Hse Offshore Guide

HEALTH AND SAFETY EXECUTIVE

HAZARDOUS INSTALLATIONS DIRECTORATE

OFFSHORE DIVISION

GUIDANCE FOR THE TOPIC ASSESSMENT OF THE MAJOR ACCIDENT HAZARD ASPECTS OF SAFETY CASES

April 2006

1

CONTENTS 1. GENERAL 6 2. VESSEL IMPACT 12

2.HS1 Loss of Integrity of Structure, Process, Pipelines, Wells 16 2.HS2 Fatalities of Workforce 16 2.G1 Attendant and Passing Vessels 18 2.G2 Failures: Positional, Navigational, Procedural, Human Error 20 2.F1 Likelihood Factors [including historic data] 22 2.F2 Loss of Integrity to Installation Systems 23 2.F3 Fatalities to Workforce 23 2.F4 Subsea Facilities, Exclusion Zone 25 2.F5 Verification, Testing & Inspection 26 2.F6 SBVs, Communications & Procedures 27 2.F7 SBVs, Visual & Radar, Platform Mounted Radar, Automated Systems 28 2.F8 Procedures [Including Vessel Contracting, Vessel Suitability, Platform Operations, Inspections, Marine Operations and Combined Operations] 29 2.F9 Physical Protection 30 2.F10 Robust Structure, Plant and Equipment 31

3 LOSS OF STRUCTURAL INTEGRITY 32 3.HS1: Fixed Steel Installations 36 3.HS2: Fixed Concrete Installations 36 3.HS3: Semi Submersible Installations 36 3.HS4: Ship Shaped/Floating Installations 36 3.HS5: Jack-Up Installations 36 3.G1: Extreme Weather, including Wave-In-Deck Loading 39 3.G2: Fatigue Failure 39 3.G3: Corrosion 39 3.G4: Marine Growth 39 3.G11: Foundation Failure 39 3.G12: Scour 39 3.G13: Seismic Event 39 3.G5: Poor Fabrication Procedures/Materials Defects/ Materials Failure [Brittle Fracture]42 3.G6: Topsides Overloading 42 3.G7: Change of Use/Structural Modification 42 3.G17 Inadequate Management System Procedures 42 3.G18: Inadequate Design 42 3.G19: Inadequate Inspection, Repair & Maintenance During Fabrication and Operation 42 3.G20: Inadequate Re-assessment 42 3.G21: Inadequate Verification 42 3.G22: Operator Error 42 3.G8: Fire 47 3.G9: Explosion 47 3.G10: Blowout 47 3.G14: Boat Impact 47 3.G15: Helicopter/Aircraft Impact 47 3.G16: Dropped Objects 47 3.F1: Hazard Studies [HAZOPs etc] 49 3.F2: Generic Historical Data 49 3.F3: Installation Specific Data 49 3.F4: IVB Data 49 3.F5: Reliability Analysis 49 3.F6: Extent of Structural Damage/Failure 49 3.F7: Reduced Redundancy, Remaining Residual and Reserve Strength 49 3.F8: Remaining Fatigue Life 49 3.F9: Concept Selection 52 3.F10: Use of Best Design Practice 52

2

3.F11: Use of Suitable Safety Factors 52 3.F12: High Redundancy - Inherent Safety 52 3.F13: Optimum Materials and Fabrication Procedures 52 3.F14: Maintenance Management Procedures 52 3.F15: Sufficient Air Gap for 10,000-year Storm 52 3.F16: Suitable Safety Factors [Fatigue, Applied Loading, Pile loads etc] 52 3.F17: High Redundancy - Prevention 52 3.F18: Maintenance and Repair Management Procedures 52 3.F19: Control Measures [Management/Structural] for Accidental Loads 52 3.F20: Suitably Rated Fire and Blast Walls/Use of PFP etc 52 3.F21: Maintenance & Repair Management Procedures 52 3.F22: System Management Procedures for Accidental Loads 52 3.F23: High Redundancy – Mitigation 52

4.1 LOSS OF MARITIME INTEGRITY - LOSS OF STABILITY 56 4.1.HS1 Jack Ups 61 4.1.HS2 Semi Subs 61 4.1.HS3 Monohulls 61 4.1.HS4 Other Types 61 4.1.G1-G5 Initiators 61 4.1.F1-F29 Risk Evaluation Measures 61 4.1.F30-49 Risk Management Measures 61

4.2 LOSS OF MARITME INTEGRITY - LOSS OF POSITION 66 4.2.HS1 Mooring System 71 4.2.G1-G5 Initiators 71 4.2.F1-F16 Risk Evaluation 71 4.2.F17-F35 Risk Management Measures 71 4.2.HS2 Dynamic Positioning 74 4.2.G1-G5 Initiators 74 4.2.F1-F16 Risk Evaluation 74 4.2.F17-F35 Risk Management Measures 74

5.1 LOSS OF CONTAINMENT - PROCESS 80 5.1.HS1: Pressure Vessels (Including Columns) 84 5.1.HS5: Piping and Piping Components 84 5.1.HS12: Valves 84 5.1.HS2: Heat Exchangers 93 5.1.HS3: Atmospheric Vessels [eg Wemcos, TPSs] 95 5.1.HS4: Centrifuges/Hydrocyclones 97 5.1.HS6: Smallbore Tubing 98 5.1.HS8: Flexible Hoses 99 5.1.HS9: Pumps 100 5.1.HS10: Compressors 100 5.1.HS11: Turbines 100 5.1.HS13: Deck Tanks 102 5.1.HS15: Hazardous Drains/Caisson 103 5.1.HS17: Flare Towers 105 5.1.HS18: Mechanical Integrity of FPSO Mooring Turrets 106 5.1.HS19: Temporary Equipment 108 5.1.G1 Part 1: Corrosion: Internal 110 5.1.G1 Part 2: Corrosion: External 113 5.1.G2: Erosion 115 5.1.G4 Internal explosion 117 5.1.G7: Fire 119 5.1.G24: Incorrect Material Specification 120 5.1.G26: Thermal Radiation 122 5.1.F1: Generic Historical Data 123 5.1.F2: Company and Installation Specific Data 124 5.1.F3: Installation Specific Hazard Studies 125

3

5.1.F4: Layout 127 5.1.F8: Safety Integrity Levels Standards 129 5.1.F10: Concept Selection 131 5.1.F11: Size of Release, Speed of Detection and Effectiveness 132 5.1.F12: Dispersion, Open or Closed Modules, Ventilation Rates 133 5.1.F14: Inherent Safety 134 5.1.F15: Relief Systems 136 5.1.F16: High Integrity Protection Systems [HIPS] 138 5.1.F17: Blowdown/Flare Systems 140 5.1.F18: Shutdown Systems 142 5.1.F19: Alarm and Trip Systems 144 5.1.F23: Isolations 146

5.2 LOSS OF CONTAINMENT – PIPELINES 147 5.2.HS0: The Pipeline System 151 5.2.HS1: Rigid Risers 159 5.2.HS2: Other Risers including Flexible Risers 162 5.2.HS3: Outboard Pipeline 165 5.2.HS4: ESDV Valves (ESDV) 168 5.2.HS5: Subsea Isolation Systems (SSIS) 171 5.2.HS6: Pig Traps 175

5.3 LOSS OF CONTAINMENT – FIRE & EXPLOSION 178 5.3.F1: Ignition Probability 181 5.3.F3: Delayed or Immediate Ignition 182 5.3.F7: Escalation, Layout, Separation, Open/Closed Modules 184 5.3.F8: Fire Types 186 5.3.F9: Thermal Flux, Smoke Obscuration Effects 187 5.3.F10: Fire Modelling 188 5.3.F11: Explosion Modelling 189 5.3.F13: Intrinsically Safe Electrical Equipment 191 5.3.F14: Separate Accommodation Jacket 193 5.3.F17: Normally Unmanned Installations (NUI) 194 5.3.F19: Layout – No Jet Fire Targets 195 5.3.F20: Hazardous Area Zoning 196 5.3.F21: Electrical Equipment for Use in Potentially Flammable Atmospheres 197 5.3.F23 Fire/Smoke/Gas/Flame Detectors/Alarms 199 5.3.F24 Firewalls 200 5.3.F25 Passive Fire Protection [PFP] 201 5.3.F26 Resistant Temporary Refuges 202 5.3.F27 Deluge & Sprinklers 203 5.3.F28 Ventilation and HVAC 204 5.3.F29 Blast Walls 206 5.3.F30 Suppression and Flame Arrestors 207

6. WELLS 208 7. DIVING 215

7.HS1: Divers Life Support Equipment 220 7.HS2: Diving Bell/Basket Systems 222 7.HS3: Deck Chamber Complex 224 7.HS4: Common Systems 226 7.HS5: Diving Platform 228 7.F1-F3: Risk Evaluation 230 7.F1-F3: Risk Evaluation 232 7.F4-F9: Risk Management Measures 234

8. HELICOPTER CRASH 236 8.HS1 Helicopters 239 8.HS2: Other Aircraft 239 8.F1-F9: Risk Evaluation 242 8.F10-F20: Risk Management Measures 244

4

9. NON PROCESS FIRES & EXPLOSIONS 246 9.HS1: Accommodation Fires 249 9.HS2: Cellulosic Fires 251 9.HS3: Electrical Fires 252 9.HS4: Non Cellulosic Fires 254

10. Emergency Response 255 10.F1: Emergency Response Management 257 10.F2: Alarms and Communication 259 10.F3: Temporary Refuge and Muster Stations 261 10.F4: Access/Egress Routes 263 10.F5: Evacuation 265 10.F6: Escape 267 10.F7: Rescue and Recovery 269 10.F8: Ship Collision 271 10.F9: Emergency Lighting 273 10.F10: Emergency Communications 275

11. HUMAN FACTORS 279 11.G1: Human Error: Selection, Competence and Training 280 11.G2: Human Error: Stress, Fatigue, Shifts and Organisational Factors 282 11.G3: Human Error in Design 284 11.G4: ALARP & SFAIRP Awareness 286 11.G5: Command, Control, Communication [C ] and Decision Making3 288 11.G6: Procedural Integrity 290 11.G7: Permit to Work Systems 292 11.G8: Employee Involvement 294 11.G9: Organisational Change Management 296 11.G10: Knowledge Management 298 11.G11: Contractualisation: Communications and Competence 300 11.G12: Multi Skilling/Multi Tasking 302

12. HUMAN VULNERABILITY 304 13. QUANTITATIVE RISK ASSESSMENT [QRA] 306 14. GLOSSARY OF ABBREVIATIONS 307

5

1. GENERAL 1 Introduction

The purpose of this document is to provide a framework of topic assessment principles and guidance in respect of the assessment of the major accident hazard aspects of offshore safety cases.

The aims of this framework of assessment principles and guidance are:

• to complement SCHAM in respect of topic assessment

• to form a component of the OSD quality system for safety case assessment

• to provide OSD with defensibility for the decisions made regarding the sufficiency of the technical content of offshore safety cases

• to give greater transparency to the assessment decisions and criteria

• to provide a basis for consistency in the assessment process and its outcomes

• to facilitate effective interfacing between the various topic assessments

• to provide guidance material for specialist assessors, including those who may be new to HSE, OSD or safety case assessment

• to identify where there are ‘gaps’ in the supporting topic guidance

• to identify, by reference, relevant technical policy and good practice

• pletion reports, etc] by

relating the judgements to particulars in the guidance

• to allow for peer review to be undertaken.

of

can only be finally determined by topic assessors using experience and judgement.

g the basis and scope of the assessment considerations and the assessment outcomes.

reasonable clarification of HSE’s expectations of the technical content of safety cases.

ough

ded as an exhaustive statement of the available measures or of performance standards.

as representing good practice, alternative approaches proposed by a duty holder are likely

to assist assessors in the recording of judgements made during the assessment process [eg assessment briefs, issue notes, case com

The document is intended primarily to assist topic assessors in undertaking assessment activities, but it does not purport to present definitive criteria in respect of the adequacythe technical content of safety case submissions. Adequacy, or otherwise, is contextspecific and

The document will also be valuable to case managers and deputy case managers in understandin

An aim of the guidance is to provide the offshore industry with

The guidance should enable assessment to be undertaken in accordance with the requirements of the Offshore Installations (Safety Case) Regulations 2005 [SCR], thrconsideration of major accident hazards and the duty holder’s evaluation of risk and proposed risk control measures. Although the guidance indicates areas where measures for controlling risk are required, the document is not inten

Whilst the guidance contains reference to specific standards, models, methodologies, etc

6

http://www.hse.gov.uk/offshore/scham/index.htm

to be acceptable if the duty holder can demonstrate that the alternative approaches are equivalent, or better, in terms of health and safety, than those cited in the guidance.

Information pertaining to the use of good practice and research information in safety case assessment is contained in SCHAM.

The document can also be used to provide valuable reference material to identify good practice, together with industry, national and international standards, which will aid OSD’s inspection and enforcement activities.

2 Scope

The scope of this guidance is intended to address the assessment of duty holder’s submissions in respect of SCR Regulation 12 (1). The scope does not include the administrative procedures to be adopted for safety case assessment which are addressed in SCHAM.

3 Safety Management Systems

Safety management systems (SMS) encompass many of the systems and procedures, the failure of which are key causal factors in most accidents/incidents. Moreover leadership based on sound values and policies can lead to a climate of improvements and gains in health, safety and sustainability. SMS are relevant to the lifecycle of an installation i.e. from initial concept design to dismantlement.

A safety case should contain sufficient information to indicate that a clearly defined safety management system is in place for the installation, which complies with current good practice which includes the following examples:

HS (G) 65 Successful Health and Safety Management

Plant guidelines for the technical management of Chemical Process Safety AIChE

STEP Guide to SMS Interfacing

Assessment Principles for Offshore Safety Cases [APOSC] - Management of health and safety - Principle 2

A Guide to the Offshore Installations (Safety Case) Regulations 2005 (L30). Regulation 12 paragraphs 176 to 186

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACoP and guidance (L65)

GASCET Chapter 11 - Human Factors

The SMS should encompass the marine, helicopter and diving activities of the installation, and relevant aspects of combined operations. The areas of interface between the SMS of these operations, and the SMS of the installation, need to be identified and assessed for clarity, to ensure no potential hazard from either duplication/commission or omission.

One key SMS issue is the area of examination, maintenance, test, and verification of equipment: particularly where the equipment in question is a safety critical element, as defined under the scheme of verification required by SCR, or the scheme for the systematic examination of plant required by PFEER, this includes the competence, experience and supervision of those who operate and maintain these safety critical elements. There is an overlap with the aspects of SMS that deal with verification and examination schemes, and there may be some synergy in an integrated assessment of these. Furthermore, as the above safety critical elements and plant will be identified in the

7

http://www.hse.gov.uk/offshore/scham/index.htm

http://www.hse.gov.uk/offshore/aposc190306.pdf

fire and explosion risk assessment for the installation, there is a link to the topic areas of risk assessment (GASCET Section 13) and fire/explosion (GASCET Section 5.3).

4 Assessment of Adequacy

In assessing the major accident hazard aspects of safety case submissions it is necessary to determine the adequacy of, inter alia,

• Hazard identification

• Risk evaluation

• Risk management measures [barriers and performance standards]

• The demonstration of compliance with the relevant statutory provisions

The significance and importance of the components of the above is dependent on the specific aspects of the installation being considered, e.g. the installation type and lifecycle stage. Each section addresses both installation type and lifecycle aspects. In general the base case guidance is for an operational safety case. Where points do not apply for certain types of safety case, or additional points do apply this is specifically identified.

To assist in the assessment process prompt lists have been developed based on the experience of HSE personnel and these are documented in a categorisation table in each of the major accident sections. Each section that deals with a hazard has a categorisation table having six sub-sections that provide supporting information:

• Source of Hazard

• Initiators

• Risk Evaluation

• Risk Management Measures

Inherent Safety

Prevention

Detection

Control

Mitigation

• Performance Standards

Additionally there are standalone sections for Emergency Response, Human Factors, Human Vulnerability and QRA.

4.1 Categorisation Table

The prompt lists presented in the tables in each of the major accident hazard sections constitute a categorisation table for each major accident hazard. The categorisation table can be used in association with the installation specific aspects presented in the submission to identify sources of hazard and initiators that may combine to start escalation paths to a major accident, consequence paths that might thereafter ensue, and potential risk management measures. Where appropriate and available, areas where performance standards should be considered are identified.

8

4.2 Hazard Identification

In general for a major accident to occur a source of hazard has to be present together with at least one initiator. In each major accident hazard section the appropriate categorisation table may include sub-classification of sources of hazard and does contain a number of ‘initiators’. Generally in each section the categorisation table contains grouping/sub-classification of similar initiators.

An assessor should examine the adequacy of the hazard identification in conjunction with the contents of the categorisation tables in each section.

4.3 Risk Evaluation

The evaluation of the risk that might stem from each major accident hazard can be assessed by identification and evaluation of factors that might result in an adverse combination of source of hazard and initiator [causal chains], together with identification and evaluation of escalation paths that might result [consequence chains].

The information in each categorisation table under the heading of risk evaluation lists prompts to assist in assessing the adequacy of the duty holder’s identification and evaluation of such causal and consequence chains. These are subdivided into ‘likelihood factors’ [factors affecting the frequency of the major accident] and ‘consequences’.

4.4 Risk Management Measures

The adequacy of the duty holder’s identification and selection of risk management measures and their proposed implementation should be assessed. Such measures can be classified as barriers. These may be one or more of engineering, procedural or human [also classified as hardware, software or live ware].

By priority the barriers can be categorised as:

Inherent Safety

Prevention

Detection

Control

Mitigation

Each categorisation table contains potential risk management measures categorised according to these barrier types. An assessor should note that a duty holder might change the barrier emphasis to suit the company policy and/or the characteristics of a particular installation.

An assessor should assess the adequacy of the barriers [and their associated performance standards] described in a safety case in combination for each major accident in the light of the nature of the hazards, the type of installation and the level of risk.

4.5 Performance Standards

To assist in the assessment of the adequacy of the duty holder’s submission in relation to performance standards, areas where such standards might be required have been identified and listed in the categorisation tables in each section. Performance standards are generally installation and context specific and the adequacy of them must be judged on a case-by-case basis. In each section the relevant performance standards have been grouped into categories pertaining to the different risk management measures [barriers].

9

The associated text in each section provides details of, or reference to, good practice associated with each performance standard.

In general the management of risks associated with major hazards for new installations should be better than for similar existing installations. Therefore for new installations and major modifications assessors should be looking for evidence that duty holders are adopting existing good practice [as a minimum], and for a clear indication how best practice is being addressed.

4.6 Depth of Assessment

Each section provides an indication of the scope of assessment that is likely to be required according to the type of safety case and the nature of the circumstances. The depth of assessment is to be guided by the assessment and be sufficient to establish that the measures being taken will control the major accident risks so that the relevant statutory provisions are complied with.

In addition, in order to determine the adequacy of the demonstration of compliance with the relevant statutory provisions an assessor should consider whether a duty holder has adequately assessed the reasonable practicability of introducing further risk management measures, to further reduce risk.

Where safety case contents match with good practice identified in the assessment sheets for a particular topic associated with a major accident, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue to follow-up through inspection.

5 Interfaces between Assessors:

Each section provides an indication of the topic teams that have an interest in the major accident in general and in particular the risk management measures and their performance standards through cross-referencing to other section as appropriate. This should be used as a guide to where dialogue between topic assessors will be required.

6 Reference Documents:

There are a number of documents that provide generic guidance. These are listed below.

L30 A Guide to the Offshore Installations (Safety Case) Regulations 2005 Third Edition HSE Books 2006 ISBN 0 7176 9184 9

Assessment Principles for Offshore Safety Cases [APOSC]

HSE Offshore Information Sheet 2/2006 Offshore Installations (Safety Case) Regulations 2005 Regulation 12 Demonstrating compliance with the relevant statutory provisions

SPC/Permissioning/09 HID’s Approach to ALARP Decisions

The HSE ALARP Suite of Guidance, comprising:

a) Principles and Guidelines to assist HSE in its Judgements that duty holders have reduced risks as low as reasonably practicable

b) Assessing Compliance with the Law in Individual Cases and the Use of Good Practice

c) Policy and Guidance on Reducing Risks as low as reasonably practicable in Design

10


http://www.hse.gov.uk/offshore/sheet22006.pdf


http://www.hse.gov.uk/foi/internalops/hid/spc/spcperm09.pdf

http://www.hse.gov.uk/risk/theory/alarp1.htm






d) HSE principles for Cost benefit Analysis (CBA) in support of ALARP decisions

e) Cost Benefit Analysis (CBA) Checklist

f) ALARP ‘at a glance’

g) Reducing Risks, Protecting People, HSE’s Decision Making Process [R2P2]

L21 Management of Health and Safety at Work ACOP Second Edition HSE Books 2000 ISBN 0 7176 2488 9

UKOOA Risk Framework Document

11

http://www.hse.gov.uk/risk/theory/alarpcba.htm

http://www.hse.gov.uk/risk/theory/alarpcba.htm

http://www.hse.gov.uk/risk/theory/alarpcheck.htm

http://www.hse.gov.uk/risk/theory/alarpglance.htm

http://www.hse.gov.uk/risk/theory/r2p2.pdf

http://www.hse.gov.uk/risk/theory/r2p2.pdf

2. VESSEL IMPACT 1. Scope

This section provides guidance for the assessment of safety case content with respect to vessel collisions, from hazard identification through to consequence determination, including risk management measures. Interfaces with other sections are identified.

2. Assessment of Adequacy of Demonstration

The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a hazard source and an initiator [causal chains], together with identification and evaluation of escalation paths that might result [consequence chains].

Two broad hazard sources can be identified and divided into a number of different vessel types thus:

• Attendant vessels

• Passing vessels

For a major accident to be realised, these Hazard Sources need an Initiator. For vessel collisions, the following broad categories of Initiator are proposed:

• Positioning Failure

• Navigational Failure

• Procedural Failure

• Human Error

Evaluation of risk will need consideration of the likelihood and consequence factors:

• Frequency

• Consequence

The usual measures are employed in controlling the hazard:

• Inherent Safety

• Prevention through

Procedures

Personnel

High Visibility

Incident Reporting and Analysis

Detection

• Control through

Quality Assurance

Operating envelope

12

Procedures

Fenders/barriers

• Mitigation

Platform ESD system

Pipeline subsea ESD valve

Shock resistant plant

Physical protection

Structural integrity

o Robustness

o Redundancy

o Reserve strength

o Double hulls

• Emergency Response

3. Depth of Assessment

This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions.

Where relevant sections of the safety case are consistent with the good practice identified in the assessment sheets, there will usually be no need for an assessor to probe into the details of the application of this practice. However, this may be a suitable issue to follow-up through inspection.

13

4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation Table below:

Vessel Impact

Source of Hazard

Initiators Risk Evaluation Risk Management Measures

Performance Standards

HS1 Loss of Integrity G1 Attendant and Passing Vessels

Frequency Inherent Safety

- Structure

- Process

- Pipelines

- Wells

HS2 Fatalities of Workforce

G2 Failures F4 Subsea Facilities, Exclusion zone

- Positional

- Navigational

- Procedural

- Human Error

F1 Likelihood Factors [including historic data]

Prevention

F5 Verification, Testing and Inspection

F6 SBVs, Communications and Procedures

14

Vessel Impact

Source of Hazard



F7 SBVs, Visual & Radar, Platform Mounted Radar, Automated Systems

F8 Procedures [Including Vessel Contracting and Suitability, Platform Operations, Inspections, Marine Operations and Combined Operations]

Consequences

F2 Loss of Integrity to Installation Systems [structural, process, pipelines, wells]

F3 Fatalities to Workforce Mitigation

F9 Physical Protection

F10 Robust Structure, Plant and Equipment

15

2.HS1 Loss of Integrity of Structure, Process, Pipelines, Wells

2.HS2 Fatalities of Workforce

1. Confirmation should be obtained that the risks to the workforce, integrity of the structure, the topside process and safety related equipment, pipelines and wells from all foreseeable attendant and passing vessel collisions are or will be controlled to ensure compliance with the relevant provisions. This is achieved by a multidisciplinary approach using assessment sheets contained in the relevant sections.

2. There are likely to be differing company standards used in demonstration and each should be examined for equivalence with general ALARP principles.

3. Relevant Legislation, ACOP and Guidance includes:

Offshore Installations (Safety Case) Regulations 2005

Offshore Installations and Wells (Design and Construction, etc) Regulations 1996


4. Specific Technical Issues:

For passing vessels there should be time to take some form of emergency action and assessment should, in the main, be carried out in line with that in Section 10 Emergency Response. Attendant vessels may provide a more instantaneous vessel collision and hence it is expected that appropriate robustness is built into the installation engineering and safety systems.

5. Other Related Assessment Sheets in this Section are:

2.F1 Likelihood Factors [including historic data]

2.F2 Loss of Integrity to Installation Systems

2.F3 Fatalities to Workforce

2.F4 Subsea Facilities, Exclusion Zone

2.F5 Verification, Inspection, Testing

2.F6 SBVs, Communications, and Procedures

2.F7 SBVs visual and radar, platform mounted radar, automated systems

2.F8 Procedures - including Vessel contracting, vessel suitability, platform, operations, inspections, marine operations & combined operations

2. F9 Physical protection

2.F10 Robust Structure, plant and equipment

6. Cross-Referenced Sections and Sheets are:

Sheet 3.G14 Boat Impact

Sheet 4.1.G5 Collision/Grounding

Sheet 10.F8 Ship Collision

Section 11 Human Factors

16


Section 12 Human Vulnerability

7. Lead Assessment Section for this Sheet:

OSD5.5

8. Team responsible for authoring and updating this sheet:

OSD5.3

17

2.G1 Attendant and Passing Vessels

1. Confirmation should be obtained that the all foreseeable attendant vessels have been identified and that particular passing vessels that may be in the vicinity of the installation have been identified.

2. The adequacy of vessel identification process can only be assessed on an individual basis. Typical vessels may include:

• Attendant vessels

Standby vessels

Supply vessels

Multi-purpose vessels

MODUs

Semis

Jack-ups

Drill ships

Accommodation units

Shuttle tankers

Heavy lift vessels

Anchor handling vessels

Diving support vessels

Survey vessels

Well intervention vessels

Tugs

Barges

Multi-role vessels [standby and supply]

Pipe lay

Counter pollution vessels

• Passing vessels

All of the above [when headed for other installations]

Merchant vessels, including:

Ferries

Fishing craft

Pleasure crafts

Naval craft

18

Submarines

Further consideration will be required where installations are located in known shipping routes.






None


None


None


OSD5.5


OSD5.3

19


2.G2 Failures: Positional, Navigational, Procedural, Human Error

1. For a major accident to be realised, the collision of passing and attendant vessels is caused by a failure on those vessels. For vessel collisions, the following broad categories of Initiator are proposed:

• Positioning Failure

DP failure

Mooring failure

Extreme weather

Installation moves

Weather vaning

• Navigational Failure

Watchkeeping failure

Navigation equipment failure

Navigation aids failure

Mechanical failure

Control system failure

Power failure

• Procedural Failure

Incorrect/Inappropriate

Not correctly applied

• Human Error

Commission/Omission/Fatigue

Specific assessment and guidance on these failures for passing vessels are outwith the scope of this document. However, some control can be expected on reducing the risk for initiators for attendant vessels.

UKOOA Guidelines for Ship/Installation Collision Avoidance, 2003

2. The above guidelines are generic in nature and treatment of the initiators for individual platforms and platform layouts should be assessed.





4. Specific Technical Issues

20


Initiators for attendant vessels will be vessel, company and installation specific. Assessment should seek out this information.

5. Other Relevant Assessment Sheets in this Section are:

2.F5 Verification, Testing & Inspection

2.F6 SBVs, Communications, and Procedures

2.F7 SBVs Visual and Radar, Platform Mounted Radar, Automated Systems

2.F8 Procedures - Including Vessel Contracting, Vessel Suitability, Platform Operations, Inspections, Marine Operations & Combined Operations

6. Cross Referenced Sections and Sheets are:

Section 4.1 Loss of Maritime Integrity - Loss of Stability

Section 4.2 Loss of Maritime Integrity - Loss of Position

Section 10 Emergency Response

Section 11 Human factors

7. Lead Assessment for this Sheet:

OSD5.5

8. Team responsible for authoring this sheet:

OSD5.3

21

2.F1 Likelihood Factors [including historic data]

1. Confirmation should be obtained that the likelihood of vessel collisions has been derived from a recognised model or from a local marine traffic survey.

• Use of software, ‘COAST, CRASH, COLLIDE, MAN’

• Shipping surveys

• Historic data

2. Where the hazard identification process listed above has not been used, judgement as to the adequacy can only be assessed on an individual basis.

Further consideration will be required on an installation specific basis.

• Installation location, particularly when sited near known shipping routes

• No dedicated standby vessel

• Vessel control and speed

• Point of contact with installation

• Vessel orientation






None


None


None


OSD5.5


OSD5.3

22



2.F3 Fatalities to Workforce

1. Confirmation should be obtained that all consequences of a vessel collision have been considered. The consequences may involve many disciplines and a multidisciplinary approach should have been used.

2. Where a multidisciplinary approach has not been used, the adequacy should be judged by examining the completeness of the technical consequences documented.






Injuries to people

o Direct contact

o Strong vibration

Loss of structural integrity

o Direct contact

o Strong vibration

o Large relative deformation

Loss of stability

o Direct contact

o Strong vibration

o Large relative deformation

Loss of position

o Direct contact

Loss of containment

Loss of other safety critical equipment

Loss of EER


2.F9 Physical Protection

2.F10 Robust Structure, Plant and Equipment


23


Sheet 4.1.G5 Collision/Grounding

Sheet 10.F8 Ship Collision




OSD5.5


OSD5.3

24

2.F4 Subsea Facilities, Exclusion Zone

1. Confirmation should be obtained that, where appropriate in design cases only, subsea facilities have been considered in the concept selection thus providing inherent safety by eliminating the need for surface facilities. Where surface facilities are provided confirmation should be obtained that the safety system acknowledges the management of appropriate exclusion zone.

2. Not applicable.





4. Specific technical issues:

None


None


Section 6 Wells



OSD5.5


OSD5.3

25



1. Confirmation should be obtained that procedures and equipment for the prevention of collisions follow the requirements of the recognised guidance/codes of practice below:

UKOOA Guidelines for Ship/Installation Collision Avoidance 2003

UKOOA Guidelines for Survey of Vessels Standing by Offshore Installations 2001

UKOOA Guidelines for the Management & Operation of Vessels Standing by Offshore Installations 2001.

UKOOA Guidelines for the Safe Management & Operation of Offshore Support Vessels 2002.

Guidance & ACOP to the Offshore Installations (Prevention of Fire & Explosion & Emergency Response) Regulations 1995 (L65)

Further guidance can be obtained from:

OTO 1999 052 Effective Collision Risk Management for Offshore Installations

2. Where standard or guidance other than that listed above has been used, judgement as to the adequacy of the detection system can only be assessed on an individual basis.

Alternative/additional measures may be required for other types of field arrangement or when standby vessel sharing is agreed.






None


2.F7 SBVs Visual & Radar, Platform Mounted Radar, Automated Systems

2.F8 Procedures [Including Vessel Contracting, Vessel Suitability, Platform Operations, Inspection, Marine Operations and Combined Operations]





OSD5.5


OSD5.3

26

http://www.hse.gov.uk/research/otohtm/1999/oto99052.htm


2.F6 SBVs, Communications & Procedures

1. Confirmation should be obtained that procedures and equipment for the prevention of collisions follow the requirements of the recognised guidance/codes of practice below:



UKOOA Guidelines for the Management & Operation of Vessels Standing by Offshore Installations 2001

UKOOA Guidelines for the Safe Management & Operation of Offshore Support Vessels 2002

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 ACOP & Guidance L65










None








OSD5.5


OSD5.3

27



2.F7 SBVs, Visual & Radar, Platform Mounted Radar, Automated Systems

1. Confirmation should be obtained that detection equipment, operation and procedures follow the requirements of the recognised guidance/codes of practice below:


UKOOA Guidelines for the Management & Operation of Vessels Standing by Offshore Installations 2001

L65 Guidance & ACOP to the Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995



OTO 97 058 Performance of Standby Vessel Radar

2. Where standards or guidance other than that listed above has been used, judgement as to the adequacy of the detection system can only be assessed on an individual basis.







None









OSD5.5


OSD5.3

28


http://www.hse.gov.uk/research/otopdf/1997/oto97058.pdf


2.F8 Procedures [Including Vessel Contracting, Vessel Suitability, Platform Operations, Inspections, Marine Operations and Combined Operations]

1. Confirmation should be obtained that the control of collision risks follow the requirements of the recognised guidance/codes of practice below:


UKOOA Guidelines for the Safe Management & Operation of Offshore Support Vessels 2002


L65 Guidance & ACOP to the Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995










None









OSD5.5


OSD5.3

29



2.F9 Physical Protection

1. Confirmation should be obtained that all Safety Critical Elements [SCEs] within zones vulnerable to impact from attendant vessels are properly protected against damage due to direct impact, large relative deformations and strong vibrations. Examples of such SCEs are:

• Risers [possibly including associated ESD valves]

• Conductors

• Caissons

• Escape routes and other EER related items

There is no specific guidance about what constitutes adequate protection, although some of the analysis techniques used in Section 3 Loss of Structural Integrity may be used to demonstrate strength through design.

2. Due to the lack of guidance at present, adequacy can only be assessed on an individual basis.

Further consideration will be required where damage to SCEs is tolerated on the basis that other safeguards are in place. This may require discussion with other topic teams.






None




Section 3 Loss of Structural Integrity

Section 5.1 Loss of Containment - Process

Section 5.2 Loss of Containment - Pipelines

Section 6 Wells



OSD5.1 to OSD5.3


OSD5.3

30


2.F10 Robust Structure, Plant and Equipment

1. Confirmation should be obtained that the safety critical plant and equipment in the installation can sustain the large displacements and strong vibrations resulting from reasonably foreseeable collisions from attendant vessels [see Section 3 Loss of Structural Integrity].

For structures there is limited authoritative guidance in this area:

ON 27 Status of Technical Guidance on Design, Construction and Certification

Also two main methods are currently available:

• Qualitative – through techniques such as Walkdown

• Quantitative – by structural analysis coupled to survival criteria for the plant and equipment

2. Due to the lack of guidance at present, adequacy can only be assessed on an individual basis.






None


2.F2 Loss of Integrity of Installation Systems





Section 6 Wells


OSD5.1 to OSD5.3 [structural aspects]

OSD3 [plant and equipment]


OSD5.3

31

http://www.hse.gov.uk/offshore/notices/on_27.htm


3 LOSS OF STRUCTURAL INTEGRITY 1. Scope

This Section provides guidance for the assessment of safety case content with respect to the loss of structural integrity of an installation, from hazard identification through to consequence determination, including risk management measures.


The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator, together with identification and evaluation of escalation paths that might result.

The loss of structural integrity major accident hazard sources have been classified as follows:

• Fixed steel installations

• Fixed concrete installations

• Semi submersible installations

• Ship shaped/floating installations

• Jack-up installations

For the latent major accident hazards to be activated towards a major accident, initiators have been identified. These have been classified as:

• Accidental hazards

• Environmental hazards

• Management system hazards



Where safety case contents match with good practice identified in the assessment sheets for a particular topic associated with a major accident, there will usually be no need for an assessor to probe into the details of the how the good practice is applied. This may, however, be a suitable issue to follow-up through inspection.

A list of references is provided in each assessment sheet. It should be noted that a more extensive commentary should be referenced. The documents listed provide further guidance, particularly in relation to good practice and performance standards. In some cases the reference material will not be fully applicable and may be limited in some parts. These aspects are referred to on the assessment sheets.

32


Loss of Structural Integrity

Source of Hazard



HS1 Fixed Steel Installations

G1 Extreme Weather, incl. Wave-In-Deck Loading


HS2 Fixed Concrete Installations

G2 Fatigue Failure

HS3 Semi submersible Installations

G3 Corrosion F1 Hazard Studies [HAZOPS etc]

F9 Concept Selection Substructure Topsides

HS4 Ship-Shaped/Floating Installations

G4 Marine Growth F2 Generic Historical Data F10 Use of Best Design Practice

HS5 Jack-Up Installations

G5 Poor Fabrication Procedures /Materials Defects/Materials Failure [Brittle Fracture]

F3 Installation-Specific Data F11 Use of Suitable Safety Factors Fixed steel installations

G6 Topsides Overloading F4 IVB Data F12 High Redundancy Fixed Concrete Installations

G7 Change of Use/Structural Modification

F5 Reliability Analysis F13 Optimum Materials and Fabrication Procedures

Semi Submersibles

G8 Fire F14 Maintenance Management Procedures

Ship-Shaped Installations/ Floaters [Hull]

G9 Explosion Jack-Ups

G10 Blowout Prevention

33


Source of Hazard



G11 Foundation Failure Consequences

G12 Scour F15 Sufficient Air Gap for 10,000-Year Storm

G13 Seismic Event F6 Extent of Structural Damage/Failure

F16 Suitable Safety Factors (Fatigue, Applied Loading, Pile Loads etc)

G14 Boat Impact F7 Reduced Redundancy, Remaining Residual & Reserve Strength

F17 High Redundancy

G15 Helicopter/Aircraft Impact

F8 Remaining Fatigue Life F18 Maintenance and Repair Management Procedures

G16 Dropped Objects F19 Control Measures [Management/Structural] for Accidental Loads

G17 Inadequate Management System Procedures

Extreme Weather Excess Topsides Weight

G18 Inadequate Design Mitigation Fatigue Fire

G19 Inadequate Inspection, Repair & Maintenance During Fabrication and Operation

Corrosion Explosion

G20 Inadequate Re-assessment

F20 Suitably rated fire and blast walls/use of PFP etc.

Marine Growth Corrosion

G21 Inadequate Verification

F21 Maintenance & repair management procedures

Foundation Performance & Scour

34


Source of Hazard



G22 Operator Error F22 System management procedures for accidental loads

Fire

F23 High redundancy Explosion

35

3.HS1: Fixed Steel Installations

3.HS2: Fixed Concrete Installations

3.HS3: Semi Submersible Installations

3.HS4: Ship Shaped/Floating Installations

3.HS5: Jack-Up Installations

1. Confirmation should be obtained that installations have been designed and constructed, and/or re-assessed, maintained and repaired in accordance with the latest edition of a recognised standard, recommended practice or code of practice. Recognised standards, recommended practices and codes of practice include:

ISO 19900 Petroleum and Natural Gas Industries Offshore Structures Part 1: General Requirements

ISO 19901-1 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 1: Metocean Design and Operating Considerations

ISO 19901-2 Petroleum and Natural Gas Industries - Specific Requirements For Offshore structures Part 2: Seismic Design Procedures and Criteria

ISO 19901-3 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 3: Topsides Structure

ISO 19901-4 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 4: Geotechnical and Foundations Design Considerations

ISO 19901-5 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 5: Weight Control During Engineering and Construction

ISO 19902 Petroleum and Natural Gas Industries - Fixed Steel Offshore Structures

ISO 19903 Petroleum and Natural Gas Industries - Fixed Concrete Offshore Structures

ISO 19904 Petroleum and Natural Gas Industries - Floating Offshore Structures

ISO 19905, Petroleum and Natural Gas Industries - Site-Specific Assessment of Mobile Offshore Units

ISO 13822 Basis of Design of Structures - Assessment of Existing Structures

NORSOK N-001 Structural Design

NORSOK N-002 Collection of Metocean Data

NORSOK N-003 Actions and Load Effects

NORSOK N-004 Design of Steel Structures: Annex A - Design Against Accidental Loads; Annex B - Buckling Strength of Shells; Annex C - Fatigue Strength Analysis

NORSOK N-005 Condition Monitoring of Load Bearing Structures

NORSOK S001 Technical Safety

NORSOK Z-001 Documentation for Operation

NORSOK Z-013 Risk and Emergency Preparedness Analysis

36

ON27 Status of Technical Guidance on design, Construction and Certification

OTO 2001 010 Environmental Considerations

OTO 2001 011 Corrosion Protection

OTO 2001 012 Site Investigations

OTO 2001 013 Loads

OTO 2001 014 Foundations

OTO 2001 015 Steel

OTO 2001 016 Pile Sleeve Connections

OTO 2001 017 Materials Other Than Steel Or Concrete

OTO 2001 046 Concrete

OTO 2001 048 Floating Installations

OTO 2001 051 Self-Elevating Installations (Jack-Up Units)

API RP2A 18th Edition or later Recommended Practice for Planning, Designing, and Constructing Fixed Offshore Platforms

Classification Society Rules: Semi sub/Floating Installations/Jack-Ups only

IMO Rules: Semi sub/Floating Installations/Jack-Ups only

SNAME T&R Bulletin 5-5A 1994 Society of Naval Architects & Marine Engineers (SNAME) Recommended Practice for Site-specific Assessment of Mobile Jack-up Units

2. Where a standard, recommended industry/company practice or code of practice other than those listed above has been employed, judgement of the adequacy of the installation can only be assessed on an individual basis, taking account of the current condition of the installation.






Hazards to structural integrity arise from three principal sources, namely:

• Accidental events, ie fire, explosions, blowout, boat impact, helicopter/ aircraft impact and dropped objects

• Natural events, ie extreme weather, fatigue failure, corrosion, marine growth, scour and seismic events.

• Management system inadequacies, ie poor fabrication procedures, topsides overloading, change of use/structural modification, inadequate system management procedures, inadequate design and inadequate inspection, repair and maintenance during fabrication and operation.

37














There is a need to consider that different approaches to the management of structural integrity may be required, depending on:

• Whether the installation is manned or normally unmanned.

• The age of the installation and the codes and standards that it has been designed to.

For ageing installations, it is important to place special emphasis on the knowledge and understanding of the integrity.


