally, what measures and arrangements have been made for managing an emergency. What arrangements have been made to ensure that the Temporary Refuge will provide sufficient protection to enable people to muster safely. What arrangements and provisions have been made to ensure that the integrity of the Temporary Refuge is not compromised by any of the hazards identified in the risk assessment. Also, how long this integrity has been designed to be maintained for. Demonstrate that the evacuation and escape arrangements have been integrated in a logical and systematic manner. Also, that they take into account the potential worst environmental conditions in which they may need to be undertaken.

Rescue and Recovery. The safety case should demonstrate that effective rescue and recovery arrangements have been planned for to cope with major accidents.

Combined Operations. The safety case should demonstrate how the management system addresses the additional risks associated with combined operations, including:  

The arrangements in place for coordinating the management systems of all duty holders involved in any combined operation. The arrangements in place for a joint review of the safety aspects of any combined operation by all duty holders involved, which shall include the identification of hazards with the potential to cause a major accident and the assessment of risks which may arise during any such operation.


Tel: +44(0)1482 806805 Page: 109

4.7 - Offshore Safety Case Content: Management of Major Risks and Hazards. 

The plant likely to be used during any combined operation.

Specific Examples of Arrangements. Arrangements would normally include: 

 

The arrangements for the control of well operations, including those to: o Control pressure in a well. o Prevent the uncontrolled release of hazardous substances. o Minimise the effects of damage to subsea equipment by drilling equipment. A description of the arrangements made for protecting people on the installation from toxic gas. A description of the measures or arrangements for the protection of people on the installation from the hazards of fire, heat, smoke, toxic gas, or fumes, including the arrangements for people to be evacuated from the installation. This would include: o Temporary refuges. o Emergency routes and evacuation points. o Means of evacuation from the installation. o Facilities within the temporary refuge for the monitoring and control of the incident and for organising evacuation. 4.8 - Offshore Safety Case Content: Lifecycle Requirements.

The safety case should include a design notification, which describes how the principles of risk evaluation and risk management are being applied to the design to ensure that major accident risks will be controlled. This should include well engineering aspects, especially those that refer to well operations before the start of the facility operations.

Safe Design Concept. The safety case is required to include an explanation of how inherently safe design concepts were considered and applied. This requirement not only applies to when the installation was at the design stage, but also at other stages in the life of the installation. In order to ensure an inherently safer design, the design process should incorporate at a very early stage a hazard management strategy. This should include consideration of: 

The concept selection, for example: o A platform or subsea development? o Attended or unattended wells? o Floating or fixed wells? o Multiple or single structures?


Tel: +44(0)1482 806805 Page: 110

4.8 - Offshore Safety Case Content: Lifecycle Requirements.          

Where the installation should be located and its orientation. The substitution of hazardous substances and processes by less hazardous ones. The segregation of hazards. Reducing the complexity of the design. The reduction of subsea uncertainty (for example, the use of seismic surveys). The location and routing of the riser. Making allowances for human factors (for example, by designing in fail-safe features). The selection of materials. The corrosion, erosion, and stress concentration in the design. How the design can allow for inspection and maintenance.

Decommissioning and Dismantlement. When the installation is reaching the end of its working life, the safety case will have to be revised to deal with decommissioning or dismantlement operations. At that point the safety case revision will include a description of the sequence of events from cessation of production to dismantling of the structure. The safety case will also include a description of the extent and availability of safety systems during decommissioning or dismantlement operations. Any major accident hazards identified from the decommissioning or dismantlement operations will be identified in the safety case, as well as how the management system will maintain effective control during these periods. 4.9 - Onshore Safety Reports. The safety report will be assessed by the enforcing authorities and evaluated to ensure it meets the requirements of the legislation. The safety report is split into five main sections:     

Descriptive information. Information on management measures to prevent major incidents. Information on potential major incidents. Information on measures to prevent or mitigate the consequences of a major incident. Information on the emergency response measures of a major incident.

In the following pages we will look at these sections in more detail. 4.10 - Onshore Safety Report Contents: Descriptive Information.