3.G1-3.G4, 3.G12, 3.G13: Environmental hazards

3.G8, 3.G9, 3.G10, 3.G14, 3.G15, 3.G16: Accidental hazards

3.G5-3.G7, 3.G17-3.G22: Management system hazards

3.F1–3.F8 Risk evaluation

3.F1–3.F5 Frequency

3.F6–3.F8 Consequences

3.F9–3.F23 Risk management measures:

3.F9–3.F14 Inherent safety

3.F15–3.F19 Prevention

3.F20–3.F23 Mitigation


None


OSD5.1: Jack-up installations

OSD5.2: Fixed installations

OSD5.3: Semi submersible installations/ship shaped/floating installations


OSD5.2

38

3.G1: Extreme Weather, including Wave-In-Deck Loading

3.G2: Fatigue Failure

3.G3: Corrosion

3.G4: Marine Growth

3.G11: Foundation Failure

3.G12: Scour

3.G13: Seismic Event

1. Confirmation should be obtained that installations have been designed and constructed, and/or re-assessed, maintained and repaired in accordance with the latest edition of a recognised standard, recommended practice or code of practice for accidental hazards. General requirements for accidental hazards are found in:

ON27 Status of Technical Guidance on Design, Construction and Certification

OTO 2001 013 Loads






SNAME T&R Bulletin 5-5A 1994 Society of Naval Architects & Marine Engineers (SNAME) Recommended Practice for Site-specific Assessment of Mobile Jack-up Units







4.1 Extreme Weather [Initiator 3.G1]

The installation must be designed to ensure that it can withstand extreme loading, based on the use of appropriate metocean data. In accordance with ISO 19901-1 the air gap

39




assessment philosophy should be based on the principle that the deck height should be chosen such that the frequency of wave impact on the deck is compatible with the target failure rate of the substructure. The use of a load and resistance factor design methodology requires that extreme waves do not cause major structural damage with an annual failure probability exceeding 10-4. The structure should remain capable of withstanding the 100-year environmental load without progressive collapse in the damaged condition. In both the 10,000-year [intact] and 100-year [damaged] scenarios, load and resistance factors of unity are to be used.

4.2 Fatigue Failure [Initiator 3.G2]

The consequences of fatigue failure, which is defined as the occurrence of a through thickness crack, can be very serious and fatigue life is therefore an important structural integrity performance criterion for offshore structures. The principal sources of guidance on the prediction of fatigue life are OTO 2001 015, NORSOK N-004 and ISO 19902. However, there is considerable uncertainty in the assessment process and cracking can occur within the design life. The fatigue assessment should include consideration of the effects of the principal causes of fatigue damage, ie

• fabrication defects, including weld root defects

• damage from pile driving followed by fatigue, for fixed steel platforms as well as special factors, eg

• single-sided closure welds

• ring-stiffened joints

• high strength steels [generally defined as steels with a yield strength exceeding 400 MPa]

4.3 Corrosion [Initiator 3.G3]

The consequence of corrosion is loss of member thickness, leading to reduced static strength, buckling capacity and possible local structural collapse. It is common practice to provide a 'corrosion allowance' for members located near mean sea level [often between 6 -12 mm] where corrosion rates are higher. Steel exposed to sea spray is also vulnerable and in the splash zone epoxy or similar paints are often used to provide corrosion protection, since the CP system is ineffective in this zone.

Overprotection [ie potentials more negative than -1100mV Ag/AgCl] can be damaging to fatigue [ie it can increase fatigue crack growth rates significantly] and to epoxy or similar coatings, with the possibility of bonding to the steel being lost. Hence, design of the anode system is important to minimise this effect and regular monitoring of potentials is also essential to reduce this problem in practice. Guidance can be found in OTO 2001 011.

4.4 Marine Growth [Initiator 3.G4]

The marine growth allowance should be specified in the safety case and controlled to ensure that the loading on the structure is maintained within the design limits or remedial action is undertaken.

4.5 Foundation Failure [Initiator 3.G11]

The design adequacy of foundations is demonstrated by use of an appropriate standard or equivalent associated with that type of installation, [ISO 19901-4, ISO 19902, ISO 19903, SNAME T&R Bulletin 5-5A]. The safety case should give measures to ensure that the design capacity does not deteriorate to a level whereby foundation instability and failure

40



occurs. For situations where soils are known to be weak some monitoring of deck level may be appropriate to provide a means whereby this may be controlled. Interaction of foundations with wells, well drilling or footprints should be assessed.

4.6 Scour [Initiator 3.G12]

The safety case should specify the allowable scour and means by which the actual scour is monitored. Remedial activity should be specified where necessary.

4.7 Seismic Events [Initiator 3.G13]

Duty holders should be able to demonstrate that structures have a low probability of catastrophic failure when subjected to earthquakes and that supports of both safety critical plant and equipment are sufficiently robust to withstand the accelerations, displacements and relative deflections caused. The emphasis of the assessment is that the primary control of the seismic hazard is inherent safety, achieved by the ability of structures and equipment supports to withstand seismic forces and vibrations through adequate design with suitable safety factors [eg to the 200-year return period] and a subsequent check to a longer return period [eg to the 10,000-year return period]. Equipment safety is provided by appropriate specification and attention to vulnerability of supports. The implications of acceleration, displacement and deflection for the integrity of Safety Critical Elements also need to be considered. See ISO 19901-2.


3.HS1 Fixed Steel Installations

3.HS2 Fixed Concrete Installations

3.HS3 Semi Submersible Installations

3.HS5 Jack-Up Installations




Section 6 Wells




OSD5.2


OSD5.2

41

3.G5: Poor Fabrication Procedures/Materials Defects/ Materials Failure [Brittle Fracture]

3.G6: Topsides Overloading

3.G7: Change of Use/Structural Modification

3.G17 Inadequate Management System Procedures

3.G18: Inadequate Design

3.G19: Inadequate Inspection, Repair & Maintenance During Fabrication and Operation

3.G20: Inadequate Re-assessment

3.G21: Inadequate Verification

3.G22: Operator Error

1. Confirmation should be obtained that installations have been designed and constructed, and/or re-assessed, maintained and repaired in accordance with the latest edition of a recognised standard, recommended practice or code of practice for management system hazards. General requirements for accidental hazards are found in:

ON27 Status of Technical Guidance on design, Construction and Certification


ISO 19901-2 Petroleum and Natural Gas Industries - Specific Requirements For Offshore structures Part 2: Seismic Design Procedures and Criteria




EEMUA 158 Construction Specification for Fixed Offshore Structures in the North Sea

HS(G)65 Successful Management of Health and Safety

CSWIP Certification Scheme for Welding and Inspection Personnel or equivalent

2. Where a standard, recommended industry/company practices or code of practice other than those listed above has been employed, judgement of the adequacy of the installation can only be assessed on an individual basis, taking account of the current condition of the installation.




42




4.1 Fabrication Procedures [Initiator 3.G5]

For new installations or platform reuse, fabrication defects are a major cause of fatigue failure in offshore structures and consequently a principal mechanism for the control of fatigue failure is the thorough inspection for weld defects during fabrication. Defects detected during fabrication should be repaired. They may be allowed to remain only where it can be demonstrated that they do not compromise the integrity of the structure. Further information is given in EEMUA 158.

Studies have shown that significant defects [ie up to 5 mm in height] can be present. Although such defects would normally be repaired, the detection of defects in this size range is close to the limits of current inspection techniques for this kind of defect and the integrity assessment should take this into account.

4.2 Topsides Overloading [Initiator 3.G6]

Evidence of the structure’s ability to withstand foreseen changes in the topsides loading is required. This may include weight monitoring procedures – see ISO 19901-5. Careful consideration needs to be given to the ability of the structure to withstand changes in the topsides loading. Appropriate weight monitoring procedures should be complemented by component and system strength assessments to ensure that the design limits of the structure are not exceeded during its operational life.

4.3 Change of Use/Structural Modification [Initiator 3.G7]

Any change of use affecting the original design [eg variation of the topsides loading and change of process requirements] and any structural modification require a reassessment of the structural integrity to ensure that the operational limits are not exceeded.

4.4 Management System Procedures [Initiator 3.G17]

The duty holder must implement adequate system management procedures to ensure that the risk of structural failure is maintained at an acceptable level. Reference should be made to the requirements of HS(G)65.

Competence is an essential requirement in the management of structural integrity and is now recognised in the suite of ISO structural standards. The need for suitably qualified personnel in all aspects of structural integrity management, eg offshore structural engineering and inspection planning, is specified. Assessors should ensure that suitably qualified personnel to CSWIP or equivalent are designated.

4.5 Design [Initiator 3.G18]

The Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 (DCR) place a requirement on the duty holder to design installations to withstand such forces acting on it that are reasonably foreseeable and that in the event of foreseeable damage it will retain sufficient integrity to enable action to be taken to safeguard the health and safety of personnel on or near it so far as is reasonably practicable. The application of good practice is one of the key measures with respect to structural integrity risk management in demonstrating compliance with these regulatory requirements, with particular emphasis on the setting of performance standards [see Verification, 3.G21] and the provision of adequate safety margins against failure from major hazards. This requires the use of appropriate standards for the design of offshore structures. Where an installation designed under the previous certification regime does not show the same level

43


of safety as newer structures, the duty holder should demonstrate that it meets the relevant DCR requirements.

4.6 Inspection, Repair & Maintenance During Fabrication & Operation [Initiator 3.G19]

Inspection Planning Methodologies Structural inspection is a key factor in providing data for the management of structural integrity. For North Sea structures on the UKCS, preparation of an inspection plan is a requirement of Regulation 8 of DCR. This requires the duty holder to ensure that suitable arrangements are in place for maintaining the integrity of the installation. This entails the quantification/identification of the risk of structural failure and the subsequent formulation of a suitable cost-effective inspection schedule to enable the targeting of critical components. The inspection programme should include a thorough fabrication inspection [see 3.G5], a baseline inspection once the platform has been installed, the collation and evaluation of platform and inspection data, periodic inspections to monitor any deterioration [eg from fatigue] and special inspections following any accidental damage or extreme loading events to determine whether there is a need for any remedial work in the event of damage or deterioration. Reference should be made to the ISO standard for offshore inspection (ISO 19902), for both in-service inspection and structural integrity management. The plan should contain information to demonstrate that the accidental hazards are within the design limits.

It is important that the plan takes into account the effects of structural redundancy in setting targets with a contingency that shows an awareness that unexpected failures may occur in practice, which will not be predicted using current probabilistic techniques.

Inspection Techniques A number of different inspection techniques are used during fabrication and operation. The case should either refer to or describe appropriate inspection techniques. Standard techniques applied in the fabrication yard include UT, MPI and sometimes RT.

The use of FMD as the principal inspection method applied to primary and secondary members in steel jacket structures accepts that significant damage must occur for the damage to be detected and hence total reliance on FMD is not necessarily sufficient to ensure structural integrity. It is therefore necessary that this approach is complemented with rigorous structural integrity assessment and management.

Repairs The ability of a repair to restore the integrity of a fatigue damaged component is a necessary requirement in maintaining the overall integrity of an offshore structure. Several different repair methods can be used offshore. They involve weld repair, structural modification or the use of strengthening techniques. Methods used include:

• normal welding for above water repairs

• hyperbaric weld repair [underwater]

• removal of cracks by grinding with or without subsequent re-welding

• drilling of crack arrester holes

• member removal or replacement

• addition of strengthening members

• joint reinforcement using gusset plates

• internal grouting of members and joints

44

• use of grouted and mechanical clamps

There is a continuing need for regular inspection of repaired components as part of the overall inspection of the structure.

4.7 Re-assessment [Initiator 3.G20]

Where structures have come to the end of the design life or suffered significant damage, reassessment of the structural integrity should be performed to demonstrate that existing installations continue to meet regulatory requirements. The principal sources of guidance on reassessment are ISO 13822, ISO 19902 and NORSOK.

The safety case should demonstrate the criteria for reassessment ISO 19901 and 19902:

• extension of service life beyond the original calculated design life

• damage or deterioration of a primary structural component

• change of use that violates the original design or previous integrity assessment

• departures from the original basis of design [eg increased loading or inadequate deck height]

• original design criteria are no longer valid

as well as the versions of the design codes used.

Many installations have been designed to earlier versions of structural codes and standards which have subsequently been updated to reflect improved knowledge and experience. Hence, design criteria based on the original version of the code may now be unconservative and no longer valid and reassessment is necessary. In-service inspection practices will determine the nature and extent of the reassessment process to demonstrate structural integrity. Hence, the reassessment process needs to take into consideration the changes in inspection practices that have taken place in recent years as these have implications on the approach to structural integrity assessment.

When it is shown that the structure is not acceptable by analysis then strengthening or repairs may be required to demonstrate that measures have been or will be taken to ensure compliance with DCR. When this is not possible operational limits may be needed on the platform [eg demanning when extreme weather is imminent]. The adequacy of fatigue life for the intended remaining life should also be reviewed and this should be taken into account when planning repairs and future inspection schedules.

Ageing Installations

Ageing is characterised by deterioration which is caused mainly by fatigue and corrosion. Any structural deterioration due to ageing should be taken into account in the reassessment process. It is therefore important to have accurate knowledge of both the condition of a structure with respect to fatigue and corrosion and knowledge of the response of the structure to the ageing process for effective structural integrity assessment.

Knowledge of the design specification and the damage state may not always be available for ageing structures. Safety margins during reassessment need to be increased in such circumstances. It is therefore important that good records of both design details and changes in the structural condition [due to in-service damage and deterioration] are maintained.

4.8 Verification [Initiator 3.G21]

45

Verification is a key process in the overall SIM as a result of DCR. This includes the identification and risk management of Safety Critical Elements (SCE). In general, the whole jacket is considered to be a SCE and other SCEs include the topsides, temporary refuge and helideck. For each SCE, performance standards need to be developed, providing a statement of the performance required of the system and which is used as a basis for managing the particular hazard through the lifecycle of the installation.

4.9 Operator Error [Initiator 3.G22]

The assessment should take into consideration the possibility of the introduction of enhanced risk resulting from operator error, particularly in areas of weight growth or ships collision.







Section 7 Diving




OSD5.1, OSD5.2 and OSD5.3.


OSD5.2

46

3.G8: Fire

3.G9: Explosion

3.G10: Blowout

3.G14: Boat Impact

3.G15: Helicopter/Aircraft Impact

3.G16: Dropped Objects

1. Confirmation should be obtained that installations have been designed and constructed, and/or re-assessed, maintained and repaired in accordance with the latest edition of a recognised standard, recommended practice or code of practice for accidental hazards. General requirements for accidental hazards are found in:

ON27 Status of Technical Guidance on Design, Construction and Certification

OTO 2001 013 Loads



ISO 19904 Petroleum and Natural Gas Industries - Floating Offshore Structures

NORSOK S001 Technical Safety

NORSOK Z-001 Documentation for Operation

NORSOK Z-013 Risk and Emergency Preparedness Analysis

SCI Technical Note No 4 Explosion Resistant Design for Offshore Structures







4.1 Fire [Initiator 3.G8]

The structural response of equipment, TR supports and primary structure from fires identified in the case should be assessed to the Steel Construction Institute’s Interim Guidance Notes on fire & explosion [IGN].

4.2 Explosions [Initiator 3.G9]

47




The structural response and escalation potential from explosions identified in the case should be assessed to the IGN.

4.3 Blowout [Initiator 3.G10]

Refer to Section 6 – Wells for potential of this hazard.

4.4 Boat impact [Initiator 3.G14]

The structural response from boat impact should be assessed - see Section 2 – Vessel Impact.

4.5 Helicopter/Aircraft Impact [Initiator 3.G15]

The structural response from helicopter/aircraft impact should be assessed - see Section 8 - Helicopter Crash.

4.6 Dropped Objects [Initiator 3.G16]

The structural response to dropped objects should be assessed. Normal engineering principles should have been applied taking account of the size and weight of objects identified in the case.







Section 2 Vessel Impact


Section 5.3 Loss of Containment - Fire & Explosion

Section 8 Helicopter Crash




OSD5.2


OSD5.2

48

3.F1: Hazard Studies [HAZOPs etc]

3.F2: Generic Historical Data

3.F3: Installation Specific Data

3.F4: IVB Data

3.F5: Reliability Analysis

3.F6: Extent of Structural Damage/Failure

3.F7: Reduced Redundancy, Remaining Residual and Reserve Strength

3.F8: Remaining Fatigue Life

1. Confirmation should be obtained that risk evaluation has been carried out in accordance with industry guidelines and is based on recognised risk data sources, for example:

CMPT A Guide to QRA for Offshore Installations

UKOOA Guidelines for QRA Uncertainty

UKOOA Guidelines Formal Safety Assessment

DnV Guidelines for Offshore Structural Reliability Analysis

2. Where industry guidance and data sources other than those listed above have been used then the duty holder will need to justify the validity of other sources of guidance and data.






4.1 Hazard Studies [Initiator 3.F1]

It is not normal engineering practice to perform discrete hazard studies. ISO 19000 [General Requirements] lists the hazards that are considered in the more specific standards in the ISO series.

4.2 Generic Historical Data [Initiator 3.F2]

Historical data is usually inappropriate to determine the loss of integrity frequency although some cases may try and use this approach. If used the appropriateness [type of structure, geographical location] of the data should be assessed.

4.3 Installation-Specific Data [Initiator 3.F3]

Reliable and comprehensive structural data are an essential requirement for the structural integrity assessment of an installation during its life cycle. The case should give an account of this deterioration.

4.4 IVB Data [Initiator 3.F4]

49


See 3.F3 Installation-specific data

4.5 Reliability Analysis [Initiator 3.F5]

If the case uses a reliability approach, good practice is to be found in the DnV guidelines for offshore structural reliability analysis. A recent initiative, Advanced Structural Reliability Network (ASRANET), has been set up to encourage the integration of reliability analysis with advanced structural analysis in an attempt to provide more accurate and realistic measures of failure and hence provide some technical basis for dealing with ageing infrastructures.

CONSEQUENCES [3.F6–3.F8]

Loss of structural integrity can have serious consequences, depending on the redundancy, component strength, system strength and fatigue life. The safety case should therefore contain evidence that foreseeable structural damage to the installation, escalation potentials and all likely scenarios have been considered.

4.6 Extent of Structural Damage/Failure [Initiator 3.F6]

The case should indicate:

• whether there is any existing damage or local failure

• the assessment has taken this into account to ensure the appropriate integrity.

4.7 Redundancy, Residual & System Strength [Initiator 3.F7]

Existing codes and standards are based on satisfying component adequacy and hence structures are normally designed on a component basis. However, fixed offshore platforms generally have a multiplicity of load paths so that failure of one component does not necessarily lead to catastrophic structural collapse. The implementation of an effective structural integrity management system requires the application of system strength analysis to provide an understanding of the performance of the structural system.

Thus, should the duty holder wish to optimise the design and inspection procedures, full consideration should be given to the performance of a systems analysis to quantify the reserve and residual capacities, now recognised as the key parameters in managing integrity, and the identification of critical components in the structure.

Platform configuration is a key factor to be considered in assessment. X braced panels are more 'ductile' in that they offer alternative load paths compared to, for example, K bracing where once a member fails there is no alternative load path through the frame. Thus, the potential reduction in static strength of a joint in K-based framing is likely to be more damaging than a cracked joint in X-braced framing and this needs to be reflected in the level of assessment of system strength.

4.8 Remaining Fatigue Life [Initiator 3.F8]

For welded joints in offshore structures, the fatigue life N3 is defined as the point at which a through-thickness crack forms. However, actual failure will occur when the load bearing capacity of the remaining ligament is insufficient for the applied load and this is designated N4. At this stage load shedding will take place and the applied loads will be transferred to neighbouring components.

The reliance on FMD in maintenance strategies for offshore installations requires that the inspection interval is such that N4 is not exceeded. The available information indicates that the remaining fatigue life on penetration of the wall thickness may be rather limited. It is therefore important that due consideration is given in the development of the structural

50

integrity management plan to the possibility of total member failure occurring after penetration of the wall and of the consequences to structural integrity.









Section 13 QRA


OSD5.2


OSD5.2

51

3.F9: Concept Selection

3.F10: Use of Best Design Practice

3.F11: Use of Suitable Safety Factors

3.F12: High Redundancy - Inherent Safety

3.F13: Optimum Materials and Fabrication Procedures

3.F14: Maintenance Management Procedures

3.F15: Sufficient Air Gap for 10,000-year Storm

3.F16: Suitable Safety Factors [Fatigue, Applied Loading, Pile loads etc]

3.F17: High Redundancy - Prevention

3.F18: Maintenance and Repair Management Procedures

3.F19: Control Measures [Management/Structural] for Accidental Loads

3.F20: Suitably Rated Fire and Blast Walls/Use of PFP etc

3.F21: Maintenance & Repair Management Procedures

3.F22: System Management Procedures for Accidental Loads

3.F23: High Redundancy – Mitigation


CMPT A Guide to QRA for Offshore Installations

UKOOA Guidelines for QRA Uncertainty

UKOOA Guidelines Formal Safety Assessment

HS(G)65 Successful Management of Health and Safety

2. Where industry guidance and data sources other than those listed above have been used then the duty holder will need to justify the validity of other sources of guidance and data.






Inherent Safety [3.F9-3.F14]

4.1 Concept Selection [Initiator 3.F9]

52


The integrity of the concept selected should be of a level which is ensured by following the latest standards. If reuse is part of the concept, the assessment must consider loss of deterioration and fatigue in previous uses as well as evidence of the actual condition of the structure.

4.2 Use of Best Design Practices [Initiator 3.F10]

Design best practice is to be found in the latest editions of standards.

4.3 Use of Suitable Safety Factors [Initiator 3.F11]

Standards stipulate safety factors. These are generically suitable but in some cases special consideration of alternative safety factors may be made. The rationale behind such consideration should be examined.

4.4 Redundancy [Initiator 3.F12]

Adequate component integrity is achieved through appropriate material selection and design for static strength and fatigue capacity [complemented by an appropriate level of inspection during fabrication for weld defects and in service for defects, corrosion and marine growth]. A fundamental requirement for the design of offshore installations with the required level of inherent safety is the use of best design practice. The principal documents for the structural design of offshore installations operated on the UKCS are the appropriate parts of API RP 2A [at least 18th Edition] and the emerging ISO documents supplemented by information outlined in ON27.

Many installations have been designed to earlier versions of structural codes and standards which have subsequently been updated to reflect improved knowledge and experience. Hence, design criteria based on the original version of the code may be unconservative and no longer valid and reassessment is necessary.

4.5 Optimum Materials and Fabrication [3.F13]

Most offshore structures are constructed from weldable medium strength steels [usually grade 50D], for which codes and standards exist, eg BS 7191. Welding procedures are now well developed for the medium strength steels used offshore and are well codified, eg EEMUA 158 and AWS D1.1. More recently, newer higher strength steels, with a better strength to weight ratio, are being used increasingly. However, in general there is less test data available to support the design equations and the duty holder should ensure that sufficient and reliable data are available to enable a structural integrity assessment with an appropriate level of confidence.

Inspection at the fabrication stage is recognised as a major part of the reliability aspect of performance standards and there is a need for this to be well documented for proper life cycle efficiency.

4.6 Maintenance Management Procedures/Structural Inspection & Condition Monitoring [Initiator 3.F14]

Structural inspection is a key factor in providing data for the management of structural integrity. For North Sea structures on the UKCS, preparation of an inspection plan is a requirement of DCR Regulation 8. This requires that the duty holder ensures that suitable arrangements are in place for maintaining the integrity of the installation, through periodic assessments and carrying out any remedial work in the event of damage or deterioration. The inspection programme includes:

• a baseline inspection once the platform has been installed

• periodic inspections to monitor any deterioration [eg from fatigue]

53


• special inspections following any accidental damage or extreme loading events.

A set of default inspection requirements is included, with prescriptive survey periods for cases where an inspection plan has not been produced. The inspection planning methodology should demonstrate an understanding of the significance of the analytical information requirement and the inspection strategy implementation.

Normal underwater inspection programmes include a condition survey of the anodes, the extent of marine growth and corrosion potential monitoring of areas of the jacket structure. Through this, anodes can be identified and subsequently replaced to ensure an adequate level of cathodic protection is provided for the life of the structure.

Prevention [3.F15-3.F19]

4.7 Sufficient Air Gap for 10,000-year Storm [Initiator 3.F15]

ISO 19900 specifies that the air gap assessment philosophy should be based on the principle that the deck height should be chosen such that the frequency of wave impact on the deck is compatible with the target failure rate of the substructure. The NPD approach, which is applicable to the UKCS, is based on a load and resistance factor design methodology and requires that extreme waves do not cause major structural damage with an annual failure probability exceeding 10-4. It is considered acceptable for load damage to occur provided that the structure remains capable of withstanding the 100-year environmental load without progressive collapse. In both the 10,000-year [intact] and 100-year [damaged] scenarios, load and resistance factors of unity are to be used.

4.8 Suitable Safety Factors [Fatigue, Applied Loading, Pile Loads, etc] [Initiator 3.F16]

An important requirement in traditional deterministic approaches to engineering design is the selection of appropriate safety factors, eg on fatigue life, the applied loading, the pile loads, etc. A major calibration exercise has been performed on the ISO standard for offshore structures in order to derive consistent values for partial safety factors [PSFs] for actions & resistance, based on a selected target reliability. The target reliability is commonly taken to be the implied probability of structural failure in codes & standards which are judged to be acceptable. For offshore structures, the system target reliability based on extreme wave system reliability, ignoring fatigue analysis, has been used.

4.9 High Redundancy [Initiator 3.F17]

High redundancy is redundancy that is significantly more than that enshrined in the latest standards. Claims for this should be examined with a view to establishing common load paths and the adequacy of bracing giving the higher than standard redundancy.

4.10 Maintenance and Repair Management Procedures [Initiator 3.F18]

See 3.G17 Inadequate Management Systems Procedure.

4.11 Control Measures [Management/Structural] for Accidental Loads [Initiator 3.F19]

The management system should ensure that the installation retains sufficient structural integrity in the event of accidental damage so that the overall risk is maintained at an appropriate level.

Mitigation [3.F20–3.F23]

4.12 Suitably Rated Fire & Blast Walls [Initiator 3.F20]

A significant amount of work [including full scale testing] has been undertaken concerning the science and engineering of fire and explosion loads and effects on offshore structures.

54

The design and reassessment framework for this work is currently being considered as the industry moves to standardise and harmonise matters associated with these hazards.

Topsides structures are sensitive to fire and explosions and consequently it is important to model steel panels realistically. The strengthening of structures to enable them to withstand large explosions requires a better understanding of ultimate capacity performance and escalation prediction. This requires understanding of and data on high temperature and strain rate effects on materials plasticity and fracture behaviour.

4.13 High Redundancy [Initiator 3.F23]

See 3.F12 Redundancy.


3.G1 Extreme Weather including Wave-In-Deck Loading


Section 2 Vessel impact

Section 5.1 Loss of containment - Process

Section 5.3 Loss of containment - Fire & Explosion

Section 7 Diving




Section 13 QRA


OSD5.2


OSD5.2

55

4.1 LOSS OF MARITIME INTEGRITY - LOSS OF STABILITY 1. Scope

This Section provides guidance for the assessment of safety case content with respect to the loss of stability of an installation, from hazard identification through to consequence determination, including risk management measures. The installation types [source of hazard] are categorised by hull form as:

• Jack-Ups

• Semi-submersible Units

• Monohulls [includes FPSO, FSU, Drillships, Well intervention vessels]

• Other hull forms [eg TLPs, Spar buoys]


‘Any loss in the stability of the installation’ is defined as a ‘major accident’ in Regulation 2 of the Offshore Installations (Safety Case) Regulations 2005 [SCR]. For the purpose of this Section and safety case assessment this is interpreted as any unplanned change in the floating stability of the installation. This might be due to a variety of reasons which include, but are not restricted to: collision with another vessel, failure of the watertight integrity, internal flooding from pipework, operation of installations drench and firefighting system, human errors in deck loading and ballast distribution, movement of deckload, failure or unexpected loads on mooring line, excessive loads on derrick, or exceedence of design environmental parameters.

The categorisation table in this Section presents a number of prompts or keywords for the initiators that might lead to a loss of stability [the causal chain]. The initiators have been divided into 5 categories as:

• Design

• Operational Hardware

• Interface Systems

• Human Factors

• External Events

The categorisation table also shows keywords for the evaluation of the escalation path [the consequence chain]; how the risk is evaluated in terms of both frequency and consequence. Similarly keywords are presented for the risk management measures that can be introduced, these cover the complete range of possible measures and are:

• Inherent Safety

• Prevention

• Detection

• Control

56

• Mitigation

• Evacuation, Escape and Rescue [EER]

The assessor should examine the adequacy of the hazard identification, risk evaluation and management measures as described in the safety case in conjunction with the

ation table below.

3.

ment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure

will usually be no need for an assessor to probe into the details of how the good practice is

eather dependent activities and the effects on personnel. It is important that these motion characteristics are adequately assessed at the design stage for any

Section. These are the main references that should be familiar to, and consulted by, the assessor. They are not a complete list of references on the subject of loss of stability.

contents of the categoris

Depth of Assessment

This section gives guidance on the depth of assess

compliance with the relevant statutory provisions.

Where the safety case contents match with good practice identified herein, there

applied. This may, however, be a suitable issue to follow up through inspection.

Stability is fundamental to the motion responses of an installation. The motion characteristics are important design inputs for the design of installation plant and equipment, w

installation.

A list of references is found at the end of this

57

4. The Assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation Table below:

Loss of Maritime Integrity - Loss of Stability

Source of Hazard



HS1 Jack-Ups G1 Design Assessment Frequency Inherent Safety Intact stability

HS2 Semi Subs Hull subdivision F1 Generic data F30 Not afloat [jack-up] Damage stability

HS3 Monohulls Watertight structure F2 Company data Ballast systems

HS4 Other Types Piping systems F3 Classification Society Prevention Marine competency

Weight management

F4 ISO/IMO standards F31 Sub division

Codes and standards

F5 HAZOP studies F32 Collision resistant

Specification/ dimensions

F6 FMECA studies F33 Isolation valves

G2 Operational Hardware Section 3

F7 Personnel policies F34 Bilge alarm systems

Overload F8 Selection – Section 11

Fatigue F9 Training – Section 11 Detection

Material defect F10 Competency – Section 11 F35 CCTV

Construction defect F11 Concept design F36 Flood detection

Commissioning defect

F12 Operations procedure F37 Inspection procedures

Maintenance defect F13 Maintenance policies F38 Draft, trim, heel indicators

Corrosion/ erosion

F39 Tank gauging system

58


Source of Hazard



G3 Interface systems Consequences F40 Bilge alarm system

Electric controls - Section 5.1

F14 Stability design codes

Hydraulic controls F15 Marine systems design Control

Pneumatic controls F16 Redundancy F41 Emergency response plan

UPS/power generation

F17 Flexibility of operation F42 Training simulators

G4 Human Factors – Section 11

F18 Subdivision F43 Damage control

Operations deficiency

F19 Damage extent

Training F20 Trim/heel/draft Mitigation

Competency F21 Motions F44 Counterballast

Communication F22 Hydrocarbon containment – Section 5.1

F45 Support vessels

Incorrect action F23 Progressive flooding F46 Towage/salvage

G5 External Events F24 Cargo movement

Fire/explosion – Section 5.3, & Section 9

F25 Structural collapse – Section 3

Emergency Response

Firefighting water F26 Additional environmental load

F47 Non essential [Helicopter]

Over/under pressure

F27 EER impairment – Section 10

F48 Emergency [TEMPSC]

59


Source of Hazard



Sabotage/terrorism F28 Personnel mobility – Section 12

F49 Keep within limits

Dropped object – Section 3

F29 Panic – Section 12

Severe environment – Section 3

Moorings failure – Section 4.2

Collision/ grounding – Section 2

Power failure – Section 5.1

60

4.1.HS1 Jack Ups

4.1.HS2 Semi Subs

4.1.HS3 Monohulls

4.1.HS4 Other Types

4.1.G1-G5 Initiators

4.1.F1-F29 Risk Evaluation Measures

4.1.F30-49 Risk Management Measures

1. The assessor should obtain confirmation that the risk of loss of stability has been fully assessed. Both intact and damage stability criteria and environmental loads are to be used in the assessment. This in practice means that the installation is designed, constructed, operated and maintained in accordance with HSE standards.

In general, HSE standard of performance is defined in the former ‘4th Edition’, see Operations Notice ON27, and in particular referencing OTO 2001-049. There are particular points that require further attention, and these are listed in the bullet points that follow in this Section.

The risk assessment approach should follow one of the techniques described in guidance document OTO 2001-063.

Where there is not compliance with the above assessment standards the duty holder should demonstrate that there is an equivalent level of performance, with regard to the loss of stability, obtained by the use of some other internationally recognised standard.

HSE recognise that the standards of the Norwegian Maritime Directorate [NMD] are broadly equivalent to HSE required performance standard. The assessor should obtain confirmation that the installation is fully compliant with the NMD Mobile Offshore Unit [MOU] Code. Any qualifications to the NMD approval should be investigated to HSE satisfaction to confirm acceptance of the safety case.

Compliance only with either the International Maritime Organisation [IMO] codes for Mobile Offshore Drilling Units [MODU Code], or the Code for Special Purpose Ships are not equivalent to the HSE requirements. Further risk

assessments will be required and possible modifications to subdivision and piping arrangements. Each installation will be considered on an individual basis.

Relevant Legislation, ACOP and Guidance includes:

Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c); 12(1)(d); Schedule 3

Offshore Installations and Wells (Design and Construction, etc) Regulations 1996, Regulations 5, 8, 9


All Installation Types

For all installation types, the safety case will be required to demonstrate to the assessor, directly or by reference to other documents, that:

61




• An acceptable standard of watertight integrity is achieved in the design of the installation.

• The risk of accidental flooding has been properly assessed with regard to both frequency and consequence of this accidental event

• The piping and control systems are capable of control of the flooding and restoring the installation to stable equilibrium.

• The risk of loss of the control system has been adequately assessed, and that loss of the main control system will not lead to a loss of stability.

• There are suitably qualified personnel for the operation and maintenance of the marine equipment essential to vessel stability and watertight integrity.

• The components of the marine systems essential to watertight integrity have been defined as safety critical elements and are included in the verification scheme.

Jack-Up Units

The following points are particularly relevant to jack-up units and require to be addressed in the safety case:

• Procedures and systems for maintenance of watertight integrity during in-field and ocean transit.

• Procedures for marine operations on approach and departure from adjacent installations. Pre-load procedures.

• Compliance with Safety Notice 2/2001.

•

larly relevant to semi sub units and require to be

• Effect of moorings and thrusters on stability.

• ing adequate suction with vessel at maximum inclined angle after damage.

• a flooded pump room.

are particularly relevant to FPSO/FSUs and require to be addressed in the safety case:

•

• es for the maintenance of stability during the offloading of cargo

• on with the shuttle tanker minimised due to suitable equipment and

• Compliance with Safety Notice 4/2003.

Compliance with SPC/TECH/OSD/21.

Semi-Submersible Units

The following points are particuaddressed in the safety case:

Adequate de-ballasting system or secondary system, capable of develop

Ability to de-ballast with

Monohull Units

The following points

Adequate freeboard, or other protection, against the effects of green water loading.

Suitable procedurto shuttle tanker.

Risk of collisiprocedures.

62


None



Section 3 Structural Integrity




Section 5.3 Loss of Containment - Fire and Explosion

Section 6 Wells




Section 13 QRA

This Section has been cross-referenced by the following Sections and Sheets:

Sheet 5.1.F8 Safety Integrity Levels Standards

Section 7 Diving

Section 8 Helicopters

7. Lead Assessment Section

OSD5.4


OSD5.4

63

Annex 1

LIST OF REFERENCES

The following sources of general guidance are useful, but are not to be taken as a complete list of references on the assessment of loss of stability:

Operations Notices

ON27 Status of technical guidance on design, construction and certification

Safety Notices

SN 04/2003 Reducing the Risks Associated With Flooded Machinery Spaces on Monohull FPSO and FSU Installations

SN 01/2003 Ageing semi-submersible installations

SN 02/2001 Jack-up [self elevating] installations: floating damage stability survivability criterion

Semi-Permanent Circulars

SPC/TECH/OSD/24 Accident/Incident Data

SPC/TECH/OSD/21 The Safe Approach, Set-up and Departure of Jack-up Rigs to Fixed Installations

SPC/TECH/OSD/17 Report by the OSD Working Group into P36 Incident

SPC/TECH/OSD/04 Collision Risk Management Advice to Inspectors

SPC/ENF/68 Risks Associated with Flooded Machinery Spaces on Monohull FPSO and FSU Installations

HSE Research Reports

RR049 Review of the Jack-Ups: Safety in Transit [JSIT] technical working group

RR095 Accident statistics for floating offshore units on the UK Continental Shelf 1980–2001

RR143 Review of the risk assessment of buoyancy loss [RABL] project

OTO 2001-010 Environmental considerations

OTO 2001-011 Corrosion protection

OTO 2001-012 Site Investigations

OTO 2001-013 Loads

OTO 2001-048 Floating Installations

OTO 2001-049 Stability, Watertight integrity and ballasting

OTO 2001-051 Self-elevating installations [jack-up units]

OTO 2001-063 Marine Risk Assessment

OTO 2001-065 Mechanical equipment

64


http://www.hse.gov.uk/offshore/notices/sn_04_03.htm



http://www.hse.gov.uk/foi/internalops/hid/spc/spctosd24.pdf


http://www.hse.gov.uk/foi/internalops/hid/spc/spcenf68.pdf

http://www.hse.gov.uk/research/rrhtm/rr049.htm












OTO 2000-097 Rationalisation of FPSO design issues

OTO 2000-123 Review of model testing requirements for FPSOs

OTO 1999-092 Human factors assessment of safety critical tasks

OTO 1998-045 Quantified Risk Assessment of Jack-Up Operations Afloat

OTH 1994/434 Criteria for jack-ups manoeuvring in close proximity to jacket platforms

Other Sources

DNV OS-C301 DnV Offshore Standard Stability & Watertight Integrity

UKOOA Guidelines for Safe Movement of Self-Elevating Offshore Installations (Jack-Ups), April 1995

UKOOA FPSO Design Guidance Notes for UKCS Service

UKOOA Guidelines for Selection and Training of Ballast Control Operators

HSG 48 Reducing error and influencing behaviour

65




http://www.hse.gov.uk/research/othhtm/400-499/oth434.htm

4.2 LOSS OF MARITME INTEGRITY - LOSS OF POSITION 1. Scope

This section provides guidance for the assessment of safety case content with respect to the loss of position of any floating installation. The scope ranges from hazard identification through to consequence determination, including risk management measures. Position may be lost through either a failure of the mooring system, or a failure of the dynamic positioning system.


Loss of position of a floating installation can easily lead to collision with an adjacent installation, or to the release of hydrocarbons from fractured drilling or well operations risers. Hence, loss of position is clearly a hazard ‘with the potential to cause a major accident’ and requires evaluation within the safety case [SCR Regulation 12(1)(c), d)].

‘Loss of position’ is an incident that is reportable under the Offshore Installation and Wells (Design and Construction, etc) Regulations 1996 [DCR] as well as more generally in the application of Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995 (RIDDOR) offshore.

The categorisation table in this section presents a number of prompts or keywords for the initiators that might lead to a loss of position [the causal chain]. The initiators have been divided into five categories as:

• Design

• Operational Hardware

• Interface Systems

• Human Factors

• External Events

The categorisation table also shows keywords for the evaluation of the escalation path [the consequence chain]; how the risk is evaluated in terms of both frequency and consequence. Similarly keywords are presented for the risk management measures that can be introduced, these cover the complete range of possible measures and are:

• Inherent Safety

• Prevention

• Detection

• Control

• Mitigation

• Evacuation, Escape and Rescue [EER]

ion the safety case in conjunction with the

contents of the categorisation table below.

The assessor should examine the adequacy of the hazard identification, risk evaluatand management measures as described in

66



Where the safety case contents match with good practice identified herein, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue to follow up through inspection.

A list of references is found at the end of this section. These are the main references that should be familiar to, and consulted by, the assessor. They are not a complete list of references on the subject of loss of stationkeeping.

Two ‘sources of hazard’: the mooring system and the dynamic positioning system are identified in the Categorisation Table. These are dealt with separately in the following assessment sheets 4.1HS1 [Moorings] and 4.2HS2 [Dynamic Positioning]. Thruster assisted mooring systems are included in the assessment of the mooring systems.

67


Loss of Maritime Integrity - Loss of Position

Source of Hazard



HS1 Mooring System

G1 Design Assessment Frequency Inherent Safety Classification societies

Anchor Environmental Forces Section 3

F1 Generic data F17 Redundancy in design IMCA/NMD/API standards

Chain Seismic/erosion F2 System specific data F18 Water depth Material specification

Wire Incorrect specification F3 Emergency tow F19 Excursion radius Software specification

Fairleads Uncontrolled modifications

F4 Support vessels F20 Flexible riser Audit reports

Stopper F5 Incident response time F21 Weathervaning Client standards

Winches G2 Operational Hardware

F6 Proximity to other hazards Personnel competency

Control system – Section 5

Overload F7 Maintenance programme Prevention

Turret Fatigue – Section 3

F22 Redundancy

Turret bearings

Material defect – Section 5.1

Consequences F23 Tension meters

Manufacturing defence

F8 Collision – Section 2 F24 Weather forecasts

HS2 Dynamic Positioning

Commissioning defect

F9 HC release – Section 5.1

F25 Standby power

Reference sensors

Maintenance defect F10 Motions outside of limits

68


Source of Hazard

Risk Management Measures


Initiators Risk Evaluation

Thrusters F11 Emergency Response required – Section 10

Detection

Power management

G3 Interface systems F12 HELO Ops impaired – Section 10

F26 Tension meters

and generation – Section 5

Electric controls F13 Tilt/trip F27 Position monitoring

Computer software

Hydraulic controls F14 Noise/vibration – Section 12

F28 Position alarms

Hydrodynamic model

Pneumatic controls F15 Riser damage – Section 5.2

F29 Other vessels

UPS/power generation

F16 Turret drag chain

Control

G4 Human Factors – Section 11

F30 Emergency response

Incorrect operation F31 Monitor movement

Poor ergonomics F32 Shutdowns

Inadequate training

Low competence Mitigation

Deficient procedures F33 Alert Coastguard

F34 Emergency tow

G5 External Events

Emergency response action

Emergency Response

69


Source of Hazard



Fire – Section 5.3, Section 9

F35 Precautionary – Section 11

Explosion – Section 5.3

Gas release – Section 5.1, Section 6

Trawler/external disturbance

70

4.2.HS1 Mooring System


4.2.F1-F16 Risk Evaluation

4.2.F17-F35 Risk Management Measures

1. The assessor should obtain confirmation that the mooring system is designed, constructed, operated, and maintained in accordance with recognised standards. In general, HSE standard of performance is defined in the former ‘4th Edition’, see Operations Notice ON27.

Reference may also be made to Classification Society Rules, and the associated ‘Class Notation’ [eg POSMOOR Code from Det Norske Veritas, and Offshore Standard OS-E301]. The assessor should be satisfied that the appropriate design rules have been selected to suit the operating environment for the installation safety case.

2. Where there is not compliance with the above assessment standards the duty holder should demonstrate that the mooring system would have an equivalent level of performance. HSE recognise that the standards of the Norwegian Maritime Directorate [NMD] are broadly equivalent to HSE required performance standard. In addition to the Classification Society Rules, there is also much useful information obtainable from the American Petroleum Institute [API] as well as various industry working parties and associated publications [JIP publications]. These are listed in Annex 1 – List of References at the end of this section.


Offshore Installations (Safety Case) Regulations 2005 Regulations 12(1)(c); 12(1)(d); Schedule 3



The safety case will be required to demonstrate to the assessor, directly or by reference to other documents, that:

• Appropriate standards have been used for the mooring equipment.

• The hazard assessment includes the loss of a mooring line, or mooring system component, and further evaluation of this by quantitative risk assessment where necessary.

• The mooring system components are included as ‘safety critical elements’ where this is appropriate, with performance standards defined for these elements.

• There is a mooring integrity monitoring system with an appropriate performance standard for the detection of a failed mooring line within an acceptable timescale. This particularly applies to FPSOs and other installations that remain on station for prolonged periods.

• Inspection and maintenance requirements are defined for the safety critical components of the mooring system.

71


• There are personnel with a defined level of competency, and responsibility for theoperation and maintenance of the mooring sys

tem.

n the assessment.

eavy weather, or to offset the installation for operational requirements.

owout]

ser

• ns is defined.

The risk assessment approach should conform to the requirements contained in

Thruster-Assisted Mooring System

In addition to meeting the specific technical issues listed above, the following points will

• A clear definition of the control mode – ie manual, or automatic thruster assist.

• priate selection of the consequence class and the safety factors for the marine operation to be undertaken.

• ol for the thruster if main communication/ control link fails.

• assessment of possible failure modes and corrective actions required

•

s ents [SCEs] and with appropriate performance standards and

le maintenance of thruster system as required for an SCE of a positional g system.

tion are:

• The proximity to other installations, including requirements for gangway access, has been fully considered i

• There is adequate clearance of the mooring lines from any sub-surface equipment,obstructions, or pipelines.

• There are suitable emergency procedures, mitigation measures, and drills to deal with events such as a lost mooring line.

• Procedures exist for the adjustment of line tension that may be required prior to periods of h

• Operation of the mooring system is possible from control stations without hazard to personnel.

• Emergency release of the moorings is possible [such as during a sub sea blso that move off location is possible without main power generation being available.

• The availability of emergency release system has been assessed and ridisconnect and cargo handling considered when applicable.

Suitable stand-off location for combined operatio

• guidance document OTO 2001-063.

also require to be demonstrated to the satisfaction of the assessor:

Appro

Availability of a back-up contr

Thorough[eg full pitch thruster failure].

Assessment of the thruster availability and the required redundancy in the controlsystem.

• Inclusion of the thrusters, power system, control system, and reference system asafety critical elemverification scheme.

• Suitabmoorin

5. Other Related Assessment Sheets in this Sec

72

None

6. e

s

ent - Fire and Explosion

Section ency Response

Section 13 QRA

This section has been cross-referenced by the following sections and sheets:

Sheet 5.1.F8 Safety Integrity Levels Standards disconnect/Cargo handling]

Diving

7. essment Section for this Sheet:

OSD5.4


OSD5.4

Cross-Refer nced Sections and Sheets are:





Section 5.2 Loss of Containment - Pipeline

Section 5.3 Loss of Containm

Section 6 Wells

10 Emerg



[Mooring release/Riser

Section 7


Lead Ass

73

4.2.HS2 Dynamic Positioning


4.2.F1-F16 Risk Evaluation

4.2.F17-F35 Risk Management Measures

1. The assessor should obtain confirmation that the dynamic positioning system is designed with respect to redundancy in accordance with recognised standards, for example IMO MSC circular 645, or equivalent Classification Society Rules. The safety case should also demonstrate that for any particular DP operation the equipment class of the vessel has been decided based upon a risk assessment on the consequences of a loss of position. Reference should also be made to IMCA M103, or Petroleum Safety Association - Activities Regulations, section 81, for suitable examples.

2. Where there is not compliance with the above standards, the duty holder should demonstrate that the dynamic positioning system would have an equivalent level of performance with respect to single point failures, including fire and flooding of machinery spaces.

The safety case should demonstrate that requirements under the Management of Health and Safety at Work Regulations 1999 (MHSWR) are complied with including suitable and sufficient risk assessment encompassing planning of DP operations, communications, competency, and decision-making.


Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c); 12(1)(d); Schedule 3



The safety case will be required to demonstrate to the assessor, directly or by reference to other documents, that:

• Appropriate standards have been used for the dynamic positioning system.

• All modes of operation have been considered in the assessment of hazards. These will include diving operations, well operations, riser excursion limits, and proximity to other installations, control of heading for FPSO offload. Each type of operation will have its own hazards and associated risks.

• The interface of the DP system with any thruster-assisted mooring system has been adequately assessed.

• Operation of the DP system in conjunction with any interface requirements for emergency riser disconnects, mooring release, or cargo handling operations has been suitably considered.

• Maximum excursion limits and environmental operating restrictions are clearly defined.

74

• A Failure Modes and Effects Analysis [FMEA] is available and represents the current DP configuration, and conforms to IMCA management guidance for

• encies ed by the Verification Scheme.

DP of the power generation and management

• ments are defined for the safety critical

• of the training and experience of DP qualified personnel are

• repairs, or modifications to the DP system are properly managed

• equent action taken to

sters, power generation, control equipment etc. are developed prior to the DP operation.

• Operating guidelines specific to the particular DP operation to be undertaken.

5. Related Assessment Sheets in this Section are:

None

6. renced Sections and Sheets are:







Section 6 Wells

Section Response



Section 13 QRA

n ha been ferenced by the following sections and sheets:

FMEAs. [Under development as at June 2004, but refer also to RR195]

There are records of annual DP proving trials, or other proving trials at frequdetermin

• The Safety Critical Elements [SCEs] required by the safety case include the system, and important elements system.

Inspection and maintenance requirecomponents of the DP system.

Suitable recordsmaintained.

Any changes,and controlled.

There is a system for reporting of DP faults and the subsrectify them.

• Operating limits in terms of environment, thru

Cross-Refe

10 Emergency

This sectio s cross-re

75

Sheet 5.1.F8 Safety Integrity Levels Standards [Mooring release/Riser disconnect/Cargo handling]

Section 7 Diving



OSD5.4


OSD5.4

76

Annex 1

LIST OF REFERENCES

The following sources of general guidance are useful, but are not to be taken as a complete list of references on the assessment of loss of position:

Operations Notices

ON27 Status of technical guidance on design, construction and certification

Safety Notices

SN 3/2005 Floating Production Storage and Offloading (FPSO) – Mooring inspection

Semi-Permanent Circulars

SPC/TECH/OSD/24 Accident/Incident Data

SPC/ENF/50 Reporting of Mooring Failures

SPC/ENF/107 Floating Production Storage and Offloading – Mooring inspection

HSE Research Reports

RR219 Design and integrity management of mobile installation moorings

RR195 Review of methods for demonstrating redundancy in dynamic positioning systems for the offshore industry

RR095 Accident statistics for floating offshore units on the UK Continental Shelf 1980 – 2001

OTO 2001-010 Environmental considerations

OTO 2001-011 Corrosion protection

OTO 2001-012 Site Investigations

OTO 2001-013 Loads

OTO 2001-050 Stationkeeping

OTO 2001-063 Marine Risk Assessment

OTO 2001-065 Mechanical equipment

OTO 2000-026 Appraisal of AP1RP 2F for Floating Production System

OTO 2000-053 Collision resistance of ship-shaped structures to impact

OTO 2000-065 Development of the concept of structural toughness

OTO 2000-097 rationalisation of FPSO design issues

OTO 2000-123 Review of model testing requirements for FPSOs

OTO 1999-066 Effects of motion on cognitive performance

OTO 1999-092 Human factors assessment of safety critical tasks

77





http://intranet/operational/hid_circs/enforcement/spc_enf_107.htm


















OTH086 Quick release systems for Moorings

Other Sources – Moorings

Classification Society [DnV, LR, ABS, BV] Rules

DnV OS-E301 Position mooring

IMO Circ 737/1995 Guidelines on anchoring equipment

AP1 RP Spec 2F Mooring Chain

AP1 RP 2fps Recommended Practice for Planning, Designing and Constructing Floating Production Systems

AP1 RP 2SK Design and Analysis of Station keeping Systems for Floating Structures

AP1 RP 2I Inservice Inspection of Mooring Hardware for Floating Drilling Units.

AP1 RP2SM Recommended Practice for Design, Manufacture, Installation and Maintenance of Synthetic Fiber Ropes for Offshore Mooring

AP1 RP 2T Planning, Designing, and Constructing Tension Leg Platforms

Other Sources – Dynamic Positioning

Classification Society [DnV, LR, ABS, BV] Rules

IMO Guidelines In particular from Marine safety Committee [MSC]

MSC Circ 645/1994 Guidelines for Vessels with Dynamic Positioning Equipment

MSC Circ 738/1995 Guidelines on training requirements

IMCA M103 Guidelines for the Design and Operation of Dynamically Positioned Vessels

IMCA M166 Guidance on failure modes and effects analyses [FMEAs]

IMCA M161 Guidelines for the Design and Operation of Dynamically Positioned Vessels: Two-Vessel Operations: A Supplement to IMCA M103

IMCA M 159 Guidance on Thruster-Assisted Stationkeeping by FPSOs and Similar Turret-Moored Vessels

IMCA M 150 Quantified Frequency of Shuttle Tanker Collision during Offtake Operation

IMCA M 117 The training and Experience of Key DP Personnel

115 DPVOA Risk analysis of collision of dynamically positioned support vessels with offshore installations [Revised]

112 UKOOA UKOOA Publications of joint initiatives – Guidelines for Offshore Installations Safety Case Diving Operations from Vessels – Guidelines for Auditing Vessels with Dynamic Positioning Systems

DPVOA 1611/14 DP Position loss risks in shallow water

IMAC D010 Diving Operations from Vessels operating in DP mode

78

Other Sources – General

UKOOA FPSO Design Guidance Notes

UKOOA Tandem Loading Guidelines

NPD/NMD Guidelines and NORSOK Standards

HSEG48 Reducing error and influencing behaviour

ISO 1990 1-7.E.3 Petroleum and Natural Gas Industries – specific requirements for offshore structure –Part 7: stationkeeping systems for floating offshore structures and mobile offshore units; under development as at June 2004

Joint Industry Projects [JIP] have been conducted in a number of areas. Information on these is the property of the participants, but in a number of cases this information is becoming publicly available. JIPs have been conducted with the following parties as principal contact and in subject areas:

DNV Reliability based design for Deepwater Moorings

Noble Denton Integrated Riser and Mooring Design

Noble Denton Studless Chain Corrosion Fatigue

BMT/Noble Denton Response based design of FPSOs

79

5.1 LOSS OF CONTAINMENT - PROCESS 1. Scope

This section provides guidance for the assessment of safety case content with respect to the loss of containment from process plant and process operations, from hazard identification through to elements of consequence determination, including risk management measures. However it excludes assessment of the consequences of ignition of any release. This is considered separately in Section 5.3.


The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator, together with identification and evaluation of escalation paths that might result. Potential sources of hazard, initiators etc, are shown in Section 4 below. Assessors should ensure that, where relevant, safety cases contain appropriate consideration of each of these factors.



Where safety case contents match with good practice identified in the assessment sheets for a particular element associated with a major accident, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue for follow-up by inspection.

80


Loss of Containment - Process

Source of Hazard



HS1 Pressure Vessels

G1 Corrosion: Internal/External

Frequency F14 Inherent Safety Vessels, pipework, Flexible hoses

[inc Columns] G2 Erosion F1 Generic historical data - fully rated vessels, pipework,

tubing tanks, risers/ Temperature &

HS2 Heat Exchangers

G3 Overpressure F2 Company & installation data

pipelines, risers, etc drains/caissons pressure rating

HS3 Atmospheric Vessels

G4 Internal explosion F3 Installation specific hazard studies

- large segregation distances

Temp & pressure rating

Material specification

[eg Wemcos, TPSs]

G5 Under pressurisation

- HAZOPs - separate accommodation jacket

Material specification Corrosion allowance

HS4 Centrifuges/ G6 Fatigue/vibration cracking

- FMEAs - inventory minimisation Corrosion allowance Fatigue life

Hydrocyclones G7 Fire Fatigue life Frequency of inspect

HS5 Piping G8 Seal failure - Design reviews Frequency of inspect Integrity of connectors

HS6 Smallbore tubing

G9 Turret failure F4 Layout Prevention Relief arrangements

HS7 Pipeline Risers

G10 Inadequate installation

F5 Company standards/procedures

F15 Relief systems & capacity Pumps, Compressors

HS8 Flexible hoses G11 Operator error: inadequate

F6 Corrosion/erosion policy F16 HIPS systems Reliability of protective

Turbines

HS9 Pumps Training F7 Operational reviews [procedures]

F17 Blowdown/flare systems systems Flow rate

81


Source of Hazard



HS10 Compressors G12 Operator error: inadequate

F8 SIL standards F18 Shutdown systems Adequacy of supports

Head/pressure

HS11 Turbines competency F9 Equipment selection [eg weld or

F19 Alarms/Trips Fire protection Shut-in pressure

HS12 Valves G13 Violation Flange] F20 Good procedures Heat Exchangers NPSH

HS13 Deck Drains [inc

G14 Deficient procedures:

F10 Concept selection - operational Thermal rating Turndown

tote tanks and operational Temp & pressure rating

Minimum flow

Chemical injection

G15 Deficient procedures:

- maintenance Shell & tubeside Sealing system

tanks] maintenance Flow rates

HS14 Marine storage tanks

G16 Ship collision Consequences F21 Competent personnel Material specification Valves

HS15 Hazardous drains

G17 Dropped object F11 Size of release F22 Monitoring & audit systems

Fatigue life Temperature &

/caissons G18 Seismic event Frequency of inspect pressure rating

HS16 Integral storage cells

G19 Missile [eg turbine blade]

-speed & effectiveness of detection

F23 Isolations and PTW controls

Relief arrangements Material specification

HS17 Flare towers G20 Ageing/mechanical & response & capacity Corrosion allowance

HS18 Turrets degradation - blowdown system Detection Closure mode

HS19 Temporary G21 External loads F12 Dispersion F24 Gas detection Centrifuges/ Fire protection

Equipment [eg stood on, struck by

- open/closed modules/ventilation

F25 Fire detection Hydrocyclones Integrity of seals

82


Source of Hazard



scaffold pole] rates Temp & pressure rating

Leakage rate

G22 Helicopter collision/rollover

F13 Toxicity of release Material specification

G23 Inadequate design Ignition transfer to fire & explosion

Corrosion allowance Turrets

G24 Incorrect material Section 5.3 Separation efficiency Temperature &

specification Vibration [centrifuges]

pressure rating

G25 Incorrect material usage

Flare/Vent Systems Material specification

G26 Thermal radiation Temp & pressure rating

Corrosion allowance

G27 Slugging/water hammer

Material specification Integrity of seals

G28 Sloshing/slam liquid loads

Corrosion allowance Seal leaking rate

G29 Structural failure Separation efficiency

Gas dispersion

Thermal radiation

Noise level

Turndown

83

5.1.HS1: Pressure Vessels (Including Columns)

5.1.HS5: Piping and Piping Components

5.1.HS12: Valves

[Relevant Sheets: 5.1.G17, 5.1.G18, 5.1.G20, 5.1.G21, 5.1.G29, 5.1G3, 5.1.G5, 5.1.G6, 5.1.G8, 5.1.G10, 5.1.G27, 5.3.F15, 5.3.F18]

1. This sheet is generally applicable to the mechanical integrity of static components that form the boundary of a hydrocarbon containment system; ie pressure vessels and piping etc. It is also of relevance to rotating equipment, in so far as these also have pressure boundaries. Aspects specific to machinery and rotating equipment are dealt with elsewhere. Similarly, process control and plant isolation requirements are not dealt with here.

This sheet is not intended to limit the scope of an assessor to pursue any aspect of safety that they believe is important to a particular safety case, within the remit provided by the safety case regulations. It is though intended to provide guidance as to the minimum acceptable demonstration of safety that a duty holder should be able to provide. As with all safety assessment work, there is a need for HSE assessors to concentrate on areas where there are grounds for believing the safety demonstration may be weakest. Knowledge of such areas comes from HSE’s collective experience, as well as that of the wider engineering community. This document is intended to provide pointers towards what are believed to be the most pressing concerns. Conversely, it is not considered necessary or practical for a particular safety case to mention explicitly all of the aspects of design and operational concerns identified below. However the duty holder should in principle be able to address all such concerns and hence provide an adequate demonstration of integrity. Therefore, it is reasonable for an assessor to question a duty holder on any aspect of the integrity justification.

Confirmation should be obtained that the pressure system elements have been designed, constructed, installed, and operated in accordance with a recognised standard or code of practice.

As a general principle, HSE accepts that codes, standards published by BSI, ASME, API and others, are for the most part well founded, in that they have been written to encompass the present best knowledge and advice available. However adherence to a code is not in itself a demonstration of safety. There are several reasons for this. Not only are some codes inherently goal oriented themselves, but there are also some matters which are the subject of technical uncertainty, or indeed where current code provisions appear to be inadequate or may not reflect the state of the art. The safety case assessment process may therefore include questioning as to the detailed application or adequacy of parts of codes. A typical, but non-exhaustive, list of standards and codes of practice would include:

PD5500:2003 Specification for unfired fusion welded pressure vessels

ASME VIII Boiler and pressure vessel code

BS EN 13445 Unfired pressure vessels

ASME B31.3 Process piping

ISO13703 [API 14E] Petroleum and natural gas industries. Design and installation of piping systems on offshore production platforms

ISO 15649 Petroleum and natural gas industries. Piping

84

PD CEN/TR 14549 2004 Guide to the use of ISO 15649 and ANSI/ASME B31.3 for piping in Europe in compliance with the Pressure Equipment Directive

ISO 14692 Parts 1 to 4 Petroleum and natural gas industries. Glass-reinforced plastics (GRP) piping.

BS 4994 Specification for design and construction of vessels and tanks in reinforced plastics

Codes to assist in-service integrity:

A typical but non-exhaustive list of relevant standards would include:

ASME Boiler and Pressure Vessel Code Series

Inspection:

API 510 Pressure vessel inspection code: Maintenance inspection, rating, repair, and alteration

API 570 Piping Inspection Code: Inspection, repair, alteration, and rerating of in-service piping systems

API 574 Inspection practices for piping system components

EEMUA Standards

API RP 580 Risk based inspection

API 581 Risk based inspection

Flaw assessment:

BS 7910 Guide on methods for assessing the acceptability of flaws in metallic structures

Fitness for purpose:

API 579 Recommended practice for fitness-for-service and continued operation of equipment

The emerging ASME Post Construction codes are likely to provide useful benchmarks for inspection planning, flaw evaluation, repair, and testing.

2. Where a standard or code of practice other than those listed above has been employed, judgement as to the adequacy of alternative measures can only be assessed on an individual basis, and the duty holder should be required to provide an engineering justification of how an equivalent level of health and safety performance is delivered.

The avoidance of loss of containment relies primarily on the integrity of the containment in which the hydrocarbons are held. The issue of mechanical integrity can itself be subdivided into issues of initial integrity and continuing integrity.

2.1 Initial integrity

Adequate initial integrity is delivered by adherence to suitable design principles, often embodied in codes and standards. Full consideration should be taken of design details, operating and fault conditions, material properties and potential failure modes. Related issues include the provision of protective systems. Delivery of the design intent is provided by suitable quality controls on manufacture followed by appropriate inspection and testing.

Adequate initial integrity is ensured by adherence to the following engineering principles.

85

• Risks implicit in the design should be identified. [APOSC 91]

• Engineering design should seek to minimise risk and adopt a hierarchical approach [APOSC 92 & 98]

• Appropriate industry standards should be used.

• Engineering structures important to safety should maintain their integrity through life, requiring a demonstration that normal operating loads and foreseeable extreme loads have been quantified.

• The materials used should be suitable. [APOSC 95]

• Active safety features should have demonstrably adequate reliability, availability and survivability

2.2 In-service Integrity

Following a consideration of the initial integrity, attention must be turned to the continuing integrity of the containment, throughout its service life. This is ensured by; operating the plant within the limits for which it was designed; by carrying out appropriate maintenance and through periodic examination by a competent person, to identify significant inservice degradation. Also, procedures must be in place to ensure that modifications to the plant will not compromise the integrity of the containment. Finally, the duty holder needs to be sure that the assumptions made at the design stage are still valid. For example, a change of usage may lead to faster corrosion/erosion rates and different applied loads may invalidate the design fatigue assessment.


Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c) & 12(1)(d) & Schedules

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 9 and 19

Provision and Use of Work Equipment Regulations 1998, Regulations 4, 5 and 6

Lifting Operations and Lifting Equipment Regulations 1998, Regulations 8 and 9

Pressure Equipment Regulations 1999, Regulations 7 and 10

Assessment Principles for Offshore Safety Cases [APOSC] 14, 16, 35, 41, 91, 92, 95, & 98

4. Specific technical issues

Relevant initiators and potential failure mechanisms are identified below:

4.1 Primary & Secondary Loads

Primary loads typically include design pressure and self-weight etc. Secondary loads typically include thermal loads and equipment displacements etc. Adherence to the relevant design codes and standards should ensure that the pressure systems are adequately designed for primary and secondary loads.

4.1.1 Overpressure [Initiator 5.1.G3]

Pressure system should be designed for maximum and, where relevant, the minimum anticipated operating pressure under all modes of operation. It needs to be borne in mind that the maximum operating pressure may not occur during the normal mode of operation.

86





Designing equipment and systems to the maximum pressure to which it can be subjected can have advantages in simplifying plant by reducing or eliminating protection or relief systems. Based on established design pressures, the facilities should be protected with recognised relief devices discharging to suitable disposal or an instrumented high integrity protection system or a combination of both. The latter subject is covered in 5.1.F16. Possible sources of overpressure need to be identified and allowed for.

Issues for Safety Case Assessment

It should be established whether provision against over pressurisation is provided by active measures, such as pressure relief and control systems, or is dependent upon the strength of the component itself. Later in life, plant changes may necessitate reassessment.

When overpressurisation is a foreseeable event, the consequences should be considered. The nature of the failure should be determinable, ie whether a leak or a catastrophic failure could result. Further assessment of consequence could include assessment of the hazards posed by any release.

4.1.2 Risers and Topsides Pressure Rating [Initiator 5.3.F15]

It is normal practice in offshore industry to use different design codes for the design of topside piping and risers. Risers are normally designed to pipeline design codes, such as BS 8010 and topside piping is normally designed to piping code ASME B31.3. Both the codes use different factor of safety in the design of pressure systems for primary and secondary loads. Hence it is important that at the specification break between riser and topside piping the pressure rating on both sides, ie riser and topside, is compatible.


It should be established that specification break made between topside piping and a riser is made at appropriate location so that the design requirements of respective design codes are satisfied.

4.1.3 Under-Pressurisation [Initiator 5.1.G5]

Underpressure events also have the potential to cause failures i.e. by implosion if the under-pressure that results is below atmospheric pressure [vacuum conditions]. Normally, integrity is assured by adherence to a recognised design code.

4.1.4 External Loads and Structural Support Failure [Initiators 5.1.G21 & 5.1.G29]

Lack of consideration of pipe supports and movement of piping and connected equipment at the design phase can result in failure of supports, leakage at flanged joints and overloading of sensitive equipment such as pumps and compressors etc.

External loads could come from a disturbance of the structure itself, ie a partial failure or relative displacements. External movements may result from vessel movements [FPSO] or wind sway, eg piping supported from a tall slender tower or temperature changes in connected equipment. Loads due to such movements need to be considered and adequate flexibility should be provided within the pipework.

For floating vessels, the motion may well contribute significantly to the fatigue load


Confirmation that external loads acting on the pressure system have been considered and allowed for in the mechanical design.

4.1.5 Inadequate Installation [Initiator 5.1.G10]

87

Inadequate installation of plant is a significant source of engineering failure. Deficiencies include misalignment of mating parts, incorrect welding and jointing procedures, inadequate inspection, and the omission of certain parts of the overall commissioning process, such as pressure testing. Commissioning procedures should be in place to ensure that installed pressure equipment is inspected before use to identify any design faults that may have been introduced at the construction stage and to confirm suitability for use.


Does the duty holder have an effective safety management system for installation and modification of plant.

4.1.6 Seismic Event [Initiator 5.1.G18]

If seismic events are deemed a possibility, then in principle the effects can be included as a design load case. In such a situation, the response of the structure will have been calculated and the resultant motion would have to be imposed on the hydrocarbon containment system.


Whether seismic assessment has been carried out at the design stage.

4.2 Occasional Loads

These include slugging, water hammer, wind, sloshing and liquid slam, etc [5.1.G27 & 5.1.G28].

During design, the operation of each piping system needs to be clearly understood not only under normal conditions but also those conditions arising during start up, shutdown and as a result of process upsets.

The dynamic loads produced by the movement of fluids within a pressurised system can be considerable. Excitation from valve slams or from flow instabilities has been known to be a source of severe vibration.


The safety case should make it clear that occasional loads have been considered during the design phase.

4.3 Degradation in Service

4.3.1 Corrosion

Please refer to generic sheets 5.1.G1 Parts 1 & 2 & 5.1.F6.

Piping containing hydrocarbons should avoid 'dead legs' and be designed to facilitate drainage to prevent trapping of fluid.

4.3.2 Erosion

Please refer to generic sheets 5.1.G2 & 5.1.F6.

4.3.3 Fatigue/Vibration Cracking [5.1.G6]

Fatigue is a damage mechanism by which cracks can propagate in a structure under the influence of repeated cycles of stress well below the level capable of causing general yielding. Fatigue is often characterised as occurring in two phases, the first is that of initiation, ie from manufacture up to the point where a detectable crack is present. The

88

second is the phase of defect growth, where propagation from the point of detectability to the point of failure occurs.

Fatigue is addressed initially at the design stage. There are a number of methodologies by which this can be done. However we note that for plant with a limited fatigue load, the codes normally provide for the exclusion of a full analysis, providing that certain preconditions can be met, ie it is established that there will only be a limited number of full pressure cycles etc.

In general though, the fatigue loads from all sources of repetitive stress have to be characterised both in terms of the stress amplitude and their number. This can be used to determine a fatigue lifetime for the component.


The importance of fatigue as a potential failure mechanism varies greatly according to the type of duty a pressure vessel or piping system is subjected to. However, in an environment where installations are increasingly being used beyond its original design lifetime, there are important issues as to whether the plant is still within its original fatigue life. For older plant, the duty holder could be questioned as to the current validity of the original fatigue calculations.

Experience has shown that fluid induced vibration is a significant cause of failure in offshore pressure systems, affecting both vessels and piping. Such type of vibration is perhaps somewhat difficult to treat within design codes. Further guidance on this topic is provided in:

JIP Report MTD Guideline for the Avoidance of Vibration Induced Fatigue in Process Pipework; and

OTR Report 2002/28 Transient Vibration Guidelines for Fast Acting Valves Screening Assessment.

It is a reasonable question to ask how the duty holder assures the integrity of plant against this source of fatigue.

4.3.4 Seal/Gasket/Compression Fitting Failure [5.1.G8]

A suitable demonstration should be provided for the integrity of joints and seals where failure could lead to a release of hydrocarbons. General information should be provided to indicate that flanges and other joints have been adequately designed and properly made to avoid flammable and toxic hazards. Further guidance is available in IP/UKOOA Guidelines for the Management of Integrity of Bolted Pipe Joints.

4.3.5 Fully Welded Topside Pipework in Critical Areas [5.3.F18 & 5.1.F9]

The use of fully welded pipework topside is one of the approaches to adhere to the principle of inherently safer design. However, for ease of access for operation, inspection, maintenance and repairs, it is not possible to have fully welded pipework everywhere on topside plant. The duty holder should avoid routing of pipework containing hazardous fluid through non hazardous area. If this is unavoidable then pipework shall be all welded [no flanges] and not located in a vulnerable position where it may be mechanically damaged.


It should be established in the safety case that as far as possible hydrocarbon pipework in non-hazardous areas is fully welded.

4.4 Materials

89

Materials chosen should be suitable for the application in terms of the process fluid, environment and applied loading.

4.4.1 Incorrect Material Specification

Please refer to 5.1.G24 regarding issues relating to incorrect material specification. Issues relating to incorrect material usage [5.1.G25] are addressed by ensuring that pressurised equipment is designed and manufactured in accordance with a recognised design standard as indicated in Section 1above.

4.4.2 Brittle Fracture

The prevention of brittle fracture is addressed within design codes. Prevention involves the correct choice of materials, operation within strict temperature/pressure limits and monitoring ageing phenomena such as embrittlement. Ferritic steels are subject to a ductile to brittle transition as temperature decreases, rendering them highly vulnerable to brittle fracture when cold. Transition temperatures vary, but are typically below ambient values for offshore applications. Ageing though can lead to a shift in the transition temperature and render components more susceptible to brittle fracture. Austenitic steels remain ductile at low temperatures and may be preferred for application such as blowdown lines.

Brittle fracture is possible whenever low temperatures are involved, in particular low temperatures associated with gas expansion. This is particularly the case when systems are still pressurised, although in some circumstances, the differential stresses through the wall of a vessel by sudden cooling could lead to crack propagation.


Choice of materials.

Identification of vulnerable components.

4.4.3 Ageing/Mechanical Degradation [5.1.G20]

The effect of ageing is undoubtedly one of the major integrity issues facing the older installations. Ageing encompasses degradation mechanisms such as fatigue and corrosion. There are also some other phenomena, for example creep and the deterioration in mechanical properties such as fracture toughness. The latter phenomenon is associated with changes in transition temperatures. Provision against these mechanisms is explicitly required, as part of the design criteria and operational monitoring exists for the express purpose of detecting these phenomena.

Nevertheless, ageing related failures are occurring. The implication of this is that either plant is being operated beyond its original design life, that conditions have changed because modification has rendered the initial assumptions invalid or that inspection regimes are inadequate.

In recent years, the popularity of risk-based inspection schemes has led to situations where inspection intervals have been lengthened for some plant. Where such decisions have been made, the requirements on the knowledge about plant state are high.


As for fatigue, corrosion and other degradation phenomena above; including:

Whether initial design assumptions are still valid.

Whether modifications have had their implications on lifetime assessed.

Whether the inspection regime is adequate.

90

4.5 Dropped Loads [5.1.G17]

Major hazards assessed are the impact of dropped loads onto hydrocarbon containment plant and or accommodation areas. Protection essentially relies upon having an effective safety management system.

Typical benchmarks employed include:

HSG221 Technical guidance on the safe use of lifting equipment offshore

BS 7121-2 & 11 Code of practice for the safe use of cranes

Step Change lifting and mechanical handling guidelines

OMHEC Training Standard for offshore crane operators and banksmen

OMHEC Enterprise of competence

91

http://www.hse.gov.uk/offshore/trainingstandard.pdf

http://www.hse.gov.uk/offshore/competence.pdf


Plans showing crane over sail area and identification of areas where HC piping and vessels and accommodation units are vulnerable to dropped loads and or boom collapse. References to dropped object/load impact studies and their conclusions. Provision of protective barriers on vulnerable areas.

Description of cranes and lifting machinery including safe working load, de-rating for prevailing sea state, and rated capacity indicator.

Details of the arrangements for maintenance and thorough examination of cranes.

Details of how competence is assessed for crane operators, banskmen, slingers and for those responsible for planning lifting operations.

Evidence that lifting operations are planned and assistance is available to identify and plan non-routine lifts.


5.1.G1 Part 1 Corrosion: Internal

5.1.G1 Part 2 Corrosion: External

5.1.G2 Erosion

5.1.G18 Seismic Event

5.1.F16 High Integrity Protection Systems [HIPS]




OSD3.4


OSD3.4

92

5.1.HS2: Heat Exchangers

1. Confirmation should be obtained that heat exchangers have been designed, constructed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include:

BS EN ISO 16812:2003 and API Standard 660 for shell & tube exchangers

BS EN ISO 15547:2001 and API Std 662 for plate heat exchangers

BS EN ISO 13706:2000 and API Std 661 for air cooled heat exchangers

BS EN ISO 13705:2002 and API Std 560 for fired heaters

TEMA ‘Standards of the Tubular Exchanger Manufacturers Association’ are applicable for tubular heat exchangers.

Pressure Vessel Design Codes applicable to heat exchangers:

PD 5500:2003 Specification for unfired fusion welded pressure vessels



Printed circuit heat exchangers [PCHEs] are normally designed to ASME VIII Division 1 but other design codes such as PD 5500 can be employed as required by the purchaser.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the heat exchange equipment can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.


Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c)

Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35

Provision and Use of Work Equipment Regulations 1998 Regulation 4


4.1 Shell and Tube Heat Exchangers

Flow induced tube vibration which results in thinning of the tubes can occur where the tubes pass through the tube sheets. The possibility of this occurring should have been examined as part of the design.

The provision of overpressure relief for tube failure should be considered when the design pressure for the low pressure side of the exchanger is less than 2/3 of the design pressure of the high pressure side. Justification should be provided if the requirements of the 2/3 rule [as contained in API RP 521] are not met. [NB the 2/3 rule is written in the context of ASME pressure vessel codes for which the test pressure is typically 150% of the design pressure. In the rare circumstances where test pressures do not conform to these requirements, the 2/3 rule may not apply and more detailed assessment will be necessary.]

Related guidance:

API RP 52 Guide for Pressure Relieving and Depressuring Systems. 4th Edition March 1997

93


IP Guidelines for the Design and Safe Operation of Shell and Tube Heat Exchangers to Withstand the Impact of Tube Failure, August 2000, ISBN 0 85293 286 3

4.2 Printed Circuit Heat Exchangers

For PHCEs there is an issue with thermal cycling which has been known to have caused failure of the integrity of the heat exchange matrix. This phenomenon is most likely to occur when the unit is subjected to frequent start-ups and shutdowns. Confirmation should be sought that this has been taken into account as part of the design process.

4.3 Gasketed Plate Heat Exchangers

There is a likelihood of significant hydrocarbon release to the atmosphere on gasket failure. Shields should normally be fitted to prevent fluids from contacting personnel in the event of gasket failure. There is a working pressure limitation for gasketed plate heat exchanger of approx 25 barg.


5.1.HS1 Pressure Vessels (Including Columns)


None


OSD3.1


OSD3.1

94

5.1.HS3: Atmospheric Vessels [eg Wemcos, TPSs]

1. Confirmation should be obtained that atmospheric vessels and their accessories have been designed and constructed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include:

API Standard 2000 Venting Atmospheric and Low Pressure Storage Tanks; Non Refrigerated and Refrigerated, 5th Edition, 1998

API Publication 2210 Flame Arresters for Vents of Tanks Storing Petroleum Products

API Bulletin 2521 Use of Pressure-Vacuum Vent Valves for Atmospheric Pressure Tanks to Reduce Evaporation Loss

API Standard 620 Design and Construction of Large, Welded, Low Pressure Storage Tanks

API Standard 650 Welded Steel Tanks for Oil Storage

API Specification 12D Field Welded Tanks for Storage Production Liquids

API Specification 12F Shop Welded Tanks for Storage of Production Liquids

BSI 1564:1975 Specification for the manufacture of vertical steel welded non-refrigerated storage tanks with butt-welded shells for the petroleum industry

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the atmospheric vessel can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.



Assessment Principles for Offshore Safety Cases [APOSC] paras 14, 16 and 35

Provision and Use of Work Equipment Regulations 1998, Regulation 4


4.1 Venting for Fire Exposure

It is likely that tanks installed on offshore installations will not be fitted with a frangible roof-to-shell attachment for fire venting purposes. Where this is the case, confirmation should be sought that venting capacity is adequate for fire exposure conditions.

4.2 Bunding

It should be clear that any decision as to whether tanks should be bunded or not has been made in the light of a corresponding fire analysis.

4.3 The emergency dumping/draining of the flammable content of large tanks should have been considered.

4.4 Consideration should have been given to minimising storage tank sizes and inventories as part of a wider consideration of an inherently safer design features.

4.5 Methanol Storage Tanks

95


Provision should be made to limit the discharge of methanol vapour to atmosphere. For large storage tanks, the provision of an inert gas blanket should have been considered.


5.1.F14 Inherent Safety


None


OSD3.1


OSD3.1

96

5.1.HS4: Centrifuges/Hydrocyclones

1. Confirmation should be obtained that centrifuges and hydrocyclones have been designed, and constructed, in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include:

PD 5500:2003 Specification for unfired fusion welded pressure vessels



2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the centrifuge or hydrocyclone can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.






None


5.1.HS1 Pressure Vessels (Including Columns)


None


OSD3.1


OSD3.1

97


5.1.HS6: Smallbore Tubing

1. Confirmation should be obtained that the design, installation and maintenance of smallbore tubing is in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include:

Guidelines for the Management, Design, Installation and Maintenance of Smallbore Tubing Systems: UKOOA/Institute of Petroleum 2000

2. Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy can only be made on an individual basis and the duty holder should be required to justify why equivalent standards of safety should result.






None over and above those described in the referenced standard.


5.1.G6 Fatigue/Vibration Cracking


None


OSD3.1


OSD3.1

98


5.1.HS8: Flexible Hoses

1. Confirmation should be sought that the design, specification and usage of flexible hoses used on the installation is in accordance with a recognised standard or code of practice. Recognised standards/codes of practice include:

Flexible Hose Management Guidelines: UKOOA/HSE/Institute of Petroleum 2003

2. Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy can only be made on an individual basis and the duty holder should be required to justify why equivalent standards of safety should result.







None

6. Cross-referenced Sections and Sheets are:

None


OSD3.1


OSD3.1

99


5.1.HS9: Pumps

5.1.HS10: Compressors

5.1.HS11: Turbines

[Relevant Sheets: 5.1.G7, 5.1.G19]

1. Introduction

This sheet is to provide guidance for safety case assessment for areas dealt with by the Mechanical Systems Team OSD3.4. What follows is therefore generally applicable to the mechanical integrity of machinery and rotating equipment. Aspects specific to hydrocarbon containment are dealt with elsewhere. Similarly, process control and plant isolation requirements are not dealt with here.

The document is not intended to limit the scope of an assessor to pursue any aspect of safety that they believe is important to a particular safety case, within the remit provided by the Safety Case Regulations. It is though intended to provide guidance as to the minimum acceptable demonstration of safety that a duty holder should be able to provide. As with all safety case assessment work, there is a need for HSE assessors to concentrate on areas where there are grounds for believing the safety demonstration may be weakest. Knowledge of such areas comes from HSE’s collective experience, as well as that of the wider engineering community. There is some guidance below that provides pointers towards what are believed to be the most pressing concerns. Conversely, it is not considered necessary or practical for a particular safety case to mention explicitly all of the aspects of design and operational concerns identified below. However, the duty holder should in principle be able to address all such concerns and hence provide an adequate demonstration of integrity. Therefore, in the last resort, it is reasonable for an assessor to question a duty holder on any aspect of the integrity justification.

2. Machinery and Rotating Equipment Integrity

Machinery and rotating equipment is often packaged together to form a single system. The packages employ a combination of rotating equipment such as pumps, compressors and generators, driven by a gas turbine or electric motor. Typical applications include:

• Process and export gas compression

• Oil export pumping

• Fire water pumping

• Utilities [electricity generation/compressed air]

Our main source of reference is HSE’s Inspection Guidance Notes [IGN]: HSE Research report 076 “Machinery and Rotating Equipment Integrity Inspection Guidance Notes”.

The IGN provides technical guidance that focuses on commonly used equipment such as gas compression and oil export packages, typical machinery including turbines, motors and diesel engines, and rotating equipment such as pumps and compressors etc. The IGN provides an understanding of the technology used and considers those aspects of design, operation and maintenance that could contribute to a major offshore incident. The report also includes a structured review to assist Inspectors gauge compliance with statutory requirements and it gives examples of poor practice to look out for.

A comprehensive list of relevant standards is provided in Section 5.15 of the IGN.

100



3. Relevant Legislation, ACOP and Guidance Includes:






None


None


OSD3.4


OSD3.4

101


5.1.HS13: Deck Tanks

1. Confirmation should be obtained that deck tanks and their accessories have been designed and constructed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice include:

API Standard 2000 Venting Atmospheric and Low Pressure Storage Tanks; Non Refrigerated and Refrigerated, 5th Edition, April 1998

API Publication 2210 Flame Arresters for Vents of Tanks Storing Petroleum Products

API Bulletin 2521 Use of Pressure-Vacuum Vent Valves for Atmospheric Pressure Tanks to Reduce Evaporation Loss

API Standard 650 Welded Steel Tanks for Oil Storage

API Specification 12D Field Welded Tanks for Storage of Production Liquids

API Specification 12F Shop Welded Tanks for Storage of Production Liquids

BS 1564:1975 Specification for the manufacture of vertical steel welded non-refrigerated storage tanks with butt-welded shells for the petroleum industry

BS 1564:1975 Specification for pressed steel sectional rectangular tanks.

2. Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy of the deck tank can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.


Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c)


Provision and use of Work Equipment Regulations 1998, Regulation 4


4.1 Venting for Fire Exposure

Venting capacity should be adequate for fire exposure.

4.2 Methanol Storage Tanks

Provision should be made to limit the discharge of methanol vapour to atmosphere.


None


None


OSD3.1


OSD3.1

102


5.1.HS15: Hazardous Drains/Caisson

1. Confirmation should be obtained that the hazardous drains system and disposal caisson have been designed and constructed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice include:

Pipework:

ANSI B31.3 Petroleum refinery piping

Sump Tanks & Disposal Caisson:

API Standard 2000 Venting Atmospheric and Low Pressure Storage Tanks; Non Refrigerated and Refrigerated, 5th Edition, April 1998

2. Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy of the hazardous drains system and disposal caisson can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.





4.1 Flame Arrester

The hazardous drains sump tanks and disposal caisson will generally be vented to the atmospheric vent header although, in some cases, a dedicated vent may be provided. In either case, the vent should be fitted with a flame arrestor designed to API 2210 or equivalent.

4.2 Wave Action

The drains sump vent should be of sufficient capacity to accommodate the inbreathing and outbreathing due to the rise and fall in liquid level as a result of wave action.

Dip pipes, within the caisson, should terminate at sufficient depth to ensure that they are submerged at all times.

4.3 Dip Pipe Perforation

Dip pipes can be subjected to accelerated rates of corrosion at, or just below, the liquid level in the caisson. Perforation resulting from such corrosion may result in the migration of hydrocarbon vapour from the caisson into the drains system, [this has resulted in a number of hydrocarbon releases]. Confirmation should be obtained that there is an inspection scheme in place to address this phenomenon.

4.4 A number of hydrocarbon releases have resulted from poor design involving inappropriate interconnections between the closed/flare system and the open drains. Plant blowdown then causes gas to discharge from the open drains. Confirmation should be sought that this possibility has been examined during the plant HAZOP studies.