Tel: +44(0)1482 806805 Page: 111

4.10 - Onshore Safety Report Contents: Descriptive Information.

Overview of the Facility and its Activities. The overview will give a general outline of the installation itself, what activities are carried out, and what products it uses and produces. It will also include the identified major incident scenarios and the measures in place for protection and intervention.

Information about Dangerous Substances in Use at the Facility. This will show:   



The maximum quantities of dangerous substances likely to be present on the site at any time. The chemical name of each and every type of dangerous substance involved in the process system. The physical and chemical behaviour and/or characteristics of each type of dangerous substance including, where relevant: o Flash point. o Flammable limits. o Vapour pressure. o Density etc. The potential harm, either immediate or delayed, which could be caused by these dangerous substances. For example: o Asphyxiant. o Flammable. o Harmful to the environment etc.

Information about the Surrounding Environment. A description of the surrounding environment including use of the land or activities conducted on the surrounding land, the extent and location of population, the location of significant buildings and infrastructure (for example, hospitals, schools, road networks, etc.), and water extraction points. A map of the area usually forms part of this section. This will also show the extent of the area to be affected by the worst case scenario. 4.11- Onshore Safety Report Contents: Information on Management Measures to Prevent Major Incidents.


Tel: +44(0)1482 806805 Page: 112

4.11- Onshore Safety Report Contents: Information on Management Measures to Prevent Major Incidents.

Major Accident Prevention Policy (MAPP). The COMAH Regulations require UK based onshore facilities to produce a Major Accident Prevention Policy. The MAPP sets out the policy on the prevention of major accidents and it should outline the following:           

Description of the Safety Management System. Roles and responsibilities of all key personnel. Training requirements to maintain competency levels and correct any shortfalls in competency. Hazard identification and risk assessment process. Procedures and instructions for the safe operation of plant. Design and any subsequent modification of the site. Identification of all foreseeable emergency scenarios and preparation for them. Accident investigation procedures. How compliance will be measured. Review and audit frequency and procedures. When, and under what circumstances, the MAPP will be updated. 4.12 - Onshore Safety Report Contents: Information on Potential Major Incidents.

This section describes the processes and scenarios that could lead to a major incident occurring. This will include details about the processes, the areas of the facility likely to be affected, and the scenarios identified as plausible. 4.13 - Onshore Safety Report Contents: Information on Measures to Prevent or Mitigate the Consequences of a Major Incident. This section describes the facility, the plant, and the equipment in the context of how major incidents can be prevented or mitigated. This will include details on operating parameters and what measures are in place to ensure they are not exceeded, emergency shutdown elements, detection equipment, firefighting arrangements, emergency evacuation and temporary arrangements, etc. All these elements will be categorised into either:    

Inherent safety measures. Prevention measures. Control measures. Limitation measures.


Tel: +44(0)1482 806805 Page: 113

4.14 - Onshore Safety Report Contents: Information on the Emergency Response Measures of a Major Incident.

Onsite Emergency Plan. This section describes the protection and intervention measures which are included in the onsite emergency plan. This will include:      

What equipment there is to limit the consequences of a major incident. What arrangements there are for alerting and intervening in an emergency. What onsite and offsite resources are available. What arrangements have been made to ensure all the resources and other equipment are maintained to an acceptable standard. What arrangements there are for the training of personnel in emergency response. What arrangements there are for testing of the emergency plan.

Offsite Emergency Plan. This section describes the arrangements for involving external emergency services and agencies. This will include:    

    

Details of the site including its location, roads, and access points. A site plan showing key facilities such as control centres, medical centres, main process plants, and storage areas. Details of site personnel. Details of offsite areas likely to be affected by a major incident as well as levels of harm or damage possible. This will include the type of buildings, population density, sensitive buildings, drainage details etc. Details of dangerous substances on site including the types of substances, quantities, hazardous properties, location etc. Details of any relevant technical advice. Details of equipment and resources that are available for firefighting purposes. The function of key posts with duties in an emergency response, their location and how they can be identified. An outline of the initial actions to be taken in case of an emergency situation, such as warning the public, setting up emergency facilities such as a control room etc. 4.15 - Auditing Safety Cases and Safety Reports.