None

103



None


OSD3.1


OSD3.1

104

5.1.HS17: Flare Towers

1. Confirmation should be obtained that flare towers have been designed and constructed in accordance with recognised standards or code of practice. Recognised standards/codes of practice include:

API RP 521 American Petroleum Institute [1997] Guide for Pressure Relieving and Depressurising Systems

The Institute of Petroleum [2001] Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown Systems ISBN 0 85293 287 1

The above codes, standards and guidance are applicable to flare towers on both fixed installations and FPSOs. Well test equipment on drilling installations is likely to have dedicated well test flare booms.

2. Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy of the flare tower can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.





A review of lessons learned from past incidents is given in Section 6 of Institute of Petroleum Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown Systems. This guide includes ‘checklists for assessment of relief and blowdown systems’ [pp 100-102] for both designers and operators. The guide should be included as part of the assessment process.

An overview of radiation exposure levels is given in Section 5.8 of the Institute of Petroleum Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown Systems. Confirmation should be obtained that the suggested limits are not exceeded.


5.1.F15 Relief Systems


None


OSD3.1


OSD3.1

105


5.1.HS18: Mechanical Integrity of FPSO Mooring Turrets

[Relevant Sheets: 5.1.G.9]

Introduction

Many floating production storage and offtake facilities [FPSOs] employ the principal of free weathervaning of the hull round a geostationary mooring spread. For this purpose, the hull structure is designed or modified to accommodate an internal turret to which static mooring lines are fixed permitting unrestricted rotation of the vessel about that axis of fixation. The turret incorporates a bearing arrangement similar to a crane slew ring to reduce friction and, also usually a high pressure swivel system to permit and control the transfer of fluids from the stationary risers to the rotating vessel and its processing and storage facilities.

The design and operational safety/integrity of the bearing and swivel arrangements are matters for technical assessment by OSD Mechanical Specialists at the design safety case and operational safety case stages. Other aspects such as integration of the turret with the hull structure and the design/integrity of flowlines and flexible risers need to be addressed by respective specialist sections.

Assessment Principles

i. There are no national or international standards or formal codes for the design of turrets or swivels, although they draw heavily upon existing large low speed bearing design and fluid/gas sealing technology. Each example to date is a bespoke engineering solution and the most appropriate method of assessment therefore involves the basic principals of hazard identification, FMEA, Risk Assessment and whether risks are controlled to ensure compliance with the relevant statutory provisions.

ii. OSD3.4, to obtain the information necessary to approach the assessment task in a competent and consistent manner, commissioned a technical survey of published information covering all FPSO and FSO installations in the UK sector. From this information a practical and comprehensive database was created called:

The FPSO Turret and Swivel Interactive Knowledge Base

The IKB provides the following principal reference facilities:

i. General description of turret systems

- Ship structures

- General systems and arrangements

- Mooring systems and turret loadings

- Scaffolding and support systems

- Personnel

- Construction standards

ii. Turret system design

- Major components and boundaries

- Turret transfer systems

106

- Interfacing systems

iii. Fluid transfer systems

iv. Failure modes

v. Inspection and maintenance

vi. Examples of good and bad practice

This extensive register encompasses detail of all existing turret mooring designs and arrangements existing in UK waters. In addition it discusses in appropriate technical language the merits and weaknesses of respective systems and guides the reader first toward an appreciation of the broader aspects of the technology, hazard identification and risk recognition processes, to a position where specific examples may be subject to comparative appraisal against a cross industry selection of design types and their operational characteristics and histories.


Offshore Installations (Safety Case) Regulations 2005, Regulation 12

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4, 5, 9 & 19

Offshore Installations and Wells (Design and Construction, etc) Regulations 1996, Regulations 4, 5, 6, 7 & 8

4. For marginal field development the turret moored FPSO offers commercial attractions. Mooring turrets clearly embody major hazard potentials including both the control of the transient hazardous inventories within them and station keeping of the parent vessel. Full and intelligent use of the FPSO turret database and application of its reflective appraisal procedures are the best means available for assessing and evaluating both the design and the lifetime operational integrity of this advanced production technology.


For the purpose of this manual mooring turrets have been assigned to Section 5.1 - Loss of Containment - Process. However, the turret is a multi functional design feature, its construction and housing form an integral part of the vessel primary structure and the mooring system. Whilst these considerations are the responsibility of structural and marine specialists, structural strength and especially stiffness are of paramount importance to the performance of the turret bearings, seals and flanged joints. Consequently there are at least three safety critical elements to be assessed in relation to the turret, namely integrity of primary and support structure, mooring integrity and the integrity of fluid paths [flexible risers, swivels and rigid pipework]. It is therefore desirable that the assessment of turret design and operational issues should be undertaken on a multi discipline basis with input from OSD5 and other OSD3 Specialist Teams.


None


OSD3.4


OSD3.4

107

5.1.HS19: Temporary Equipment

1. Confirmation should be obtained that systems and procedures are in place to manage the risks associated with the use of temporary equipment. These should be broadly in line with the guidance given in SPC/TECH/OSD/25.

Confirmation should also be obtained that all temporary equipment has been designed and constructed in accordance with recognised standards or codes of practice, or if not, justification sought as to why the standard(s) employed should result in equivalent levels of safety.

2. Where systems and procedures differ markedly from those recommended in SLC 2004/02, judgement as to the adequacy of the management of risks associated with the temporary equipment can only be assessed on an individual basis and the duty holder should be required to justify that the applied systems and procedures will be equally effective.



Assessment Principles for Offshore Safety Cases [APOSC], paras 14 and 35



4.1 Deciding What Is, and Is Not, Temporary Equipment

Essentially Temporary Equipment compromises equipment which is not a permanent part of the installation, and which is intended to be removed after a finite period of time.

4.2 Impact of Temporary Equipment on Existing Plant/Systems

A HAZID and HAZOP should have been conducted to ensure that the Temporary Equipment will not compromise the integrity of the existing plant and systems [and vice versa].

4.3 Control of Change

There should be systems/procedures in place to control short term amendments to existing procedures/documentation. The systems/procedures should cover the re-instatement of amended material.

4.4 Competence and Training

Temporary training requirements need to be identified, recorded and implemented. Contractor competence and training should be verified by the duty holder.

4.5 Control of Contractors

The integration of systems/procedures will be required where the Contractors have their own systems/procedures for the operation, control and maintenance of the temporary equipment.


None


None

108




OSD3.1


OSD3.1

109

5.1.G1 Part 1: Corrosion: Internal

Topsides Plant

1. Confirmation should be obtained that internal corrosion is being managed through implementation of a corrosion management system. There are no recognised standards or codes of practice that deal with the corrosion management system. Hence in co-operation with the offshore industry CAPCIS have prepared the research report OTO 2001/044 Review of Corrosion Management for Offshore Oil and Gas Processing for HSE, which provides guidance and examples of best practice. This is considered to be the benchmark that duty holders’ corrosion management system should satisfy. Recognised standards and codes of practice dealing with certain specific elements of corrosion management include:

DnV RP G-101 Risk Based Inspection of Topsides Static Mechanical Equipment

API Publication 581 Risk Based Inspection

HSE RR363/2001 Best Practice for risk based inspection as part of integrity management

RIMAP Generic Risk Based Inspection and Maintenance Planning

NORSOK standard M-506 CO2 Corrosion Rate Calculation Model

NORSOK Standard M-CR-505 Corrosion Monitoring Design

NACE Standard RP0775 Preparation and Installation of Corrosion Coupons and Interpretation of Test Data in Oil Field Operations

NACE Standard RP0497 Field Corrosion Evaluation Using Metallic Test Specimens

NACE Standard RP0192 Monitoring Corrosion In Oil & Gas Production with Iron Counts

ASTM G4 Standard Guide for Conducting Corrosion Coupon Tests in Field Application

ASTM G96 Standard Guide for On-line Monitoring of Corrosion in Plant Equipment [Electrical and Electrochemical Methods]

Institute of Petroleum Model Code of Safe Practice for Petroleum Industry Part 13: Pressure Piping Systems Examination

Institute of Petroleum Model Code of Safe Practice for Petroleum Industry Part 12: Pressure Vessel Systems Examination

EEMUA 193 Recommendations for the Training, Development and Competency Assessment of Inspection Personnel

EEMUA 179 A Working Guide for Carbon Steel Equipment in Wet H2S Service [Developed largely from Oil Refinery experience]

API RP574 Inspection Practices for Piping System Codes

API RP570 Piping Inspection Code: Inspection, repair, alteration and re-rating of in-service piping systems

API RP510 Pressure vessel inspection code: Maintenance inspection, rating, repair, and alteration

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of corrosion management can only be assessed on an individual basis, and the duty holder should be required to justify why its

110



http://www.hse.gov.uk/research/crr_htm/2001/crr01363.htm

procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005, Regulations12(1)(c) and 12(1)(d)

Assessment Principles for Offshore Safety Cases [APOSC], paras 95, 98 and 102

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4(1)(a); 9(b) and 12

Pressure Equipment Regulations 1999


The safety case assessment should seek to establish to what extent aspects of the corrosion management system listed below have been addressed particularly because experience has shown them to be contributory factors in corrosion incidents:

• Clear, explicit policy governing corrosion and plant monitoring.

• Sufficient in–house expertise, clear allocation of responsibilities and involvement of offshore staff to enable delivery of the policy.

• Better analysis and integration of inspection and monitoring data including use of statistical techniques to allow for uncertainties resulting from limitations of inspection techniques and coverage.

• Better use of opportunistic inspection.

• Better documentation of system.

• Increased utilisation of platform staff knowledge and raised awareness.

• Widen scope of inspection plans that includes certain amount of speculative inspection.

• Improved identification of corrosion hot spots based on plant walkabout rather then examination of drawings.

• Increased system performance monitoring and improved failure investigations that identify underlying system failures.

• set criteria, evaluation of system failures and identification of areas to be improved.

• Regular independent audits of the corrosion management system.

• Ensuring high availability of inhibitor injection system.

• radation near injection points due to local

• outlined Guidance”, “Mitsui Babcock GSP 235,

• legs and where unavoidable implementation of targeted inspection scheme.

Regular system reviews that includes assessment of system performance against

Consideration of enhanced degflow/environmental conditions.

Planning of non-invasive inspection [NII] scheme based on considerationsin JIP reports “HOIS NII Decision Recommended Practice for NII”.

Minimisation of dead

111


• Identification of areas prone to pitting and application of the most appropriate inspection techniques and prevention schemes including designing them out.

• Identification of components that could suffer preferential weld corrosion and application of appropriate specialised inspection techniques and prevention strategies. Further guidance in JIP report “Risk of preferential weldment corrosion of ferritic steels in CO2 containing environments” and the “Guidelines for the prevention, control and monitoring of preferential weld corrosion of ferritic steels in wet hydrocarbon production systems containing CO2”.

• Level of attention given to the hydrocarbon drains systems integrity management.

• Special consideration of the failure mechanisms of smallbore piping [3” and below] and application of appropriate inspection techniques.

• Consideration of chloride stress corrosion cracking and or pitting in corrosion resistant materials operating in environmental condition where high concentration of salts can develop.

• Management of process conditions [ie ensuring no oxygen] to prevent formation and deposition of elemental sulphur in plant handling sour fluids.

• More user friendly and accessible corrosion monitoring probe and chemical injection quill access fittings and locations.

• Inspection and monitoring data analysis including use of statistical and reliability methods.

• How is past experience captured and incorporated in the design of corrosion protection measures for new installations.


5.1.G2 Erosion

5.1.G6 Fatigue/Vibration Cracking

5.1.G15 Deficient Procedures: Maintenance

5.1.G20 Ageing/Mechanical Degradation

5.1.G24 Incorrect Material Specification

5.1.G25 Incorrect Material Usage


None


OSD5.1


OSD5.1

112

5.1.G1 Part 2: Corrosion: External

Topsides Plant and Structure

1. Confirmation should be obtained that external corrosion has been managed by implementation of a corrosion management system. There is no single national or international standard dealing with this topic and hence a number of approaches, including treating it as part of the process plant corrosion management system or the installation fabric maintenance system have been adopted. Recognised standards/codes of practice dealing with certain specific elements of corrosion management include:

OT0 2001-011Corrosion Protection

BS5493 Code of practice for protection of iron and steel structures against corrosion

NORSOK standard M-501 Surface preparation and protective coatings

ISO 12944 Paints and Varnishes – Corrosion Protection of Steel Structures

85 5493: 1977 Protective coating of iron and steel structures against corrosion.

EN ISO 14713: Protection against corrosion of iron and steel in structures - Metal coatings - Guide.

EN ISO 1461: Hot dip galvanized coatings on fabricated products.

EN 10240: (Draft) Coatings for steel tubes: Specification for hot dip galvanized coatings.

ISO 4628-3: 1982 Paints and varnishes - Evaluation of degradation of paint coatings - Designation of intensity, quantity and size of common types of defect - Part 3: Designation of degree of rusting.

BS 7079: Part Al Preparation of steel substrates before application of paints and related products - Visual assessment of surface cleanliness - Part 1: Rust grades and preparation grades of uncoated steel substrates and of steel substrates after overall removal of previous coatings.

ISO 9223: 1992 Corrosion of metals and alloys - Corrosivity of atmospheres - Classification.

ISO 11303:2002 Corrosion of metals and alloys - Guidelines for selection of protection methods against atmospheric corrosion

EN 22063: 1993 Metallic and Other Inorganic Coatings - Thermal Spraying - Zinc, Aluminium and Their Alloys

EEMUA 200 Guide to the specification, installation, maintenance of spring supports of piping

ISO CD 19902 Petroleum and natural gas industries – Fixed offshore structures

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of corrosion management system can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c) and 12(1)(d

113


Assessment Principles for Offshore Safety Cases [APOSC] paras 95, 98 and 102

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4(1)(a), 9(b) & 12



External corrosion of topsides on an ageing installation does not usually receive the same degree of attention as the management of the internal corrosion with the result that on a number of installations the primary threat of hydrocarbon release is from external corrosion. In addition a significant number of personnel injuries on such installations are due to falls and trips resulting from failure of corroded members used as temporary supports or steps. Corroded walkways have also featured in a number of incidents. Particular issues that should be probed as part of the safety case assessment include:

• Management of process plant integrity around corrosion traps such as pipe supports, penetrations, saddles, etc.

• Management of the risks associated with surface preparation and painting on ‘live’ plant.

• Management of corrosion under insulation.

• Management of bolt corrosion.

• Management of pitting and stress corrosion cracking in corrosion resistant alloy piping and tubing operating in areas exposed to sea spray/deluge. See RR129 “Review of external Stress Corrosion Cracking of 22% Cr Duplex Stainless Steel” for further guidance.

• Painting and refurbishment planning systems and performance standards including short term remedies.

• Maintenance of spring supports.

• Corrosion management of walkways, hand railings, escape equipment attachment points and other similar secondary structural components.


5.1.G15 Deficient Procedures: Maintenance

5.1.G20 Ageing/Mechanical Degradation

5.1.G24 Incorrect Material Specification

5.1.G25 Incorrect Material Usage


None


OSD5.1 for process plant and OSD5.1 – OSD5.4 for topsides structures.


OSD5.1

114



5.1.G2: Erosion

1. Confirmation should be obtained that erosion is being managed through implementation of an erosion management system that includes amongst other things selection of appropriate materials and coatings, control of fluid velocities, removal/prevention of solid particles, effective detection systems, plant design that minimises changes in flow direction and erosion resistant valve design. Recognised standards/codes of practice dealing with erosion include:

DNV Recommended Practice RP 0501 Erosive Wear in Piping Systems

ISO 13703 Offshore Piping Systems

API RP14E Design and Installation of Offshore Production Platform Piping Systems

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of erosion management system can only be assessed on an individual basis, and the duty holder should be required to demonstrate its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c) and 12(1)(d)


Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4(1)(a), 9(b) and 12



There have been a number of major hydrocarbon releases recently caused by solids particle erosion where failure of a number of crucial control measures had occurred. Wall thinning is usually very rapid and hence prevention rather then control should be the guiding principle. Operations staff do not always appreciate the impact of the production rate on erosion risk. Prevention of erosion in the production plant can be achieved by design whereas for well servicing and drilling operations process management is usually the only available option. Erosion tends to be a localised effect which means that a very good knowledge of the local rather then global flow velocities is required in order to assess erosion risks. Sand detection systems have proved to have varying reliability and hence their effectiveness should be explored as part of the assessment process.

Relevant guidance documents include:

RR115 Erosion in Elbows in Hydrocarbon Production systems: Review Document

SPC/TECH/OSD/19 Offshore Produced Sand Management


5.1.G1 Part 1 Corrosion: Internal

5.1.G1 Part 2 Corrosion: External


None

115





OSD5.1


OSD3.1

116

5.1.G4 Internal explosion

1. Confirmation should be obtained that internal explosions have been assessed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include:

Fire, Explosion and Risk Assessment Topic Guidance HSE website 2003

Fire & Explosion Strategy Document HSE website 2004

OTN 95 196 1995 Gas explosion handbook HSE-OSD report

Guidelines for Fire & Explosion Management (UKOOA) 1995

CMPT - A guide to QRA for Offshore Installations

BS EN 13702:1999 Petroleum and Natural Gas Industries – Control and Mitigation of Fires and Explosions on Offshore Production – Requirements and Guidelines.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the evaluation of the internal explosion hazard can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/ practices in the relevant areas will deliver an equivalent level of health and safety performance.

3. Relevant Legislation, ACOP and Guidance include:


Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995


Internal explosions are regarded as a lower risk factor in comparison to topsides external explosions. Specific attention should be paid to situations whereby air could ingress into a hydrocarbon-saturated atmosphere and form a flammable air/vapour mixture. The risk from a gas turbine sourced internal explosion should be assessed with particular emphasis on fuel/air control, emergency shutdown control and internal conditions that could give rise to volumes of un-ignited fuel air mixtures.

The adequacy of Internal Explosion venting available in each engine installation should also be investigated.

5. Other related assessment sheets in this Section are:

None

6. Cross-referenced Sections and sheets are:


Sheet 5.1.HS9 Pumps

Sheet 5.1.HS10 Compressors

Sheet 5.1.HS11 Turbines

Sheet 5.1.F3 Installation Specific Hazard Studies

Sheet 5.1.F8 Safety Integrity Levels Standards

117

http://www.hse.gov.uk/offshore/fireexp/index.htm

http://www.hse.gov.uk/offshore/strategy/index.htm

Sheet 5.3.F23 Fire/Smoke/Gas/Flame Detectors/Alarms

7. Lead assessment section for this sheet:

OSD3.2

8. Team Responsible for authoring and updating this sheet:

OSD3.2

118

5.1.G7: Fire

1. Confirmation should be obtained that requirements for the identification of fire hazards as initiators to other hazardous events have been analysed in accordance with recognised standards or codes of practice that would be used for a manned installation. Recognised standards/ codes of practice would include:

ISO/FDIS 13702 Petroleum and Natural Gas Industries – Control and mitigation of fires and explosions on offshore production installations – requirements and guidelines.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the evaluation of these hazards can only be assessed on an individual basis, and the duty holder should be required to justify which its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.




Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2003

Fire & Explosion Strategy Document, HSE website 2004


Specific attention should be paid to the identification of mitigation barriers to stop escalation paths early in a hazardous event situation. For example, a fire detection system should be regularly tested to maintain its design performance of identifying rapidly fires in accommodation as well as process areas.


None


Sheet 5.3.F8 Fire Types

Sheet 5.3.F10 Fire Modelling

Sheet 5.3.F11 Explosion Modelling

Sheet 5.3.F28 Ventilation and HVAC


OSD3.2


OSD3.2

119



5.1.G24: Incorrect Material Specification

1. Confirmation should be obtained that material selection has been based on a rigorous evaluation of all internal and external environments, operational and non operational conditions including upset conditions, design life and system performance standards, failure modes and consequences, inspection and monitoring requirements and health conditions. In addition to the standards listed below most process plant component standards also cover material performance requirements to some extent. Recognised standards/codes of practice dealing with materials selection include:

NORSOK Standard M-001 Materials Selection

EEMUA 194 Guidelines For Materials Selection and Corrosion Control for Subsea Oil and Gas Production Equipment

ASME B31.3 Process Piping

ASME Boiler and Pressure Vessel Code Section VIII

BS5500 [PD 5500] Specification for Unfired Fusion Welded Pressure Vessels

EFC Pub 16 Guidelines on Materials For Carbon and Low Alloys Steels for H2S Containing Environments in Oil and Gas Production

EFC Pub 17 Corrosion Resistant Alloys for Oil and Gas Production. Guidance on General Requirements and Test Methods for H2S Service

EFC Pub 23 CO2 Corrosion Control in Oil and Gas Production

NACE MR0175 Sulphide Stress Cracking Resistant Materials for Oilfield Equipment

NORSOK Standards M-506 CO2 Corrosion Rate Calculation Model

ISO 14692 Petroleum and natural gas industries. Glass-reinforced plastics [GRP] piping

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of materials specification can only be assessed on an individual basis, and the duty holder should be required to justify which its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c), 12(1)(d)


Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 9(1) and 12



Although the above standards provide a good basis for evaluation of materials selection they are not all encompassing and hence the following should in addition be examined:

• How has the industry experience been captured and fed into the materials selection process?

120


• What is being done to design out corrosion under lagging?

• Have the various problems with vessel internal coatings experienced by a number of duty holders been recognised?

• Are risks of preferential weld corrosion adequately addressed?

• How are the significant erosion risks in vessel sand wash drains tackled?

• Are ESD and Control valve trims adequate to maintain seal tightness under the operating environment?

• Are the limitations and problems in using corrosion allowance approach to manage degradation recognised?

• Do provisions for testing include the need to demonstrate adequacy of the material’s corrosion resistance as well as physical properties?

• Have the limitations of 316SS tubing been considered in the material selection process?

• Are the particular requirements for bolting material and its corrosion protection adequately addressed?


Sheet 5.1.G2 Erosion

Sheet 5.1.G6 Fatigue/Vibration Cracking

Sheet 5.1.G15 Deficient Procedures: Maintenance

Sheet 5.1.G20 Ageing/Mechanical Degradation

Sheet 5.1.G25 Incorrect Material Usage


None


OSD5.1


OSD5.1

121

5.1.G26: Thermal Radiation

1. Confirmation should be obtained that requirements for the identification of thermal radiation as an initiator to other hazardous events have been analysed in accordance with recognised standards or codes of practice that would be used for a manned installation. Recognised standards/codes include:

ISO/FDIS 13702 Petroleum and Natural Gas Industries– Control and Mitigation of fires & explosions on offshore production installations – requirements and guidelines

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the evaluation of thermal radiation hazards can only be assessed on an individual basis, and the duty holder should be required to justify which its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.







Thermal radiation sources should be identified using techniques such as HAZOP studies in conjunction with manufacturers information, and evaluated and recorded as a thermal radiation hazard.


None


Sheet 5.3.F8 Fire Types





OSD3.2


OSD3.2

122



5.1.F1: Generic Historical Data

1. Confirmation: in order for duty holders to estimate the frequency of potential accident scenarios, data will be required on a range of relevant inputs, ranging from failure of individual parts of the hydrocarbon containment envelope, [pressure vessels, piping, heat exchangers etc] through to the probability that alarm and preventative systems or items of equipment such as fire and gas alarms and components of the shutdown system will fail to operate correctly on demand.

2. If the frequency estimates produced for the various accident scenarios are to be realistic and credible it is essential that the data used in deriving them is soundly based and defensible. In many cases where company or installation specific data [see 5.1.F2] is not available estimates will have to have been produced using generic historical data from across the industry worldwide. This data will have been produced using a variety of different sources. Potential sources are described in SPC/TECH/OSD/24 and include OREDA, E&P Forum, WOAD etc.

Assessors should carefully examine the values assigned to the failure rates for different types of equipment against typical indicative historical values given in SPC/TECH/OSD/24. The values quoted have been produced by HSE using relevant data sources including the OSD Hydrocarbon Release Database.

Where a duty holder has used a failure rate/probability which differs markedly from the indicative values given in SPC/TECH/OSD/24 and where the usage of this figure results in a significantly lower release/accident frequency being adduced, the duty holder should be requested to provide a detailed justification.




None


5.1.F2 Company and Installation Specific Data


None


OSD3.1


OSD3.1

123




5.1.F2: Company and Installation Specific Data

1. Confirmation: Enquiries should be made as to whether company or installation specific data is available and has been used to estimate failure/release frequencies as opposed to reliance on generic historical data.

2. Company/installation data is preferable to generic data as it is more likely to reflect accurately the effect of company/installation specific features such as its safety management policies/practices/ competencies, operating history etc. If it is available but has not been used, justification should be sought.

Care should be taken where generic data has been employed but has been modified allegedly to reflect ‘company specific circumstances’. Experience suggests that such modifications almost invariably result in claims for lower than average failure/release rates. Clearly it is an anomalous situation where every duty holder is apparently better than average and the basis for such claims should be carefully examined.

Care should also be taken in cases where company/installation data is being used but it indicates failure/release rates markedly different from the indicative figures given in SPC/TECH/OSD/24. The basis for any claims of superior performance needs to be carefully established and examined.




None


5.1.F1 Generic Historical Data


None


OSD3.1


OSD3.1

124


5.1.F3: Installation Specific Hazard Studies

1. Confirmation should be obtained that installation specific hazard studies have been carried out in accordance with recognised standards or codes of practice for all operational safety cases. Normally the hazard studies should include a detailed HAZOP study. Recognised standards/codes of practice for HAZOP include:

HAZOP: Guide to Best Practice – I.Chem.E 2000

IEC 61882 Guide for Hazard and Operability Studies (HAZOP Studies)

CIA 1977 A Guide to Hazard and Operability Studies (relevant to older installations only).

The HAZOP study could be used in conjunction with other recognised techniques such as:

Failure Modes and Effect Analysis (relevant standard IEC 60812 – Procedures for Failure Modes and Effects Analysis).

Fault Tree Analysis (relevant standard IEC 61025 – Fault Tree Analysis)

SAFE (Safety Analysis Function Evaluation) Charts using EN/ISO 10418 (formerly API RP 14C) methodology.

BS EN ISO 17776:2002 – Guidelines on tools and techniques for hazard identification and risk assessment.

Restricting the hazard identification process to high level hazards [fire, explosion, toxic release, structural failure etc] can be acceptable for design safety cases (provided more detailed work is still to be carried out) but does not provide the depth or rigour required for operational safety cases.

2. Where a standard/code of practice/methodology other than those listed above has been employed, judgement as to the adequacy of the hazard studies can only be assessed on an individual basis and the duty holder should be required to justify why the methods employed will be equally effective.

3. Factors to note in assessing hazard studies include:

i. As noted above whilst restricting the identification process to high level hazards or accidents [fire, explosion etc] may have some justification for design safety cases [where more detailed work has yet to be carried out] it is of extremely limited value in the operational safety cases context. Identifying fire as a hazard in a module containing hydrocarbon does nothing to identify ways in which the hydrocarbon might be released or where and how it might be ignited. Without this knowledge little can be done to reduce the likelihood of a fire occurring. What is required is a full examination of the ways in which the release might occur and become ignited, incorporating consideration of a full range of possible initiating events such as hardware failure, human error etc. The methodology cited above should provide an appropriate level of insight into the relevant accident scenarios, with perhaps additional amplification being provided via techniques such as Fault Tree Analysis for scenarios involving coincidental failure of multiple system components. It is also important that appropriate detailed hazard identification is applied to all activities taking place on a particular installation and not just to the more obvious process systems. For example, there have been instances where the hazard identification for such operations as drilling, workover and wirelining essentially consisted of noting that blow-out might occur with respect to the equipment, procedures and operations taking place on the individual installation under

125

consideration. Maintenance related activities are another area which sometimes only receive fairly peripheral attention.

ii. The possibility of accidental breakthrough of gas or liquid from a high pressure system to a lower pressure one needs to be considered as part of the hazard study process. In view of the number of accidents that have occurred in this manner, it is better if a specific HP/LP interface study has been carried out to supplement other studies such as HAZOP. It is important that such studies consider all foreseeable modes of operation.

iii. Confirmation should be sought that all ‘actions’ and remedial work identified from the hazard studies have been completed and ‘signed off’.


None



Section 13 QRA


OSD3.1


OSD3.1

126

5.1.F4: Layout

1. Confirmation should be obtained that the layout has been designed in accordance with a recognised standard or code of practice. Recognised current standards / codes of practice would include:

EN ISO 13702 (1999) Petroleum and natural gas industries – Control and mitigation of fires and explosions on offshore production installations – Requirements and guidelines. Particularly section 5 – Installation layout

EN ISO 13703 (2001) Petroleum and natural gas industries – Design and installation of piping systems on offshore production platforms. Particularly Section 9.2 Layout

EN ISO 15138 (2000) Petroleum and natural gas industries – Offshore production installations – Heating, ventilation and air-conditioning. Particularly section 5.3 – System design General; 5.4 – Area-specific system design; and the associated Annexes.

ISO 15544 (2000) Petroleum and natural gas industries – Offshore production installations – Requirements and guidelines for emergency response. Particularly section 11 - Escape, refuge, evacuation and rescue and associated Annex F.

Institute of Petroleum (2002) Model Code of Safe Practice Part 15 Area classification code for installations handling flammable fluids.

Installation layouts may have been designed to the following superseded and obsolete codes and standards.

API RP 2G (1974) Recommended Practice for Production Facilities on Offshore Structures

API RP 14E (1975 - 1984) Recommended Practice for Design and installation of offshore production platform piping systems

API RP 14F (1978 – 1985) Recommended Practice for Design and installation of electrical systems for offshore production platforms

BS5345 (1976) Code of practice for the selection, installation and maintenance of electrical apparatus for use in potentially explosive atmospheres

The above codes, standards and guidance are applicable to the layout of all types of installation (fixed, FPSO and MODUs).

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the layout can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures / practices in the relevant areas will deliver an equivalent level of health and safety performance.


Equipment and Protective Systems Intended for Use in Potentially Explosive Atmospheres Regulations 1996 SI 1996/192 – NB: These regulations are applicable to fixed installations but do not apply to MODUs, floating production platforms (FPPs) and floating production storage and offloading vessels (FPSOs).

4. Specific technical issues:

4.1 The safety case should not merely describe the layout but include arguments and rationale for: segregation of hazards (APOSC para 71(d)); avoidance of undue complexity (APOSC para 71(e)); location and routing of risers (APOSC para 71(g)); orientation and

127




spacing of equipment; fire zones; location of fire walls and blast walls; hazardous area classification; and, ventilation. A layout HAZOP is an appropriate technique for identifying some of these issues.

4.2 On existing installations removal of redundant equipment and removal or redesign of windwalls or module walls may reduce the potential for accumulation of flammable substances.

5. Other related assessment sheets in this Section are:

5.1.F10 Concept selection

6. Cross-referenced Sections and Sheets are:

None

7. Lead assessment section for this sheet:

OSD3.1


OSD3.1

128

5.1.F8: Safety Integrity Levels Standards

1. Confirmation should be obtained that the consequence of failure has been identified for all instrument based protective functions. Where failure of the instrumented based protective function could lead to death or to serious injury confirmation should be obtained that the consequences of such failure have been risk assessed in accordance with a recognised standard/code of practice. Recognised standards include:

UKOOA Guidelines for Instrument Based Protective Systems

IEC 61508 Functional safety of electrical/electronic/programmable electronic safety related systems

IEC 61511 Functional safety. Safety instrumented systems for the process industry sector

Safety Integrity Levels [SILs] provide a scale for describing the performance of instrumented protection systems.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the risk assessment can only be assessed on an individual basis and the duty holder should be required to justify that the methods used will be equally effective as those in the standards listed.

3. Relevant Legislation, ACOP and Guidance Include:

Management of Health and Safety at Work Regulations 1999, Regulation 3



4.1 Where a methodology presented in the above standards has been followed but a non standard calibration/rule matrix [risk graph] has been employed the duty holder should provide a detailed justification that the non-standard/calibration rule matrix will be produce an equivalent level of safety to that which would be achieved using the standard calibrations/rules.

4.2 Although IEC 61508 permits functions with a SIL greater than SIL 3 any function allocated above SIL 3 is beyond what is recognised as acceptable practice in the UKOOA Guidelines and hence should always be queried and subject to the most detailed scrutiny.

4.3 Functions allocated a SIL 3 target should be subject to detailed assessment.

4.4 Systems which should be considered for assessment include:

• Ballast systems

• Cargo handling systems

• Riser disconnect systems

• Blowout preventer systems



5.1.F18 Shutdown Systems

5.1.F19 Alarms and Trip Systems

129


Section 4.1 Loss of Maritime Integrity - Loss of Stability [Ballast systems & cargo handling systems]

Section 6 Wells [Blowout Preventers]


OSD3.5


OSD3.5

130

5.1.F10: Concept Selection

1. Confirmation should be obtained that safety issues have been given prominence in choosing between different design options and that the selection has not been dominated excessively by economic considerations. In particular, evidence should be sought that inherently safer principles as set out in the Management of Health and Safety at Work Regulations 1999, [para 27] and APOSC, [paras 67, 68 and 71] have been properly taken into account. For new manned, fixed installations this should always include consideration of providing a separate accommodation jacket removed from the drilling and production facilities.

Concept selection is an issue which predominately applies at the initial design stage for a new installation where a number of different design concepts can be identified. On a more limited scale similar issues are also relevant to the design of additional facilities/modifications for an existing installation.

2. Notwithstanding the above, whilst OSD can and should seek to influence the design toward inherently safer concepts, it has no specific legal powers in this area and the decision as to which concept is selected ultimately lies with the duty holder. OSD’s role thereafter is to ensure that the risks posed by the chosen design are controlled in accordance with the requirements of the relevant statutory provisions.


Management of Health and Safety at Work Regulations 1999, ACOP para 27



Evaluation of different design concepts for a new manned, fixed installation should always include a separate bridge linked accommodation jacket as a comparator option. This option may not be reasonably practicable in all cases but there should be clear evidence that it has been carefully examined and there are sound reasons for its rejection based on ALARP principles.




None


OSD3.1


OSD3.1

131



5.1.F11: Size of Release, Speed of Detection and Effectiveness

1. Confirmation should be obtained that size of release, speed of detection and effectiveness has been assessed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include:

ISO 13702:1999 Petroleum and Natural Gas Industries – Control and Mitigation of Fires and Explosions on Offshore Production Installations – Requirements and Guidelines.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the analysis of release, speed of detection and effectiveness can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.







4.1 The release sizes used in the analysis should ideally be related to an assessment of credible failures based on a ‘walk down’ of the plant/equipment in question and parts count based on as-built P&IDs.

4.2 Speed of detection and effectiveness will affect potential for escalation.

4.3 Effectiveness of detection should not be based on equipment reliability alone.


5.1.F12 Dispersion, Open or Enclosed Modules, Ventilation Rates




OSD3.2


OSD3.2

132



5.1.F12: Dispersion, Open or Closed Modules, Ventilation Rates

1. Confirmation should be obtained that ventilation regimes throughout the platform have been analysed in accordance with recognised standards or codes of practice. This includes open and closed modules, as well as open deck area. Recognised standards/codes of practice would include:

BS 5925 [ISO 15138] Ventilation Principles and Designing for Natural Ventilation

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the installations’ ventilation regimes can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.







Local air movement surveys are recommended before any hot work or intrusive maintenance is carried out to evaluate the local ventilation rate.


None


Sheet 5.3.F7 Escalation, Layout Separation, Open/Closed Modules




OSD3.2


OSD3.2

133



5.1.F14: Inherent Safety

1. Confirmation should be obtained that inherent safety has been designed into the plant in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include:

BS EN ISO 17776 International Standards Organisation (ISO) (2002) Petroleum and Natural Gas Industries – Offshore Production Installations – Guidelines on tools and techniques for hazard identification and risk assessment,

L85 A Guide to the Integrity, Workplace Environment and Miscellaneous Aspects of the Offshore Installations and Wells (Design and Construction, etc) Regulations 1996, HSE Books, Regulation 5 and guidance paragraph 32.

L65 Prevention of Fire and Explosion, and Emergency Response on Offshore Installations, Approved Code of Practice and guidance, HSE Books, Regulation 4 and guidance paragraph 38 and Regulation 9 and guidance paragraphs 87-88.

L30 A Guide to the Offshore Installations (Safety Case) Regulations 2005, HSE Books, paragraph 23 Regulation 6 and guidance para 136 and Schedule 1 and guidance para 249.

Assessment Principles for Offshore Safety Cases [APOSC], paragraphs 92-95 and 98.

L21 Management of health and safety at work, HSE Books, Regulation 4, ACOP paragraph 29, guidance paragraph 30 and Schedule 1.

UKOOA (1996) Guidelines for Management of Safety Critical Elements: A Joint Industry Guide.

UKOOA (1996) Guidelines for Fire and Explosion Hazard Management. Particularly Section 5 on ‘Inherent Safety and Prevention’.

The above codes, standards and guidance are applicable to all types of installation.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of inherent safety can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Similar considerations will apply where the duty holder is unable to demonstrate any systematic considerations of inherent safety principles.


Offshore Installations (Safety Case) Regulations 2005, Schedule 2, para13

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4 and ACoP para 38

Management of Health and Safety at Work Regulations 1999, ACoP, para 27

Assessment Principles for Offshore Safety Cases [APOSC], paras 92, 93, 94, 95 and 98

OTH 96 521 Improving Inherent Safety


4.1. During the design stage, which covers concept selection through to detailed design specification [drawings, calculations, specifications, etc], there is the maximum potential for reducing risks, by early application of the principles of inherently safer design.

134



http://www.hse.gov.uk/research/othpdf/500-599/oth521.pdf

For example consideration should have been given to avoiding offshore processing [process onshore], inventory minimisation, segregation, complexity reduction, provision of separate accommodation, etc. See SPC/ENFORCEMENT/35 Safety in Design.

4.2. An installation that is designed and constructed such that risks are controlled to ensure compliance with the relevant statutory requirements depends to a significant extent on the efforts applied to achieve inherently safer design at the earliest stages of the project design process. See SPC/ENFORCEMENT/14 Design Management.

4.3 Incorporating the principles of inherent safety implies that installations should preferably be designed to have fully rated risers, vessels, pipework and pipelines. If the topsides are not fully rated a hierarchy of over-pressure protection measures should have been considered: full flow relief; partial relief with instrumented protection system; HIPS, etc.


5.1.F4 Layout

5.1F10 Concept Selection



None


OSD3.1


OSD3.1

135


5.1.F15: Relief Systems

1. Confirmation should be obtained that relief systems have been designed and constructed in accordance with a recognised standard or code of practice. Records standards/codes of practice would include:

API RP 520 Part II American Petroleum Institute, Sizing, Selection and Installation of Pressure - Relieving Devices in Refineries, Part I – Sizing and Selection, API RP 520 Part I (2000); Part II – Installation

API RP 521 American Petroleum Institute (1997) Guide for Pressure-relieving and Depressuring Systems.

API Std 526 American Petroleum Institute (2002) Flanged Steel Pressure Relief Valves

API Std 527 American Petroleum Institute (1991) Seat Tightness of Pressure Relief Valves

PD5500: 2003 British Standard Specification for unfired fusion welded pressure vessels

BS6759-3 British Standard (1984) Safety Valves: Specifications for safety valves for process fluids

EN ISO, Safety Devices for protection against excessive pressure – Part 1: Safety Valves (EN ISO 4126-1); - Part 2: Bursting Disc Safety Devices (EN ISO 4126-2, 2003); - Part 3: Safety valves and bursting disc safety devices in combination (EN ISO 4126-3, 1995); - Part 4: Pilot-operated safety valves (ISO 4126-4, 1999); - Part 6: Application, selection and installation of bursting disc safety devices [EN ISO 4126-6, 2000]

ASME VIII (2001) Boiler and pressure vessel code

The Institute of Petroleum (2001) Guidelines for the safe and optimum design of hydrocarbon pressure relief and blowdown systems, ISBN 0 85293 287 1

The above codes, standards and guidance are applicable to relief systems on all types of installation [fixed, FPSO and for well test equipment on drilling installations]. Relief systems associated with plant on new installations and new plant on existing installations should have been designed to the current version of the above codes and standards. Relief systems on older installations may have been designed to superseded codes, eg BS 1515 Pressure Vessel Code, BS 2915 Specification for Bursting Discs and Bursting Disc Devices.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the relief systems can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005, Schedule 2, para 13


4.1 There are important differences between proportional relief valves/check valves and safety relief valves. Swagelok proportional relief valves/check valves do not meet the requirements of the ASME Boiler and Pressure Vessel Code Section VIII. See Product Notice issued by Swagelock Feb/Mar 2002.

136

4.2 Failures of bellows in balanced bellows type relief valves have occurred. As a result some operators have modified the bonnet vents of balanced bellows pressure relief valves rather than tackling the underlying causes. However, such modifications may adversely affect the valve’s performance with serious health and safety consequences. See Safety Notice 2/2002.

4.3 A review of lessons learned from past incidents is given in Section 6 of Institute of Petroleum (2001) Guidelines for the safe and optimum design of hydrocarbon pressure relief and blowdown systems.

4.4 Modifications to existing facilities may have altered the duty subsequently required of a relief device or system/subsystem. It is important, therefore, that confirmation is obtained that potentially affected relief duties/devices have been reassessed as part of the design of the modifications.



5.1.F17 Blowdown/Flare System

5.1.HS17 Flare Towers


None


OSD3.1


OSD3.1

137


5.1.F16: High Integrity Protection Systems [HIPS]

1. Confirmation should be obtained that the HIPS has been designed to recognised standards/codes of practice. Recognised standards include:




HIPS provide an instrumented means of protecting plant & equipment from conditions outside the design basis. Normally this will relate to excess pressure although it could relate to extremes of temperature [hot or cold]. HIPS are sometimes also referred to as HIPPS [high integrity pressure protection system] or OPPS [overpressure protection system].

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the HIPS can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referred standards.


Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 9

Provision and Use of Work Equipment Regulations 1998, Regulation 18 and Guidance paras 272-275


4.1 The duty holder should be required to demonstrate that an inherently safer alternative to HIPS is not reasonably practicable.

4.2 Where there are interdependencies between HIPS equipment and emergency shutdown equipment the HIPS performance detailed assessment may be required to establish whether the claimed benefits of the HIPS can be fully realised.

4.3 Where fast HIPS response [<10 seconds] is required detailed assessment may be required to confirm the required response time has been properly established and that HIPS performance can be readily verified.

4.4 Where the HIPS is to be located subsea detailed assessment may be required because of the limited field experience in this environment.

4.5 Generally functions implemented by HIPS will have a target SIL of 2 or 3. Targets lower than these may be reasonable but may require detailed assessment to confirm the suitability of the performance standard.

4.6 The use of software for the central logic of any SIL 3 HIPS is novel in the UKCS and outside the recommendations in the UKOOA Guidelines. The duty holder should provide a detailed justification for such software and the justification should be subject to detailed assessment.


5.1.F8 Safety Integrity Levels Standards

138




None


OSD3.5


OSD3.5

139

5.1.F17: Blowdown/Flare Systems

1. Confirmation should be obtained that blowdown and flare and vent systems have been designed and constructed in accordance with a recognised standard/code of practice. Recognised standards/codes of practice would include:

API RP 521 American Petroleum Institute (1997) Guide for Pressure Relieving and Depressuring Systems

The Institute of Petroleum (2001) Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown Systems ISBN 0 85293 287 1

The above codes, standards and guidance are applicable to blowdown flare systems on all types of installation [fixed, FPSO and for well test equipment on drilling installations].

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the blowdown/flare systems can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005, Schedule 2 para 13


4.1 Staggered or staged blowdown of sections of plant may be specified where the flare/vent system capacity is limited. The assumptions on which the design is based and any philosophy for the order in which sections of plant undergo blowdown should be clear. Where plant modifications have occurred confirmation should be obtained that checks have/will be carried out to confirm that stagings and timings are still achievable.

4.2 Tie-in of new developments may impose higher flows and lower temperatures on existing relief and vent systems. The impact of these conditions and the implications of any mitigating measures, eg staged blowdown, temperature trips to inhibit blowdown, should have been addressed.

4.3 A detailed reliability study should have been undertaken on closed flare or vent systems. The assumptions on which the design is based should be clear. The IVB should have had an opportunity to comment on and influence the design. It is likely that an actuated block valve in parallel with a bursting disc will have an overall probability of failure on demand [PFD] of about 2E-04 and therefore be SIL3. Three devices in parallel: block valve, bursting disc and buckling pin valve, with a PFD of ~2E-06, have been used by some duty holders. To achieve these levels of reliability annual or more frequent testing of all systems should be specified. The implementation of these test intervals would be a suitable topic for post-acceptance inspection. See sheet 5.1.F16 on HIP systems.

4.4 A review of lessons learned from past incidents is given in Section 6 of Institute of Petroleum Guidelines for the safe and optimum design of hydrocarbon pressure relief and blowdown systems. This guide includes ‘checklists for assessment of relief and blowdown systems’ [pp 100-102] for both designers and operators.

4.5 If a locked open valve is located downstream of a blowdown valve/restriction orifice, the pipework up to and including the locked open valve should be rated at the full pressure of the upstream system. The locked valve can be used to test the functionality of

140

the BDV without blowing down the plant. In these circumstances the pipework downstream of the orifice may fail if it is rated for the lower pressure of the flare system.


5.1.F15 Relief Systems


5.1.HS17 Flare Towers


None


OSD3.1


OSD3.1

141

5.1.F18: Shutdown Systems

1. Confirmation should be obtained that shutdown systems have been designed for recognised standards/code of practice. Recognised standards for trip systems include:




API RP14C Recommended practice for analysis, design, installation and testing of basic surface safety systems for offshore production platforms

Shutdown systems provide an instrumented means of protecting plant and equipment from conditions outside the design basis. By isolating inventories and effecting blowdown they also provide means for mitigating some of the hazards arising following loss of containment.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the protection systems can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referenced standards.





4.1 Where the shutdown function includes shutting subsea wells and the subsea wellhead valves do not close on loss of communication with the host platform the design should be subject to detailed assessment.

4.2 Where the closure of an import ESDV could lead to pressure exceeding the design pressure of the corresponding import pipeline the design should be subject to detailed assessment

4.3 Where the ESD equipment has not been subject to a survivability analysis the design should be subject to detailed assessment.





None


OSD3.5

142


OSD3.5

143

5.1.F19: Alarm and Trip Systems

1. Confirmation should be obtained that alarm and trip systems have been designed for recognised standards/codes of practice.

Recognised standards for alarm and trip systems include:




API RP14C Recommended practice for analysis, design, installation and testing of basic surface safety systems for offshore production platforms

Recognised standards for alarm systems include:

EEMUA Document 191 Alarm system guidance

Trip systems provide an instrumented means of protecting plant and equipment from conditions that could lead to circumstances outside the design basis. Alarm systems provide a means of warning operators that plant conditions are deviating significantly from normal or for alerting operators to take mitigating action after an incident. Trip systems shutdown items of plant when significant deviations from normal occur.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the alarm/trip system can only be assessed on an individual basis and the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to a design which is in compliance with the reference codes and standards.




4.1 If there are situations on plant where an operator response to an alarm condition is required to prevent conditions exceeding the design basis of the plant then the plant design does not follow the principles of inherently safer design. In such cases the duty holder should be required to justify in detail why none of the inherently safer options is reasonably practicable.

4.2. For an alarm system to function properly there must be an effective interface to the process operator. EEMUA Document 191 addresses ergonomic issues relating to alarm presentation and information overload. A detailed assessment of this area will involve consideration of human factors.






144



OSD3.5


OSD3.5

145

5.1.F23: Isolations

1. Confirmation should be obtained that isolation procedures are in accordance with recognised standards or codes of practice which includes:

Oil Industry Advisory Committee -The safe isolation of plant and equipment

2. Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy can only be made on an individual basis and the duty holder should be requested to justify why equivalent standards of safety should result.



Assessment Principles for Offshore Safety Cases [APOSC], para 72





None


Sheet 11.G7 Permit to Work Systems


OSD3.1


OSD3.1

146


5.2 LOSS OF CONTAINMENT – PIPELINES 1. Scope

This Section provides guidance for the assessment of safety case content, with respect to pipelines which may affect an offshore installation, from hazard identification and risk evaluation to risk management measures. It covers the major accident hazards associated with major accident hazard pipelines.


A number of major accident hazard initiators have been identified which could affect the integrity of a pipeline system. The assessor should examine the adequacy of the hazard identification, initiators, risk evaluation and management in conjunction with the contents of the categorisation table.

The main hazard sources are:

• fixed risers [5.2.HS1]

• other risers including flexible risers [5.2.HS2]

• outboard pipelines (eg interfield, intrafield, trunk lines, etc.) [5.2.HS3]

• emergency shutdown valves (ESDV) [5.2.HS4]

• subsea isolation systems (SSIS) [5.2.HS5]

• pig traps (including sphere launchers/ receivers) [5.2.HS6]


It is important that safety case assessment is not used as the vehicle for dealing with matters more properly addressed by The Pipelines Safety Regulations 1996 (SI 1996/825). The assessment should therefore be limited to ensuring that a duty holder has included an adequate description of all pipelines, including design parameters as necessary, and evaluating the impact of pipelines and their inventories on the overall case for safety.


Where safety case contents match with good practice identified in the assessment sheets for a particular topic associated with a major accident, there will usually be no need for an assessor to probe into the details of how good practice is applied. This may, however, be a suitable issue to follow-up through inspection.

147


Loss of Containment - Pipelines

Source of Hazard

Initiators Risk Evaluation Risk Management Measures Performance Standards

HS1 Rigid Riser G1 External Corrosion Frequency F14 Inherent Safety Temperature & Pressure Rating

HS2 Other Risers including Flexible Risers

G2

Internal Corrosion F1 Generic Historic data [PARLOC]

- fully rated pipelines & risers Material specification

HS3 Outboard Pipeline

G3 Erosion F2 Company & Pipeline System Data

- riser routine Corrosion allowance

HS4 ESDV Valves (ESDV)

G4 Overpressure F3 Pipeline system studies - inherent impact resistance Fatigue life

HS5 Subsea Isolation Systems (SSIS)

G5 High Temperature - HAZID - pipe burial & trenching Frequency of inspection

HS6 Pig Trap G6 Low Temperature - HAZOPs - concrete ballast costing Relief arrangements & capacity

G7 Fatigue/Vibration - FMEAs Reliability of protective systems

G8 Fire [Section 5.3] - Design reviews Prevention Adequacy of supports

G9 Fitting Failure F4 Equipment layout F15 Relief systems

G10 Incorrect Installation F5 Company standards/competence

F16 HIPS systems Risers

G11 Operator Error – Inadequate Training [Section 11]

F6 Corrosion/erosion allowance F17 Shutdown systems Temperature & pressure rating

G12 Operator Error – Inadequate Competency [Section 11]

F7 Operations/Maintenance procedures

F18 Alarms/trips Material specification

Corrosion allowance

148


Source of Hazard


G13 Violation [Section 11] F8 SIL standards F19 Cathodic protection Fatigue life

Frequency of inspection

G14 Deficient Procedures – Operational [Section 11]

F9 Equipment selection F20 Good procedures Relief arrangements & capacity

G15 Deficient Procedures – Maintenance [Section 11]

F10 Concept selection - operational [control of erosion/internal corrosion temperature during blowdown]

Reliability of protective systems

Adequacy of supports

G16 Ship Collision [Section 2]

F21 Competent personnel Fire protection

G17 Dropped Object Consequences F22 Monitoring & Audit systems Pig Traps

G18 Seismic Event [Section 3]

F11 Size of release F23 Isolation and PTW controls Temperature & Pressure Rating

G19 Missile [eg turbine blade]

- Speed & effectiveness of detection & response

F24 Intelligent pigging Material specification

Corrosion allowance

G20 Ageing/Mechanical Degradation

- blowdown system F25 Wall thickness monitoring Fatigue life

G21 Abnormal External Load

F12 Dispersion F26 Inhibition performance monitoring Frequency of inspection

Relief arrangements & capacity

G22 Helicopter Collision/ Rollover [Section 8]

F13 Toxicity Refer to Section 12 F27 Fire protection

- active

Reliability of protective systems

G23 Inadequate Design Ignition Refer to Section 5.3 - passive Adequacy of supports

Integrity of closure seals

149


Source of Hazard


G24 Incorrect Material Specification

F28 Anchor pattern controls Fire protection

G25 Thermal Radiation F29 Fail safe system Valves

G26 Slugging/Water Hammer

F30 Pre-operation strength & leak testing Temperature & pressure rating

G27 Structural Support Failure [Section 3]

F31 NDT inspection Material specification

G28 Fishing Gear Snagging

F32 Condition monitoring Corrosion allowance

Closure mode

G29 Anchor

Snagging/Dropping

F33 Gas detection

F34 Fire detection

Integrity of seals

Leakage rate

G30 Explosion Overpressure

150

5.2.HS0: The Pipeline System

1. Pipeline System Overview

General requirements for assessment:

A statement that the person responsible for the operation of the pipeline has responsibility for the entire length of the pipeline (including risers, pig traps etc.). A statement of who is responsible for starting up the pipeline at any time following a shutdown, and the procedures and checks which are made before start up.

Confirmation that the person(s) responsible for the inspection and maintenance of the pipeline has responsibility for the entire length of the pipeline.

A description of the inspection and maintenance arrangements summarising and justifying the methods of inspection of the pipeline to the identified hazard limit distance from the installation (the distance beyond which a pipeline rupture could not conceivably cause danger to the platform), the management system for carrying out the inspection work, recording it, storage of the records, deciding on requirement and scope for remedial work, including methods of control of contractors.

A description of procedures to satisfy the operation, maintenance and testing requirements for the ESD valves, demonstrating that any leakage has been assessed and found not to be excessive.

A statement that damage prevention procedures are in place, including a list of identified hazards (eg dropped cargo, anchors, mooring lines, vessels, etc.) and any limitations imposed (no anchoring areas, vessel size limitations, approach routes, etc).

A description of procedures to be followed for modifications and repairs, including safety studies, how isolation procedures are decided upon and how the standards of work and inspection are set.

A statement that there are emergency procedures to cover all identified hazards, a list of the titles of all emergency and operating manuals applicable to the pipelines connected to the installation, the distribution list of installations at which the emergency manuals are present, who is involved in writing and updating the emergency manuals, the update frequency and the events which trigger an update, the management system for making and communicating day to day changes, the content of procedures stating the type of emergency/ hazard and main actions to be taken (eg which valves to close), with pipeline system diagrams in support, if necessary, and a statement or diagram showing responsibility interfaces with other operators.

A statement that procedures are in place, and a summary description, to cover simultaneous production and diving, or any other form of maintenance, at a subsea manifold/well connected by pipeline to the installation, or on the pipeline itself, to control any hazards arising which could affect the diving support vessel, its crew or divers, or the installation.

A description of connections between the installation and subsea manifolds/ wells or normally unattended satellites.

A description of all past modifications and repairs to the pipelines which could have a bearing on the other parts of the safety case, namely the system description, hazard identification, risk evaluation and reduction.

2. Where a standard/code of practice other than those listed in Annex 1 and Sheets 5.2.HS1-6 has been employed, judgement as to the adequacy can only be assessed on

151

an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.


Pipelines Safety Regulations 1996, in particular Regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82

Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACOP and Guidance Document L65

Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 9, 14, 16, 95, 115

Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12


The pipeline system should be described and then that information used to check the identification of hazards and to ensure that they have been addressed. The safety case should be checked to find any anomalies which may exist in the hazard identification results and to track down faults in method.

Safety cases should identify all hazards arising from pipelines or their inventories that could give rise to major accidents – the most significant major accident hazards are covered in Sheets 5.2.HS1 to HS6. Hazard identification should take account of pipeline systems aspects such as management interfaces between installations, inter-platform control, telemetry, leak detection and pipelines emergency procedures.

All hazards which could result in a loss of pipeline integrity at any location within the hazard limit distance [5.2.HS3] should be identified and included in the overall risk assessment for the installation. The hazard limit distance is that distance from the installation beyond which a pipeline release could not conceivably be a hazard to the installation.

The hazards involving any pipeline attached to subsea wells or manifolds, which could endanger drilling rigs or diving support vessels should be identified.

An assessment should be made to show that risks have been evaluated and that these analyses have been carried forward into the overall risk assessment for the installation. Checks should be made of the adequacy of proposed hazard minimisation or risk reduction measures and that they are consistent with the overall risk assessment.

Within the installation description the duty holder should include all interconnecting facilities – ie pipelines and subsea installations, including:

• a description or diagram of connections to pipeline systems and of any pipeline with the potential to cause a major accident;

• owners and operators of connected installations and interfaces;

• fluids, pipeline sizes, directions, and approximate flow rates;

• subsea valves, tees, wyes, remotely operable valves, etc.;

• telemetry links to other installations;

152


• all potential pressurising sources (eg subsea wells, other pipelines connected subsea, pumps and compressors, etc.);

• process flow diagrams of any subsea production facilities, showing actuated and manual valves;

• complex operations (eg hot water circulation, chemical injection, water or gas injection, gas lift, etc.) or where dual (or multiple) purpose lines are used (eg round-trip pigging);

• liquid/gas separation or pumping facilities;

• a description of the pipeline over-pressure protection system (see below);

• a description of the leak detection system (see below); and

• pipeline pigging philosophy and practice.

Specific pipeline data should include:

• pipe diameter;

• wall thickness(es), stating any allowance for corrosion;

• the pipeline platform approach route;

• the riser, topsides pipework and demarcation points;

• s (ie from installation to installation, including any branches connected

subsea);

• the ESDV and any subsea isolation system;

•

the pipeline;

erating pressure;

•

ified minimum yield stress, the type of pipe (eg steel, flexible,

• control of

• e pipeline which is critical to the safety of the

Damage Prevention

pipeline inventory at maximum allowable operating pressure between the pipelineextremitie

the fluids in the pipeline;

• the design standard or code used for

• the existence of any weight coating;

• the current maximum allowable op

• the operating temperature range;

the grade of steel/ material of construction of the pipeline, riser and topsides pipework, including whether it is sour/non-sour service rated, and the type of anycladding. (In the case of duplex or other special materials for which an industry specification may not exist, the safety case should state, for example, the composition, specduplex, bundle));

the arrangements for corrosion management, including monitoring and corrosion, internally and externally, and predicted corrosion rates; and

any other element of the design of thinstallation.

153

The pipeline should be protected from third party and/or construction damage by vessel anchors and mooring wires and chains, by pipe lay abandon and retrieval wires, and by fishing trawls.

Also, consider the anchoring procedures for standby vessels, supply vessels, diving support vessels, heavy lift crane vessels, flotels, drilling rigs, etc.

Major damage risks come from dropped objects (eg cargo being loaded offshore) and from vessel collisions with risers. Exposed risers should be protected with fenders or equivalent, and procedures should be in place to limit vessel sizes and types, weather conditions for loading, etc.

Pipeline spool-pieces located under platform cranes should be protected from dropped cargo containers, well casings, etc. Procedures should be in place to limit the types and weights of items of cargo to be handled to ensure that they do not exceed the design of the pipeline protection.

A further cause of damage is due to jack-up spud cans making deep holes in the seabed into which a pipeline can slip.

Protection

Assessment of protection requirements, its type and extent, for all parts of the pipeline should be carried out. The assessor should be aware of relevant standards and should use them as a guide as to whether studies have produced credible results. The studies should cover hazard identification, risk evaluation and risk reduction.

Pipeline Safety Systems

The duty holder should describe all the safety systems in place for safe operation, safety of personnel and prevention of hazard escalation. The performance standards required of these systems should be described. For example, how often they may fail the tests without having to be replaced, how fast are they expected to react, etc. The safety systems are intended to cover the greatest and most frequent hazards, and they should provide the fastest response and warning of hazards. Emergency procedures are intended to cover the rest.

The assessor should examine the installed safety systems, as described in the safety case, and should compare this description with the results of the hazard identification. The hazard identification should identify the critical safety system components. These components should be prominent in the testing and maintenance scheme, and certainly should be mentioned in the method of devising and updating it. The assessor should examine the emergency procedures in the light of the installed systems.

Pipeline Over-pressure Protection and Depressurisation

The safety case should describe the type and operation of any pipeline over-pressure protection and depressurisation measures in place (other than pig trap systems). This will mainly involve relief systems for pipeline sections in-board of ESD valves (with high pressure trips).

Pressure breaks should be examined critically. The primary protection should be by design ie the pipeline should be designed for the highest foreseeable pressure (inherently safe design). Secondary protection may include pressure safety valves (spring operated), HIPS [5.1.F16], etc.

The pipeline depressurisation philosophy should detail reasons for the need for depressurisation and any limitations or controls in place to mitigate potential low

154

temperature, embrittlement and hydrate formation problems (eg controlled depressurisation rate with methanol injection).

There should be a description of all available means of depressurisation of the pipelines which could be used in an emergency, referring to the pipeline system description if necessary, and the emergency procedures - although operators are naturally reluctant to flare off large quantities of gas, methods exist for rapid removal of substantial quantities with co-operation from other users of a pipeline system.

Pipeline Leak Detection

The duty holder should describe the type and operation of the pipeline leak detection system, including control functions monitored, monitoring locations (eg at each end of the pipeline) and the alarm and shutdown set points for these functions. This should include:

• the actions resulting, eg alarms in the control room and who takes actions to shut-down? How are third parties and the beach informed?

• what is the response time against leak size and what are the criteria used for shut-down?

Pipeline Emergency Shut-Down Functions

The safety case should give a satisfactory definition of the emergency shut-down facilities.

The levels of shut-down should be clearly defined. The description should include the list of initiating parameters from the pipeline system and resulting actions on the pipeline system for each level of shut-down. In particular, the level at which the riser ESD valves are closed. All operation and failure modes should be described, including local/test controls, and the various failsafe closure modes.

Are there functions built into the ESD system to receive/send shutdown signals from/to third parties, or to alarm them of ESD valve closure, or are these all manual actions by the operator?

If SSIVs are installed, all modes of operation and failure should be described. Are they tied back into the ESD system and automatically actuated, at a certain shut-down level, or are they manually initiated?

Where pipeline blow-down facilities or procedures are in place, their mode of operation should be clearly defined. Is the pipeline blow-down automatic or manually initiated? Is it controlled to prevent potential hydrate and pipeline low temperature problems?

Connection to Pipeline Systems

Communication, power and telemetry links to other installations: this aspect is required to verify claims of automatic shutdown capabilities, data transfer, etc., and will be used in detail in relation to safety systems.

Fluids, approximate operating pressures and line sizes.

The well head shut-in pressure of subsea wells connected to the installation: the maximum allowable operating pressure (MAOP) rating of the relevant riser should be above this pressure;

The MAOPs of all pipelines connected subsea to each riser: for any particular riser these should all be equal to avoid the possibility of overpressurisation from a third party platform;

155

High pressure shut down set points for pumps and compressors and other pressure sources connected to the pipeline: these should all be less than the MAOP;

Location of pipeline system control centre, especially when tying into major transportation systems.

If the considerations mentioned above in connection with MAOPs are not satisfied, the MAOP should be adjusted accordingly, or a high integrity pressure limiting or shutdown system should be in place. Such a system should be examined in detail.

For pipeline operations further information may be required by assessors to be included - ie where operators submit a joint safety case for a number of installations such as subsea manifolds/wells or unmanned satellites connected to a central platform.

Subsea Facilities

These may be remote from the installation but connected to it, and details should be included of:

• satellite wells and protection afforded to these remote installations;

• modes of control of the facilities;

• process flow diagrams, showing actuated and manual valves, where dual (or multiple) purpose lines are used (eg round trip pigging), or complex operations are intended, eg. hot water circulation, methanol, chemical, water/ gas injection, provision for gas lift etc.; and

• details of any liquid / gas separation or pumping facilities.

The duty holder should take account of the possible hazards from backflow from water injection lines for example, which are apparently non-hazardous. In round trip pigging systems a water line could be connected subsea to a production line. Where the installation is a floater water backflow could sink the vessel. Loss of flow of corrosion inhibitor if undetected could lead to corrosion of a flowline carrying a hazardous fluid.

The assessor should take into account hazards from satellite well flowlines due to dropped objects, anchors and mooring lines which could affect crews of drilling and diving support vessels.

Has the potential for sand carry-over been considered in the design? This can give erosion problems, particularly at riser bends and at SSIVs.

Future Pipelines and Connections to Other Installations

The duty holder should give a description of routing, location and layout of known future pipelines and risers. It is important to consider and comment on these aspects at an early stage to ensure that changes can be implemented completely and without unnecessary complication.

Pipeline Communications/Control/Telemetry

• Within the description of the pipeline communications, control and telemetry systems, the following should be addressed:

• the transmitted parameters;

• the criteria necessary for correct operation (ie limitations of the equipment in terms of environmental or other conditions);

156

• action of the installed system on loss of communication/ control/ telemetry links, and manual intervention procedures: usually the pipeline should be shut down;

• remotely controlled action that can be taken under major accident conditions by inter-connected installations, and the sequence and timing of such actions, including emergency shut-down arrangements; and

• shore-based control systems.

Pipeline Operations

The duty holder should state the expected frequency and purpose of pigging throughout the field life.

The duty holder should summarise the inspection scheme for each part of the pipeline, describing the techniques used and justifying their adequacy with consideration to conditions such as currents/sand waves, wave action, corrosion, fishing and other activity. For ESD valves testing and inspection activities should be covered under this heading. Testing of ESD, control, telemetry and communication systems should be included. Any special equipment used for inspection should be described, such as intelligent pigs, ESD valve seat leak testing facilities, new technology, etc.

For all cases of leaking seats on ESD valves the duty holder should demonstrate that the effects have been assessed and that appropriate action has been or will be taken. This should be covered in the safety case as the summary of an assessment study.

The duty holder should provide the maintenance schedule and demonstrate that adequate maintenance is carried out. Parts which are expected to be included are valves, actuators, pig trap closures, control, telemetry and communication systems, riser tensioners and quick-disconnect systems on floating production platforms, and any other mechanical equipment.

Operating Temperatures

The assessor should recognise the potential for:

• hydrate formation which can lead to blockage problems and possible ineffectiveness of safety systems;

• formation of process condensates which may lead to pipeline slugging conditions, for which the pipeline may or may not be designed;

• wax formation in oil lines which may lead to blockage of critical components;

• ice formation on the outside or inside of valves which may render them inoperable;

• low temperature embrittlement of pipe steel; and

• failure of blowdown systems.

Process Upset Conditions

Examples of process upsets include slugs, surges and emergency shut-downs. Some system designs rely upon the processes not going outside certain parameters, eg a dry sour gas line if not designed for sour service must not get wet due to a process upset.

What systems are in place to warn operators or to shut down the line in this type of situation?

157

Decommissioning and Abandonment

Taking a pipeline out of use falls under two main headings - cleaning out of hazardous substances from pipelines, risers and topsides, and ensuring safe removal of facilities as required. For pipelines this subject involves principally the safety of divers and of other

ets in this Section are:

xible Risers

n Systems (SSIS)

6. ere ed S

of Position

ire and Explosion

onse

n Factors

ions & Procedures

7. Assessment Unit for this Sheet:

8. responsible for authoring and updating this sheet:

SI3B

personnel involved with platform abandonment.

5. Other Related Assessment She

5.2.HS1 Rigid Riser

5.2.HS2 Other Risers including Fle

5.2.HS3 Outboard Pipeline

5.2.HS4 ESDV Valves (ESDV)

5.2.HS5 Subsea Isolatio

5.2.HS6 Pig Trap

Cross-Ref nc ections and Sheets are:



Section 4.2 Loss of Maritime Integrity - Loss


Section 5.3 Loss of Containment - F

Section 10 Emergency Resp

Section 11 Huma

Section 13 QRA

Sheet 2.F6 SBVs, Communicat

Lead

SI3

Team

158

5.2.HS1: Rigid Risers

[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G6, 5.2.G7, 5.2.G8, 5.2.G9, 5.2.G10, 5.2.G16, 5.2.G17, 5.2.G19, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G25, 5.2.G27, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F16, 5.2.F17, 5.2.F18, 5.2.F19, 5.2.F20, 5.2.F24, 5.2.F25, 5.2.F26, 5.2.F27, 5.2.F30, 5.2.F31, 5.2.F32]

1. The riser is one of the most important parts of the pipeline system and its integrity has to be assured. All information relating to risers should be assessed from the seabed to either the emergency shutdown valve (ESDV) or the pig trap (if fitted). In particular:

• approximate route (eg showing relevant module decks, bulkheads and jacket members, riser supports/ guides);

• ESDV location;

• mechanical joints, eg flanged and insulation joints;

• all branches outboard of the ESDV as far as their respective isolation valve(s) and their nominal diameter; and

• fire, explosion, impact or other protection provided for the riser and ESDV.

Confirmation should be obtained that the pipeline operator/duty holder has ensured that the pipeline riser has been properly designed and constructed and is operated safely to ensure that the riser will be in accordance with recognised standards and guidance. These include:

BS 4515-1 Specification for the Welding of Steel Pipelines on Land and Offshore – Part 1: Carbon and Carbon Manganese Steel Pipelines

BS 4515-2 Specification for the Welding of Steel Pipelines on Land and Offshore – Part 2: Duplex Stainless Steel Pipelines

ISO 13847 Pipeline Welding

ISO 15590 Part 1 Induction Bends

ISO 15590 Part 2 Fittings

ISO 15590 Part 3 Flanges

ISO 15589 Part 2 Cathodic Protection Offshore

ISO 3183 Petroleum and Natural Gas Industries – Steel Pipe for Pipelines

API 5L Line Pipe

High Integrity Pressure Protection Systems (HIPPS) for the Overpressure Protection of Pipelines (Draft)

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.


159



Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACoP and Guidance Document L65




Riser Routing and Design

The duty holder should, with the aid of schematics, describe the riser routing in relation to platform, pipeline platform approaches and field layout. This is necessary from the assessor's point of view to enable him to assess the full impact of layout versus topsides and vessel activities. The riser should, where possible, be routed away from hazards such as fire, explosion and impact. Specific issues to be addressed include:

• position of cranes, which will be used for loading vessels;

• whether an external riser is located on the weather side of the platform, making it vulnerable to impacts from drifting vessels, especially important where there is also a crane on that side;

• fire protection;

• accessibility for inspection, ie when located in caissons or in platform legs;

• gas risers in concrete platform legs, which could leak and pressurise the leg causing it to collapse; and

• adequate support of the riser, especially in the wave zone.

Risers should ideally be located in-board of jacket braces or other structural members to protect them from vessel impact. If not, there should be fenders or other means installed which can absorb impact energy without touching the riser.

Where risers are located in J-tubes (conduits) or in caissons, the J-tubes or caissons should be sealed off at both ends and filled with inhibited water to protect the riser from corrosion.


5.2.HS3 Outboard Pipelines


5.2.HS5 Subsea Isolation Systems (SSIS)

5.2.HS6 Pig Trap


160

of Position

n

ions & Procedures

7. Assessment Unit for this Sheet:

8. responsible for authoring and updating this sheet:

SI3B



Section 4.2 Loss of Maritime Integrity - Loss


Section 5.3 Loss of Containment - Fire and Explosio

Sheet 2.F6 SBVs, Communicat

Lead

SI3

Team

161

5.2.HS2: Other Risers including Flexible Risers

[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G6, 5.2.G7, 5.2.G8, 5.2.G9, 5.2.G10, 5.2.G16, 5.2.G17, 5.2.G19, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G25, 5.2.G27, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F16, 5.2.F17, 5.2.F18, 5.2.F19, 5.2.F20, 5.2.F24, 5.2.F25, 5.2.F26, 5.2.F27, 5.2.F30, 5.2.F31, 5.2.F32]

1. The riser is one of the most important parts of the pipeline system and its integrity has to be assured. All information relating to risers should be assessed from the seabed to either the emergency shutdown valve (ESDV) or the pig trap (if fitted). In particular:

• approximate route (eg showing relevant module decks, bulkheads and jacket members, riser supports/ guides);

• ESDV location;

• mechanical joints, eg flanged and insulation joints;

• all branches outboard of the ESDV as far as their respective isolation valve(s) and their nominal diameter; and

• fire, explosion, impact or other protection provided for the riser and ESDV.

Confirmation should be obtained that the pipeline operator/duty holder has ensured that the pipeline riser has been properly designed and constructed and is operated safely to ensure that the riser will be in accordance with recognised standards and guidance. These include:

API Specification 17J 2nd Edition November 1999 Specification for Unbonded Flexible Pipe

API RP 17B 2nd Edition July 1998 Recommended Practice for Flexible Pipe

ISO 13628-2 Design and Operation of Subsea Production Systems – Part 2: Flexible Pipe Systems for Subsea and Marine Operations

Other guidance and sources of information:

UKOOA Study Report on State of the Art Flexible Riser Integrity Issues – MCS International Doc No 2-1-4-181/SR01 Rev 04 April 2001

UKOOA Guidance Note Monitoring Methods and Integrity Assurance for Unbonded Flexible Pipe Rev 5 Oct 2002

API Technical Report TR17RUG The Ageing of PA-11 in Flexible Pipes




Pipelines Safety Regulations 1996, in particular regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82

162






Risers to floating installations are particularly vulnerable to damage.

Steel tensioned risers located under the installation are susceptible to dropped object damage, damage during running and retrieval, and to overstressing or fatigue in certain circumstances. The riser stress analysis should be applicable for all sea states and modes in which the riser can remain connected to the installation. These risers usually include short sections of flexible pipe at the topsides which is susceptible to damage also.

Flexible risers are vulnerable to damage from vessels, dropped objects, fatigue and overstress damage. As with the steel tensioned risers the stress analysis should cover all applicable cases. Connections with steel pipe should be configured to avoid the flexible being damaged by bending at the connection, either by their layout or by use of bend restrictors.

Riser stress analysis for both of the above types should cover extreme static installation offsets from its station, static wind, wave and current loading, natural frequency analysis, dynamic response to wave frequencies (stresses and fatigue damage assessment) and dynamic transient responses. Operators should be aware of the fatigue lives of the components. At a minimum, assessors should check the design lives of key components which are difficult or expensive to replace regularly, and the limiting sea states for the riser system.

Duty holders should provide an isometric drawing of the riser routing(s), showing the module decks and bulkheads through which it passes, from the seabed to the ESD valve/pig trap and the first process isolation valve. The assessor can then use this and module general arrangement drawings, plot plans, etc. to compare with the list of identified hazards to the riser.

This drawing should indicate the ESD valve location, the types and positions of riser supports, flange joints, insulation joint, any other weak joint, any branches outboard of the ESD valve to their respective isolation valve(s) and their nominal diameter and any parts of the riser that are not accessible for inspection and fire, explosion, impact or other protection which is fitted. It is not necessary to show topside branches other than the main process flow branch. Any hook-up welds should be shown to indicate the interface between contractors. For floating installations there should also be scale plans and elevations of the risers, showing extreme offset configurations.

A description of fire, explosion and impact protection should address:

• active and passive fire protection;

• explosion protection - in terms of segregation by layout and physical partitioning using blast walls;

163


• fire & gas detection systems (a rough check of what is in place should be made - detailed analysis will be carried out by topsides assessors); and

• dropped object protection.


5.2.HS3 Outboard Pipelines



5.2.HS6 Pig Trap







Sheet 2.F6 SBVs, Communications & Procedures

7. Lead Assessment Unit for this Sheet:

SI3


SI3B

164

5.2.HS3: Outboard Pipeline

[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G5, 5.2.G6, 5.2.G7, 5.2.G9, 5.2.G10, 5.2.G17, 5.2.G18, 5.2.G20, 5.2.G21, 5.2.G22, 5.2.G24, 5.2.G28, 5.2.G29, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F16, 5.2.F17, 5.2.F19, 5.2.F20, 5.2.F24, 5.2.F25, 5.2.F26, 5.2.F28, 5.2.F29, 5.2.F30, 5.2.F31, 5.2.F32]

1. It is important to assess in detail the pipeline within 500 metres from the installation, taking into account features such as:

• the installation itself;

• pipeline(s);

• no-anchoring areas;

• anchor patterns and jack-up footprints for vessels normally moored in the vicinity; and

• layout of tie-ins, spool pieces, crossovers, subsea isolation systems (SSISs), other subsea equipment and extent of protection measures such as mattresses, rock dump, trenching, protection covers, etc.

All hazards which could result in a loss of pipeline integrity at any location (within the hazard limit distance – ie where the installation could be affected) should be identified and included in the overall risk assessment for the installation.

The hazards involving any pipeline attached to subsea wells or manifolds, which could endanger drilling rigs or diving support vessels should be addressed.

Assessment should be made of the interaction between the installation and others linked by pipeline(s) and the effect an interconnected pipeline system could have on the installation.

Safety cases should identify all hazards arising from pipelines or their inventories that could give rise to major accidents. Hazard identification should take account of parts of pipelines located close to installations whose failure could affect the installation and pipeline systems aspects such as management interfaces between installations, inter-platform control, telemetry, leak detection and pipelines emergency procedures.

Confirmation should be obtained that the pipeline operator/duty holder has ensured that the outboard pipeline (for example, interfield pipeline, trunk line, etc.) has been properly designed and constructed and is operated safely to ensure that the pipeline will be in accordance with recognised standards and guidance. These include:


BS 4515-2 Specification for the Welding of Steel Pipelines on Land and Offshore – Part 2: Duplex Stainless Steel Pipelines


ISO 15590 Part 1 Induction Bends



165

ISO 15589 Part 2 Cathodic Protection Offshore

ISO 3183 Petroleum and Natural Gas Industries – Steel Pipe for Pipelines

ISO 21329 Testing Mechanical Connectors

API 5L – Line Pipe

Other guidance and sources of information:

SPC/TECH/OSD/18 Health & Safety Issues Associated with Changes from Dry Gas to Wet Gas Operations









Specific Technical Issues:

Pipeline to Platform Approaches

The duty holder should describe, with scale diagrams:

• the layout and configuration of the plant;

• the connections to be made to any pipeline or installations; and

• any wells to be connected to the installation.

The scale plan of the location should be large enough to show any features that may be significant in the assessment of the hazard or risk associated with the site. Typically, items of significance include:

• pipelines, whether connected to the installation or not;

• subsea wells and manifolds;

• control umbilicals;

• other fixed installations in the area; and

166



• any significant undulations in the seabed.

The duty holder should therefore provide a pipeline to installation approaches plan to 500 metres from the installation, showing the installation(s), pipelines, direction of geographical (true or grid) and installation north, no-anchoring areas, anchor patterns for vessels normally moored in the vicinity (and the vessel itself), layout of tie-ins, spool-pieces, crossovers, SSISs, other subsea equipment, extent of protection measures such as mattresses, rock dump, trenching, protection covers, supports and any significant undulations in the seabed elevation which could conceivably cause bending/spanning/upheaval buckling.

Note that this is also required for subsea manifolds and producing subsea wells because of potential hazards to drilling rigs, DSVs and their crews.

Details of tie-ins, spool-pieces, cross-overs and other subsea equipment such as SSISs should be evaluated to assess risks from dropped objects, fishing activities and anchors.

The assessor should consider the effects of having a flotel located over the lines, if this is the case, with respect to dropped object and anchor/ mooring line damage. Similarly jack-up temporary moorings used during jacking operations, construction vessels, diving support vessels, and standby vessels should be considered.

Moorings for drilling semis (usually but not always located well away from fixed platforms) and jack-ups drilling satellite wells and exploration wells should be considered in connection with the in-field pipeline layout. Duty holders should take account of hazards from satellite well flowlines due to dropped objects, anchors and mooring lines which could affect crews of drilling and diving support vessels.


5.2.HS1 Rigid Riser

5.2.HS2 Other Risers including Flexible Risers










SI3


SI3B

167

5.2.HS4: ESDV Valves (ESDV)

[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G5, 5.2.G6, 5.2.G7, 5.2.G8, 5.2.G9, 5.2.G10, 5.2.G17, 5.2.G19, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G25, 5.2.G27, 5.2.G30, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F16, 5.2.F17, 5.2.F18, 5.2.F19, 5.2.F20, 5.2.F23, 5.2.F24, 5.2.F25, 5.2.F26, 5.2.F27, 5.2.F29, 5.2.F30, 5.2.F31, 5.2.F32]

1. An assessment should be carried out for all ESDVs at an installation with particular reference to the definitions of ESD levels and modes of operation and failure of the ESDVs.

Confirmation should be obtained that the pipeline operator/duty holder has ensured that the ESDV has been properly designed and constructed and is operated safely to ensure that the ESDV will be in accordance with recognised standards and guidance. These include:

API Spec 6D Pipeline Valves

ISO 14313 Pipeline Valves

Other Guidance and Sources of Information:

Department of Energy – Guidance Notes in Support of the Offshore Installations (Emergency Pipeline Valve) Regulations 1989 SI 1989/1029

HSE/UKOOA Guidance On The Setting Of Tolerable Pipeline Riser ESDV Internal Body Seal Leak Rates For Offshore Pipelines (in draft)

SPC/TECH/OSD/26 Riser Emergency Shut Down Valve (ESDV) Leakage Assessment





Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACOP and Guidance Document L65

Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 8, 9, 14, 16, 109, 115



ESDV Location

The ESDV shall be located in a position:

• in which it can be safely and fully inspected, maintained and tested;

168



• such that the ESDV is above water; and

• subject to the above, such that the distance along the riser from the ESD valve to the base of the riser is as short as reasonably practicable.

The duty holder should indicate the ESD valve location(s) on the riser isometric drawing.

ESDV Fire, Explosion and Impact Protection

The duty holder should demonstrate, through description and general layout drawings, that adequate fire, explosion and impact protection is afforded to the ESD valve and its appurtenances, eg actuator, hydraulic accumulators, hydraulic piping, outboard maintenance valve. It is expected that in order to define the type and extent of protection, the duty holder will carry out detailed studies which should be listed among the references. The assessor should check the scope of these studies and their results.

Fire Protection

The ESDV actuator and all components necessary for ESDV fail-safe closure should remain fully operable under anticipated fire conditions. The pressure containing capability of the ESDV, including any out-board maintenance valves and any flanged connections to the riser, should be preserved under the anticipated fire conditions. The assessor should check the results of studies against these criteria.

Whilst both passive and active fire protection systems may be used, it should be noted that passive systems (coatings, covers, etc) do not require prime movers, distribution systems and an initiation signal, and are therefore likely to be more reliable and have higher integrity than active systems (deluge, etc). Accordingly, active fire protection systems acting on their own may not be sufficient.

There should be fire and gas detection in the vicinity of the ESD valve.

Explosion Protection

It is not usually reasonably practicable to afford protection against all of the effects of an explosion in the immediate vicinity of an ESDV. Operators should conduct studies to find expected explosion overpressures and missile energies and to decide the reasonably practicable protection required.

In general, explosion protection is best achieved by locating the ESD valve well outside congested equipment modules where the explosion over-pressures are known to be highest. ESDVs located immediately outside the openings from congested modules are also susceptible to explosion damage. Whilst this is possible with new designs, it will probably be found that for existing installations the duty holder has provided blast walls to protect the ESDVs from explosion effects.

Impact Protection

Protection from horizontal impacts may be achieved by blast walls provided for explosion protection.

The main impacts to be considered are:

• dropped and falling objects;

• missiles resulting from explosions; and

• vessels/ships.

169

The operator should carry out a study of the possible impacts, including those which could be experienced following another incident, such as heavy machinery falling from above, and he should assess what protection is necessary.

Note, whilst this "protection by design" will be possible for new installations, for existing installations the assessors experience will be necessary in judging the adequacy of protection in place. Some of the protection may be in the form of procedural control, eg for crane handling, boat approach, etc.

ESDV Operational Failure

The duty holder should assess the risks of the ESD valve failing to operate on demand. This could be anticipated in design by the fitting of a subsea isolation system (SSIS) or otherwise.

Actuators and Control Panel

The duty holder should describe the type of actuators used on the ESDVs.

The ESDV, its actuator, the local control panel, and where fitted, its accumulators and any ESDV dedicated maintenance valves, should be located close together. The location of the local control panel, together with any other measures taken, should facilitate the rapid selection of the correct control panel and should enable the operative to view the valve position indicator during local partial closure tests.

The actuator and any stored energy device (eg spring return or accumulator) required for fail-safe close purposes should be protected as part of "the valve and its actuating mechanism". A description of the protection of these items should be included in the safety case.


5.2.HS1 Rigid Riser








SI3


SI3B

170

5.2.HS5: Subsea Isolation Systems (SSIS)

[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G6, 5.2.G7, 5.2.G9, 5.2.G10, 5.2.G17, 5.2.G18, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G27, 5.2.G28, 5.2.G29, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F17, 5.2.F18, 5.2.F19, 5.2.F20, 5.2.F24, 5.2.F26, 5.2.F28, 5.2.F29, 5.2.F30, 5.2.F31, 5.2.F32]

1. An assessment should be carried out for all ESDVs at an installation with particular reference to the definitions of ESD levels and modes of operation and failure of the ESDVs.