According to the HSE an audit means "a systematic assessment of the adequacy of the management system to achieve its purpose, carried out by persons who are sufficiently independent of the system (but who may be employed by the duty holder) to ensure that SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 114

4.15 - Auditing Safety Cases and Safety Reports. such assessment is objective. Under OSCR and COMAH, organisations have duties to audit their safety cases and safety reports. The frequency and scope of the audits is to be decided by the organisation and will depend on the level of risk. However, the audit plan will come under scrutiny by the enforcing authority and therefore will have to be deemed satisfactory. In addition to carrying out audits, OSCR also imposes duties on offshore organisations regarding audit reports. 

A copy of the audit report shall be kept at the head office and onboard the installation.



A written statement shall be prepared recording: o The main findings of the report. o The recommendations of the report. o The action proposed to implement those recommendations, including the timescales involved. Ensure that a record is kept of any action taken in consequence of an audit report, and a copy of that record kept at the head office and on the installation.





Audit reports and associated records shall be kept for at least 3 years. Question 12.

Is the below statement True or False? 'A safety case is required for all onshore oil and gas installations.' 4.16 - Example Exam Questions. Here are sample exam questions that NEBOSH has asked. Again, there is no guarantee that these questions will be repeated in the future. But it will give you a flavour of the types of questions asked on this subject. 1. Safety case documents offshore and safety report documents onshore contain similar information requirements. (a) Identify these similar information requirements. (4) (b) Outline the reasons for using these documents. (4) SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015)

Tel: +44(0)1482 806805 Page: 115

4.16 - Example Exam Questions. 2. In the case of a safety report: a) Outline the typical contents of an onsite emergency plan. (4) b) Outline the typical contents of an offsite emergency plan. (4) 4.17 - Summary. The learning outcome for this section was: 4.0 - Explain the purpose and content of an organisation's documented evidence to provide a convincing and valid argument that a system is adequately safe in the oil & gas industries. In this section we have learnt:    

About the documented evidence required for onshore and offshore installations. What the above evidence is used for. The typical contents of safety cases and safety reports. Auditing requirements of Safety Cases.


Tel: +44(0)1482 806805 Page: 116

SHEilds – General Contacts

SHEilds UK

SHEilds FZ-LLC

SHEilds House 24 Priory Tec Park Saxon Way Hessle Hull HU13 9PB

Block 19 Office 204 Knowledge Village Dubai PO Box 501725

Tel: 0845 122 3408 Intl: +44 (0) 1482 806 805 Email: info@sheilds.org

Safety Training India Mumbai Office No. 305, Third Floor, Sangeet Plaza, Near to Marol Fire Brigade, Marol-Maroshi Road, Marol Naka, Andheri (E), Mumbai 400 059 India Tel: +91 (0) 22 3222 6805 Tel: +91 (0) 72 0830 6494 Email: info@safetytraining.co.in

Tel: +971 4 3754012 Email: info@sheilds.me

Safety Training India Hyderabad 8-1-21/144/1, Flat No 301 Rismy Towers, Surya Nagar Colony Tolichowki X Roads Near Orange Honda Showroom Hyderabad - 500008, A.P Tel: +91 (0) 40 6464 0660 Tel: +91 (0) 98 8575 7517 Email: info@safetytraining.co.in

Safety Training India Delhi

South Africa Office

202, 203 2nd Floor, Building No. 7, Local Shoping Center, Near Pushpa Bhawan, New Delhi 110062

Savanah Office Park Corner. Rugby Street and 9th Avenue, Weltevredenpark, Roodepoort, 1715

Tel: +(0)11 43005888 Tel: +91 9540828481 Email: info@safetytraining.co.in

Tel: +2711 675 4177 Tel: +2711 675 4178 Tel: +2711 675 4179 Email: success@sheilds.co.za


Tel: +44(0)1482 806805 Page: 117

IOG Element1

Recommend Documents