Confirmation should be obtained that the pipeline operator/duty holder has ensured that the ESDV has been properly designed and constructed and is operated safely to ensure that the ESDV will be in accordance with recognised standards and guidance. These include:

API Spec 6D Pipeline Valves

ISO 14313 Subsea Pipeline Valves






Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 8, 9, 14, 16, 109, 115



The duty holder should describe the subsea isolation systems (SSISs) installed. There should be a description with layout giving location, modes of operation, type of valve and actuator and failure modes (eg fail close on loss of hydraulics/signal).

The hardware description of an SSIS is not of such great importance. What is more important is having adequate measures taken against hazards from pipelines and risers and if not, and if a SSIS is not fitted, why not? If a SSIS is fitted, how was its location decided?

The assessor should acknowledge that subsea isolation valves (SSIVs) are not a mandatory requirement. However, the duty holder is expected in agreement with the Cullen Report and in particular recommendation 44 to ".... demonstrate in the safety case that adequate provision has been made, including if necessary the use of SSIVs, against hazards from risers and pipelines".

171


Due to the location of the subsea isolation systems, significant inventory of hydrocarbons will be present between the subsea valve and the top of the riser. Therefore, failure of the riser or underwater pipeline near the installation will result in an unavoidable discharge of hydrocarbons under pressure, with the potential of serious fire or vapour cloud explosion. A subsea valve cannot prevent this initial discharge from taking place and cannot protect personnel in the open or working in the vicinity of the riser. This can also upset the buoyancy of floating production installations and vessels.

In assessing the arguments for/against installing a subsea valve, it is necessary to concentrate on the effect it has upon the consequences of a failure. Particularly so where pipelines are branched into main transportation lines or third-party imports are concerned. Note that in such cases, without a subsea isolation system, there is scope for an unlimited supply of fuel in a fire situation.

Although topside ESDVs are required by law for most major accident hazard pipelines, the risk of the ESDV failing to operate on demand should be included in the input to the decision concerning the fitting of an SSIS.

Non-return or Check Valves

On some risers a non-return valve (NRV) or check-valve may be used as a means of isolation.

The NRV has the advantages of being a self-contained operation and of rapid closure in the event of a pipeline rupture. Due to the closure times of actuated valves, there will be some initial hydrocarbon discharge which will last longer than for a non-return valve.

One of the disadvantages with NRVs is that an actuated SSIV has the advantage of being closed in the event of a small leak or a fire in the vicinity of the riser, whereas the same cannot be said about non-return valves.

They are however, not suitable for all applications - they can be installed on export lines but, by their nature, not on import lines. For export pipelines they may prevent the normal flow being reversed for operational reasons, such as during routine depressurisation. Their presence also makes it more difficult to pig the line, and are liable to be damaged by pigging. The important thing to note is that they will not prevent a small leak (ie may not give a tight seal).

Accordingly, the duty holder should give the exact criteria under which their operation and efficiency is expected.

Location of SSIS

Location studies will normally be carried out where SSISs are to be installed. Subsea valves are usually located some distance away from the installation they are intended to protect. This is necessary to balance the risks due to any possible line failures resulting from objects dropped from the platform, supply boats, or from dragging anchors, fishing hazards, etc. on the platform side of the valve

A rupture on the far side of the valve in which case it is necessary to address:

• gas cloud or oil pool dispersion;

• protection of the pipeline; and

• protection of the SSIS which can itself be an extra leak path.

In some cases an operator will wish to locate a SSIS for ease of construction - examples are floating production installations with riser base valves, flowline bundles which arrive

172

within 50 metres of a fixed platform, SSIS skids serving several pipelines, spool-piece flanges being used to avoid the cost of hyperbaric welds, etc.

The pipeline to platform approach layout should be considered carefully to ensure that each SSIS is located on a sound risk balancing basis.

Description of SSIS

The description must include the modes of closure/operation and the failure modes. Operators are sometimes reluctant to have fail safe close valves in case, during a test or following a spurious failure, it shuts and remains jammed shut. It is however, no use having a SSIS in place which is almost impossible to use or is functionally locked open.

There should be fail safe modes of closure or similar in event of loss of hydraulics/other platform signals. The system should include local energy storage (such as a spring or hydraulic accumulator) to close the valve, and it should not rely on platform based hydraulic or other power supply for closure in an emergency.

Protection

The SSIS should be protected from impact and snag loads from anchor lines and fishing trawls. Usually a structure is provided for this purpose.

Inspection, Testing and Maintenance

The duty holder should describe the philosophy for carrying out inspection, testing and maintenance on the subsea isolation valves. This should not just be limited to SSIVs - NRVs should be addressed as well.

As with any safety system, the reliability needs to be assured, and this is normally done by carrying out periodic tests. The duty holder should describe the extent, type and frequency of these tests. There should be detailed procedures in place for this purpose. However, experience indicates that this is not always the case and operators are sometimes afraid of testing in case the valves are damaged or cannot be opened again. Testing should include:

• full (and if desired partial) closure;

• valve seat leak tests; and

• checks for confirming closure, eg provision of local (visual) valve position indicators as well as the remote system.


5.2.HS1 Rigid Riser


5.2.HS3 Outboard Pipeline






173



SI3


SI3B

174

5.2.HS6: Pig Traps

[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G5, 5.2.G6, 5.2.G7, 5.2.G8, 5.2.G9, 5.2.G10, 5.2.G17, 5.2.G19, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G25, 5.2.G26, 5.2.G27, 5.2.G30, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F20, 5.2.F23, 5.2.F24, 5.2.F25, 5.2.F27, 5.2.F29, 5.2.F30, 5.2.F31, 5.2.F32]

1. Confirmation should be obtained that the pipeline operator/duty holder has ensured that the pig trap (including sphere launchers and receivers) has been properly designed and constructed and is operated safely to ensure that the pig trap/ sphere launcher/receiver will be in accordance with recognised standards and guidance. These include:





ISO 3183 Parts 1 & 2 Linepipe

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.




Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995) and associated ACoP and Guidance Document L65

Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 8, 9, 14 and 16



Ensure that pig trap loading hatches are facing outboard and that adequate protection is afforded against accidental opening of the hatches whilst under pressure.

There should be a description of the pigging facilities including closure design, detail on all safety features such as double blocking method, interlocks etc.

Bad maintenance and material defects have led to failure of pig trap closures, resulting in substantial damage to pipework and other platform facilities. Incorrect maintenance of a pig signaller has led to an uncontrolled release of gas.


175


5.2.HS1 Rigid Riser







SI3


SI3B

176

Annex 1

REFERENCE DOCUMENTS

A list of references is provided in each assessment sheet.

The documents listed below provide guidance for pipeline systems in general, particularly in relation to good practice and performance standards. However, in some cases the reference material will not be fully applicable and may be limited in some parts.

Standards and Codes of Practice

BS EN 14161:2003 – Petroleum and Natural Gas Industries - Pipeline Transportation Systems

BS PD 8010 Part 2:2004 Code of Practice for Pipelines. Part 2: Subsea Pipelines

Institute of Petroleum Model Code of Safe Practice Part 6 Pipelines

DNV Offshore Standard DNV-OS-F101 Submarine Pipeline Systems January 2003

ISO 13623 Pipeline Transportation Systems (but see BS EN 14161)

ISO 16708 Reliability Based Limit State Methods

ANSI/NACE Std MR0175-2002 Sulphide Stress Cracking Resistant Metallic Materials for Oilfield Equipment

API RP 14C Recommended Practice for Analysis, Design, Installation and Testing of Basic Surface Safety Systems for Offshore Production Platforms 7th Edition March 2001

OIAC The Safe Isolation of Plant & Equipment

Other guidance and sources of information

HSE/IP/UKOOA PARLOC 2001: The Update of Loss of Containment Data for Offshore Pipelines 5th Edition

OSD Hydrocarbon Release Database

Department of Energy – Submarine Pipelines Guidance Notes

SPC/TECH/GEN/18 Underlagging Corrosion of Plant & Pipework

Offshore Safety Notice 2/00 Bolting of Flanged Joints for Pressurised Systems

Institute of Petroleum Guide to the Design of Relief and Blowdown Systems

UKOOA/IP Guidelines for the Management of Integrity of Bolted Pipe Joints

UKOOA/IP Guidelines for the Management, Design, Installation and Maintenance of Smallbore Tubing Systems

UKOOA Guidelines for Instrument Based Protection Systems Rev 2 1999

Report 2003 3135 Project Guidelines for Engineering Critical Assessment for Pipeline Installation Methods Introducing Cyclic Plastic Strain.

177

http://www.hse.gov.uk/offshore/hydrocarbon.htm

http://www.hse.gov.uk/foi/internalops/hid/spc/spctg18.pdf

5.3 LOSS OF CONTAINMENT – FIRE & EXPLOSION 1. Scope

This Section provides guidance for the assessment of safety case content with respect to the loss of containment from process plant and process operations, leading to fires and explosion. The assessment procedure includes hazard identification, consequence determination and risk management measures.


The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator, together with identification and evaluation of escalation paths that might result. Potential sources of hazard, initiators, etc, are shown in the document. Assessors should ensure that, where relevant, safety cases contain information demonstrating that consideration has been given to each of these factors




178


Loss of Containment - Fire & Explosion

Source of Hazard Initiators Risk Evaluation Risk Management Measures Performance Standards

Loss of Containment Ignition Frequency

Open/Closed Modules

Inherent Safety

F1 Ignition Probability F13 Intrinsically Safe Electrical Equipment

Fire resistant structures

*Ignition sources/’Ex’ rating/ F14 Separate Accommodation Jacket Inventory size

Electrical Zoning F15 Risers & Topsides Pressure Rating Fire load limits

F2 Hot and cold work policies F16 Fully Rated Structure Impact loads

F3 Delayed or Immediate Ignition F17 Normally Unmanned Installations (NUI)

Impact protection

F4 Energy of Ignition F18 Fully Welded Topside Pipework in Critical Areas

Containment strength

Consequences F19 Layout – No jet fire Targets Material specification

Low risk location

F5 Release Size, Detection, Shutdown

Certification schemes

Effectiveness Prevention

F6 Cloud size, Dispersion Conditions/ F20 Hazardous Areas

Ventilation F21 Electrical Equipment for Use in Potentially Flammable Atmospheres

F7 Escalation, Layout, Separation, F22 PTW

F8 Fire Types Detection

179

Loss of Containment - Fire & Explosion

Source of Hazard Initiators Risk Evaluation Risk Management Measures Performance Standards

F23

F26

F27

F28

F9 Thermal Flux, Smoke Obscuration Fire/Smoke/Gas/Flame Detectors/Alarms

Effects

F10 Fire Modelling Mitigation

F11 Explosion Modelling F24 Firewalls

F12 Near and Far Field Effects F25 Passive Fire Protection [PFP]

Resistant Temporary Refuges

Deluge & Sprinklers

Ventilation and HVAC

F29 Blast Walls

F30 Suppression and Flame Arrestors

180

5.3.F1: Ignition Probability

1. There are no agreed recognised standards or codes of practice for confirming that the probability of ignition has been derived from information relevant to the installation design and operational intent, see Section 3 below.


2. Judgement as to the adequacy of the ignition probability assessment can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.





Fire & Explosion and Risk Assessment Topic Guidance, HSE website 2003

None


None


None


OSD3.2


OSD3.2

181



5.3.F3: Delayed or Immediate Ignition

1. There are no agreed recognised standards or codes of practice for the assessment of delayed or immediate ignition.

Analysis of the timing of ignition of a gas releases is important in determining the explosion risk. Early ignition will tend to give rise to a jet fire. Delayed ignition can cause an explosion or flash fire, depending on the degree of confinement.

2. Judgement as to the adequacy of the analysis of delayed or immediate ignition can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.




Fire, Explosion & Risk Assessment Topic Guidance, HSE website 2003



4.1 The safety case should provide evidence that techniques such as event tree analysis or an equivalent approach has been used to assess consequences of immediate or delayed ignition.

4.2 The basis for calculation of delayed or immediate ignition used in the event trees should be justified on the basis of ignition probability models used.

4.3 Models should to take account of factors including the leak duration, type and dimensions of module, ventilation rate and types of ignition sources which are present


5.3.F23 Fire/Smoke/Gas/Flame Detectors/Alarms



Sheet 5.1.F12 Dispersion, Open or Closed Modules, Ventilation Rates

182




OSD3.2


OSD3.2

183

5.3.F7: Escalation, Layout, Separation, Open/Closed Modules

1. Confirmation should be obtained that escalation, layout, separation, open/closed modules have been designed, constructed and analysed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include:

ISO/FDIS 13702 Petroleum and Natural Gas Industries – Control & Mitigation of Fires and Explosions on Offshore Production Installations: Requirements and Guidelines

Escalation of a fire or explosion incident will be dependant on installation layout, separation of hazardous and safe areas, and module type. Escalation risk will be primarily focussed on TR impairment and escape/evacuation risks rather than individual risk to personnel working on the plant or involved in drilling etc.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the design for escalation, layout, separation and open/closed modules can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/ practices in the relevant areas will deliver an equivalent level of health and safety performance.






UKOOA/HSE Fire & Explosion Guidance Part 0: Fire & Explosion Hazard Management, October 2003

UKOOA/HSE Fire & Explosion Guidance Part 1: Avoidance & Mitigation of Explosions, October 2003


4.1 Evidence should be provided to demonstrate that wherever possible large hydrocarbon inventories have been separated and isolation is provided between them such that escalation risk between them has been minimised.

4.2 It should be demonstrated that both immediate and delayed escalation has been considered.

4.3 Evidence should be provided that the HAZID process has been thorough and consideration of escalation from relatively small scale initiating incidents has been included.


5.3.F5 Release Size, Detection, Shutdown Effectiveness

5.3.F6 Cloud Size, Dispersion Conditions/Ventilation

5.3.F8 Fire Types


184





OSD3.2


OSD3.2

185

5.3.F8: Fire Types

1. There are no agreed recognised standards or codes of practice for confirming that all reasonably foreseeable fire types have been identified and assessed.

2. Judgement as to the adequacy of the identification and characterisation of fire types can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.







None


5.3.F9 Thermal Flux, Smoke Obscuration Effects

5.3.F10 Fire Modelling


None


OSD3.2


OSD3.2

186



5.3.F9: Thermal Flux, Smoke Obscuration Effects

1. There are no agreed recognised standards or codes of practice for confirming that due consideration has been given to the determination of appropriate levels of thermal flux and smoke obscuration effects within a consequence assessment, see Section 3 below.

2. Judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.






OSD SPC Human Vulnerability Criteria for Use in Hazard and Risk Assessment for the Offshore Industry [under development]


None


None


None


OSD3.2


OSD3.2

187



5.3.F10: Fire Modelling

1. There are no agreed recognised standards or codes of practice for assessing the modelling of fires.

2. Judgement as to the adequacy of the fire modelling assessment can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.







4.1. There are major uncertainties in modelling the behaviour and properties of fires of condensate and higher molecular weight hydrocarbons, multi-component materials, and liquids released from pressurised containment.

4.2 Evaluating very large flames of all materials, and the behaviour of running fires also require careful consideration, as the fire characterisation parameters may exceed the model’s capability.

4.3 The influence of water deluge and foam on fuel distribution should be considered separately as part of fire mitigation.


5.3.F8 Fire Types



None


OSD3.2


OSD3.2

188



5.3.F11: Explosion Modelling

1. Confirmation should be obtained that explosion modelling has been analysed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include:

ISO/FDIS 13702Petroleum and Natural Gas Industries – Control and Mitigation of Fires & Explosions on Offshore Production Installations: Requirements & Guidelines

Explosion modelling for offshore structures is required to quantify the risk of immediate or delayed escalation. Phenomenological modelling can provide an acceptable level of accuracy provided that appropriate gas dispersion modelling is carried out to give a representation of gas cloud size. CFD modelling may provide the highest degree of accuracy provided appropriate gas cloud modelling is carried out.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the explosion modelling can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.






UKOOA/HSE Fire & Explosion Guidance Part 0: Fire & Explosion Hazard Management October 2003

UKOOA/HSE Fire & Explosion Guidance Part 1: Avoidance and Mitigation of Explosions October 2003


The explosions analysis should explain what type (average, average peak or peak) of overpressure has been calculated and how it has been used in the analysis of effects on blast walls, fixings, structures, decks and roofs, plant and equipment.


5.3.F3 Delayed or Immediate Ignition

5.3.F7 Escalation, Layout, Separation, Open/Closed Modules


Section 5.1 Loss of Containment – Process

Sheet 5.1.F11 Size of Release, Speed of Detection and Effectiveness


OSD3.2

189




OSD3.2

190

5.3.F13: Intrinsically Safe Electrical Equipment

1. Confirmation should be obtained that intrinsically safe electrical apparatus has been designed and is maintained to recognised standards/codes of practice appropriate to the nature of the flammable atmosphere that the apparatus may encounter and the category of hazardous area zone where the apparatus will be located/operated. Appropriate CE marking with respect to the Atex Directive is one way of indicating that the design is to a recognised standard [See 5.3.F21 Electrical Equipment for Use in Potentially Flammable Atmospheres].

Design Standards for Intrinsically Safe Apparatus Include:

BSEN50020 Electrical apparatus for potentially explosive atmospheres. Intrinsic safety ‘i’ and;

IEC60079-11 [BSEN60079-25] Electrical apparatus for explosive gas atmospheres. Part 11: Intrinsic safety

Standards for Selection of Intrinsically Safe Apparatus Include:

BSEN60079-14 [IEC60079-14] Electrical apparatus for explosive gas atmospheres. Electrical installations in hazardous areas (other than mines)

Standards for Inspection/Maintenance of Ex Equipment Include:

BSEN0079-17 [IEC60079-17] Electrical apparatus for explosive gas atmospheres. Inspection and maintenance of electrical installations in hazardous areas (other than mines) and;

BS5345 Code of practice for selection, installation and maintenance of electrical apparatus for use in potentially explosive atmospheres (other than mining applications or explosive processing and manufacture) [now superseded].

‘Intrinsic safety’ is a type of protection for electrical apparatus to be used in potentially flammable atmospheres. The mechanism by which ‘intrinsic safety’ protection is achieved is the restriction of electrical [and electromagnetic] energy within apparatus and interconnected wiring to a level which cannot cause ignition by sparking or heating. Intrinsically safe equipment is designated Exi.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the electrical equipment and its maintenance regime can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referenced standards.


Electricity at Work Regulations 1989, Regulations 4 and 6: Memorandum of Guidance on EAWR Regulation 6, paras 14-19

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 9(2)(d)


Equipment and Protective Systems for Use in Potentially Explosive Atmospheres Regulations [Not applicable to MODUs, FPSOs and FSUs].

191


4.1 Intrinsically safe electrical equipment is divided into two further categories Exia and Exib. An Exib circuit must remain non-incendive in normal operation and operation with one fault. An Exia circuit must remain non-incendive in normal operation and operation with two faults. Some of the mechanisms employed to achieve ‘intrinsic safety’ rely on the operation of active components [eg Zener diode barriers in a safe area] to restrict the flow of energy into the apparatus. Other mechanisms for achieving intrinsic safety include procedural elements [eg apparatus should not be opened in a hazardous area]. Thus even within electrical equipment designated ‘intrinsically safe’ there can be significant variation in the degree to which the equipment corresponds to the concept of ‘inherently safer’.

4.2 Exia certification is the only standard type of certification allowed for electrical equipment which is intended for use in Zone 0 atmospheres.

4.3 Many electrical functions cannot readily be implemented using the ‘intrinsically safe’ concept [eg trace heating, motors].

4.4 Where risk of electrical ignition is a key determinant of risk for the installation [eg congested modules near TR] then the duty holder should examine the extent to which protection against incendivity of electrical equipment using Exia ‘intrinsically safe’ techniques is a reasonably practicable option.


5.3.F20 Hazardous Area Zoning

5.3.F21 Electrical Equipment for Use in Potentially Flammable Atmospheres


None


OSD3.5


OSD3.5

192

5.3.F14: Separate Accommodation Jacket

1. One of the most obvious and inherently safer means of protecting personnel on offshore installations from fire and explosion hazards is to provide a separate accommodation jacket removed from but connected to [normally by bridge link] the main hazardous activity centres of drilling and hydrocarbon production. This concept of two separate bridge linked jackets has been incorporated into a number of recent new designs [eg Shearwater, Buzzard] as well as modifications to existing platforms [eg Claymore].

Whilst the selection between different design options ultimately lies with the duty holder, confirmation should be obtained that provision of a separate accommodation jacket was considered as a design option for all new facilities. Provision of a separate accommodation jacket should also have been examined as a potential risk reduction remedial measure for existing installations.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the design options considered can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referenced standards.


Management of Health and Safety at Work Regulations 1999, ACOP para 27



None


None


5.1.F10 Concept Selection



OSD3.1


OSD3.1

193


5.3.F17: Normally Unmanned Installations (NUI)

1. Confirmation should be obtained that requirements for fire and explosion hazards have been analysed in accordance with recognised standards or codes of practice that would be used for a manned Installation. Recognised standards/codes of practice would include:

ISO/FDIS 13702 Petroleum and Natural Gas Industries – Control and Mitigation of Fires & Explosions on Offshore Production Installations: Requirements and Guidelines

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the evaluation of these hazards can an only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.







Specific attention should be paid to the Installation status to ensure that plant and equipment is in a safe state prior to a planned visit such that persons are not entering a hazardous environment.


5.3.F8 Fire Types


5.3.F11 Explosion Modelling

5.3.F28 Ventilation and HVAC




OSD3.2


OSD3.2

194



5.3.F19: Layout – No Jet Fire Targets

1. Confirmation should be obtained that the installation’s layout for jet fire mitigation has been analysed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include:

ISO/FDIS 13702 Petroleum and Natural Gas Industries – Control and Mitigation of Fires & Explosions on Offshore Production Installations: Requirements and Guidelines

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the layout for jet fire mitigation can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.







4.1 Wherever possible redundant plant should be removed to minimise potential targets for incident jet fires.

4.2 Process plant including pipework, vessels cable tray etc should, as far as possible, be oriented to minimise targets for potential jet fires or protection provided to absorb jet fire momentum and thermal flux.









OSD3.2


OSD3.2

195



5.3.F20: Hazardous Area Zoning

1. Confirmation should be obtained that hazardous area zoning of plant is based on the likelihood that a flammable atmosphere may arise in the area. Recognised standards/codes of practice would include:

BSEN60079-10 [IEC60079-10] Electrical Apparatus for Explosive Gas Atmospheres. Classification of Hazardous Areas

Institute of Petroleum Model Codes of Safe Practice in the Petroleum Industry. Part 15: Area Classification Code for Installations Handling Flammable Fluids

IEC 61892-7 Mobile and Fixed Offshore Units – Electrical Installations – Hazardous Areas

API-RP500B Recommended Practice for Classification of Locations for Electrical Installations at Petroleum Facilities Classified as Class 1, Division 1 and Division 2

2. Where a standard other than those listed above has been employed, judgement as to the adequacy can only be made on an individual basis and the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to those required by the referenced standards.


Equipment and Protective Systems for Use in Potentially Explosive Atmospheres Regulations [not applicable to MODUs, FPSOs and FSUs]

Electricity at Work Regulations 1989, Regulation 6


Provision and Use of Work Equipment Regulations 1998, Regulation 10 [Atex aspects not applicable to MODUs, FPSOs and FSUs]


4.1 Zones may change depending on activity [eg drilling or the presence of another installation during a combined operation].

4.2 Zoning may depend on forced ventilation. If ventilation fails then equipment not suitable for use in the reduced ventilation zone should be de-energised.


5.3.F13 Intrinsically Safe Electrical Equipment

5.3.F21 Electrical Equipment for Use in Potentially Flammable Atmospheres


None


OSD3.2

8. Team responsible for authoring and updating this sheet: OSD3.2

196

5.3.F21: Electrical Equipment for Use in Potentially Flammable Atmospheres

Introduction

Electrical equipment can cause ignition of flammable atmospheres either by sparking or by temperature effects. Suitable equipment [whether or not it predates the requirements of the Atex 95 Directive] is usually marked with an Ex symbol and this has led to the colloquial designation ‘Ex equipment’. Sources of electromagnetic radiation [eg aerials] can also cause ignition of flammable atmospheres whether or not the radiation source is located in a hazardous atmosphere

1. Confirmation should be obtained that electrical equipment in potentially flammable atmospheres has been designed selected and maintained with a recognised industry standard or code of practice. Recognised design standards for electrical equipment for use in potentially flammable atmospheres include:

The harmonised standards under the Atex 95 Directive. The European Atex 95 Directive requires new equipment in hazardous areas from July 2003 on fixed installations to be suitably ‘CE’ marked. Details of harmonised standards under Atex 95 are issued in the European Union Journal. A summary of the relevant harmonised standards is given at http://europa.eu.int/comm/enterprise/newapproach/standardization/harmstds/reflist/atex.html

IEC60079 Electrical Apparatus for Explosive Gas Atmospheres. Parts of this are almost identical to the corresponding CENELEC standards identified above.

BS5345 Code of Practice for the Selection, Installation and Maintenance of Electrical Apparatus for Use in Potentially Explosive Atmospheres [no longer current]

Recognised standards for selection of electrical equipment for use in potentially flammable atmospheres include:

BSEN60079-14 (IEC60079-14) Electrical Apparatus for Explosive Gas Atmospheres

Recognised standards for inspection and maintenance of electrical equipment for use in potentially flammable atmospheres include:

BSEN60079-17 (IEC60079-17) Electrical Apparatus for Explosive Gas Atmospheres

BS5345 Code of Practice for the Selection, Installation and Maintenance of Electrical Apparatus for Use in Potentially Explosive Atmospheres (no longer current).

The recognised standard for ignition of flammable atmospheres by radio frequency radiation sources include:

BS6656 Guide to Inadvertent Ignition of Flammable Atmospheres by Radio Frequency Radiation

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the management of electrical equipment for hazardous areas can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referenced standards.


197

http://europa.eu.int/comm/enterprise/newapproach/standardization/harmstds/reflist/atex.html

http://europa.eu.int/comm/enterprise/newapproach/standardization/harmstds/reflist/atex.html

Equipment and Protective Systems for Use in Potentially Explosive Atmospheres Regulations 1996 [not applicable to MODUs, FPSOs and FSUs]

Electricity at Work Regulations 1989, Regulation 6


Provision and Use of Work Equipment Regulations 1998, Regulation 10 [Not applicable to MODUs, FPSOs and FSUs]


4.1 A typical installation may contain several thousand items of electrical apparatus for use in potentially flammable atmospheres. In the vast majority of cases it is unlikely that safety case assessment would require evidence of electrical protection for specific items of apparatus. It is normally evidence of the general approach that is being sought and assessed.

4.2 Where deluge is automatically triggered by detection of gas the suitability of electrical equipment in the relevant area should be subject to detailed assessment.

4.3 Where equipment acts as a source of high power electromagnetic radiation [eg Radar] then the duty holder should have assessed the risk that ignition of flammable atmospheres could be caused by induced currents in local metallic structures. In general unless the sources of radio frequency radiation are very powerful it is unlikely they will be a significant contributor to the risk of ignition.


5.3.F13 Intrinsically Safe Electrical Equipment

5.3.F20 Hazardous Area Zoning


None


OSD3.5


OSD3.5

198


1. Confirmation should be obtained that fire, smoke and gas detection and alarm systems have been designed and assessed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include:

ISO/FDIS 13702: 1998E Petroleum and Natural Gas Industries – Control and Mitigation of Fires & Explosion on Offshore Production Platforms – Requirements and Guidelines

BS EN 60079-10: 1996 Electrical Apparatus for Explosive Gas Atmospheres, Part 10, Classification of Hazardous Areas

IP [2002] Model Code of Safe Practice for the Petroleum Industry: Part 15 Model Code of Safe Practice Part 15: Area Classification Code for Installations Handling Flammable Fluids, Institute of Petroleum 2nd Edition August 2002

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis. In these cases the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of performance.




Fire and Explosion Strategy, HSE website 2004



None


5.3.F26 Resistant Temporary Refuges


Sheet 10.F3 Temporary Refuge and Muster Stations


OSD3.2


OSD3.2

199



5.3.F24 Firewalls

1. Confirmation should be obtained that firewalls have been designed, constructed and maintained in accordance with a recognised standard or code of practice. This would typically be provided by adequate certification that the firewall had satisfied a suitable fire test. Recognised standards/codes of practice would include:

BS 476 [Parts 20, 21 and 22] fire tests on building materials and structures

BS 6336 1982 Guide to the development and presentation of fire tests and their use in hazard assessment

BS 5950 Part 8: 1990 Structural use of steelwork in building: Code of practice for fire resistant design

ISO 834 1999 Fire resistance test elements of building construction

ISO 13702 1999 Control & mitigation of fires & explosions on offshore production installations

IMO [2001] Code for the construction and equipment of mobile offshore drilling units – consolidated

ASTM E-119 Fire Tests of Building Materials

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.







None


None


None


OSD3.2


OSD3.2

200



5.3.F25 Passive Fire Protection [PFP]

1. Confirmation should be obtained that passive fire protection [PFP] has been designed and constructed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include:

BS 476 [parts 20, 21 and 22] Fire tests on building materials and structures

ISO 2003 Determination of resistance to jet fires of passive fire protection materials

BS EN13381 2002 Test methods for the determining the contribution to the fire resistance of structural members

ISO 834 1999 Fire resistance test - elements of building construction

ISO 13702 1999 Control and mitigation of fires and explosions on offshore production installations





Fire and Explosion strategy, HSE website 2004

Fire, Explosion and risk assessment Topic Guidance, HSE website 2003


None


None


None


OSD3.2


OSD3.2

201



5.3.F26 Resistant Temporary Refuges

1. Confirmation should be obtained that the temporary refuge [TR] performance has been designed and assessed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include:

ISO/FDIS 13702: 1998E Petroleum and Natural Gas industries - Control and Mitigation of Fires and Explosions on Offshore Production Platforms UKOOA/HSE Fire and Explosion Guidance Part 1 Avoidance and Mitigation of Explosions Issue 1 October 2003






Fire, Explosion and Risk assessment Topic Guidance, HSE website 2003


4.1 Criteria used for the impairment of safety functions due to fire and explosion events which have an endurance time of less than an hour, and/or the risk of breach of the integrity of the TR is greater than one in one thousand per year.

4.2 Exceptional circumstances where a TR is not provided.

4.3 The reliance on manual fire damper shutdown.

4.4 The need to monitor the environmental conditions inside the TR.


None


None


OSD3.2


OSD3.2

202



5.3.F27 Deluge & Sprinklers

1. Confirmation should be obtained that water deluge and spray systems have been assessed in accordance with a recognised standard or code of practice.

Recognised standards/codes of practice would include:

BS EN 13702:1999 Petroleum and Natural gas industries – Control and Mitigation of Fires and Explosions on Offshore Production – Requirements and Guidelines

BS 5839:1988 Fire detection and alarm systems for buildings






Fire, Explosion and Risk assessment Topic Guidance, HSE website 2003


General deluge flow rates should be a minimum of 10 litres/min/m2 for pool fire protection, 20 litres/min/m2 for high pressure leak fires [high thermal output], and 400 litres/min/m2 to protect structural steelwork from impinging jet fires.


None


None


OSD3.2


OSD3.2

203




1. Confirmation should be obtained that ventilation systems have been designed and assessed in accordance with a recognised standard or code of practice. Ventilation should be derived from the identification and assessment of major accident hazards. Recognised standards/codes of practice would include:

ISO/FDIS 13702: 1998E (1998) Petroleum and Natural Gas industries - Control and Mitigation of Fires & Explosions on Offshore Production Platforms - Requirements and Guidelines

ISO 15138:2000(E) (2000) Petroleum and Natural Gas Industries - Offshore Production Installations - Heating, Ventilation and Air-conditioning

IP (2002) Model Code of Safe Practice for the Petroleum Industry: Part 15 Institute of Petroleum Model Code of Safe Practice Part 15: Area Classification Code for Installations Handling Flammable Fluids, 2nd Ed, August 2002

BSI 5925:1991 Ventilation Principles and Designing for Natural Ventilation

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of performance.




Fire and Explosion Strategy, HSE website

Fire, Explosion and Risk Assessment Topic guidance, HSE website 2003

HSE Offshore Information Sheet 2/2006 Offshore Installations (Safety Case) Regulations 2005 Regulation 12 Demonstrating compliance with the relevant statutory provisions


None





Sheet 5.1.F11 Size of Release, Speed of Detection and Effectiveness

Section 9 Non Process Fires & Explosions

Section 13 QRA


204




OSD3.2


OSD3.2

205

5.3.F29 Blast Walls

1. Confirmation should be obtained that blast walls for overpressure mitigation have been analysed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include:

ISO/FDIS 13702 Petroleum and Natural Gas industries - Control and Mitigation of Fires & Explosions on Offshore Production Platforms - Requirements and Guidelines

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy the blast wall for overpressure mitigation can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.




Fire and Explosion strategy, HSE website 2004



4.1. Blast walls should be built to the highest resistance possible within the constraints of CBA and capability of the supporting structure.

4.2. Process plant including pipework, vessels, cable tray, etc, should as far as possible be oriented in line with explosion vent paths to reduce turbulence and blockage and hence overpressure incident on the blast walls.







OSD3.2


OSD3.2

206



5.3.F30 Suppression and Flame Arrestors

1. Confirmation should be obtained that the requirement for flame suppression devices or flame arrestors has been analysed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include:

EN 12874 Flame arrestors – Performance requirements, test methods and limits for use

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy the flame arrestor duty and related performance can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.





Fire, Explosion and Risk Assessment Topic Guidance, HSE website2003


4.1 Wherever possible flame arrestor devices should be specified as suitable for unstable detonations and not the less onerous stable detonations.

4.2 The Maximum Experimental Safe Gap (MESG) is a property of a specific gas mixture. Installed devices must be designed and built to the most onerous flammable gas mixture an installation will process.


5.3.F8 Fire Types







OSD3.2


OSD3.2

207



6. WELLS 1. Scope

This Section provides guidance for the assessment of safety case content with respect to wells and well systems, from hazard identification through to consequence determination, including risk management measures.


The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of source hazard and initiator, together with identification and evaluation of escalation paths that might result.

The main hazard sources have been identified as follows:

Shallow Formations Intermediate Formations Reservoir Introduced Fluids Explosives Radioactive Sources Pressure Vessels Dropped Objects

For the latent major accident hazards to be activated towards a major accident, 33 initiators have been identified. These are detailed in the categorisation table below.

Guidance and standards exist for the basic design of the well and equipment [although the relevance for a particular well will need to be considered]. A list of relevant guidance is given in Section 4 below.

Generally, however, guidance and standards are not available for the assessment of conditions and operational activities. These should be evaluated using the assessors own technical expertise and peer reviewed with other wells inspectors using either the formal peer review system or discussed at the monthly well practices forum.

It is envisaged that internal guidance will be developed in the near future at which stage the guidance will be added to this manual.

The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the categorisation table below.

208


Wells

Source of Hazard


HS1 Shallow Formations

G1

Overpressure Frequency Inherent Safety

HS2 Intermediate Functions

G2 Underpressure F1 Well Specific Hazard Studies F16 Fully Rated Equipment Material Specification

HS3 Reservoir G3 High Temperature - basis of design F17 Inherent Impact Resistance Containment Capability

HS4 Introduced Fluids

G4 Low Temperature - HAZID 18 Wellhead Platform Competency Schemes

HS5 Explosives G5 Erosion - HAZOP F19 Normally Unmanned Installation Inspection & Monitoring

HS6 Radioactive Sources

G6 Corrosion - FMEA F20 Subsea Development Arrangements

HS7 Pressure Vessel

G7 Seismic Event F2 Equipment Selection F21 Equipment Selection – Ex, IS Impact Protection

HS8 Dropped Objects

G8 Fatigue/Vibration F3 Equipment Layout F22 Material Selection Fire Resistant Equipment

G9 Fire F4 Corporate Standards Prevention Inventory Size

G10 Explosion F5 Competence F23 Competent Procedures

G11 Inadequate Design F6 Operations Procedure - operational

G12 Inadequate Specification

F7 Maintenance Procedure - maintenance

G13 Inadequate Material Specification

F8 Company/Installation Data F24 Competent Personnel

G14 Incorrect Installation F9 Generic Historic Data F25 Pre-operational Tests

209

Wells

Source of Hazard


G15 Inadequate Training F10 Concept Selection F26 Isolation and PTW Controls

G16 Inadequate Maintenance

F27 Integrity Monitoring

G17 Inadequate Supervision

Consequences - mechanical

G18 Incorrect Maintenance Procedures

F11 Size of Release: - electrical

G19 Incorrect Operational Procedures

- speed of detection F28 Monitoring and Audit Systems

G20 Incorrect Equipment - effectiveness of response F29 Alarms

G21 Mechanical Degradation

F12 Dispersion of Release

G22 Structural Failure F13 Toxicity of Release Detection

G23 Thermal Radiation F14 Ignition Source: Mechanical and/or Electrical

F30 Competent Personnel

G24 Fishing Gear Snagging

F15 Escalation F31 Alarms

G25 Anchor Subsidence

G26 Subsidence

G27 Violation

G28 Weather – Extreme

G29 Helicopter Collision

G30 Ship Collision

210

Wells

Source of Hazard


G31 Operator Error

G32 Seal Failure

G33 Chemicals

211

4. Standards and Guidance for Equipment Design

APE SPEC 16D Specification for Control Systems for Drilling Well Control Equipment and Control Systems for Diverter Equipment

API 14E Recommended Practice for Design and Installation Products Platform

API 17B Recommended Practice for Flexible Pipe

API 6A Specification for Wellhead and Xmas Tree Equipment

API BULL 16J Comparison of Marine Drilling Riser Analysis

API BULL 6AR Recommended Practice for Repair and Remanufacture of Wellhead and Xmas Tree Equipment, First Edition

API BULL 6FA Specification Fire Test for Valves

API BULL 6FC F1 Fire Test for Valve with Automatic Backseats

API BULL 6FC F2 Fire Test for Valve with Automatic Backseats

API RP 16Q Design, Selection, Operation and Maintenance of Marine Drilling Riser Systems

API RP 2R Design, Rating, and Testing of Marine Drilling Riser

API RP 53 Characterisation of Exploration and Production Associated Wastes

API SPEC 10 Specification for Materials and Testing for Well Cements

API SPEC 13A Drilling Fluid Materials

API SPEC 13C Recommended Practice for Drilling Fluid Processing Systems Evaluation

API SPEC 14A Subsurface Safety Valve Equipment

API SPEC 16A Specification for Drill Through Equipment

API SPEC 5CT Specification for Casing and Tubing

APR RP 5B1 Recommended Practice for Gauging and Inspection of Casing, Tubing and Pipeline Threads

APR RP 5C1 Recommended practice for care and use on casing and tubing

ASME 8 Boiler and Pressure Vessel Code

BS 1515 Flanges & their joints bolting

BS 5500 Specification of unrefined fusion weld pressure vessels

ISO 10405 Petroleum and natural gas industries - Care and use of casing and tubing

ISO 10407 Petroleum and natural gas industries; drilling and production equipment; drill stem design and operating limits

ISO 10414 Petroleum and natural gas industries - Field testing of drilling fluids - Part 1: Water based fluids

212

ISO 10416 Petroleum and natural gas industries - Drilling fluids - Laboratory testing

ISO 10418 Petroleum and natural gas industries - Offshore production installations - Basic surface process safety systems

ISO 10423 Petroleum and natural gas industries - Drilling and production equipment - Wellhead and Xmas tree equipment

ISO 10424 Draft Document - Petroleum and natural gas industries - Rotary drilling equipment - Part 1: Specification for rotary drilling equipment

ISO 10426 Petroleum and natural gas industries - Cements and materials for well cementing - Part 1: Specification

ISO 10427 Petroleum and natural gas industries - Casing centralisers - Part 1: Bow-spring casing centralisers

ISO 10432 Petroleum and natural gas industries - Downhole equipment - Subsurface safety valve equipment

ISO 11960 Welded carbon steel gas cylinders; periodic inspection and testing

ISO 11961 Seamless aluminium alloy gas cylinders; periodic inspection and testing

ISO 13500 Petroleum and natural gas industries - Drilling fluid materials - Specifications and tests

ISO 13533 Petroleum and natural gas industries - Drilling and production equipment – Drill through equipment

ISO 13534 Petroleum and natural gas industries - Drilling and production equipment - Inspection, maintenance, repair and remanufacture of hoisting equipment

ISO 13628-4 Petroleum and natural gas industries - Design and operation of subsea production systems - Part 4: Subsea wellhead and tree equipment

ISO 13678 Petroleum and natural gas industries - Evaluation and testing of thread compounds for use with casing, tubing and line pipe

ISO 13680 Corrosion resistant alloy seamless tubes for use as casing, tubing and coupling stock - Technical delivery conditions

ISO 13702 Control and mitigation of fires and explosions on offshore production installations - Requirements and guidelines

ISO 14224 Collection and exchange of reliability and maintenance data for equipment

ISO 14310 Downhole equipment - Packers and bridge plugs

ISO 15156 Materials for use in H2S containing environments in oil and gas production - Part 1: General principles for selection of cracking resistant materials

ISO 15544 Offshore production installations - Requirements and guidelines for emergency response

213

ISO 16070 Downhole equipment - Lock mandrels and landing nipples.

214

7. DIVING 1. Scope

This Section provides guidance for the assessment of safety case content with respect to diving operations, from hazard identification through to consequence determination, including risk management measures. It covers the major accident hazards of:

• the failure of life support systems for diving operations in connection with the installation;

• the detachment of a diving bell used for such operations;

• the trapping of a diver in a diving bell or other subsea chamber used for such operations; and

• any other event arising from a diving operation involving death or serious personal injury to five or more persons on the installation or engaged in any activity in connection with it.

Guidance in relation to the assessment of a collision of a diving support vessel [DSV] is provided in Section 2: Vessel Impact.


The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator [casual chains], together with identification and evaluation of escalation paths that might result [consequence chains].

The diving major accident hazard prompts have been classified as follows:

• Diving major accident hazards that are specified in the Safety Case Regulations [ie failure of life support systems, detachment of diving bell and trapping of a diver in a bell or other chamber]

• Any other event involving death or serious personal injury to five or more persons on the installation or engaged in an activity in connection with it.


• Human error

• Design failure

• Maintenance failure

• Procedural failure

• Positioning failure

• Collision of bell or chamber with subsea structure

• ing diving operation


Fire or explosion affect

215


Where safety case contents match with good practice identified in the assessment sheets for a particular element associated with a major accident, there will usually be no need for an assessor to probe into the details of the how the good practice is applied. This may, however, be a suitable issue to follow-up through inspection

A list of references is provided in each assessment sheet. It should be noted that a more extensive commentary should be referenced. The documents listed provide further guidance, particularly in relation to good practice and performance standards. In some cases the reference material will not be fully applicable and may be limited in some parts. These aspects are referred to on the assessment sheets.

216


Diving

Source of Hazard


HS1 Divers’ Life Support Equipment

Heating system

Umbilicals

Personal equipment

G1

G2

G3

Human Factors [Section 11]

Commission

Omission

Fatigue

F1 Likelihood Factors

Historic data concept selection

Layout design

Installation/DSV information

Vessel performance procedures

Competence [Section 11]

F4 Inherent safety

National & industry standards

SMS: client and contractor

Competence [Section 11] client and contractor

DSV

Selection

Capability

Crewing

Audit

HS2 Diving bell/basket systems

Dive control

Bell/basket launch and recovery

Diving bell/basket main bell umbilical

Subsea habitats.

G4

G5

G6

G7

G8

G9

Design failure

Power Failure

Mechanical Failure

Pressure System Failure

Maintenance Failure

Power failure

Mechanical Failure

Pressure System Failure

Project scheduling timeframe

Weather

F5

F6

Prevention alternatives to diving operations

SIMOPS assessment

Planned maintenance familiarisation

[diving personnel with installation & vice versa]

Hazard identification

[HAZOPS – client with contractor]

Detection system monitoring

Dive system and vessel auditing

Diving plant and equipment

Selection

Audit

EER

Evacuation

Escape

Rescue

Recovery

217

Diving

Source of Hazard


HS3 Deck chamber complex

Surface compression chamber

Life support control

Hyperbaric evacuation system

G10

G11

G12

Procedural Failure [Section 11] Incorrect/inappropriate

Simultaneous operations [SIMOPS]

Extreme Weather [Section 3]

F2 Consequences

Uncontrolled decompression

Inability to maintain life support

Cold suffocation

Damage to pipeline/subsea structures [Section 5.2 & Section 3] Impact damage to installation

[Section 2]

F7 Control diving policy

PTW [Section 11]

Operating procedures competency [Section 11]

Manning issues

Client review/acceptance of procedures

Procedures

Operating

Emergency

Audit

HS4

Common systems

Compressors & pumps

High pressure gas storage

Breathing gas and environmental control systems

Power generation & management.

G13

G14

G15

Positioning Failure [Section 4.2]

Dynamic positioning/ mooring failure

Collision of bell/basket with subsea structures

Anchor wire

Other structures

F3

Factors which may affect the consequence

Number of Divers exposed

Proximity of hydrocarbons [Section 5.1]

EER arrangements [Section 10]

F8

F9

Mitigation emergency procedures [Section 10]

Location of dive system [siting of the facility]

Firefighting deluge [Sections 5.3 & 9]

EER Co-ordination [Section 6]

Human factors

Selection

Training

Competence

Supervision

218

Diving

Source of Hazard


HS5 Diving Platform

DSVs

Offshore installation

G16

G17

G18

Fire & Explosion

[Sections 5.3 & 9] Any fire or explosion in vicinity of dive system affecting essential services

Sinking of DSV

Subsea Releases

219

7.HS1: Divers Life Support Equipment

1. Confirmation should be obtained that the duty holder’s management system will ensure that the divers’ life support equipment [ie heating system, umbilicals and personal equipment] will be designed, constructed and maintained and will be operated in accordance with relevant recognised standards and guidance. These include:

Diving Equipment Systems Inspection Guidance Note [DESIGN] IMCA 1995

IMCA D 010 [Rev 2] Diving Operations from Vessels Operating in DP Mode

IMCA D0 018 (2) Code of Practice on The Initial and Periodic Examination, Testing and Certification of Diving Plant and Equipment

IMCA D023 Diving Equipments Systems Inspection Guidance Note for Surface Oriented Diving Systems (Air)

IMCA D 28/98 Minimum Supervisory Requirements for Offshore Diving Operations Carried Out on the UK Continental Shelf

Guidelines for Offshore Installation Safety Cases: Diving Operations from Vessels. A Joint Industry Guide UKOOA 1993

Would also include the offshore ACOP and relevant HSE Diving Information Sheets.

2. Where a standard/code of practice other than those listed above has been employed, judgements as to the adequacy of the life support equipment can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations



For permanent onboard diving equipment the security of these systems should be discussed. For temporary equipment the management arrangements for any integration into the platform systems should be described. The effect on diving systems of platform incidents and/or extreme weather should be discussed either for the installed equipment or for the outline of possible temporary equipment.


7.HS2 Diving/Basket Systems

7.HS3 Deck Chamber Complex

7.HS4 Common Systems



Section 5.3 Loss of Containment - Fire and Explosion [Fire and Explosion in vicinity of the dive system]

220

http://www.hse.gov.uk/pubns/diveindx.htm


Section 9 Non Process Fires & Explosions [Fire and Explosion in vicinity of the dive system]



OSD4.6 or 4.7 [dependant on location]


OSD4.4

221

7.HS2: Diving Bell/Basket Systems

1. Confirmation should be obtained that the duty holder’s management system will ensure that the diving bell/basket systems are designed, construction and maintained and will be operated in accordance with relevant recognised standards and guidance. These include:


OTH 91 338 Maintenance, Inspection and Discard of Diving Bell Hoist Ropes HSE Books 1993 ISBN 0 11 886387 8 BS ISO 4309:2004 Cranes. Wire Ropes. Care, Maintenance, Installation, Examination and Discard

BS EN 12385 – 3:2004 Steel Wire Ropes. Safety Information for Use and Maintenance.

OTO 97 063 Degradation of Galvanised Multi Strand Wire Ropes HSE 1997 Guidelines for Offshore Installation Safety Cases: Diving Operations from Vessels. A Joint Industry Guide UKOOA 1993

IMCA D 010 [Rev 2] Diving Operations from Vessels in DP Mode

IMCA D0 018 Code of Practice on The Initial and Periodic Examination, Testing and Certification of Diving Plant and Equipment

IMCA D023 Diving Equipments Systems Inspection Guidance Note for Surface Oriented Diving Systems [Air]

IMCA DO 24 Diving Equipment Systems Inspection Guidance Note for Saturation Diving Systems [Bell]



2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the diving bell/basket systems can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.





Clearly the detailed specification of the system in use will be part of the diving contractors’ Diving Project Plan. In addition the actions to be carried out if a diving bell becomes detached from the system or if the divers are trapped in the bell or habitat will be contained in the Diving Project Plan which is the prime responsibility of the diving contractor under DWR. The safety case duty holder will probably be required to provide assistance particularly in co-ordinating any wider emergency response. If diving operations are envisaged, arrangements for providing this assistance should be documented in the safety case. Depending on the operational circumstances this might take various forms from a very detailed and specific support document to a simple statement of intent by the duty holder. The latter will usually be acceptable in a safety

222





case but will, of course, need to be expanded when a diving contract has been placed and before diving operations commenced. This would be evaluated during inspection activities. Formal procedures for providing assistance in the event of a detached diving bell or habitat are recommended.


7.HS1 Divers Life Support Equipment











OSD4.4

223

7.HS3: Deck Chamber Complex

1. Confirmation should be obtained that the duty holder’s management system will ensure that deck chamber complexes are designed, constructed and maintained and will be operated in accordance with relevant recognised standards and guidance. These include:


AODC Guidance Note Number 029: Oxygen Cleaning, published by IMCA

AODC Guidance Note Number 016 Rev 1: Marking and Colour Coding of Gas Cylinders, Quads and Tanks for Diving Applications, published by IMCA.

BS EN 1089-3 1997 Transportable Gas Cylinders - Cylinder Identification. Part 3: Colour Coding

AODC Guidance Note 016 Rev 1, published by IMCA




IMCA D 025 Evacuation of Divers from Installations


2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the deck chamber complex can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.





For permanent onboard diving equipment the security of these systems should be discussed and should be included in the verification scheme. There should be a company policy preventing the over swinging of pressurised systems and gas storage banks, and formal procedures for the evacuation of divers from an installation based dive system in the event of platform abandonment.

For temporary equipment the management arrangements for any integration into the platform systems should be described. There should be a system for revising the verification scheme to cover the diving systems presence on the installation.

The effect on diving systems of platform incidents and/or extreme weather should be discussed either for the installed equipment or for the outline of possible temporary equipment.

224













OSD4.4

225

7.HS4: Common Systems

1. Confirmation should be obtained that the duty holder’s management system will ensure that the common systems [ie compressors, pumps, high pressure gas storage, breathing gas and environmental control systems, power generation and management systems] will be designed, constructed and maintained and will be operated in accordance with relevant recognised standards and guidance. These include:



IMCA D0 018 (2) Code of Practice on The Initial and Periodic Examination, Testing and Certification of Diving Plant and Equipment





2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the common systems can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.





For permanent onboard equipment the security of these systems should be discussed. For temporary equipment the management arrangements for any integration into the platform systems should be described. The effect on diving systems of platform incidents and/or extreme weather should be discussed either for the installed equipment or for the outline of possible temporary equipment. There should be a company policy preventing the over swinging of pressurised systems and gas storage banks.


None




226







OSD4.4

227

7.HS5: Diving Platform

1. Confirmation should be obtained that the duty holder’s management system will ensure that the diving platform will be designed, constructed and maintained and will be operated in accordance with relevant recognised standards and guidance. These include:



DPVOA - 1611/14 DP Vessel Owners Association: DP Position Loss risks in Shallow Water

GM - 1611/01-0189-650 DP Vessel Owners Association: Guidelines for the Design and Operation of Dynamically Positioned Vessels

Guidelines for the Specification and Operation of Dynamically Positioned Diving Support Vessels - Norwegian Petroleum Directorate - Petroleum engineering division of the UK Department of Energy.

IMCA D 010 [Rev 2] Diving Operations from Vessels Operating in DP Mode

IMCA D 006 [Rev 2] Diving Operations in the Vicinity of Pipelines.






2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the diving platform can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.





Danger to the installation platform from a fire, explosion or the release of a dangerous substance from a diving system is considered to be low provided a sound system of maintenance and inspection is in place. Diving systems permanently onboard installations should be included in the verification scheme. Incidents from a vessel based system should also be considered though the consequences for the installation will probably be much reduced and can be discounted.

228



Collision of the DSV with the installation is a credible event which may have major consequences. The UKOOA Guidelines referred to above should be referred to in the safety case or companies manuals. There should be a management system in place to ensure that the diving system onboard DSVs used in connection with installations is maintained to a similar standard as onboard systems.


None











OSD4.4

229

7.F1-F3: Risk Evaluation

1. Confirmation should be obtained that that the safety case considers the risks associated with and from diving including the likelihood of an incident, the consequences and the factors affecting the consequence. There are no standards associated with the likelihood of an accident occurring, but the duty holder would be required to demonstrate that diving project plans and where appropriate the safety case takes into consideration the following guidance and standards:

DMAC 028 Provision of Emergency Medical Care for Divers in Saturation

DMAC 22 Proximity to a Recompression Chamber after Surfacing

DMAC 21 The Duration of Saturation Exposures and Surface Intervals Following Saturation

DPVOA - 1611/14 DP Vessel Owners Association: DP Position Loss Risks in Shallow Water



The duty holder should demonstrate that for any given diving project that all risks will be considered. These would include any historic data available, the selection of the type of diving [including the necessity for diving], the layout and design of the dive system, the DSV performance [if appropriate], the competence of those involved in the project and the project scheduling and timeframe [including weather considerations].



IMCA D025 Evacuation of Divers from Installations


2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the safety case can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.



There could be situations where divers are at risk because their work activity prevents them from taking the normal action available to a conventional member of the workforce because they are in the pressure chamber. For such situations, emergency procedures for the evacuation of the divers would be provided. These specialised arrangements will largely be the responsibility of the diving contractor, but when the diving is taking place from an installation there is a requirement on the duty holder to co-operate. The amount of detail will vary depending on the type of installation and the diving system. Where divers are on the installation they should be included in the PFEER assessment and in the summary included in the safety case.


230


Section 2 Vessel Impact (Impact damage to the installation)

Section 5.1 Loss of Containment - Process (Proximity of hydrocarbons)







OSD4.4

231


1. Confirmation should be obtained that that the safety case considers the risks associated with and from diving including the likelihood of an incident, the consequences and the factors affecting the consequence. There are no standards associated with the likelihood of an accident occurring, but the duty holder would be required to demonstrate that diving project plans and where appropriate the safety case takes into consideration the following guidance and standards:



DMAC 028 Provision of Emergency Medical Care for Divers in Saturation

DMAC 22 Proximity to a Recompression Chamber after Surfacing

DMAC 21 The Duration of Saturation Exposures and Surface Intervals Following Saturation

DPVOA - 1611/14 DP Vessel Owners Association: DP Position Loss Risks in Shallow Water

IMCA D025 Evacuation of Divers from Installations


2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the safety case can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.



The duty holder should demonstrate that for any given diving project that all risks will be considered. These would include any historic data available, the selection of the type of diving [including the necessity for diving], the layout and design of the dive system, the DSV performance [if appropriate], the competence of those involved in the project and the project scheduling and timeframe [including weather considerations].

There could be situations where divers are at risk because their work activity prevents them from taking the normal action available to a conventional member of the workforce because they are in the pressure chamber. For such situations, emergency procedures for the evacuation of the divers would be provided. These specialised arrangements will largely be the responsibility of the diving contractor, but when the diving is taking place from an installation there is a requirement on the duty holder to co-operate. The amount of detail will vary depending on the type of installation and the diving system. Where divers are on the installation they should be included in the PFEER assessment and in the summary included in the safety case.




232



Section 2 Vessel Impact (Impact damage to the installation)

Section 5.1 Loss of Containment - Process (Proximity of hydrocarbons)







OSD4.4

233

7.F4-F9: Risk Management Measures

1. Confirmation should be obtained that the duty holder’s safety management system takes into account relevant recognised standards and guidance. These include:

All IMCA Guidance and other industry guidance identified in other sheets of this section, HSE diving information sheets, the Offshore ACOP and other HSE guidance such as HSG 65.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the risk management measures can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.




The safety case, where appropriate, should have risk management measures in place to ensure that alternatives to diving are adequately considered. For diving operations, there should be adequate consideration of simultaneous operations, familiarisation of diving personnel with installation and vice versa, and hazard identification [client with contractor and vice versa]. There should be a system of dive system and vessel auditing, and client review/acceptance of procedures.



The duty holders’ responsibility as the client for the diving project should be assessed. The responsibility for the detailed management of the safety of the diving project will be the responsibility of the diving contractor.

The purpose of the assessment is to check that the management system is adequate to ensure that the relevant statutory provisions will be complied with in relation to the installation and any activity on or in connection with it. The standard of demonstration required in the case is at a high level which will mainly, be carried out by the team responsible for the SMS assessment. Tests should be carried out that envisaged diving projects will be adequately covered. This check of the SMS should include competence of the duty holder, and procedures to ensure competence of diving contractors.



7.HS2 Diving Bell/Basket Systems


7.HS4 Common systems

7.HS5 Diving Platform


234









OSD4.4

235

8. HELICOPTER CRASH 1. Scope

This Section provides guidance for the assessment of safety case content with respect to the collision of a helicopter with the installation, from hazard identification through to consequence determination, including risk management measures. It covers the major accident hazards of:

• Helicopters used for day-to-day transport and SAR duties; and


The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator [causal chains], together with identification and evaluation of escalation paths that might result [consequence chains].

The helicopter crash major accident hazard prompts have been classified as follows:


Where safety case contents match with good practice identified in the assessment sheets for a particular sheet associated with a major accident there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue for follow-up by inspection.

• Fixed wing military aircraft if considered foreseeable because of the installation’s possible proximity to bombing ranges or other military activities.

• Helicopter crash major accident hazards that are specified in the Safety Case Regulations [ie helicopters or other relevant aircraft].

• Any other event involving death or serious personal injury to 5 or more persons on the installation or engaged in an activity in connection with it.


• Helideck design/systems.

• Aircraft systems performance.

• Operational/procedural factors.

• Human error [helideck/aircrew].


236

4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation table below.

Risk Management Measures


F11

Eliminate/reduce helicopter use

Company/Installation Data

F3

G2

F14

F5 Correct operational procedures

F16

Loss of damage to EER Plan [Section 10]

Detection

Helicopter Crash

Source of Hazard

Initiators Risk Evaluation Performance Standards

HS1 Helicopters G1 Helideck design/systems

HS2 Other relevant aircraft [eg military aircraft]

Proximity of tall structures/ obstacles wind turbulence

F1 Historic Accident Data

F10

Optimised helideck design

Helideck Operations

Radio Operators Procedures

thermal plume effects F2 F12 SCE Verification Helideck design

Helicopter landing areas

Navigational/communications

failure.

Installation Specific Risk Studies

Prevention

Operational/Procedural Factors

F4 Military flight data F13 Company transportation policy/ procedures

Landing aids failure Consequences Fire Prevention Measures [Sections 5.1, 5.3, 5.9]

Extreme weather/environmental

Process/non process fire [Sections 5.1,5.3, 5.9]

F15

Installation movements [mobiles]

F6 Structural damage to helideck/elsewhere [Section 3]

Competent personnel client review/acceptance of procedures

Incorrect/inappropriate procedures

F7

237

Helicopter Crash

Source of Hazard



F8

Lack of awareness of flying restrictions

Implications to EER Plan [Section 10]

F17

F18

Monitoring of helicopter

Communications with Aircrew

Inadequate communications F9 Helicopter crash on helideck/installation/in sea

F19

F20

Unsafe Conditions

Helicopter Status Lights

Inaccurate helicopter payload manifests

G3 Human Error [Helideck Crew]

Commission/omission

Errors/fatigues

Inadequate training

Aircraft Systems Performance/Air Worthiness

Engine/systems failure

Navigational aids failure

Helicopter design

Pilot error

Bird strikes

238

8.HS1 Helicopters

8.HS2: Other Aircraft

1. The assessor to confirm that all helidecks have been designed and that all associated helideck and helicopter operations are managed in accordance with the relevant CAA/OPITO standards and industry guidelines. Recognised standards/codes of practice include:

CAA CAP 437 Offshore Helicopter Landing Areas – Guidance on Standards

OIAC HLG Design Guide

HSE Safety Notice 1/94 Mobile Installations & Vessels: Movement of Helidecks

HSE Safety Notice 2/2004 Offshore Helidecks - Testing of Helideck Foam Production Systems

HSE Operations Notice 6 Reporting of Offshore Installation Movements

HSE Operations Notice 14 Guidance on Coast Protection Act – consent to locate and the marking offshore installations

UKOOA Guidelines for the Management of Offshore Helideck Operations

CAPs 452/535 Radio Operators’ Guides

Cogent/OPITO Approved Helideck Training Standards

UKOOA Guidelines for Management of Safety Critical Elements

2. Where a standard/code of practice other than those listed above has been employed then the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations (L30)


Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 and Guidance on Regulations (L85)

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and Approved Code of Practice (L65)


Hazard identification should include helicopters and other aircraft such as military aircraft since SCR Regulation 2 defines the collision of a helicopter with an installation as a major accident and any other event likely to cause death or serious injury to 5 or more persons. Since the collision of a civil fixed wing aircraft with an installation is not considered reasonably foreseeable the duty holder should not be expected to include this in the hazard identification process. Although a helicopter ditching in the sea in the vicinity of an installation is outside the scope of SCR [SCR ACOP para 67] the duty holder would be expected to demonstrate compliance with PFEER Regulation 17 - Arrangements for Recovery and Rescue.

239






Duty holders will generally have no control over initiating events associated with the airworthiness, technical and operational requirements of helicopters or military aircraft, aircrew performance. Therefore they should not be expected to address initiating events which are within the remit of aviation regulations. However, duty holders [the operator/owner of a fixed/mobile installation] are required under Regulation 11 of DCR to ensure that the helideck design, construction and operating environment is such that helicopter operators can discharge their duty under aviation legislation. Duty holders are responsible for the safety of the helideck and helideck operations, specifically those associated with helicopter landings and take-offs. They are required to ensure that the helideck operating environment is such that helicopter operators can discharge their duty. They have direct control over the physical characteristics of the helideck, the levels and manning of the rescue and firefighting and provision of communications. They are required to ensure that competent personnel control all activities on the helideck during helicopter operations, suggest routes to be flown and have in place a weather policy for passenger safety on the helideck and for passenger survival and rescue. They should demonstrate that appropriate safety management systems and audit arrangements are in place, and include suitable reference to such management systems in their safety cases. For mobile installations and floating fixed installations, topic assessors [TAs] should be looking for evidence that initiating events associated with helideck movements and the likely causes have been considered. [Duty holders are also required to collect, store and transmit accurate weather and oceanographic data, and information relating to installation motions]. Potential deficiencies in helideck design and construction require assessment preferably at the design stage. For example, an initiating event can be contact with, or turbulent airflow caused by adjacent structures, or obstacles on the installation or on installations nearby, or thermal effects arising from plant exhausts such as gas turbines situated near the helideck. TAs should look for evidence in a design safety case as well as an operational safety case that the duty holder has taken into account published guidance.

Inadequate communications, training of appropriate personnel, and ‘wrong rig’ landings can also be classed as initiating events. Although there is little that the duty holder can do about aircrew competence, appropriate operational procedures on the installation and effective helideck crew training policies should be in place.

There should be evidence that a process of SCE identification and verification is in place as required by SCR/DCR for controlling the risks of helicopter/ aircraft collision.


8.F1-F9 Risk Evaluation

8.F10-F20 Risk Management Measures







Section 9 Non Process Fires & Explosion



240


OSD5.5


OSD5.5

241



CMPT: A Guide to QRA for Offshore Installations

UKOOA guidelines for QRA Uncertainty

UKOOA guidelines: Formal Safety Assessment

CAA Mandatory Occurrence Reports

CAA data

OGP data

2. Where a standard/code of practice other than those listed above has been employed, judgements as to the adequacy of the safety case can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.





Offshore Installations (Prevention of Fire and Explosion, and Emergency response) Regulations 1995 and Approved Code of Practice (L65)


The most comprehensive sources of helicopter accident data for assisting with risk analysis are likely to have been published by CAA as well as from research studies commissioned by HSE, CAA and industry. It is therefore unlikely that a proper risk analysis can be carried out without reference to at least the CAA data.

The duty holder’s risk analysis should take account of installation specifics, for example the type of helicopter used, and the company’s transportation policies which will affect the frequency of helicopter operations to and from the installation or vessel. [Although offshore regulations do not require transport risk to be included in safety cases duty holders do address this in their submissions. We should not discourage this approach]. The duty holder should take into account the risks associated with military aircraft over flying the installation and that MOD have been consulted to obtain data which will assist with a risk analysis.

Although not mandatory or prescribed some duty holders have found it helpful to calculate risks in terms of risks to individuals [IR] and as potential loss of life [PLL]. This allows comparisons to be made of the risks to personnel with HSE’s risk acceptability criteria both for helideck personnel and the rest of the workforce on the installation, and to personnel arising from helicopter crashes on the helideck, elsewhere on the installation, or where appropriate, on a NUI. For major modifications and resubmissions, the duty holder should take into account any changes to working practices which may affect the risk of helicopter collisions.

242


The likely consequences will depend on where the helicopter impacts the installation, the approach speed, the degree of structural damage to the helideck or elsewhere, the possibility of fire, and the effect on EER systems and arrangements. The safety case should therefore contain evidence that foreseeable points of impact on the installation, escalation potentials and all likely scenarios have been considered.


8.HS1/8.HS2 Helicopters/Other Aircraft

8.F10-8.F20 Risk Management Measures





Section 9 Non Process Fires and Explosions



OSD5.5


OSD5.5

243

8.F10-F20: Risk Management Measures

1. Confirmation should be obtained that full account has been taken of industry guidelines, cited in the previous assessment sheets, when assessing the measures needed to manage risk.

2. Where a standard/code of practice other than those referred to above has been employed, judgements as to the adequacy of the risk management measures can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.




Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and Approved Code of Practice (L65)



The duty holder is required to list safety critical elements [SCEs], have them subject to independent review and develop a scheme for verification of their performance throughout the lifecycle of the installation. An offshore helideck is a collection of systems, some of which are safety critical because of the helideck’s function as a means of evacuation, or because their purpose is to limit the effects of a helicopter crash. For these reasons the safety case should provide evidence of a SCE verification scheme with respect to helidecks. The greatest scope for eliminating or minimising a helicopter collision is to consider at the conceptual and detailed design stage those features of a helideck which could affect helicopter operations and compromise safety.

The duty holder should therefore demonstrate in the design safety case that the routine and key technical issues, known to arise in the design and construction of offshore helidecks and related operations, have been addressed. Total elimination of helicopter movements is probably unrealistic, however, it may still be possible to reduce the need for helicopters to visit an installation either by improved planning or management of logistics. A TA should therefore look for evidence in a safety case of how the number of helicopter visits to both NAIs and NUIs [where appropriate] could be reduced or kept to a minimum.

The safety case should provide evidence of documented helicopter operational procedures for managing the risks associated with the initiating events [where appropriate] which have been listed under 8.G3 and that consideration has been given to personnel competencies, and the necessary preventative and detection measures [see 8.F11 to 8.F20].

The appropriate systems and procedures for protecting personnel [including aircrew and helicopter passengers] from the consequences of a helicopter collision should be described in the safety case. CAP 437 and UKOOA guidelines describe what is considered to be best practice with respect to the helideck fire fighting facilities, personnel training and emergency procedures. The duty holder should therefore demonstrate that procedures are in place which are based on this guidance. A helicopter [or other aircraft if considered foreseeable] colliding with the installation may lead to a need for evacuation,

244


or render the helideck unavailable for evacuation. The duty holder should therefore confirm that the emergency procedures manual for that installation specifies the action to be taken following such events.


8.HS1/8.HS2 Helicopters/Other Aircraft

8.F1-8.F9 Risk Evaluation


Section 4.1 Loss of Marine Integrity - Loss of Stability

Section 4.2 Loss of Marine Integrity - Loss of Position



Section 9 Non Process Fires & Explosions




OSD5.5


OSD5.5

245

9. NON PROCESS FIRES & EXPLOSIONS 1. Scope

This Section provides guidance for the assessment of safety case content with respect to incidents originating from non-process plant, leading to fires and explosions. The assessment procedure includes hazard identification, consequence determination and risk management measures.


The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator, together with identification and evaluation of escalation paths that might result. Potential sources of hazard, initiators, etc, are shown in the document. Assessors should ensure that, where relevant, safety cases contain information demonstrating that consideration has been given to each of these factors.




4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the categorisation tablebelow

246

Non Process Fires & Explosions

Source of Hazard Initiators Risk Evaluation Risk Management Measures


HS1 Accommodation Fires

- Laundry Fire

- Galley Fire

Inherent Safety

Intrinsically Safe Electrical Equipment

Separate Accommodation Jacket

Non Flammable Materials

Fire Resistant Structures

Inventory Size

Fire Load Limits

Impact Loads

Impact Protection

Containment Strength

Material Specification

Low Risk Location

Certification Schemes

HS2

Cellulosic Fires

- Pallet Fire

HS3 Electrical Fires

Ignition *Solid No Inventory

Human Factors

Escalation from Process Events

Impact

Corrosion Induced Failure

Inadequate Design

Incorrect Usage

Incorrect Material Specification

Dropped Containers

Inadequate Maintenance

Overheating

Procedural Inadequacies

Vibration Induced Failure

Frequency

Ignition Probability

*Ignition Sources/’Ex’ Rating/ Electrical Zoning

Hot and Cold Work Policies

Delayed or Immediate Ignition

Energy of Ignition

Flash Fire or Explosion

Prevention

Electrical Zoning

‘Ex’ Rating

Hot and Cold Work Policies

Detection

247

Non Process Fires & Explosions

Source of Hazard Initiators Risk Evaluation Risk Management Measures


HS4 Non Cellulosic Fires & Explosions

- Gas Cylinder Fires

- Helifuel Fires

- Methanol Fires

- Gas Cylinder Explosions

Consequences

Cellulosic Load Solids only

Size of Release

Dispersion

*Open/Closed Modules – Ventilation Rates

Confinement/Layout

Potential for Escalation

*Separation/Layout

Fire Models Used & Assumptions Made

Fire Resistance of Potential Targets

Human Vulnerability

PFP Effectiveness

Type of Fire

Thermal Flux/Smoke Generation

Shielding

Vulnerability of Potential Targets to Fire/Heat

Smoke Dispersion

TR Vulnerability to Smoke Ingress

Passive Fire Protection

Fire Detectors/Alarms

Smoke Detectors/Alarms

Mitigation

Fire Walls

Passive Fire Protection

Resistant Temporary Refuges

Deluge

Sprinklers

248

9.HS1: Accommodation Fires

Introduction

Accommodation fires are defined as those fires that occur in the accommodation spaces, including the control room and TR. They will be predominantly cellulosic fires from combustible non-hydrocarbon sources, for example, soft furnishings, blankets, lint in laundries etc.

1. Confirmation should be obtained that fires in accommodation areas have been analysed in accordance with a recognised standard or code of practice. Onshore Building Regulations are suitable standards to follow in assessing offshore accommodation modules for fire resistance. Recognised standards/ Codes of Practice include:

BS 5839 1988 Fire detection and alarm systems for buildings

ISO 13702:1999 Petroleum and Natural Gas Industries – Control and Mitigation of Fires and Explosions on Offshore Production Installations – Requirements and Guidelines

SI 1991/2768 The Building Regulations

UKOOA Guidelines for Fire & Explosion Hazard Management 1995

IEC 6033-1 & 2 Safety of Household and Similar Electrical Appliances

Recommendations for the Use of Electrical and Electronic Equipment for Mobile and Fixed Offshore Platforms IEE 1992

Eurocode 1: Basis of design and actions on structures. Part 2.2 Actions on structures exposed to fire

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the offshore accommodation modules for fire resistance can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective.




Electricity at Work Regulations 1989

Provision and Use of Work Equipment Regulations 1998

Operational Circular OC 217/2 (Rev) Fire Legislation and Liaison between HSE Inspectors and Fire Authorities

Guidance on General Fire Precautions at Premises subject to Fire Certificates (Special Premises) Regulations 1976


Provision for water sprinklers systems; fire resistant walls and self-closing fire doors should be evaluated as well as procedural measures such as no smoking in bedrooms. Risk evaluation of accommodation fires should be based on a standard fire assessment methodology that is, ignition sources, fire detection, fire loads, compartmentalisation, fire barriers, use of non-toxic materials, protections systems etc.

249

http://www.hse.gov.uk/foi/internalops/fod/oc/200-299/217_2r.pdf

http://www.hse.gov.uk/fireandexplosion/workplace.htm

http://www.hse.gov.uk/fireandexplosion/workplace.htm


9.HS2 Cellulosic Fires

9.HS3 Electrical Fires

9.HS4 Non Process Fires


None


OSD3.2


OSD3.2

250

9.HS2: Cellulosic Fires

Introduction

Cellulosic fires are fires that result from the combustion of solid materials such as wood, cloth, paper etc. These fires are found predominantly in accommodation spaces, including the control room, laundry and TR.

1. Confirmation should be obtained that cellulosic fires have been assessed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include:

BS 5839 1988 Fire detection and alarm systems for buildings

ISO 13702:1999 Petroleum and Natural Gas Industries – Control and Mitigation of Fires and Explosions on Offshore Production Installations – Requirements and Guidelines.

SI 1991/2768 The Building Regulations






None


9.HS1 Accommodation Fires

9.HS3 Electrical Fires


None


OSD3.2


OSD3.2

251

9.HS3: Electrical Fires

Introduction

Electrical Fires are those associated with the electrical ignition and the combustion of the special materials [eg cables] that make up electrical equipment. Electrical fires potentially introduce the additional hazard of toxic fume [HF, HCN, phosgene] resulting from the combustion process. Fires in flammable atmospheres which have an electrical ignition source are covered in Section 5.3 Loss of Containment – Fire & Explosion and are not discussed here.

1. Confirmation should be obtained that electrical equipment has been designed in accordance with a recognised standard or code of practice. Where recognised standards have been used the likelihood of an electrical fire is judged to be sufficiently low as not to require further assessment.

The recognised standards for the design of electrical systems offshore include:

Recommendations for the Use of Electrical and Electronic Equipment for Mobile and Fixed Offshore Platforms IEE 1992

The recognised standards for electrical cables offshore include:

BS 6883 – Elastomer insulated cables for fixed wiring in ships and on mobile and fixed offshore units. Requirements and Test Methods.

IEC 60331 [IEC 331] Tests for Electric Cables Under Fire Conditions [Flame Resistance]

IEC 60332 [IEC 331] Tests on Electric Cables Under Fire Conditions [Flame Retardancy]

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the analysis of electrical fire hazard can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.




Electricity at Work Regulations 1989

Provision and Use of Work Equipment Regulations 1998


None


9.HS1 Accommodation Fires

9.HS4 Non Cellulosic Fires


Sheet 5.3.F9 Thermal Flux, Smoke Obscuration Effects

252


Sheet 5.3.F23 Fire/Smoke/Gas/Flame Detectors/Alarms

Sheet 5.3.F24 Fire Walls

Sheet 5.3.F25 Passive Fire Protection [PFP]

Sheet 5.3.F26 Resistant Temporary Refuges

Sheet 5.3.F27 Deluge and Sprinklers


OSD3.5 in close liaison with OSD3.2


OSD3.5

253

9.HS4: Non Cellulosic Fires

Introduction

Non-process fires and explosions typically involve helifuel, methanol, diesel, TEG, and compressed gas cylinders.

1. Confirmation should be obtained that non process fires have been analysed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include:

ISO/FDIS 13702 Petroleum and Natural Gas Industries– Control and Mitigation of fires and explosions on offshore production installations – Requirements and guidelines

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the assessment can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.







4.1 Where fire attack is possible protection by water deluge or shielding should have been provided [especially for Acetylene cylinders].

4.2 Where gas/vapour detection is impractical or inefficient [ie Methanol or TEG] appropriate fire detection should have been provided.

4.3 Fire hazard control for atmospheric fuel storage facilities should take into account location, containment [bunding/scuppers] drainage, automatic fuel shut-off, passive fire protection and ventilation/ ventilation shut-off.


None


None


OSD3.2


OSD3.2

254

10. Emergency Response 1. Scope

The Offshore Installations (Safety Case) Regulations [SCR] and associated Schedules contain specific requirements for emergency response to major accident hazards on the installation. It is also necessary for the safety case to demonstrate that the emergency response arrangements ensure compliance with the relevant statutory provisions.

The Offshore Installation (Prevention of Fire and Explosion, and Emergency Response) Regulations [PFEER] also interface with SCR, in particular the identification of major accidents requiring an emergency response, the organisation and management of emergency response and summarising the assessment of the emergency response arrangements.


To facilitate assessment of a safety case a set of elements relating to emergency response have been defined and are set out in the following assessment sheets. This guidance covers all types of safety cases, installations, combinations of installations and operating regimes and is therefore of necessity pitched at a fairly high level. It should not therefore be regarded as restricting assessors in any way if, in their judgement, issues not explicitly covered by this guidance need to be pursued to establish the acceptability of the case for safety.

Reference is made throughout this Section to industry codes, standards and guidance. This should not be interpreted as conferring any status to such material in terms of achieving legislative compliance. Therefore, complying with UKOOA documents does not guarantee a duty holder will comply with the Regulations or will provide all the information required by assessors in a safety case.

Where industry codes, standards or guidance are employed in arguments supporting the case for safety, their relevance to the particular circumstances of the installation in question should be established in the safety case together with an indication as to how compliance of the duty holder’s arrangements with this material is achieved.


Assessment of a duty holder’s emergency response arrangements is targeted primarily at determining whether or not the performance of the arrangements made to secure an effective emergency response is credible and effective. Verifying whether or not the emergency response arrangements are physically capable of delivering the claimed performance is a matter for post acceptance inspection.

While it is a matter of balance as to how much material is required in a safety case rather than verified through inspection, any discussion included in a safety case in support of a demonstration of regulatory compliance should contain sufficient detail to lend conviction to the arguments.

Further, the assessment of safety cases is basically a sampling process. Therefore, dependent upon a number of factors including assessment history, not all the elements identified in this Section may necessarily be assessed in every safety case assessment.

Lastly, it should be noted that this material is only relevant to safety case assessment and is not sufficient to determine full compliance with PFEER.

Assessment Sheets

The subdivision of emergency response into assessment sheets for the purposes of safety case assessment is shown in Table 1.

255

Table 1

Sheet No Sheet Title

10.F1 Emergency Response Management

10.F2 Alarms and Communication

10.F3 Temporary Refuge and Muster Stations

10.F4 Access/Egress Routes

10.F5 Evacuation

10.F6 Escape

10.F7 Rescue and Recovery

10.F8 Ship Collision

10.F9 Emergency Lighting

10.F10 Emergency Communications

256

10.F1: Emergency Response Management

Introduction

The adequacy of the management of emergency response and the contribution this makes to the demonstration that major accident hazard risks have been reduced to comply with PFEER provisions is considered. Aspects of emergency response included in this assessment sheet are the emergency response plan [ERP] and adverse weather policy, the assessment of the emergency response arrangements and the competence of those involved in executing the ERP.

1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the emergency response management. Recognised codes, standards or guidance include:

UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations

UKOOA Guidelines for The Management of Competence and Training in Emergency Response

COGENT [formerly OPITO] Offshore Emergency Response Standards.


2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the emergency response management can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.





The safety case should include information on the following topics:

• Identification of major accident hazards for which an emergency response is required.

• Maximum number of people for which the case for safety is being made and their likely distribution around the installation for all operational modes.

• Emergency response strategy associated with each type of identified major accident hazard and how the strategy has incorporated the effects of adverse and exceptional weather.

• Organisation and management of emergency response both on the installation and beyond in sufficient detail to show how an effective emergency response is achieved.

• Contribution to the reduction of major accident risks made by the emergency response arrangements.

257


• Competence and training of all those involved in executing the Emergency Response Plan.

• Remedial action plans in relation to measures that are intended to be implemented.

• Verification that the emergency response arrangements are, and remain, effective.


10.F2 Alarms and Communications

10.F3 Temporary Refuge & Muster Stations


10.F5 Evacuation

10.F6 Escape




None


OSD3.3


OSD3.3

258

10.F2: Alarms and Communication

Introduction

The Safety Case Regulations require information on the arrangements for protecting persons from hazards of explosion, fire, heat, smoke, toxic gas or fumes. Alarm and communication arrangements form part of such arrangements. It should be noted that the assessment of the electrical aspects of alarms and communications are outwith the scope of this assessment sheet.

1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the emergency response management. Recognised codes, standards or guidance include:


UKOOA Guidelines for The Management of Competence and Training in Emergency Response

COGENT [formerly OPITO] Offshore Emergency Response Standards.

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the emergency response management can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.







• Arrangements made for emergency alarm signs, signals and communications as prescribed by the PFEER Regulations. The safety case should contain sufficient information to show that regulation 11 of PFEER is met

• The role of voice communications systems in directing personnel to a particular course of action during the various phases of an emergency



10.F3 Temporary Refuge & Muster Stations


10.F5 Evacuation

10.F6 Escape


259




None


OSD3.3


OSD3.3

260

10.F3: Temporary Refuge and Muster Stations

Introduction

The arrangements for the Temporary Refuge [TR] should provide sufficient protection to enable the full POB to muster safely, permit the emergency to be assessed, monitored and controlled or limited if possible and to allow the appropriate parts of the Emergency Response Plan to be executed. The assessment of TR impairment frequency and human vulnerability is outwith the scope of this Section.

1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the TR and muster stations. Recognised codes, standards or guidance include:


2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the TR and muster stations performance can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.







•

•

Location and extent of the primary, and any secondary, TR.

TR impairment due to temperature, CO, CO2, O2, H2S, smoke etc; levels at which actions may be initiated, means of monitoring and actions to be taken.

• Required endurance time for TR and muster stations for all identified major accident hazards should be specified and justified together with a description of any associated protection systems.

• Incidents which do not require use of the TR should be identified and justified, together with alternative mustering arrangements.

• Systems which will ensure that the incident can be monitored, controlled and the emergency response plan implemented.

• Quantities and type of PPE located at the TR and muster stations.




261



10.F5 Evacuation

covery

6. -Referenced Sections and Sheets are:

7. essment Section for this Sheet:

8. sponsible for authoring and updating this sheet:

OSD3.3

10.F6 Escape

10.F7 Rescue and Re


Cross

None

Lead Ass

OSD3.3

Team re

262

10.F4: Access/Egress Routes

Introduction

Arrangements should be in place for ensuring sufficient designated routes are available from all work sites on the installation to the TR/muster areas/evacuation points and from these areas to the various means of evacuation and escape for as long as they are needed.

1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the access/egress routes. Recognised codes, standards or guidance include:


2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the TR and muster stations performance can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.







• The philosophy of access/egress routes provision.

• Number and location of access/egress routes from all the potential work sites on the installation to the temporary refuge/muster stations/ evacuation and escape points should be shown diagrammatically.

• The impairment criteria and required endurance time for all routes. Sufficient information should be included to justify how the specified endurance times will be achieved taking into account the preference to protect routes rather than individuals.

• PPE [type and quantity] available for use with the above routes.

• Arrangements in the event of impairment of primary access/egress routes.





10.F5 Evacuation

10.F6 Escape

263





None


OSD3.3


OSD3.3

264

10.F5: Evacuation

Introduction

Evacuation encompasses arrangements and plant on and beyond the installation. These include provision of primary and secondary means of evacuation, eg helicopter, TEMPSC, sea transfer and bridge-link; some necessitating arrangements with others. Specific consideration is required of the availability, redundancy and diversity of the various means.

1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the evacuation performance. Recognised codes, standards or guidance include:


OTO Report 02 021 Compatibility Test Protocol for Life Jackets and Immersion Suits on Offshore Installations

2. Where a standard/code of practice other than those listed above have been employed, judgement as to the adequacy of the evacuation arrangements can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.







• The philosophy behind the selection, hierarchy, redundancy, diversity and distribution of the means of evacuation and demonstrate that the arrangements ensure, so far as is reasonably practicable, the safe evacuation of all persons.

• Each means of evacuation in terms of number, size, capacity, location, orientation, limitations in use, means of deployment/boarding, and in the case of TEMPSC – crewing and speed.

• Means of communication available to control stations and means of evacuation.

• The philosophy behind the selection and distribution of PPE which should take account of persons who have mustered directly at the evacuation point as well as those mustering at their own normal muster station.

• Emergency lighting arrangements at evacuation points.

• Arrangements to be made with others beyond the installation.

• The identification of those major accident hazards and other events which impair the evacuation arrangements.

265



• The time for which the evacuation point and means of evacuation is required to be available. Means of impairment, impairment criteria, any means of protection and alternative arrangements to accommodate such impairment.

• Compatibility between the means of evacuation and any PPE.






10.F6 Escape




None


OSD3.3


OSD3.3

266

10.F6: Escape

Introduction

The distinction between the processes of evacuation and escape had not been established at the time SCR originally came into force. This distinction was introduced by PFEER and two separate Regulations [15 and 16] set out the requirements that the duty holder must satisfy in these areas. For the purpose of safety case assessment the escape arrangements may be regarded as a subset of the evacuation arrangements intended to ensure, so far as is reasonably practicable, a safe means for all persons to leave the installation in an emergency that has also involved a failure in the principal evacuation arrangements.

1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the escape arrangements. Recognised codes, standards or guidance include:



2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the escape arrangements can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.




• The philosophy behind the selection and distribution of PPE which should take account of persons who have gone directly to an escape point.



• The philosophy behind the selection, hierarchy, redundancy, diversity and distribution of the means of escape will ensure, so far as is reasonably practicable, the escape of all persons. Such philosophy should differentiate between mass means of escape, such as could occur upon unavailability of the TEMPSC, and individual escape necessitated by having become isolated from the means of evacuation.

• Each means of escape in terms of number, size, capacity, location, limitations in use, and means of deployment/boarding.

• Emergency lighting arrangements at escape points.

• The time for which the escape point and means of escape is required to be available.

• Compatibility between the means of escape and any PPE.

267









10.F5 Evacuation



None


OSD3.3


OSD3.3

268

10.F7: Rescue and Recovery

Introduction

1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the rescue and recovery arrangements. Recognised codes, standards or guidance include:

UKOOA Guidelines for the Survey of Vessels Standing by Offshore Installations


Rescue and recovery arrangements and their required performance should be summarised in safety cases as part of both Regulation 12(1), Schedule 2 para 10, Schedule 3 para 7 and Schedule 5 para 5 requirements. Such summary need only address major accident hazards although the actual arrangements should also provide for those entering the sea either as a result of a helicopter ditching on landing or take-off or an overside working incident.



UKOOA Guidelines for the Safe Management and Operation of Vessels Standing by Offshore Installations

2. Where a standard/code of practice other than those listed above have been employed, judgement as to the adequacy of the rescue and recovery arrangements can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.






• Selection of the scenarios for which rescue and recovery is required, eg evacuation or escape, man overboard and helicopter ditch, and selection of the rescue and recovery arrangements to accommodate the selected scenarios.

• A summary of the arrangements for effecting rescue and recovery for each of the scenarios including any sharing arrangement between different installations.

• Performance Standards for rescue and recovery which should include the numbers of persons associated with each scenario, their survival times and the total recovery times to an identified place of safety.

• PPE required to achieve the quoted survival times.

• Any equipment provided to assist location of survivors.

269



• Weather limits on the rescue and recovery arrangements and actions to be taken when these are exceeded.




None




10.F5 Evacuation

10.F6 Escape



OSD3.3


OSD3.3

270

10.F8: Ship Collision

Introduction





10.F5 Evacuation

Ship collision is a major accident hazard. It should be noted that this assessment sheet relates to passing/drifting vessels. Risks due to attendant vessels are addressed in Section 2 Vessel Impact.

1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the ship collision avoidance arrangements. Recognised codes, standards or guidance include:

UKOOA Guidelines for Ship/Installation Collision Avoidance

UKOOA Guidelines for the Management of Emergency Response for Offshore Installations

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the ship collision avoidance arrangements can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety.






• Performance standards stating the required warning time and relating this to the time needed to implement the emergency response plan.



10.F6 Escape

10:F7 Rescue & Recovery


None


271


OSD3.3


OSD3.3

272

10.F9: Emergency Lighting

1. Confirmation should be obtained that the emergency lighting has been designed in accordance with a recognised standard or code of practice. Recognised current standards/codes of practice would include:

BS 5266 Emergency Lighting

The Chartered Institution of Building Services Application Guide: Lighting in Hostile and Hazardous Environments

The above codes, standards and guidance collectively cover the layout of all types of installation [fixed, FPSO and MODUs]. However they are particularly pertinent to the design of new installations and therefore are likely to be referenced in design safety cases.

Offshore Installations (Safety Case) Regulations 2005, Schedule 2 para 12 and Schedule 3 para 9

Regulations laid down by the Norwegian Maritime Directorate (1992) Regulations for Mobile Offshore Units

Lloyds, DNV and ABS Classification Rules: Mobile Offshore Units

IMO Code for the Construction and Equipment Of Mobile Offshore Drilling Units [MODU Code]

International Convention for the safety of life at sea – SOLAS

BS IEC 61892 Mobile and Fixed Offshore Units – Electrical Installations

EN1838 [equivalent to BS 5266 Part 7] Lighting Application – Emergency Lighting

BSEN 50172 Emergency Escape Lighting Systems

ICEL 1006: Emergency Lighting Design Guide

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of emergency lighting can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.


Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 14 para 141

The following Regulation is applicable to hazardous areas of fixed installations but does not apply to MODUs, floating production platforms [FPPs] and floating production storage and offloading vessels [FPSOs].

Equipment and Protective Systems Intended for Use in Potentially Explosive Atmospheres Regulations 1996


The safety case should include:

273

4.1 Details of the means of affording emergency lighting in the temporary refuge, from the temporary refuge from normal places of work, from the temporary refuge to evacuation points and at evacuation points.

4.2 Evidence of the adequacy of illumination provided by each emergency lighting system installed and the periods for which they are each maintained.

4.3 An analysis of the vulnerability of the emergency lighting systems to their operating environment and to damage from a major accident [ie protection against the effects of explosion, fire, missiles etc.]

4.4 Details of emergency lighting within hazardous areas or emergency lighting that is required to remain ‘live’ in emergency conditions regardless of location. Emergency lighting fittings for such areas should be or may have been designed in accordance with BS 5501 or BS EN 50014 and selected, installed and maintained in accordance with BS 5345 or BS EN 60079 series of standards.





10.F5 Evacuation

10.F6 Escape

Sheet 5.3.F21 Electrical Equipment for Use in Potentially Flammable Atmospheres


OSD3.5


OSD3.5

274

10.F10: Emergency Communications

Introduction

The requirement for emergency communications is detailed in PFEER. Communication for health and safety purposes is detailed in the Offshore Installations and Pipeline Works (Management and Administration) Regulations [MAR]. In summary, the requirements for emergency communications are to have sufficient and diverse means and arrangements for communicating with personnel on the installation and appropriate external bodies. [This assessment sheets covers all these elements].

It is desirable that as many as possible of the telecommunications systems provided for normal operation, and which can perform useful service in controlling the emergency, should remain active, provided that their continued operation does not create additional hazards.

To enable the ECC to communicate with any vessel standing by the installation and other ships in the vicinity, which may be involved in efforts to control the emergency situation, or in rescue operations.

To communicate with aircraft involved in an emergency [eg Search and Rescue On Scene Commander].

Communicating with Personnel on the Installation

The following objectives are to be achieved for communicating with personnel on the installation:

To enable persons controlling the emergency to alert all personnel on the installation, instruct them as required including to proceed to muster stations, and, where appropriate, to evacuate the installation.

To enable persons in charge of muster stations to communicate with each other, and with the Emergency Control Centre [ECC] on the installation.

To enable members of emergency work teams attempting to bring the situation under control to communicate with each other, and with the ECC.

To enable persons who may be trapped by the incident in an area of the installation from which they cannot reach their muster stations to communicate with the ECC.

To enable the ECC on the installation to call for external assistance, and to communicate with an Onshore Emergency Response Control.

Communicating with External Parties

The following objectives are to be achieved for communicating with external parties:

To enable the ECC on the installation to call for external assistance, and to communicate with an Onshore Emergency Response Control.

To enable the ECC to communicate with other nearby offshore installations, where applicable, which may be able to provide assistance.

To enable the ECC and helicopter landing officer to communicate with helicopters involved in evacuation and rescue operations.

To enable TEMPSC to communicate with ships and helicopters in the vicinity.

Systems to achieve the above objectives include:

275

Public address system

General alarm system

Hand portable radio units [which may be used portable-to-portable direct, portable-to-portable via a repeater, or base station to portable].

Marine VHF system [using fixed base-stations or hand-portable transceivers].

Platform UHF hand-portable radio system [where vessel is equipped with fixed or hand-portable units on frequencies assigned to installation].

MF radio operating at inter-ship frequencies.

Inmarsat service.

Aeronautical VHF system [using fixed base-stations or hand-portable transceivers].

BS EN 60849 (1998) Sound Systems for Emergency Purposes

IMO Code for the Construction and Equipment Of Mobile Offshore Drilling Units (MODU Code)

The above codes, standards and guidance collectively cover the layout of all types of installation [fixed, FPSO and MODUs]. However they are particularly pertinent to the design of new installations and therefore are likely to be referenced in design safety cases.

1. Confirmation should be obtained that the emergency communications has been designed in accordance with a recognised standard or code of practice. Recognised current standards/codes of practice would include:

CP043 1996 Issue No 2 UKOOA Guidelines for Safety Related Telecommunications Systems On Normally Attended Fixed Offshore Installations

CP044 1996 Issue No 2 UKOOA Guidelines for Safety Related Telecommunications Systems On Normally Unattended Fixed Offshore Installations

BS 7443 (1991) Specification for Sound Systems for Emergency Purposes

BS EN 60268-16 (2003) Sound Systems Equipment

Regulations laid down by the Norwegian Maritime Directive (1992) Regulations for Mobile Offshore Unit

Lloyds, DNV and ABS Classification: Mobile Offshore Units

International Convention for the safety of life at sea – SOLAS

CAP 437 Civil Aviation Authority

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of emergency communications can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.


276

Offshore Installations (Safety Case) Regulations 2005, Schedule 2 para 12 and Schedule 3 para 9

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 14 para 145

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 11 para 107-115

Offshore Installations and Pipeline Works (Management and Administration) Regulations 1995, Regulation 12

The following Regulation is applicable to hazardous areas of fixed installations but does not apply to MODUs, floating production platforms [FPPs] and floating production storage and offloading vessels [FPSOs].

Equipment and Protective Systems Intended for Use in Potentially Explosive Atmospheres Regulations 1996

Merchant Shipping (Radio Communications) Regulations 1998 [Note GMDSS not enforced by HSE]

4.2 The duty holder should be able to supply sufficient detailed information to show that PFEER Regulation 11 is met.

4.3 The requirements for alarm and PA functions are:

ii. Provision of emergency communications between persons on the installation.

i. Provide the alarm signal and continue to operate as far as possible throughout the emergency.

iv. Provide command and control at muster and embarkation points.

The safety case should recognise the importance of both audible and visible alarms and voice communications system.


4.1 UKOOA Guidelines for Safety Related Telecommunications Systems on Normally Attended Fixed Offshore Installations CPO43, 1996, Issue No 2 and UKOOA Guidelines for Safety Related Telecommunications on Normally Unattended and Fixed Offshore Installations CPO44, 1996, Issue No 2, Appendix A2 and A3, provides a basis for the specification of suitable emergency communication equipment.

i. Provision of an audible and/or visual emergency warning, to all persons on the installation.

These are normally an audible and visible alarm system and an intelligible system that in an emergency situation would be required to function as follows:

ii. Alert personnel in the accommodation cabin and work area by audible alarms.

iii. Provide verbal information to personnel on their way to muster/ embarkation points.

4.4. GMDSS is an international system which uses terrestrial and satellite technology and ship board radio systems to ensure rapid, automated, alerting of shore based

277

communication and rescue authorities, in addition to ships in the immediate vicinity in the event of a marine distress.

GMDSS applies to vessels which would include those mobile installations registered as vessels.

All offshore installations that operate on the UKCS are required to comply with PFEER.

These Regulations require that amongst other things the duty holder makes suitable arrangements for the purpose of emergency response for communication between the installation and persons beyond it. In addition to PFEER, the Offshore Installations and Pipeline Works (Management and Administration) Regulations 1995 requires under Regulation 12 that duty holders have effective communication in place to communicate between the offshore installation and the shore, vessels, aircraft and other installations.

Proximity to VHF Coastal Radio Station

10.F6 Escape


Sheet 5.3.F21Electrical Equipment for Use in Potentially Flammable Atmospheres

OSD3.5


OSD3.5

Although GMDSS is not mandatory for fixed production installations, it is mandatory for all other maritime mobiles including support and supply vessels, semi submersible, mobile jack-up drilling rigs. There is therefore a decision to be made by the duty holder, as to whether a duty holder would choose to implement GMDSS as part of its safety case.

Factors influencing this decision may include:

Location: Remoteness

Proximity to Sea Lanes

Field operations philosophy.




10.F5 Evacuation



278

It must be stressed however, that the designation of these sheets is focused on the assessment of safety cases as per the Offshore Installations (Safety Case) Regulations 2005 (SCR), rather than PFEER assessment, to which the sheets relate only insofar as SCR require a description of how the duty holder has, or will ensure, compliance with regulation 4(1) of PFEER within the safety case.

There are numerous interfaces and overlaps with other sections: eg Emergency Response and Risk Analysis; and where these associations exist, the overlap and demarcated areas of assessment are explained.

11. HUMAN FACTORS 1. Scope

The topic area of Human Factors covers three broad areas: human error; procedural integrity; and organisational integrity. The twelve elements shown in the table below sub-divides these into practical assessment sheets that are underpinned by regulation and relate to key offshore safety issues, for both assessment and inspection.

Of particular interest is the emphasis of the human factors involved in the earlier conceptual design stages of the installation lifecycle. This reflects the increasing realisation that the human element involved in professional judgement is of equal, if not greater, significance than the hazard and risk analysis methodologies themselves in deriving realistic decisions on ALARP, SFAIRP and acceptability in general.

Human error is considered in the operational scenario, but the assessment approach is to consider the pressures and influences on the individual brought by organisational culture and factors, contractualisation, multi-skilling/tasking, and competence and task analysis, and the ultimate effect this has in impairing human performance.

Procedural assessment is similarly sub-divided into Permit to Work systems [11.G7] and organisational change management [11.G9], as they have sufficient content to be assessment sheets in their own right.

Finally, it must be re-emphasised that the focus of human factors assessment is the risk and measures associated with human reliability in an acute sense, where this constitutes a causal factor in the development of major accident scenarios. Starting with the individual, we pan out to look at the procedural frameworks and the organisational context [with associated pressures] that influence human performance. We are not concerned with the chronic effect of the work environment upon the health of the individual - it is the safety effects of human performance - or more significantly human failure - that is of concern in assessment.

279

11.G1: Human Error: Selection, Competence and Training

OTH 92 374 The Selection and Training of Offshore Installation Managers for Crisis Management

Introduction

This sheet considers the arrangements for ensuring the competence of individuals to perform to an acceptable standard in given tasks and roles. In the first instance, this is influenced by appropriate test and selection procedures, but thereafter invokes the need for structured and systematic training for such tasks and roles, particularly where these are directly safety-critical. Once these measures can be demonstrated, this sheet also considers on-going competence assessment for such tasks and roles. The duty holder may operate team based working, never the less each individual team member must be competent to undertake safely the tasks they are likely to be required to do.

1. Confirmation should be obtained that a procedure is in place for the selection, competence assessment, and training of operations and maintenance personnel and that it is designed in accordance with a recognised standard or code of practice. Recognised current standards/codes of practice would include:

RR 206-01-R-01 Human Factors in Offshore Operations: Role evaluation tool

RR 086 Competence assessment for the hazardous industries [Applicable to onshore and offshore domains]

OTO 1999/092 Human factors assessment of safety critical tasks [along with RR 033: Evaluation report on OTO 1999/092]

OTO 2001/053 Preventing the propagation of errors and misplaced reliance on faulty systems; a guide to human error dependency

2. Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of operator selection, competence, and training can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re ‘sufficient particulars’ which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case, invokes a particular need for task/human analysis where the human is an integral part of the Safety Critical Element [SCE] under consideration.

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65)



Assessment within this area needs to take account of the level of ‘independence’ of an individual: where specific roles require an individual from the duty holder side to be

280






‘independent’, then evidence has to be provided to support this, and the assessor has to make an informed judgement that the level of independence is adequate.

Evidence needs to be provided that safety critical roles, tasks and procedures have been identified, and that these have been subjected to systematic task analysis or procedural review to ensure that all improvements [to comply with the relevant statutory provisions] have been made.

As a logical follow-on, where key safety-critical roles are identified, evidence is required that there has been a capability assessment undertaken for the role. Suitable assessment might involve structured psychometric assessment/test, particularly in the case of key management tactical decision-making roles.

Similarly, where key safety-critical tasks are identified, evidence is required that the simulation and test of the human and team capability has been assessed adequate for the task.

Inspection indicators: Duty holder procedures re selection, competence, training; team/individual task analysis; PFEER verification - human as SCE.


11.G2 Human Error: Stress, Fatigue, Shifts and Organisational Factors

11.G4 ALARP & SFAIRP Awareness




Sheet 5.1.HS1 Pressure Vessels [Including Columns]

Section 7 Diving

Sheet 7.F1-F3 Risk Evaluation [Likelihood Factors]


Sheet 8:F16 Competent Personnel Client Review/Acceptance of Procedures [See sheet 8.F10-F20]


OSD3.6


OSD3.6

281

11.G2: Human Error: Stress, Fatigue, Shifts and Organisational Factors

Introduction

Assessment needs to take account of external factors that can compromise individual performance of task or role, quite apart from competence. Such factors include stress, fatigue, shift patterns, and organisational factors, including company culture [although this may be difficult to elicit from a safety case].

1. Confirmation should be obtained that due consideration and assessment of external factors, in terms of stress and organisational pressure, has been conducted in accordance with a recognised standard or code of practice. Confirmation should be obtained that means are provided for managing and maintaining the alertness of staff engaged in hazardous or high consequence activities. Relevant Standards, ACOPS, Guidance [HSE and industry], and preliminary guidance [HSE research reports and internal guidance, to be formalised] are as follows:

HSG 48 Reducing error and influencing behaviour [Applicable to all forms of installation]

HSG 65 Successful health and safety management

[Applicable to all forms of installation]

RR 107 Development of internal company standards of good management practice and task-based risk assessment tool for offshore work related stress

INDG 281 HSE Help on work related stress

RR 133 Beacons of excellence in Stress Prevention

[Guidance in progress]

SPC Shiftwork offshore

SPC stress in high hazard industries

2. Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to acceptability of risk, and procedures to control these risks, can only be assessed on an individual basis, and the duty holder should be required to justify why its provision in this area will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re ‘sufficient particulars’ which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case, invokes a particular need for consideration of human vulnerability to stress/fatigue-induced error, where the human is an integral part of the safety critical element [SCE] under consideration.




282




Where specific roles require an individual from the duty holder side to be ‘independent’, then evidence has to be provided to support this. This is crucial to the assessment of risks, and their associated control measures, as compromise of independence is, in itself, a stressor, and can bring inappropriate pressure to decision-making.

Assessment of the stress/organisational hazard needs to have been conducted, as well as its potential realisation in the risk and consequences of human error. This indicates a need for a level of individual profiling for stress-vulnerability to have been conducted, in a climate of organisational support, particularly where safety-critical activity is concerned.

Inspection links: Compliance audit/verification; organisational factors - particularly independence; safety culture; independent audit and interview of duty holder staff.



11.G6 Procedural Integrity

11.G10 Knowledge Management




Sheet 5.1.HS1 Pressure Vessels [Including Columns]

Section 7 Diving


Sheet 8.F16 Competent Personnel Client Review/Acceptance of Procedures [see 8.F10 –F20]


OSD3.6


OSD3.6

283

11.G3: Human Error in Design

Introduction

Human factors (HF) feature at all phases of the installation lifecycle from inception through to dismantling. From the outset, we are concerned about human error at the initial strategic and planning stages, and concept development, particularly the capture of requirements, and any potential mismatch between design and operational function. Consequently, there is more potential to eliminate hazards at the design phase than at any other time. The ALARP judgement is more favourable towards HF and usability changes during the design phase.

1. Confirmation should be obtained that due consideration to sources of error, in the design of an installation or part of it, have been identified, and design procedures are in place to minimise the potential for human error at this stage in an installation’s lifecycle. Demonstration needs to be made that this is in accordance with a recognised standard or code of practice. Relevant Standards, ACOPS, Guidance [HSE and industry], and preliminary guidance [HSE research reports and internal guidance, to be formalised] are as follows:

RR054 Mutual misconceptions between designers and operators of hazardous installations

OTO 2000/086 operational safety of FPSOs - initial summary report [Applicable to FPSOs]

OTH 443A and OTH 443B Drill floor design; a consideration of human factors [Applicable to drilling rigs]

HSG 48 reducing error and influencing behaviour [Applicable to all forms of installation]

Ergonomics resource pack HSE web site [Applicable to all forms of installation]

HSE Manual handling toolkit [HSE research report in process of publication]

OTO 2002/001 Slips, trips and falls from height offshore

OTO 2001/053 Preventing the propagation of error and misplaced reliance on faulty systems - a guide to human error dependency

2. Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of the approach can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re ‘sufficient particulars’ which should be included within the case. Additionally the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case needs consideration of the human element in the design of Safety Critical Elements [SCEs]

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACoP and guidance (L65).



284


http://www.hse.gov.uk/research/otopdf/2000/Oto00086.pdf



http://www.hse.gov.uk/offshore/ergonomics.htm




Where contractualisation in design has occurred, reference needs to be made to the provision for knowledge management in the design. Demonstration needs to be made by the duty holder that a full requirements analysis has been conducted to preclude design-operation misconception.





11.G11 Contractualisation: Communications and Competence



Sheet 2.G1 Attendant and Passing Vessels


Section 13 QRA


OSD3.6


OSD3.6

285

11.G4: ALARP & SFAIRP Awareness

Introduction

Human error - and its minimisation - is crucial in the involvement of identification of major hazards, at the conceptual HAZOP/HAZID and preliminary risk assessment phases of the project. No matter how robust a methodology is, the greatest uncertainty at this stage is in the exercise of human judgement as to what constitutes a risk that is ALARP, or conversely a measure that is SFAIRP. We need to therefore assess carefully at the design phase to see that such human involvement is under the auspices of a robust safety management system that encompasses this phase of the installation lifecycle.

1. Confirmation should be obtained that there is sufficient consideration given to ALARP/SFAIRP principles in the formulation of the case for safety. Relevant Standards, ACOPS, Guidance (HSE and industry), and Preliminary guidance (HSE research reports and internal guidance, to be formalised) are as follows:

CRR 293/2000 A comparison of accident experience and QRA methodology

OTH 458 Update of the UKCS risk study

Reducing risks protecting people HSE

2. Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to its adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005 (including associated Schedules and guidance) Specifically: 12(1)(d) - see guidance paras 176 and 177 re. “sufficient particulars” which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case needs consideration of the human element in the design of Safety Critical Elements (SCE’s), and the net result demonstrated to show that the relevant statutory provisions have been, or will be, complied with

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance



Consideration of sound technical judgement must be considered in conjunction with the appropriateness of risk analysis techniques. Independence and competence needs to be assured, of those proposing arguments on ALARP/SFAIRP. The human involvement and uncertainty associated with HAZOP/HAZID and risk assessment techniques (including QRA) needs to be assessed by considering how the safety management system controls these human processes at this stage of the lifecycle. This assessment focuses more on the management of the processes than the validity of the methods and algorithms, although both elements are inextricably linked.


11.G3 Human Error in Design

286

http://www.hse.gov.uk/research/crr_pdf/2000/crr00293.pdf


http://www.hse.gov.uk/risk/theory/r2p2.htm





Section 13 QRA


OSD3.6


OSD3.6

287

11.G5: Command, Control, Communication [C3] and Decision Making

Introduction

The effective performance of humans, and human interaction, under emergency conditions, is an assessment topic distinct from the physical arrangements [see Section 10] under such conditions. There is an interface with the Emergency Response Section [Section 10] in the element of procedures, but whereas physical arrangements are the domain of the EER section, OSD3.3, the human performance aspects reside with OSD3.6. With the separate, and overlapping interests so defined, we can say the following.

1. Confirmation should be obtained that a clearly-defined structure of command and control for the operation of an installation is in place, and that there is a system of communication and unambiguous decision-making for both normal and emergency conditions, with ownership, and that these comply with recognised standards or codes of practice. Recognised standards/codes of practice would include:

HSG 65 Successful health and safety management

HSG 48 Reducing error and influencing behaviour

OTO 1999/025 Safety implications of self-managed teams

OTO 1996/003 Effective shift handover - a literature review

RR 135 Health and safety responsibilities of company directors and management board members

RR 044 The role of managerial leadership in determining workplace safety outcomes

OTH 534 Human and organisational factors in offshore safety

OTH 92 374 The selection and training of Offshore Installation Managers for crisis management

OTO 1999/065 Effective supervisory safety leadership behaviours in the offshore oil and gas industry

OTO 2001/053 Preventing the propagation of errors and misplaced reliance on faulty systems - a guide to human error dependency

2. Where a standard/code of practice other than that listed above has been employed, judgement as to its adequacy of systems in place can only be assessed on an individual basis, and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re ‘sufficient particulars’ which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case: need consideration of the human in the design of Safety Critical Elements [SCEs]; particularly where a C3 element is defined/declared as a SCE.


288

http://www.hse.gov.uk/research/otopdf/1999/OTO99025.pdf




http://www.hse.gov.uk/research/othpdf/200-399/oth374.pdf





There are interfaces with sections that have responsibility for EER, marine, heliops and diving activity: these areas of interface between these crews, and the core installation crew, need to be identified and assessed for clarity, to ensure no potential hazard from either duplication/commission or omission.

Inspection links: Compliance [Regulation 16]; PFEER assessment of C3 SCEs.


11.G1 Human Error: Selection, Competence and Training




11.G7 Permit to Work Systems

11.G8 Employee Involvement

11.G9 Organisational Change Management





Sheet 2.G1 Attendant and Passing Vessels


Section 7 Diving



OSD3.6


OSD3.6

289


11.G6: Procedural Integrity

Introduction

The presence of a robust structure of procedures for the key activities in the installation’s lifecycle must be able to be demonstrated by the duty holder. These must be within an overarching safety management system, but - in their own right - must be suitable and sufficient for purpose. PTW is of sufficient magnitude to warrant its own assessment sheet [11.G7] as are HAZOP/HAZID/RA procedures [11.G4], but all other procedural types may be dealt with in this sheet. Key amongst these are procedures for the identification of safety critical tasks and roles [complementary to the assessment of individuals in these tasks/roles [11.G1]. We also need to assess to see that there is a means of formal procedural reviews, and periodic task re-analysis.

1. Confirmation should therefore be obtained that clearly defined operational procedures are in place for all activity associated with the lifecycle of the installation, and that these comply with recognised standards or codes of practice. Recognised standards/codes of practice would include:

JWP/FRD/167 Formal Procedural and Task Analysis review

STEP guide to task-based risk assessment

HSG 48 Reducing Error and Influencing Behaviour

2. Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of systems in place can only be assessed on an individual basis, and the duty holder should be required to justify why its systems will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulations 12(1)(a) - management systems and 12(1)(b) - audit




Diving procedural integrity is deferred to the Diving Specialist Section. HAZID/HAZOP/RA/QRA [11.G4] and PTW [11.G7] are dealt with as separate assessment topics.



11.G3 Human Error in Design

11.G7 Permit to Work systems



290





OSD3.6


OSD3.6

291

11.G7: Permit to Work Systems

Introduction

Although a sub-set of the procedural assessment element within Human Factors, this is so major as to be a topic in its own right, particularly given that failure of permit to work [PTW] procedure has been a key causal factor in the major offshore accidents and incidents.

1. Confirmation should be obtained that clearly defined permit to work procedures are in place for all activities on the installation, and that these comply with a recognised standard or code of practice. Recognised standards/codes of practice would include:

OIAC Permit to work guidance

HSG 65 Successful Health and Safety Management


2. Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of the system in place can only be assessed on an individual basis, and the duty holder should be required to justify why its system will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re ‘sufficient particulars’ which should be included within the case.




The issue is considered in an offshore context. Although standards exist for the onshore activity, deference should be made to the industry-supported offshore consensus guidance. Procedural integrity - in a wider context - is dealt with as a separate assessment topic [11.G6].










292



Sheet 5.1.F23 Isolations

Section 7 Diving


OSD3.6


OSD3.6

293

11.G8: Employee Involvement

Introduction

The engagement and involvement of the workforce of an offshore installation is essential for the operation of a health, safety and risk management system. The employees, whether in the direct employment of the duty holder, or indirectly employed by a contractor, are a key stakeholder in the offshore safety regime, who have responsibilities as well as rights under the general duty of care of the operator. The quality of employee involvement is a measure of the safety culture of a duty holder, or a specific installation, and provides a general indicator of the effectiveness of the management system in relation to an installation or its duty holder.

The safety case should provide sufficient information in relation to how this involvement is implemented under the management system, such that rights, responsibilities, overall framework of health, safety and risk management is communicated to the workforce; and that issues may be communicated from workforce to management in an open and constructive manner.

1. Confirmation should be obtained that the safety case makes a full description of the modes and methods of employee involvement: directly; via safety representatives; via trade-union representatives, and with contractor organisations via their appropriate nominated individuals. Recognised standards/codes of practice would include:

CRR 1996 121 Health Surveillance in Great Britain

OTO 1999/025 Safety implications of self-managed teams

CRR 2000/259 The effects of new ways of working on employees’ stress levels

CRR 2000/273 Valuation of benefits of health and safety control: summary and technical report

CRR 2001/393 Effective teamworking: reducing the psychosocial risks

RR 042 Evaluating the effectiveness of the Health and Safety Executive’s Health and Safety Climate Survey Tool

RR 044 The tole of managerial leadership in determining workplace safety outcomes

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the arrangements can only be assessed on an individual basis, and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety performance.

3. Relevant Legislation, ACoP and Guidance includes:

Offshore Installations (Safety Case) Regulations 2005 including associated schedules and guidance

Assessment Principals for Offshore Safety Cases [APOSC]


Evidence of compliance with the following specific statutory requirements should be provided within the safety case:

(i) Management of Health and Safety at Work Regulations 1999:

• reg. 2 (risk assessment);

294

http://www.hse.gov.uk/research/crr_pdf/1996/CRR96121.pdf




http://www.hse.gov.uk/research/crr_htm/2001/crr01393.htm




• reg. 6 (health surveillance);

• reg. 7 (competent persons);

• reg. 8 (employee procedures);

• reg. 10 (information);

• reg. 11 (cooperation and coordination);

• reg. 12 (self-employed “employees”);

• reg. 13 (assessment and training);

• reg. 14 (employees duties);

• reg. 15 (temporary workers):

(ii) Provision and Use of Work Equipment Regulations 1998:

• reg. 8 (information and instructions

• reg. 9 (training):

(iii) Health and Safety at work etc. Act 1974:

• reg. 7 (duties on employees);

with particular emphasis on the employee involvement in the implementation of these specific conditions.


11.G5 Command, Control, Communications [C3] and Decision Making

11.G7 Permit to Work Systems




11.G12 Multi Skilling/Multi Tasking


None


OSD3.6


OSD3.6

295

11.G9: Organisational Change Management

Introduction

This topic warrants a sheet in its own right, as it is applicable to Regulation 14 and 15 revisions to safety cases specifically. Transitional arrangements are of specific interest, in addition to the end-conditions resulting from the completed change, and we need to be satisfied that adequate [and timely] arrangements are put in place by the duty holder.

1. Confirmation should be obtained that a procedure is in place for the management of change in relation to an installation, and that this is in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include:

RR 107 Development of internal company standards of good management practice and task-based risk-assessment tool for offshore work-related stress



OTO 2002/016 Framework for assessing HF capability

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of arrangements can only be assessed on an individual basis, and the duty holder should be required to demonstrate that no significant increase in risk will arise during the transitional period, or upon its completion.


Offshore Installations (Safety Case) Regulations 2005 and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance para 177(a) re ‘sufficient particulars’ which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case needs consideration of the human element on any impact on the SCE.




This topic is treated separate to, [but in conjunction with], SMS. This is because it is applicable to 14(2) where organisational change may be deemed to be a material change to the original safety case.

Of particular importance are the transitional arrangements, particularly in instances of downmanning, to ensure the continued integrity of maintenance and safe operation procedures. It is incumbent upon the duty holder to make a convincing demonstration that adequate transitional provision has been made for such, and that security provisions [eg to prevent sabotage] are in place to ensure safe operation of the installation.

Inspection links: Compliance [Regulation 16].




296




11.G5 Command, Control, Communications [C3] and Decision Making





Sheet 5.1.F23 Isolations


OSD3.6


OSD3.6

297

11.G10: Knowledge Management

Introduction

Assessment should be made to ensure that, along with a robust structure of procedures, design, operational and historic data associated with hazard/risk assessment is retained, along with maintenance and equipment failure records. Such data can, in certain cases, drive change/improvement in the installations design, equipment and/or operation.

Hitherto, this assessment sheet has not squarely resided within any of the topic sections, but since human factors deals with procedural and SMS integrity, it is perhaps most applicable for assessment by OSD3.6.

1. Confirmation should be obtained that a procedure is in place for the management and retention of design, operational, risk and historic knowledge and data in relation to an installation, and that this is in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include:

RR173 The development of a knowledge-based system to develop information to designers

RR128 The safety implications for offshore maintenance of using proprietary management/scheduling software

RR011 Preliminary assessment of Linux for safety related systems

RR012 Dealing with differences in expert opinion

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of arrangements can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005 and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance para 177(a) re ‘sufficient particulars’ which should be included within the case. Also Schedule 7: verification particulars; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case: need consideration of the human element on any impact on the SCE.




There is a particular interface with the assessment of maintenance, as such plant and historic data informs maintenance scheduling arrangements.



None


298









OSD3.6


OSD3.6

299

11.G11: Contractualisation: Communications and Competence

Introduction

This topic is of sufficient prominence to warrant an assessment sheet in its own right. The management of contractors, and the issues of ownership, responsibility, independence and competence are issues of concern in a heavily contractualised industry, where responsibility is sub-contracted along with work-packages. Assessment of both procedures and cultural aspects of contractualisation needs to be carefully undertaken, in order to gain assurance that risk is controlled offshore.

1. Confirmation should be obtained that a procedure is in place for the management and supervision of contractors by the duty holder, and that this procedure conforms with a recognised standard or code of practice. Recognised standards/codes of practice would include:

HSG 48 Reducing Errors and Influencing Behaviours


HSE/OIAC Guidance on Contractor Management

STEP Guide to Interfacing SMS

OTO 1999/065 Effective supervisory safety leadership behaviours in offshore oil and gas industry

2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the arrangements can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005 and guidance (L30). Specifically: Regulation 12(1)(a) - SMS; the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case: need consideration of the human element on any impact on the SCE, particularly where examination/verification is performed by contractor




Where specific roles require an individual from the duty holder side to be ‘independent’, as in the case of SCE verification, then evidence has to be provided to support this, and how this independence can be afforded in the contractor situation.

In addition, the duty holder must demonstrate that its management of, and communication with contractors is procedurally defined, along with training, responsibility and plant proprietary responsibility [eg crane operations].



300








Section 7 Diving

Sheet 7.F4-F9 Risk Management Measures [Inherent Safety]


OSD3.6


OSD3.6

301

11.G12: Multi Skilling/Multi Tasking

Introduction

This assessment sheet is closely linked to 11.G1 on competence/training etc, but is subtly different and does require to be a separate assessment sheet. It is similarly related to stress-induced human error, [11.G2], but also does not fit squarely within this sheet either. In brief, it is an increasing trend offshore, and has its own procedural requirements and failure modes.

Assessment is therefore required of operational safety cases in this specific respect. The duty holder should give some description within its management arrangements as to how it will control this particular mode of work amongst the installation crew.

1. Confirmation should be obtained that the safety case makes a description of, and takes due account of both multi-skilling and multi-tasking, and any potential impact on human reliability. Any justification given should take due account of a recognised standard or code of practice. Recognised standards/codes of practice would include:

OIAC Guide to multi skilling


RR 086 Competence Assessment for the Hazardous Industries

CRR 2001/348 Assessing the Safety of Staffing Arrangements for Process Operations in the Chemical and Allied Industries

OTO 1999/025 Safety Implications of Self Managed Teams

2. Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of the arrangements can only be assessed on an individual basis, and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety performance.


Offshore Installations (Safety Case) Regulations 2005 and guidance (L30). Specifically: Regulation 12(1)(a) - SMS




The duty holder needs to specify the limits it will apply to the extent of multi-skilling/tasking amongst its workforce to demonstrate that it will not be in a position where one individual’s reliability will be compromised by overloading. It must be stressed that we are concerned with the safety effects of human failure, rather than any chronic health effects, which are the domain of the Occupational Health Specialist Section.

In addition, where specific roles require an individual from the duty holder side to be ‘independent’, then evidence has to be provided to support this, particularly in a multi-tasking situation.

Inspection links: Compliance [Regulation 16]; PFEER assessment of SCEs.


302


http://www.hse.gov.uk/research/crr_pdf/2001/crr01348.pdf








None


OSD3.6


OSD3.6

303

12. HUMAN VULNERABILITY 1. Scope

This Section provides guidance for the assessment of safety case content with respect to the establishment of appropriate criteria for human vulnerability in the event of exposure to major accident hazards offshore.


The evaluation of individual risk of harm that may result from an individual’s exposure to each major accident hazard is to be assessed by establishing the level of harm [dose] required to produce or prevent a specified effect [ie impairment of emergency functions, escape or death] from each major accident hazard scenario identified. This is expected to include direct effects, accumulation of hazards and escalation of a major accident.

Human vulnerability criteria for the following should be addressed in the safety case:

• Blast overpressure

• Thermal radiation

• Elevated temperature and thermal stress

• Hydrocarbon combustion products

• Oxygen depletion

• Non-hydrocarbon combustion or decomposition products

• Release of toxic gas

• Noise

• Impact

•

• Combined effects

The assessor should examine the adequacy of the human vulnerability criteria.


des of Practice.

ous Agents Present Offshore for Application in Risk Assessment of Major Accidents.

ify e relevant areas will deliver an equivalent level of

health and safety performance.


Cold water immersion

Confirmation should be obtained that the human vulnerability criteria has been determined against accepted standards and applied in accordance with recognised CoRecognised standards, criteria and methods of application are detailed in SPC/Tech/OSD/tba Indicative Human Vulnerability to the Hazard

Where a vulnerability criterion and method of application other than those listed above have been employed, judgement as to the adequacy of the vulnerability modelling can only be assessed on an individual basis, and the duty holder should be required to justwhy its procedures or practices in th

304

None


OSD3.2


OSD3.2

305

13. QUANTITATIVE RISK ASSESSMENT [QRA] 1. There are no standards for carrying out QRA, but the following are recognised as useful

sources of guidance.

Publication 99/100 CMPT (Centre for Marine and Petroleum Technology) (1999) A Guide to Quantitative Risk Assessment for Offshore Installations, J Spouge (Ed)

UKOOA Guidelines for Fire and Explosion Hazard Management Issue 1, 1995

API 14J (RP14J) (1993) Recommended Practice for Design and Hazards Analysis for Offshore Production Facilities

2. Where guidance other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance.






Use of Risk Assessment in the Offshore Industry (currently being developed for HSE)


None


None


None


OSD 3.2


OSD 3.2

306



14. GLOSSARY OF ABBREVIATIONS ABS American Bureau of Shipping

ACOP Approved Code of Practice

ALARP As Low As Reasonably Practicable

API American Petroleum Institute

APOSC Assessment Principles for Offshore Safety Cases

ASME American Society of Marine Engineers

BV Bureau Veritas

CAA Civil Aviation Authority

CBA Cost Benefit Analysis

CCTV Closed circuit television

CFD Computational Fluid Dynamics

CIA Chemical Industries Association

CMPT Centre for Marine and Petroleum Technology

COGENT Sector Skills Council for the Oil and Gas Extraction, Chemical Manufacturing and Petroleum Industries

DCM Deputy Case Manager

DCR Offshore Installations and Wells (Design and Construction, etc) Regulations 1996

DnV Det Norske Veritas

DP Dynamic Positioning

DWR Diving at Work Regulations 1997

E & P Forum The Oil Industry International Association Exploration and Production Forum

ECC Emergency Control Centre

EEMUA Engineering Equipment and Materials Users Association

EER Escape, Evacuation and Rescue

ERP Emergency Response Plan

ESD Emergency Shutdown

FMD Flooded Member Detection

FMEA Failure Modes and Effects Analysis

FMECA Failure Modes Effects and Consequence Analysis

307

FPP Floating Production Platform

FPSO Floating Production, Storage and Offloading Vessel

FSU Floating Storage Unit

HC Hydrocarbon

Helo Ops Helicopter Operations

HID Hazardous Installations Directorate

HSE Health and Safety Executive

IGN Interim Guidance Notes

IMCA International Marine Contractors Association

IMO International Maritime Organisation

IP Institute of Petroleum

IR Individual Risk

ISO International Standards Organisation

IVB Independent Verifying Body

JIP Joint Industry Project

LR Lloyds Register

MHSWR Management of Health and Safety at Work Regulations 1999

MOD Ministry of Defence

MODU Mobile Offshore Drilling Unit

MOU Mobile Offshore Unit

MPI Magnetic Particle Testing

MSC Marine Safety Committee

NAI Normally Attended Installation

NMD Norwegian Maritime Directorate

NORSOK Norwegian Standards Organisation

NUI Normally Unmanned Installation

OGP International Association of Oil & Gas Producers

OHMEC Offshore Mechanical Handling Equipment Committee

ON Operations Notice

OREDA DNV Offshore Reliability Data Handbook

OSD Offshore Division

OTO Offshore Technology Report

308

PA Public Address

PFEER Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995

PFP Passive Fire Protection

PLL Potential Loss of Life

POB Persons on Board

PPE Personal Protective Equipment

PSF Partial Safety Factor

PTW Permit to Work

QRA Quantified Risk Assessment

RIDDOR Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995

RT Radiographic Testing

SAR Search and Rescue

SBV Standby Vessel

SCE Safety Critical Element

SCHAM Safety Case Handling and Assessment Manual

SCI Steel Construction Institute

SCR Offshore Installations (Safety Case) Regulations 1992

SFAIRP So Far As Is Reasonably Practicable

SIM Structural Integrity Management (System)

SMS Safety Management System

SNAME Society of Naval Architects and Marine Engineers

TA Topic Assessor

TEMPSC Totally Enclosed Motor Propelled Survival Craft

TLP Tension Leg Platform

TR Temporary Refuge

UKCS United Kingdom Continental Shelf

UKOOA United Kingdom Offshore Operators Association

UPS Uninterrupted Power Supply

UT Ultrasonic Testing

WOAD World Offshore Accident Database

309

Hse Offshore Guide

Documents

natural gas industries

dynamic positioning system

norwegian maritime directorate

naval architects

standby vessel sharing

specific technical issues

year return period

suitably qualified personnel